Audit logging.

The platform records every authenticated Agent API request in the Activity logs. You get a complete audit trail of machine-to-machine operations for security reviews and compliance work.

How it works

Audit logging runs in the terminate phase, after the response has gone out to the client. This means:

• Zero latency impact: The client gets their response without waiting for the log write
• No configuration: The platform logs every authenticated request through the same Activity Log system as all other platform events

What each entry contains

Each agent request creates an activity log entry with:

Event types

The HTTP method determines the event:

Viewing agent logs

Agent API activity appears in Activity logs alongside all other platform events.

In the partner dashboard

Partners see their own agent API activity under Activity → Activity logs:

• Category filter: Select Integration API keys to show only agent requests
• Event filter: Select Agent Read, Agent Write, or Agent Delete
• Subject filter: Select Integration API key to see which key made the call
• Agent events carry visual badges: 👁 Read (info), ⚡ Write (primary), ❌ Delete (danger)

In the admin dashboard

Admins see all agent API activity across all partners:

• Same filters as above, plus filtering by partner (causer)
• Useful for monitoring platform-wide API usage and investigating issues

Use the Date filter to include a whole local day or date range in your account time zone. See Viewing activity logs for the full filtering interface.

What the platform leaves out

For security and performance, some data never reaches the log:

• Request and response bodies: The platform never stores them. Requests may contain PII, and responses can be large.
• Failed authentication attempts: These do not create an authenticated Agent request entry. Monetary denials can create a separate money_access_denied security outcome under Authentication, without request content or target details.
• Health checks: The platform logs them like any other request, and they contain no sensitive data.

Monetary financial events

The Prepaid passes category contains separate monetary sale, issue, spend, reversal, refund, and oversight events. A retried committed operation produces one business event. Request logs may show each HTTP attempt, including an authorized replay.

Monetary activity carries bounded event codes, integer amounts, currency, and pseudonymous record identifiers. It excludes payment references, receipt data, request bodies, QR or claim tokens, member names and emails, and raw exception details. Read an external reference only through the authorized financial record or its export. The application does not automatically delete monetary financial history based on age. Purging ordinary activity logs does not erase that history. Member privacy removal still detaches identity and access and scrubs the affected replay data.

Use the Health center to retry failed activity, in-app notice, or wallet delivery. A delivery retry never repeats the sale or spend.

Monitoring patterns

Detect unusual activity

Watch for:

Audit after key compromise

If you suspect a compromised key:

1. Revoke the key at once (see Managing Keys)
2. Filter Activity logs for that key's prefix
3. Review which endpoints the key called and what data it touched
4. Create a new key with the same scopes for your legitimate integration

For developers

Agent logs use the same Activity model as all other platform logs. If you're building custom analytics or monitoring:

use App\Models\Activity;

// Get all agent API logs
$agentLogs = Activity::agentApi()->latest()->get();

// Get agent logs for a specific partner
$partnerLogs = Activity::agentApi()
    ->where('causer_id', $partnerId)
    ->where('causer_type', Partner::class)
    ->latest()
    ->get();

// Get agent write operations only
$writes = Activity::agentApi()
    ->forEvents(['agent_write', 'agent_delete'])
    ->latest()
    ->get();

Related topics

• Activity logs overview: The full audit trail system
• Viewing activity logs: Filtering and searching logs
• Activity log analytics: Charts and metrics
• Authentication: Key security model
• Managing Keys: Revoking compromised keys