Audit Logging.

Every authenticated Agent API request is automatically recorded in the Activity Logs. This provides a complete audit trail of all machine-to-machine operations—critical for security, compliance, and debugging.

How It Works

Audit logging runs in the terminate phase—after the response has already been sent to the client. This means:

• Zero latency impact — The client gets their response without waiting for the log to be written
• Automatic — No configuration required. Every authenticated request is logged.
• Integrated — Uses the same Activity Log system as all other platform events

What Gets Logged

Each agent request creates an activity log entry with:

Event Types

Events are derived from the HTTP method:

Viewing Agent Logs

Agent API activity appears in Activity Logs alongside all other platform events.

In the Partner Dashboard

Partners see their own agent API activity under Activity → Activity Logs:

• Category filter → Select Agent Keys to show only agent requests
• Event filter → Select Agent Read, Agent Write, or Agent Delete
• Subject filter → Select Agent Key to see which key was used
• Agent events display with visual badges: 👁 Read (info), ⚡ Write (primary), ❌ Delete (danger)

In the Admin Dashboard

Admins see all agent API activity across all partners:

• Same filters as above, plus filtering by partner (causer)
• Useful for monitoring platform-wide API usage and investigating issues

See Viewing Activity Logs for the full filtering interface.

What's NOT Logged

For security and performance:

• Request bodies are not logged (may contain PII or sensitive data)
• Response bodies are not logged (could be large)
• Failed authentication attempts are not logged here (the request never reaches the middleware that logs authenticated requests—AuthenticateAgent rejects them earlier)
• Health check details — Health checks are logged like any other request but contain no sensitive data

Monitoring Patterns

Detect Unusual Activity

Watch for:

Audit After Key Compromise

If you suspect a key has been compromised:

1. Revoke the key immediately (see Managing Keys)
2. Filter Activity Logs for that key's prefix
3. Review what endpoints were called and what data was accessed
4. Create a new key with the same scopes for your legitimate integration

For Developers

Agent logs use the same Activity model as all other platform logs. If you're building custom analytics or monitoring:

use App\Models\Activity;

// Get all agent API logs
$agentLogs = Activity::agentApi()->latest()->get();

// Get agent logs for a specific partner
$partnerLogs = Activity::agentApi()
    ->where('causer_id', $partnerId)
    ->where('causer_type', Partner::class)
    ->latest()
    ->get();

// Get agent write operations only
$writes = Activity::agentApi()
    ->forEvents(['agent_write', 'agent_delete'])
    ->latest()
    ->get();

Related Topics

• Activity Logs Overview — The full audit trail system
• Viewing Activity Logs — Filtering and searching logs
• Activity Log Analytics — Charts and metrics
• Authentication — Key security model
• Managing Keys — Revoking compromised keys