Skip to content
Docs

Audit & Compliance Reports

What Is the Audit Log?

Section titled “What Is the Audit Log?”

Every AI request routed through AgentWatch is written to a tamper-evident audit log. The log captures who made the request, which model was used, what was sent and received (prompt + response), how many tokens were consumed, the cost, latency, DLP findings, and the final outcome. This creates a complete, queryable record for compliance audits (GDPR, HIPAA, SOX, PCI-DSS), security investigations, and cost chargebacks.

Audit records are stored in two complementary layers:

  • Relational index — fast lookup by actor, organization, action type, and time range.
  • Compressed NDJSON archives — full request/response payloads archived in .ndjson.gz files; the relational row stores a filePath + lineOffset pointer for O(1) retrieval.

What Each Audit Record Contains

Section titled “What Each Audit Record Contains”
Field Description
id Unique request identifier (UUID)
timestamp UTC timestamp of the request
tenantId API key / tenant that made the request
tenantName Display name of the tenant
tenantEmail Email of the user
team Team the user belongs to
model LLM model requested
provider AI provider used (openai, anthropic, etc.)
sessionId Conversation session identifier
useCase Detected use-case category (e.g. code_assistance, code_review)
promptTokens Input tokens consumed
completionTokens Output tokens generated
totalTokens Combined token count
cost Calculated USD cost
latencyMs End-to-end response time in milliseconds
status completed, blocked, error, dlp_blocked
source api, web-chat, or mcp
dlpFindings Array of DLP detections (category, severity, score)
ipAddress Client IP address

Available Report Types

Section titled “Available Report Types”
Report Description Default Retention
Request Audit Log All AI requests with full field set above 365 days
DLP Events Requests where sensitive data was detected or blocked 365 days
Cost Reports Usage and cost aggregated by team, user, model, or provider 180 days
Security Events Authentication events, authorization failures, WAF blocks 365 days

Export Formats

Section titled “Export Formats”
Format Use Case
JSON Programmatic ingestion, SIEM integration
CSV Spreadsheet analysis, finance chargebacks

Audit Log Export Endpoint

Section titled “Audit Log Export Endpoint”

GET /api/admin/audit/export

Query Parameters:

Parameter Type Default Description
format string json json or csv
days number 30 Number of days back from today
provider string all Filter by provider (openai, anthropic, etc.)
source string all Filter by source: api, web-chat, mcp, or all
tenantId string all Filter to a single user/tenant
teamId string all Filter to all members of a team

JSON export includes a records array plus a summary block:

{
  "records": [ { ...audit fields... } ],
  "summary": {
    "totalRequests": 4821,
    "totalTokens": 12450000,
    "totalCost": 124.52,
    "byProvider": {
      "openai": { "requests": 3100, "cost": 89.11 },
      "anthropic": { "requests": 1721, "cost": 35.41 }
    }
  }
}

CSV export columns: timestamp, tenant, team, provider, model, promptTokens, completionTokens, cost, latencyMs, status, source, dlpBlocked.

Response Headers: The server sets Content-Disposition: attachment; filename="audit-export-YYYY-MM-DD.{json|csv}" so browsers download the file automatically.

Example:

Terminal window
# Export last 7 days of web chat audit logs as CSV
curl -H "Authorization: Bearer ak_admin_key" \
  "https://agentwatch.yourcompany.com/api/admin/audit/export?format=csv&days=7&source=web-chat"


# Export DLP events for a specific tenant as JSON
curl -H "Authorization: Bearer ak_admin_key" \
  "https://agentwatch.yourcompany.com/api/admin/audit/export?format=json&days=30&tenantId=emp-001"

Step-by-Step: Running a Compliance Report

Section titled “Step-by-Step: Running a Compliance Report”
  1. Navigate to Management → Audit Export.
  2. Set the Date Range (up to 365 days back).
  3. Apply filters: provider, source type, team, or individual user.
  4. Select Format (JSON for SIEM, CSV for spreadsheets).
  5. Click Export. The file downloads immediately.
  6. For scheduled exports, use the API endpoint with a cron job or SIEM connector.

API Reference

Section titled “API Reference”
Method Endpoint Description
GET /api/admin/audit/export Download audit log export
GET /api/admin/audit/logs Paginated audit log viewer
GET /api/admin/audit/stats Aggregated stats (totals, by provider, by team)