Every credential access attempt is logged — whether it succeeds, is denied, or fails due to a missing credential. Logs are append-only.

What gets logged

Event	Logged	Notes
get_credential — success	Yes	Credential name returned to agent
get_credential — denied (method)	Yes	Method not in access profile
get_credential — denied (service)	Yes	Service not in access profile
get_credential — not found	Yes	No credential stored for service
get_identity	No	Read-only; no credential access
list_audit_events	No	Reading logs doesn't create a log entry
Bearer token validation failure	No	Only credential access is logged

Log fields

{
  "id": "evt_...",
  "agent_id": "...",
  "agent_name": "cursor-dev",
  "service": "stripe",
  "method": "POST",
  "outcome": "success",
  "denial_reason": null,
  "timestamp": "2026-07-27T10:23:41.000Z"
}

denial_reason is populated only when outcome is "denied" — values: method_not_permitted, service_not_in_profile, credential_not_found.

Append-only

Audit logs cannot be deleted through the dashboard or API. They are append-only at the database level. This is intentional — a deletable audit log provides no compliance guarantee.

Retention

Logs are retained for the lifetime of your account. There is no automatic expiry.

Accessing logs

• Dashboard — the Logs page with filtering by agent, service, outcome, and date range
• MCP — list_audit_events({ limit, service }) returns recent events for the calling agent
• REST API — GET /api/v1/audit-logs (authenticated, returns your account's logs)

Compliance use cases

For compliance workflows that require log export, contact support. Enterprise plans include structured log export via API.