See every call your AI agent made

Route the agent's calls through one place and record their outcomes with the app identity and time. Gate provides gateway audit metadata, signed exports and run timelines, with storage and retention limits you can check below.

The problem

An agent changes something and nobody can say which app called the API, what route it used or when the call failed. A chat transcript records what the model said, but it does not prove which requests reached your server. Retrying from the transcript can make the original mistake happen again.

The fix without Gate

Log request metadata at your API boundary: time, authenticated app, method, route template, response status, duration and a job identifier. Redact credentials and personal data before writing logs. Correlate those records with database changes and review retention and access. An API log helps investigate a change; your own application records must explain the business effect.

The fix with Gate

Use an existing project and app that allows GET /orders/:id. Set $PROJECT to the project id, $APP_ID to the app id and $APP_KEY to its key. Keep $ADMIN, the project admin key, on your backend. Make a call through Gate, then inspect the metadata:

curl "https://gate.odilelabs.com/g/$PROJECT/orders/42" \
  -H "Authorization: Bearer $APP_KEY"

curl "https://gate.odilelabs.com/api/projects/$PROJECT/audit?app=$APP_ID" \
  -H "Authorization: Bearer $ADMIN"

curl "https://gate.odilelabs.com/api/projects/$PROJECT/audit.csv" \
  -H "Authorization: Bearer $ADMIN"

The JSON endpoint returns the latest 200 rows; CSV returns up to 10,000. Both support app, status and method filters. Gateway audit rows store time, app, method, matched route rule, path SHA-256, status, duration, reason, request body size and SHA-256 when read, plus run/event references. An unmatched call records only the first path segment as its route hint.

The gateway audit log never stores request or response bodies, raw full paths, header values or incoming query values. Hashes are not encryption or a guarantee of anonymity, and configured route rules may contain literal values. Separately, a call waiting for approval keeps its target and body encrypted until execution, rejection or expiry (at most 24 hours); administrator change logs keep IP and user-agent metadata.

Export evidence you can check

curl "https://gate.odilelabs.com/api/projects/$PROJECT/audit/proof?from=1&to=100" \
  -H "Authorization: Bearer $ADMIN" -o gate-audit-proof.json

curl -X POST "https://gate.odilelabs.com/api/projects/$PROJECT/audit/verify" \
  -H "Authorization: Bearer $ADMIN" -H 'content-type: application/json' \
  --data-binary @gate-audit-proof.json

New stored rows form a SHA-256 chain from a recorded genesis; legacy rows before that genesis are outside it. The export includes anchors and a project-specific HMAC-SHA256 signature, not a public-key signature. Verify the entire unchanged export: Gate returns intact or a failure reason and, when applicable, the one-based broken_at position. Use actual row ids for ranges; pages hold up to 10,000 rows, with next_from for the next page. Save exports outside Gate.

Follow one run

For an existing run, set $RUN_ID to its run_id from the run description. Open it in the dashboard or request its timeline:

curl "https://gate.odilelabs.com/api/projects/$PROJECT/runs/$RUN_ID/timeline" \
  -H "Authorization: Bearer $ADMIN"

See call times, methods, matched rules, statuses and reasons, held/approved/rejected actions with decision metadata, recovery outcomes and delegated children. The latest 500 events are returned; use the response's before value as ?before=... for earlier events. Timelines contain no bodies or query values.

Only calls through Gate appear. Missing or invalid keys get at most 20 audit rows per project per hour, although all are counted. Free retains 30 days; Pro retains 365. With store_audit=false, metadata streams to your configured SIEM instead of new rows or a chain being kept on Gate. Logs do not replace backend ownership checks.

Free for 3 apps and 10,000 calls a month.

Other guides

Give each agent its own key · Read only the signed-in user's data · Stop wrong-customer changes · Approve one exact action · Avoid duplicate writes.