Every primitive write and connection action emits an activity event scoped to the
tenant user. Use logs to build a per-user timeline, an agent profile
audit view across all users, or a live dashboard feed.
CLI First
| Tool | Type | Description |
|---|
logs_query | Core | Query a user’s events (filter by action, time, limit) |
logs_cross_user | Core | Query events across all users (agentProfile view) |
logs_stream | Core | Live SSE tail of activity.logged events |
Querying
Response:
Parameters
| Param | Type | Required | Default | Description |
|---|
action | string | No | — | Filter by action, e.g. vault.put, connection.execute, cards.create |
after | string | No | — | ISO timestamp — only events after this |
limit | number | No | 50 | Max events (cap 200) |
Cross-user (agentProfile view)
Live stream (SSE)
The SSE stream is ideal for a live dashboard timeline — it pushes each activity.logged
event the moment it’s recorded, no polling required.
Error Handling
| Error | Cause | Recovery |
|---|
not_found | Invalid user_id | Use GET /v1/users for valid ids |
invalid_input | Malformed after timestamp or limit | Use an ISO timestamp and a positive limit |
Typical Workflow