Skip to content
ATLAS
 Docs
On this page

Search the audit log#

Find a specific AI request or conversation, inspect what happened, and trace it from a request ID or correlation ID.

Before you begin#

  • You need the Auditor role. The Owner or an Admin gives you this additional role. Admins don't read the audit log by default. Roles and permissions lists what each role can do.
  • Prompt and response content exists only if prompt and response capture is enabled. See Prompt and response capture.

Find a request or conversation#

  1. In the sidebar, open Statistics > Audit log.
  2. Choose a tab:
    • Conversations (the default) groups related requests into sessions. Use it to understand a whole exchange. You can sort by Started, User, Requests, Tokens or Cost.
    • Request Log has one row per request. Use it to find a single call.
  3. Narrow the results with the search box and the column filters. The search box matches request ID, reference, provider, correlation ID, user and more. The Status filter offers Success, Error and Cancelled.
  4. From a conversation row, choose View in Request Log to list its requests, or Open as chat to read it as a chat.
  5. Expand a request row to open its detail panel. It shows:
    • request ID and correlation ID, if the caller sent one
    • user and organisation
    • API key, shown as atl_sk_•••• plus its last characters
    • model reference, token and cost breakdown, and any error
    • any parameters that were dropped, with the reasons
  6. For prompt and response content, scroll to the payload section. Without the Auditor role it reads "Prompt and response content requires the Auditor role."

Trace a customer report#

  1. Ask the caller for the atlas-request-id response header, or for their own atlas-correlation-id if they set one.
  2. Paste the value into the search box, or filter the Request Log by it.
  3. Open the row.

Result: you can see the outcome, cost, tokens and, with permission, the content of any request in your scope.

Good to know#

  • A request normally appears in the log within seconds. ATLAS writes the record in the background, so it never slows the request.
  • A request rejected before it reaches the audit, such as one with an invalid API key (401), has a request ID header but no row.
  • Cancelled rows are streams the consumer abandoned. Their tokens and cost still count.
  • Deleted users, projects and spaces appear as Deleted … followed by the start of their ID.