Audit Logging

We offer a GraphQL query named getAccountAuditLogs for the purpose of retrieving account activity information for audit logging. The response includes information like the IP-Address, login/logout times and in-app activity data points. An in-app activity, for example, refers to when a user changed a system setting or added an integration.

This query is designed to fetch account audit logs based on specified criteria, offering detailed insights into events related to API calls and user activities within a defined time range.

Usage

This API supports pagination, allowing a customer to collect audit logs by making paginated calls to the API.

Sample query

query getAccountAuditLogs(
  $startTime: DateTime!
  $apiCallReferences: [ApiCallReference]
  $includeApiQueries: Boolean
  $userEmail: String
  $first: Int
) {
  getAccountAuditLogs(
    startTime: $startTime
    apiCallReferences: $apiCallReferences
    includeApiQueries: $includeApiQueries
    userEmail: $userEmail
    first: $first
  ) {
    records {
      timestamp
      accountUuid
      accountName
      email
      firstName
      lastName
      url
      eventType
      apiName
      apiIsQuery
      apiCallReferences
      apiCallSource
      clientIp
    }
  }
}

Variables

{
  "startTime": "2023-12-01T12:00:00.000Z",
  "includeApiQueries": true,
  "userEmail": "[email protected]",
  "apiCallReferences": [
    {
      "parameterName": "resource_id",
      "parameterValues": ["04bb580a-7dee-4ff6-87ee-2aafe3545748", "cf351ffe-2332-4cef-9021-f0d753960a9d"]
    },
    {
      "parameterName": "dw_id",
      "parameterValue": "836a6113-c067-467c-ad08-68462f045fe6"
    }
  ],
  "first": 50
}

Agent MCP tool calls

When a Monte Carlo agent calls a tool on one of your MCP servers, the audit log records an entry. These entries have the event type Agent MCP Tool Called. Calls from chat and from automated agent runs are both recorded.

Results without an eventTypes filter include these entries. To get only some event types, pass eventTypes. It takes the enum name, such as AGENT_MCP_TOOL_CALLED for Agent MCP Tool Called entries. Allowed values are API_CALLED, USER_LOGIN, USER_LOGOUT, AGENT_MCP_TOOL_CALLED, PII_INVENTORY_VIEWED, PII_SAMPLE_ROWS_VIEWED and PII_INVENTORY_EXPORTED. An empty or missing list returns all event types.

The agentActivity field holds the details of the call. It is null for events that are not agent activity, and for entries that are missing required data. All of its fields are optional. The server fields are only set for tools on your MCP servers.

To filter by who acted, pass actorRole. This is the role of the identity that made the call. Entries from chat and from agent runs a person starts have the role USER, because the agent acts on behalf of that person. Automated agent runs have the role AGENT.

Keep these limits in mind:

• Delivery is best effort. Monte Carlo attempts one entry per tool call, and some calls may not be recorded.
• Entries hold metadata only. Tool arguments and results are not recorded.

Sample query for agent MCP tool calls

query getAgentMcpToolCalls($startTime: DateTime!, $first: Int) {
  getAccountAuditLogs(
    startTime: $startTime
    eventTypes: [AGENT_MCP_TOOL_CALLED]
    first: $first
  ) {
    records {
      timestamp
      email
      eventType
      agentActivity {
        serverId
        serverName
        toolName
        toolSource
        access
        outcome
        agentId
        surface
        isAutomated
        threadId
      }
    }
  }
}

Documentation

Detailed documentation for this query is available in our API documentation here.

Notes

• The data returned by this API may have a lag of up to 10 hours.