Skip to main content
Use the Events page in Control Center to find captured LLM calls across your organization, debug failed calls, and understand how your agents interact with models. Logs cover supported LLM calls, not every platform action. Availability can be delayed, and missing source telemetry is not reconstructed.
The Events page is only available to organization admins, IT admins, and AI Studio full access roles.
Event logs are available for WRITER Agent and API/SDK usage. Observability for Agent Builder v2 agents is not yet available.

​
Access the Events page

To open the Events page, log in to Control Center, select Activity in the left sidebar, then select Observability. The Events page in Control Center showing summary metrics, a request volume chart, and an events table Use the time range controls to select a preset window or define a custom start and end time. The summary metrics, chart, and events table all update to reflect the selected range.

​
Find specific events

The events table lists captured calls with their timestamp, success or failure status, model, session ID, creator, and latency when available. To narrow the table to the events you need, use any combination of the following:
  • Filters—narrow by status (success or failure), model, source, or the user that created the request. Combine filters to isolate specific scenarios, such as failed calls for a particular model.
  • Search—search by request ID, session ID, agent run ID, or root agent run ID to locate calls and related activity.
  • Time range—adjust the time window to focus on a specific period of activity.
The Created by field displays a resolved user name when the captured call includes a known user identity. Calls without a resolvable creator can display N/A; creator availability depends on the source, not only whether a call uses the public API.
For continuous export into a warehouse, SIEM, or analytics platform with Airbyte, Fivetran, or Singer, use the Logs Export API.

​
Inspect an event

Select any row in the events table to open the detail panel. The panel has three tabs:
  • Details—session and request IDs, timestamp, call latency, success or failure status, token usage, model and provider, and call runtime when available. The panel also shows source, run correlation, and guardrail details where recorded (including built-in DLP allow and block outcomes).
  • Request—captured, stored input for the call.
  • Response—captured, stored output for the call.
The stored input and output are not necessarily the complete, untouched provider request and response JSON.

​
Correlate calls with agent runs

When a call has run IDs, the detail panel shows its agent run ID and root agent run ID. Select View related runs to find calls associated with the same root. These IDs correlate execution activity only; a root ID does not guarantee a user turn or identify an agent’s role. Missing source telemetry and historical records may limit the calls and runs you can inspect. Agent Response Time is the lifecycle duration of the selected call’s execution leg. It is not the sum of LLM-call latencies, the length of a session or conversation, or exact user-visible latency. Parent, child, and resumed legs remain distinct rather than forming a session total. Timing is unavailable (not zero) for failed or canceled legs, and when lifecycle information is missing or ambiguous.

​
Understand unavailable content

Body availability is separate from masking. The detail panel reports why captured input or output cannot be shown:
  • Not captured (not_captured)—no stored body was captured for the call.
  • Pending (pending)—the body is still being processed.
  • Unavailable (missing or failed)—the stored body cannot be found or retrieved.
  • Expired (expired) or Deleted (deleted)—the stored body has passed its retention window or has been deleted.
  • Temporarily unavailable (ekm_denied) or Authorization unavailable (unauthorized)—body retrieval is blocked by key access or authorization.
Select Retry when the panel offers it for a retryable pending, temporary key-access, or retrieval failure. Disabling masking does not recover uncaptured, expired, or deleted bodies.

​
Mask sensitive content

Event logs can capture sensitive information from user prompts and LLM responses. To protect this data, content masking hides these fields in the event detail panel, where they appear as empty values. Masking is enabled by default. To configure masking, select the Configure masking control on the Events page. Choose one of the following options and select Confirm:
  • Enable masking—user prompts and LLM responses are hidden. These fields appear as empty values in event logs.
  • Disable masking—available captured user prompts and LLM responses are visible in event logs.
API-key body exports use a separate Logs Export API authorization path and return available bodies unmasked.

​
Next steps

Use these guides to export captured logs or review usage.
  • Export logs: Poll captured calls, terminal-run records, and agent feedback with the Logs Export API
  • Built-in DLP guardrail: Block sensitive data before it reaches a model
  • Usage and spend: Track organization-wide costs and token consumption