Audit Logs

​

Current Availability

​

Dashboard Access

1. Navigate to Interactions: app.promptguard.co → Projects → [Your Project] → Interactions
2. Filter and Search: Use filters to find specific events by type, date, or content
3. Export Data: Download interaction data for analysis

​

Audit Log Page

1. Navigate: app.promptguard.co → Dashboard → Audit Log
2. Filter: Category, action, severity, actor, date range
3. Export: Download as JSON for compliance reporting

​

What Gets Logged

​

Security Events

• Threat Detection: Security violations, blocked requests, policy triggers
• PII Redaction: Automatic masking of sensitive data
• Policy Decisions: Allow, block, or redact actions
• Detection Methods: Regex, ML, or agentic evaluator used

​

API Activity

• Request Details: All API calls with timestamps and metadata
• Response Information: Status codes, processing times
• Error Events: Failures, timeouts, and error conditions
• Usage Tracking: Token consumption and costs

​

Log Structure

​

Standard Log Format

{
  "id": "evt_abc123def456",
  "timestamp": "2024-01-15T10:30:15.123Z",
  "user_id": "user_123",
  "project_id": "proj_abc123",
  "api_key_id": "ak_xyz789",
  "decision": "block",
  "threat_type": "PROMPT_INJECTION",
  "detector": "ml_model",
  "confidence": 0.95,
  "content_preview": "Ignore all previous instructions...",
  "reason": "ML API detected injection (confidence: 0.95)",
  "metadata": {
    "model": "gpt-5-nano",
    "latency_ms": 42,
    "ip_address": "203.0.113.45"
  }
}

​

Event Categories

​

Security Events

{
  "decision": "block",
  "threat_type": "PROMPT_INJECTION",
  "detector": "ml_model",
  "confidence": 0.95,
  "reason": "ML API detected injection"
}

​

PII Redaction Events

{
  "decision": "redact",
  "threat_type": "PII_LEAK",
  "detector": "regex",
  "confidence": 1.0,
  "reason": "Credit card number detected and redacted"
}

​

Dashboard Access

​

Viewing Interactions

1. Navigate: app.promptguard.co → Projects → [Your Project] → Interactions
2. Filter: Use the filters to find specific events:
   • Flagged Only: Show only blocked/redacted events
   • Search: Search in content or reason text
   • Date Range: Filter by last N days
3. Details: Click on any event to see full details

​

Exporting Data

# Fetch recent flagged security events
curl https://api.promptguard.co/dashboard/interactions \
  -H "Cookie: session=YOUR_SESSION_COOKIE" \
  --get \
  -d "flagged_only=true" \
  -d "page_size=100"

# Fetch events for a specific project within the last 7 days
curl https://api.promptguard.co/dashboard/interactions \
  -H "Cookie: session=YOUR_SESSION_COOKIE" \
  --get \
  -d "project_id=proj_123" \
  -d "days=7" \
  -d "page=1"

​

Available Filters

​

Best Practices

​

Log Retention

• Current: Logs are retained based on your plan tier
• Free: 24 hours (no guaranteed retention)
• Pro: 7 days retention
• Scale: 30 days retention
• Enterprise: Custom retention (configurable per organization)

​

Persistent Audit Trail (Enterprise)

• Categories: security, authentication, data_access, configuration, billing
• Integrity: Each event has a SHA-256 integrity hash chained to the previous event’s hash (previous_hash → integrity_hash), forming a tamper-evident append-only chain
• Organization-scoped: Events filtered by your organization context
• SOC 2 ready: Meets audit log requirements for SOC 2 Type II compliance

​

Hash Chain Verification

curl -X POST https://api.promptguard.co/dashboard/audit-log/verify-chain \
  -H "Cookie: session=YOUR_SESSION_COOKIE" \
  -d "start_date=2026-01-01T00:00:00Z" \
  -d "end_date=2026-04-10T00:00:00Z"

{
  "valid": true,
  "verified_count": 12847,
  "first_break_at": null
}

​

GDPR Compliance

• Data Export: POST /dashboard/compliance/data-export - Export all your data
• Data Deletion: POST /dashboard/compliance/data-deletion - Delete all your data (requires confirmation)

​

Compliance

• All security events are logged for compliance
• Logs include timestamps, user IDs, organization IDs, and decision metadata
• Pull audit data via the Interactions API for compliance reporting
• Events include IP address and user agent for forensic analysis

​

Next Steps