{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"created_at": "2023-11-07T05:31:56Z",
"token_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"token_description": "<string>",
"token_owner": 123,
"token_owner_email": "<string>",
"action": "<string>",
"method": "<string>",
"path": "<string>",
"status_code": 123,
"response_content_length": 123,
"duration_ms": 123,
"remote_address": "<string>",
"client_tool": "<string>",
"tool_call_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}Token access log object
The shape of a single token access log line.
One access-log line: who called, what they reached, and how it answered.
api-token- API tokenmcp-token- MCP token
api-token, mcp-token The APIToken's or the MCPToken's id — token_kind says which. Not a foreign key because it points at two different tables. Null when authentication failed, and there is no token to name.
Client-facing action slug from the audit registry (source.create, data.sql_query, ...), derived from the resolved route — never from the raw URL. unknown is a valid value: a route nobody has mapped yet is still recorded.
http- HTTPwebsocket- WebSocketmcp_tool- MCP tool call
http, websocket, mcp_tool How much data left with this response — the size question an access audit exists to answer.
MCP tool name, when the caller declares one. Informational only — it comes from the client, so it authorises nothing.
The MCP tool call this line belongs to: on an HTTP or WebSocket line, the call that made the request; on a tool call line, the outer call (run_tool) that dispatched it. Null otherwise. Not indexed: it is only read inside the time window of one call, which the workspace/created_at index already bounds.
Was this page helpful?