Skip to main content

​
Log Ingestion

Igris ingests logs from external AI observability providers and normalizes them into a unified audit_events table. This gives you a single audit trail that combines proxy-intercepted tool calls with logs from your existing AI infrastructure.

​
How It Works

  1. Configure your provider to send webhooks to the Igris ingestion endpoint
  2. Igris normalizes the provider-specific payload into a standard event format
  3. Events are stored in the audit_events table alongside proxy-captured events
  4. Dashboard and compliance features use the unified data

​
Supported Providers

ProviderEndpointStatus
Portkey AI Gateway/api/v1/ingest/portkeySupported
Helicone/api/v1/ingest/heliconeSupported
Cloudflare AI Gateway/api/v1/ingest/cloudflareSupported
CloudWatch + Datadog/api/v1/ingest/cloudwatch, /api/v1/ingest/datadogSupported
Raw JSON/api/v1/ingest/rawSupported

​
Authentication

All ingestion endpoints require an API key in the Authorization header: 
Authorization: Bearer ig_your_api_key_here
Generate API keys in Settings → API Keys. We recommend creating a dedicated key for each provider.

​
Normalized Event Format

Regardless of source, all ingested events are stored with these fields:
FieldDescription
idUnique event ID
orgIdOrganization ID (derived from API key)
sourceProvider name (portkey, helicone, cloudflare, cloudwatch, datadog, raw, proxy)
typeEvent type (tool_call, completion, embedding, anomaly)
toolNameTool or model name
actionWhat happened (allow, deny, alert, log)
metadataProvider-specific data preserved as JSON
timestampWhen the event occurred

​
Plan Limits

Ingestion volume is gated by plan:
PlanEvents/month
Free1,000
Govern ($49)50,000
Comply ($199)500,000
Enterprise ($499)Unlimited
Events exceeding your plan limit are rejected with a 429 Too Many Requests response.