> ## Documentation Index
> Fetch the complete documentation index at: https://docs.igrisecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Trail

> Searchable, filterable log of every LLM call, MCP tool call, and connection event — with archive restore for older data.

# Audit Trail

The Audit Trail screen at [app.igrisecurity.com/audit](https://app.igrisecurity.com/audit) provides a paginated, filterable table of every event recorded by the proxy and LLM gateway. Use it for incident investigations, compliance reviews, and ad-hoc queries.

<Note>
  Audit events are **mutable**. The archive job deletes rows from the database after your plan's retention window and writes them to S3. You can restore archived events back into the live table — see [Archive and restore](#archive-and-restore) below.
</Note>

***

## Event types

| Type         | Description                                          |
| ------------ | ---------------------------------------------------- |
| `llm.call`   | A request forwarded by the LLM gateway to a provider |
| `mcp.tool`   | A tool call evaluated by the MCP proxy               |
| `connection` | A connection-level lifecycle event                   |

***

## Filters

The toolbar exposes six independent filters that can be combined freely:

| Filter          | Values                                                                                    |
| --------------- | ----------------------------------------------------------------------------------------- |
| **Type**        | All / `llm.call` / `mcp.tool` / `connection`                                              |
| **Action**      | Policy outcome: `allow`, `deny`, `alert`, `redact`                                        |
| **Connection**  | Dropdown of all registered connection slugs (or `(none)` for events without a connection) |
| **Date range**  | Calendar picker for `from` / `to` timestamps                                              |
| **Text search** | Free-text match across event ID, model, tool name, connection slug, and user ID           |
| **Sort**        | Column (timestamp / type / action / detail) and direction (asc / desc)                    |

Results update with a 250 ms debounce. Press **Clear** to reset all filters at once.

***

## Table columns

| Column         | Content                                         |
| -------------- | ----------------------------------------------- |
| **Time**       | Event timestamp                                 |
| **Type**       | `llm.call`, `mcp.tool`, or `connection`         |
| **Detail**     | Model name (LLM calls) or tool name (MCP calls) |
| **Actor**      | User or service that triggered the event        |
| **Connection** | Connection slug                                 |
| **Action**     | Policy outcome                                  |

Click any row to open the **event detail drawer** with the full event payload.

***

## Pagination

Page size is configurable (default 25 events per page). Navigation controls sit at the bottom of the table. The toolbar also shows a count: "Showing N of total events".

***

## CSV export

Click **Export** in the toolbar to download the **current page** of results as a CSV file (`audit-trail.csv`). The export includes: Time, Type, Detail, Actor, Connection, Action.

<Note>
  The export covers only the rows currently loaded in the table — not the entire result set. Apply filters first to scope what you need, then export.
</Note>

***

## Archive and restore

Igris archives audit events to S3 when they exceed your plan's retention window. The archive runs daily and deletes the rows from Postgres after writing them, so they no longer appear in the live table.

### Archive banner

When you apply a date range filter that overlaps an archived period, an amber banner appears above the table:

> **Some logs in this range are archived.** \[date range] — **Request restore**

The banner shows the start and end of the first archived range, plus a count of additional ranges if more than one overlaps.

### Requesting a restore

Click **Request restore** to open the restore dialog. It shows:

* The date range to be restored
* Estimated row count and data size
* The exact fee for this restore job and how many free restores your org has remaining this month

Restore jobs may incur a per-job fee that depends on your plan. Some plans include a number of free restores each calendar month; once those are used, each additional job is charged at your plan's rate. Higher tiers include more free restores and may have different per-job fees. Enterprise plans include unlimited free restores.

The restore dialog always reflects your current plan's fee and remaining free allowance before you confirm — you will never be charged an unexpected amount.

For current pricing details, open the **Plans & Billing** tab in [Settings](https://app.igrisecurity.com/settings).

After submitting, a restore job is queued. The job writes events back to your org's live table. Once complete, the events are visible in the audit trail again and the archive banner disappears for that range.

<Note>
  Archive restore requires the **Growth** plan or above. The button is disabled on Starter.
</Note>

***

## API

The audit trail is backed by `GET /api/v1/audit-events`. See the Reference section for full parameter documentation.