What does StackOne log for AI agent activity?

StackOne logs three kinds of activity. Action logs record each call to a business system and its outcome. Platform logs record changes to StackOne configuration. Sign-in logs record who signed in and how, through SSO or other permitted methods. Member identity, policy details and Defender results appear when the caller and checks provide them.

Is action logging on by default in StackOne?

Yes. StackOne records action logs by default, with no setup. Advanced Logs, which stores request and response bodies, is off by default and you turn it on when you need it.

How do I debug a failed AI agent tool call in StackOne?

To debug a failed AI agent tool call in StackOne, open the call's request log, follow its execution steps to the provider request that failed, and read that step's request and response bodies. Bodies need Advanced Logs, which is off by default. With it on, the Error Explainer suggests fixes. The Logs API returns the same records.

Can I see why a StackOne Tool Policy blocked a call?

Yes. Each member-based action in the StackOne logs shows which Tool Policies were evaluated, whether each one matched, its mode and its decision. Open the denied request to see the policy that blocked it and the version in force at the time.

Can I test a StackOne Tool Policy without blocking anyone?

Yes. Set a StackOne Tool Policy to Monitor only and it records what it would have denied without blocking anyone. Review those decisions in the logs, then switch the policy to Enforce. Other enforced policies and access controls still apply while you test.

Does StackOne export logs to my SIEM?

Yes, through the Logs API. Your pipeline pulls supported StackOne records and forwards them to tools such as Splunk or Datadog. The Logs API is included in Gateway Enterprise and both OEM plans. Audit logs and SIEM export are Enterprise features, and we agree the export setup with you.

Are Prompt Injection Guard results in the StackOne logs?

Yes, when Prompt Injection Guard scans a tool response. Its verdicts and scores appear in the action's Defender details in StackOne, and through the Defender action-log endpoint. Which scan stages appear depends on the scan that ran.

AI agent observability · Action and audit logs. Audit how your teams use AI agents across business systems.

Get AI agent observability on every tool call: its outcome, policy checks and provider requests.

Start Free Book Demo

Action logs

21 Sep 2026UTC

Recent actions Policies Defender

User / Agent	System / Action	Outcome / Checks
Taylor Brooksvia Copilot	SAP S/4HANA 12:41:33	200 2 Clean
Noah Patelvia Claude Code	Jamf Pro 12:42:10	200 2 Clean
Alex Morganvia Claude	Workday 12:43:51	200 3 Clean
Lena Ortizvia Copilot	Salesforce 12:44:06	200 2 Clean
Priya Shahvia Claude Code	Xero 12:45:19	403 3 Not run
Sam Riveravia Claude Code	ServiceNow 12:46:32	201 2 Clean
Alex Morganvia Claude Code	Workday 12:47:58	200 3 Clean

Workday

Get Worker

21 Sep · 12:47:58 UTC

200 OKClean

User / Agent: Alex Morgan via Claude Code
Account: People Operations

Policies evaluated3

Protect personal dataMasked

EnforceMatchedResponse filtering

Field groupPersonal datapii

Personal data masked before reaching the agent.

Keep salaries unchangedNo match

Review worker lookupsMonitor onlyWould deny

2 other policiesNo match · Would deny

Worker lookup completed

Action, platform and sign-in logs. Review tool calls, setup changes and sign-ins.

See the outcome of every tool call, setup change and sign-in.

Action logs

21 Sep 2026UTC

Recent actionsSelect a row for details

Action logs on 21 Sep 2026
User / Agent	System / Action	Outcome
Jordan Blake via ChatGPT	Salesforce12:35:12	200 198 ms
Sam Rivera via ChatGPT	ServiceNow12:36:40	201 534 ms
Taylor Brooks via Copilot	SAP S/4HANA12:38:27	404 126 ms
Alex Morgan via Claude	Workday12:41:09	200 286 ms
Noah Patel via Claude Code	Jamf Pro12:43:24	200 231 ms
Daniel Okafor via Claude	NetSuite12:44:51	200 412 ms
Priya Shah via Claude Code	Xero12:45:19	403 38 ms

Xero

Create Payment

21 Sep · 12:45:19 UTC

403 Denied

Priya Shah

via Claude Code

Account: Finance
Decided by: Restrict payment creation
Policies evaluated: 3
Duration: 38 ms

Payment refused by policy

Platform logs

21 Sep 2026UTC

Recent changesSelect a row for details

Platform logs on 21 Sep 2026
Changed by	Change / Target	Result
API key No user recorded	Workday · People Operations09:35:02	Success 201 Created
Noah Patel User session	Jamf Pro · IT Support09:41:27	Success 200 OK
SCIM Directory sync	Finance approvers09:58:10	Success 200 OK
Hannah Weiss User session	Xero · Finance approvers10:26:33	Success 200 OK
Lena Ortiz User session	Restrict payment creation11:02:14	Success 200 OK
API key No user recorded	Organization11:47:12	Success 200 OK
Hannah Weiss User session	Finance reporting12:31:40	Success 201 Created

Finance reporting

API key created

21 Sep · 12:31:40 UTC

201 Created

Recorded user: hannah@northwind.example
Authentication: User session
Project: Production
HTTP result: 201 Created

Key created in Production

Sign-in logs

21 Sep 2026UTC

Recent sign-insSelect a row for details

Sign-in logs on 21 Sep 2026
Member	Event / Method	Result
Noah Patel noah@northwind.example	Dashboard09:31:07	Success SAML
Hannah Weiss hannah@northwind.example	Dashboard10:21:48	Success SAML
Ravi Menon ravi@northwind.example	All sessions10:30:44	Revoked SCIM
Lena Ortiz lena@northwind.example	Dashboard10:57:31	Success SAML
Maya Chen maya@northwind.example	Dashboard · Password11:58:36	Failed SSO required
Jordan Blake jordan@northwind.example	ChatGPT12:22:51	Success OAuth
Priya Shah priya@northwind.example	Claude Code12:40:03	Success OAuth

Policy decision audit trail. Test a policy in Monitor only, then enforce it.

Monitor only records what a policy would have denied without blocking anyone. The logs show each decision before and after you switch.

Restrict payment creationCreate Payment in Xero · decisions per hour

The policy matched just as often after the switch. In Monitor only it logged each payment it would have stopped and blocked none; in Enforce it denied them.

Explore Tool Policies

Request and response logging. Keep request and response bodies.

Store the bodies of failed actions, or all of them, for up to 30 days, or as long as you need when you self-host.

New action with these settings

Get Supplier

SAP S/4HANA · Procurement

Action recorded

404 Not Found

Response excerptStored · 7 days

{
  "error": {
    "message":
      "Supplier not found."
  }
}

{
  "Supplier": "0000100042"
}

Redact personal data before it's stored

Turn on PII redaction in Advanced Logs to remove personal data from request and response bodies before StackOne writes them.

PII redaction in Advanced Logs

AI agent observability in production. Debug a failed tool call step by step.

When an agent's tool call fails, its request log in StackOne shows where it broke, down to the provider request. The Logs API returns the same records, so you can debug from your own tools.

1. Find the failed call
StackOne logs every MCP tool call and action run. Filter the request logs by account, connector, action, time window or status code to list the calls that failed.
2. Follow the execution steps
Each log shows the call's status, duration, connector and action. Below that are the steps StackOne ran and the requests it sent to the provider.
3. Read the failed step's bodies
With Advanced Logs on, read the request and response bodies of the step that failed. Advanced Logs is off by default. Once on, it keeps bodies for failed requests only, unless you choose All Data.
4. Get suggested fixes
In the dashboard, the Error Explainer reads the error and suggests three fixes drawn from provider and StackOne documentation. It needs Advanced Logs on.

Read the request log debugging guide

Logs API and SIEM export. Send action and platform logs to your own tools.

Pull records through the Logs API to investigate agent activity or report on your rollout.

StackOne

Logs API

api.stackone.com

POST /logs Action and request logs
POST /logs/platform Setup changes made in StackOne
POST /logs/stats/aggregate Counts by connector, outcome or policy result
GET /logs/actions/{actionRunId} One tool call
GET /logs/actions/{actionRunId}/policy The policy decision on that call

{ "data": [{"log_type": "action","event_time": "2026-09-21T12:45:19Z","action_id": "xero_create_payment","status_code": 403,"success": false,"duration_ms": 38}] }

Your network

Collector or proxy

Pulls every 5 minutes

Request: POST /logs
Basic auth: v1.eu1.xxxxx
Window: start_time = last pull

Your tools

Any SIEM or data platform

Datadog
Splunk
Elastic
Grafana
Snowflake

StackOne agent activity 24h

Tool calls1,284

Failed36

Denied24

Connect your SIEM

Run a small collector or proxy that pulls records from the Logs API and forwards them to any SIEM or data platform.

Read the Logs API reference

FAQ. Questions about observability & audit

See what your teams' agents are doing.

Walk through action logs, policy decisions and export options for your rollout.

Book Demo Start Free

AI agent observability · Action and audit logs. Audit how your teams use AI agents across business systems.

Action, platform and sign-in logs. Review tool calls, setup changes and sign-ins.

Policy decision audit trail. Test a policy in Monitor only, then enforce it.

Request and response logging. Keep request and response bodies.

Redact personal data before it's stored

AI agent observability in production. Debug a failed tool call step by step.

1. Find the failed call

2. Follow the execution steps

3. Read the failed step's bodies

4. Get suggested fixes

Logs API and SIEM export. Send action and platform logs to your own tools.

Connect your SIEM

FAQ. Questions about observability & audit

What does StackOne log for AI agent activity?

Is action logging on by default in StackOne?

How do I debug a failed AI agent tool call in StackOne?

Can I see why a StackOne Tool Policy blocked a call?

Can I test a StackOne Tool Policy without blocking anyone?

Does StackOne export logs to my SIEM?

Are Prompt Injection Guard results in the StackOne logs?

See what your teams' agents are doing.