Observability

Logs

A single timeline of every event AIronClaw records on your account: LLM requests, MCP tool calls, IP bans, rule matches and DLP redactions. Use it to power dashboards, audit jobs and SIEM ingestion.

Concepts#

Logs are returned newest-first with cursor-style page numbers. Filters compose: every parameter you add narrows the result set, so you can build a query like "DLP-matched MCP tool calls on proxy X over the last 24h" with a single request.

For per-LLM-proxy conversation logs (full prompt + completion, decryptable on demand), use the per-proxy endpoints documented under LLM Proxies → Logs.

List logs#

GET/api/logs

Query

page
number
1-indexed page number. Default 1.
limit
number
1–200 per page. Default 50.
tab
enum
Restrict to one source: mcp or llm.
event_type
csv
Comma-separated event types, e.g. mcp_request,ip_banned,rule_matched.
mcp_tool
csv
Combined MCP and tool filter. uuid:* = all tools on a proxy; uuid:toolName = one specific tool. Multiple comma-separated.
llm_proxy
csv
Comma-separated LLM proxy UUIDs.
from
epoch seconds
Lower bound (inclusive).
to
epoch seconds
Upper bound (inclusive).
q
string
Free-text search across event metadata.
exclude_empty_get
0/1
Drop GET requests that lack an mcp_method (typically MCP handshake noise).
rules_only
0/1
Only events that triggered at least one rule match or DLP redaction.
cache_status
enum
hit or miss — only events that interacted with the static cache.
curl "https://app.aironclaw.com/api/logs?tab=mcp&rules_only=1&limit=100" \
  -H "Authorization: Bearer $AIFW_PAT"

Chart buckets#

GET/api/logs/chart

Returns time-bucketed counts ready to feed a stacked bar chart. Useful for dashboards or anomaly-detection cron jobs.

Query

from*
epoch seconds
Range start.
to*
epoch seconds
Range end (must be greater than from).
buckets
number
10–100 (default 40). Number of equal-width buckets to split the range into.
tab
enum
mcp or llm to restrict to one source.
curl "https://app.aironclaw.com/api/logs/chart?from=1735689600&to=1735776000&buckets=24&tab=llm" \
  -H "Authorization: Bearer $AIFW_PAT"