curl --request GET \
--url https://api.neoagent.io/public-api/audit-log/tool-calls \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.neoagent.io/public-api/audit-log/tool-calls"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.neoagent.io/public-api/audit-log/tool-calls', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.neoagent.io/public-api/audit-log/tool-calls",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.neoagent.io/public-api/audit-log/tool-calls"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.neoagent.io/public-api/audit-log/tool-calls")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.neoagent.io/public-api/audit-log/tool-calls")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"agent_id": 123,
"agent_name": "<string>",
"autonomy_type": "CHAINED_ACTIONS",
"created_at": "2023-11-07T05:31:56Z",
"execution_id": "<string>",
"outcome": "SUCCESS",
"planned_calls_used": [
{
"approval_request_id": 123,
"plan_item_indexes": [
123
]
}
],
"result_summary": "<string>",
"step_id": "<string>",
"tool_input": {},
"tool_title": "<string>",
"tool_type_name": "<string>"
}
],
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"timings_ms": {},
"pagination": {
"has_more": true,
"next_cursor": "<string>"
},
"warnings": [
"<string>"
]
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}List agent tool calls (Audit Log)
Every tool call the tenant’s agents made in the last 30 days, one row per call, newest first — the API behind the dashboard’s Reporting -> Audit Log page. Answers “did one of my agents do this?”: search a ticket number, a user or a device name and the rows show which agent acted, when, with what input, and how it went. Triggered, scheduled and chat agents are all included. The window is the last 30 days: since and until narrow it and never widen it. On a busy tenant a search over the whole window can take more than a minute, so pass since (and until) around the change you are looking for. Rows follow the acting user’s workflow access: an owner or admin sees every agent, a user or viewer only the agents they created or were shared; a person with no dashboard account gets 403. Cursor-paginated on (created_at, step id). execution_id opens the run’s full trace at GET /executions/{execution_id}/steps.
curl --request GET \
--url https://api.neoagent.io/public-api/audit-log/tool-calls \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.neoagent.io/public-api/audit-log/tool-calls"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.neoagent.io/public-api/audit-log/tool-calls', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.neoagent.io/public-api/audit-log/tool-calls",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.neoagent.io/public-api/audit-log/tool-calls"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.neoagent.io/public-api/audit-log/tool-calls")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.neoagent.io/public-api/audit-log/tool-calls")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"agent_id": 123,
"agent_name": "<string>",
"autonomy_type": "CHAINED_ACTIONS",
"created_at": "2023-11-07T05:31:56Z",
"execution_id": "<string>",
"outcome": "SUCCESS",
"planned_calls_used": [
{
"approval_request_id": 123,
"plan_item_indexes": [
123
]
}
],
"result_summary": "<string>",
"step_id": "<string>",
"tool_input": {},
"tool_title": "<string>",
"tool_type_name": "<string>"
}
],
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"timings_ms": {},
"pagination": {
"has_more": true,
"next_cursor": "<string>"
},
"warnings": [
"<string>"
]
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"error": {
"code": "<string>",
"message": "<string>",
"details": {}
},
"meta": {
"request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}Authorizations
Authorization: Bearer <token> where <token> is either a neo_sk_<env>_<secret> API key (service account) or a Microsoft Entra ID access token (dashboard user).
Query Parameters
Case-insensitive substring over the tool input (ticket ids, user names, device names), the tool name and title, and the agent name. Max 200 characters.
Only calls of this tool (ToolType member, e.g. ADD_INTERNAL_TICKET_NOTE).
Only calls made by this agent.
Only calls whose result failed. Defaults to false.
ISO-8601 lower bound on the call time. A value older than 30 days reads as the window start. Narrow the window to keep a search fast.
ISO-8601 exclusive upper bound on the call time. Defaults to now.
Items per page (1-200, default 50).
Opaque pagination cursor from a previous response's meta.pagination.next_cursor.
