> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # List agent tool calls (Audit Log) > Every tool call the tenant's agents made in the last 30 days, one row per call, newest first — the API behind the dashboard's Reporting -> Audit Log page. Answers "did one of my agents do this?": search a ticket number, a user or a device name and the rows show which agent acted, when, with what input, and how it went. Triggered, scheduled and chat agents are all included. The window is always the last 30 days and cannot be widened. Rows follow the acting user's workflow access: an owner or admin sees every agent, a user or viewer only the agents they created or were shared; a person with no dashboard account gets 403. Cursor-paginated on `(created_at, step id)`. `execution_id` opens the run's full trace at `GET /executions/{execution_id}/steps`. ## OpenAPI ````yaml https://api.neoagent.io/public-api/openapi.json get /public-api/audit-log/tool-calls openapi: 3.1.0 info: description: >- Neo's public contract for the dashboard ChatAgent, partner integrations, and MSP automation. Every response is wrapped in a `{data, meta}` envelope; errors use `{error: {code, message, details?}, meta: {request_id}}`. Authenticate with a `Bearer neo_sk__` API key (service account) or a Microsoft Entra ID JWT (dashboard user). Signed-URL endpoints (end-user feedback links) take a `signature` query parameter instead. title: Neo Public API version: 1.0.0 servers: - url: https://api.neoagent.io security: [] tags: - description: Service metadata — health, OpenAPI. name: Meta - description: Agents and workflows — read, version history, delete, stats. name: Agents - description: Agent/workflow execution history, sub-resources, retry/cancel. name: Executions - description: >- Every tool call the tenant's agents made in the last 30 days, within the caller's workflow access. name: Audit Log - description: PSA webhook events and their workflow-match results. name: Callbacks - description: Technician-in-the-loop approval requests. name: TIL requests - description: RMM script executions triggered by agents. name: RMM scripts - description: Dispatch-agent field-update decisions. name: Dispatch - description: The authenticated tenant. name: Tenant - description: Agent-builder schema catalogs (raw JSON payloads). name: Schemas - description: Escalate to the Neo team (HubSpot ticket). name: Escalation - description: Tenant settings. name: Settings - description: Tenant API-key management (dashboard JWT only). name: API keys - description: End-user feedback links (signed-URL auth). name: Feedback - description: End-client companies (CRUD + bulk-update). name: End companies - description: Channels — bind a CONVERSATIONAL agent to a transport (Teams). name: Channels - description: PSA/RMM/M365 integration status and connection management. name: Integrations - description: Technician roster (controls TIL routing and paging). name: Technicians - description: Future runs queued for TRIGGERED agents. name: Scheduled work - description: Subscription state and customer-facing credit usage (no provider $). name: Billing - description: Inbox messages and announcements. name: Inbox & Comms - description: Tenant-authored agent skills (CRUD) and the built-in skill catalog. name: Skills paths: /public-api/audit-log/tool-calls: get: tags: - Audit Log summary: List agent tool calls (Audit Log) description: >- Every tool call the tenant's agents made in the last 30 days, one row per call, newest first — the API behind the dashboard's Reporting -> Audit Log page. Answers "did one of my agents do this?": search a ticket number, a user or a device name and the rows show which agent acted, when, with what input, and how it went. Triggered, scheduled and chat agents are all included. The window is always the last 30 days and cannot be widened. Rows follow the acting user's workflow access: an owner or admin sees every agent, a user or viewer only the agents they created or were shared; a person with no dashboard account gets 403. Cursor-paginated on `(created_at, step id)`. `execution_id` opens the run's full trace at `GET /executions/{execution_id}/steps`. operationId: public_api.audit_log_tool_calls_get parameters: - description: >- Case-insensitive substring over the tool input (ticket ids, user names, device names), the tool name and title, and the agent name. Max 200 characters. in: query name: search required: false schema: type: string - description: >- Only calls of this tool (`ToolType` member, e.g. `ADD_INTERNAL_TICKET_NOTE`). in: query name: tool_type_name required: false schema: type: string - description: Only calls made by this agent. in: query name: agent_id required: false schema: type: integer - description: Only calls whose result failed. Defaults to false. in: query name: errors_only required: false schema: type: boolean - description: Items per page (1-200, default 50). in: query name: page_size required: false schema: type: integer - description: >- Opaque pagination cursor from a previous response's `meta.pagination.next_cursor`. in: query name: cursor required: false schema: type: string responses: '200': content: application/json: schema: properties: data: items: $ref: '#/components/schemas/AuditLogToolCall' type: array meta: $ref: '#/components/schemas/SuccessMeta' required: - data - meta type: object description: Success. '400': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Bad request — malformed input. '401': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Unauthenticated — missing or invalid credentials. '403': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Forbidden — authenticated but not allowed. '404': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Not found. '409': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Conflict — the resource is in a state that blocks this operation. '422': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Request validation failed. '429': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Rate limited — see Retry-After. '500': content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' description: Internal server error. security: - bearerAuth: [] components: schemas: AuditLogToolCall: description: >- One agent tool call — an action an agent took — with the outcome of its result. properties: agent_id: anyOf: - type: integer - type: 'null' title: Agent Id agent_name: anyOf: - type: string - type: 'null' title: Agent Name autonomy_type: anyOf: - $ref: '#/components/schemas/AutonomyType' - type: 'null' created_at: format: date-time title: Created At type: string execution_id: title: Execution Id type: string outcome: $ref: '#/components/schemas/AuditLogOutcome' result_summary: anyOf: - type: string - type: 'null' title: Result Summary step_id: title: Step Id type: string tool_input: anyOf: - additionalProperties: true type: object - items: additionalProperties: true type: object type: array - type: 'null' title: Tool Input tool_title: title: Tool Title type: string tool_type_name: title: Tool Type Name type: string required: - step_id - created_at - tool_type_name - tool_title - tool_input - execution_id - agent_id - agent_name - autonomy_type - outcome - result_summary title: AuditLogToolCall type: object SuccessMeta: properties: pagination: $ref: '#/components/schemas/Pagination' request_id: format: uuid type: string timings_ms: additionalProperties: type: number type: object warnings: description: >- Non-fatal warnings about the created/updated resource (e.g. an unhealthy PSA callback). items: type: string type: array required: - request_id - timings_ms type: object ErrorEnvelope: properties: error: properties: code: description: Stable machine-readable error code. type: string details: additionalProperties: true type: object message: type: string required: - code - message type: object meta: properties: request_id: format: uuid type: - string - 'null' type: object required: - error - meta type: object AutonomyType: enum: - CHAINED_ACTIONS - AGENTIC - CONVERSATIONAL title: AutonomyType type: string AuditLogOutcome: enum: - SUCCESS - ERROR - PENDING title: AuditLogOutcome type: string Pagination: properties: has_more: type: boolean next_cursor: type: - string - 'null' required: - next_cursor - has_more type: object securitySchemes: bearerAuth: description: >- `Authorization: Bearer ` where `` is either a `neo_sk__` API key (service account) or a Microsoft Entra ID access token (dashboard user). scheme: bearer type: http ````