The log covers triggered agents, scheduled agents, and chat agents at once, and is scoped to your tenant. What you see follows your workflow access: an admin sees every agent, as does anyone given every agent and workflow, including what agents you have since deleted did; a user or viewer sees the agents they created or that were shared with them. It keeps 30 days of history.
What each row shows
For a sandbox script, the Result starts with the script’s exit code and, when Neo blocked any of its API calls, how many and why: for example
Exit code 0. Neo's proxy refused 77 API call(s): blocked_til_required x77. A non-zero exit is not always a problem: a search that finds nothing exits with code 1. In test mode Neo simulates each write a script makes that passes the proxy’s own checks, so a simulated write is not counted and does not make the row an Error. A write those checks refuse, for example for a missing permission or a required approval, is still counted.
When a write passed because you approved a request that listed that exact call (a plan of calls), the Result names that request: for example Allowed by approved plan: request 9001 (77 planned call(s)). A single request tool call shows the one it used. A sandbox script shows the listed calls it used when Neo could record them; if that record failed, the script’s row leaves the request out, although the calls went through. A listed call can be used again for the same call while the approval stands. Each request tool call that uses it has its own row; a sandbox script’s row lists the listed calls it used, however many times each ran.
Click a row to expand it. The expanded view shows the exact input the agent sent to the tool, a summary of what the tool returned (the first 400 characters), the tool’s internal name, and an Open run link to the full execution trace — every thought, tool call, message, and complete tool result of that run.
Finding an action
- Search matches the ticket number, user, device, or any other value in the tool’s input, as well as the tool and agent names. Type a ticket number to see everything any agent did on that ticket.
- All tools narrows the log to one tool, with the number of calls in the last 30 days next to each.
- All agents narrows it to one agent.
- Errors shows only calls that failed.
Ask Neo Support
The Neo Support Agent reads the same log. Ask it “did one of my agents touch ticket 48213?” or “who disabled this user last week?” and it searches the Audit Log for you, names the agent and the tool, and can open the run’s full trace. It answers under your own access: it shows the same agents you would see on the page, and a person with no dashboard account is told to ask an administrator for one.Read it through the API
The log is also available on the public API, for your own scripts or reporting:
The window is the last 30 days.
since and until narrow it to part of that time and never widen it; on a busy tenant, a search over the full 30 days can take more than a minute, so pass both when you know roughly when the change happened. An API key with no acting user reads every agent; a call made on behalf of a dashboard user follows that user’s workflow access, exactly as the page does. Full parameters and response schemas are under Endpoints in the API reference.
Tool inputs are shown as the agent sent them, with two exceptions applied when the step is recorded. Fields named
password or secure are masked whole. A password written inside a script is replaced by ***REDACTED-SECRET*** in the four places a PowerShell account-creation or password-reset step puts one: the literal given to ConvertTo-SecureString, the value of a -Password style parameter, a password assigned to a variable, and a quoted password written straight into an Active Directory SetPassword or ChangePassword call. The rest of the script stays readable, the script still runs, and technician approval still shows you the real one. A password written some other way into a script can still be stored. Everything else is stored as sent, so treat tool inputs as internal data. Loading a Neo skill shows as “Skill loaded” rather than the skill’s content, here and in the run trace. Loading a skill your team wrote shows its content, because that text is yours.