Enterprise & audit

API-first operations

Enterprise operations are API-first: they're built for scheduled pulls into compliance tooling and SIEMs rather than day-to-day terminal use. Reach them raw or through the SDK's GraphQL escape hatch.

These operations require the organization to be on the Enterprise plan — the same gate as the dashboard.

Read the audit log

The organization's append-only record of who did what — teammates, agents, and the platform itself.

query($input: AuditLogsInput!) {
  auditLogs(input: $input) {
    nodes { occurredAt action actorDisplay summary projectId }
  }
}

Export logs

One mutation exports the full audit trail, agent chats, or agent runs as CSV or JSON through a signed download link — with optional time bounds for scheduled pulls.

mutation {
  exportAccountLogs(input: {
    accountId: "acct_...",
    kind: AUDIT,            # or AGENT_CHATS, AGENT_RUNS
    format: JSON,           # or CSV
    occurredAfter: "2026-07-01T00:00:00Z",
    occurredBefore: "2026-08-01T00:00:00Z",
    idempotencyKey: "a-unique-string"
  }) { url rowCount }
}

Read SSO and governance state

The organization's SSO posture (domains, enforcement, provider) and governance policies (spend budgets, model allowlist) are readable for compliance dashboards; configuration flows live in the dashboard.

query {
  accountSsoStatus(input: { accountId: "acct_..." }) { enforced }
  accountGovernance(input: { accountId: "acct_..." }) { policies }
}