Agentic Data Plane

rpk ai auditlog list

Search the ADP audit log: who did what, to which resource, and which policy allowed or denied it. One row is one API call. A call that decided on several resources is one grouped row; RESOURCE_COUNT says how many.

--since defaults to 24h, or to no lower bound with --correlation-id. It takes an RFC 3339 timestamp, a duration ago (15m, 24h, 7d, 2w), or all for no lower bound, which scans the whole archive and can run into the server’s 30s query limit. --until must be after --since.

Filter flags (--actor, --resource-type, --policy, …​) each match one field:

  • values within one flag are ORed; different flags are ANDed

  • repeat a flag or separate values with commas; a literal comma is \,

  • a leading ! negates: --subsystem '!llm-proxy' (quote it, ! is history expansion in an interactive shell); a literal leading ! is \!

  • the resource, parent, --policy and --status flags match a call when any one of its resources matches, and return the whole call

--denied is shorthand for --outcome denied,partial: anything with a refusal in it. --outcome denied alone leaves out partly denied calls.

-o table shows a lean column set; -o wide, json, yaml and markdown add the decision and delegation fields. --fields picks the fields (and the table columns); --fields all returns every field, including the request and entity bodies, which is slower. '`rpk ai auditlog get` ID' reads one entry in full.

--limit caps the entries printed (default 50; 0 returns everything). When more remain, the exit code stays 0 and stderr gets the flags that continue the listing: --page-token, plus the resolved --since and --until when the window was relative (a duration or the default), so the next page covers the same window. Rerun with them and the same filters. When nothing matches, stderr names the filter that was sent.

Reading the audit log is itself audited; --operation '!ListAuditLogEntries' hides those reads.

Exit codes: 0 on success, including no matching entries; 1 on an error; 3 when not authenticated or missing the dataplane_adp_auditlog_list permission.

Usage

rpk ai auditlog list [flags]

Examples

This section provides examples of how to use rpk ai auditlog list.

Everything wholly or partly denied in the last hour

rpk ai auditlog list --since 1h --denied

One user’s calls outside the LLM proxy, as JSON

rpk ai auditlog list --actor alice@acme.com --subsystem '!llm-proxy' -o json

What one policy decided on the tools of one MCP server

rpk ai auditlog list --parent-type mcp-server --parent-id github --policy deny-writes

Why was an MCP tool call denied

rpk ai auditlog list --operation tools/call --denied --since 7d \
  --fields time,actor,resource_parent_id,resource_id,deciding_policy,response_error

One row per resource of a grouped call

rpk ai auditlog list --correlation-id 3f1c... -o wide

Config changes in the last week, with the before/after state

rpk ai auditlog list --since 7d --event-class entity-management \
  --fields time,actor,operation,resource_id,entity_before,entity_after -o yaml

Flags

Value Type Description

--activity

strings

activity: create, read, update, delete.

--actor

strings

effective user email (the human on a delegated call).

--actor-type

strings

actor kind: user, agent, service-account.

--agent

strings

agent name; a bare name also matches agents/<name>, a value with a '/' is sent verbatim.

--agent-uid

strings

agent uid; stays the same across renames.

--correlation-id

string

one call’s member events, one row per resource, denials first; any age unless --since is set.

--denied

bool

only calls with a refusal in them (outcome denied or partial).

--event-class

strings

event class: api-activity, entity-management (config changes).

--fields

strings

fields to return, also the table columns (comma-separated), or all.

--group

strings

group name of the effective user; at most 4 values per request (server limit).

--invoked-by

strings

authenticated caller on a delegated call, for example, a service-account email.

--limit

int

maximum entries to print; 0 returns everything. A cut-off is reported on stderr and the exit code stays 0.

--operation

strings

operation: CreateLLMProvider, tools/call, chat/completions, …​

--order-by

string

sort field with an optional " desc", for example, actor, outcome desc.

--outcome

strings

call verdict: allowed, denied, partial, masked (repeatable, comma-separated).

--page-token

string

resume a previous listing from the token it wrote to stderr.

--parent-id

strings

owner id of a child resource, for example, the MCP server name for a tool call.

--parent-type

strings

owner type of a child resource, for example, mcp-server for a tool call.

--policy

strings

any policy the decision was attributed to; a bare name also matches policies/<name> and guardrails/<name>, a value with a '/' is sent verbatim.

--query

string

case-insensitive substring of the entry message.

--resource-id

strings

resource id.

--resource-name

strings

resource display name.

--resource-type

strings

resource type as a CLI noun: mcp-server, llm-provider, agent, …​ (a value with a '.' is sent verbatim).

--service

strings

service: LLMProviderService, MCPGateway, LLMProxy, …​

--since

string

start of the window: RFC 3339, a duration ago (15m, 24h, 7d, 2w), or all; no lower bound with --correlation-id.

--source-ip

strings

caller IP.

--source-service

strings

emitting service: aigw, adp-api.

--status

strings

operation status: succeeded, failed (the verdict is --outcome).

--subsystem

strings

product surface: llm-proxy, mcp-gateway, a2a-proxy, agents, guardrails, …​

--until

string

end of the window, exclusive and after --since: RFC 3339 or a duration ago.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.