Audit logging

Instrumented Steward routes emit queryable and exportable audit events for signing, proxy, policy, credential, and approval activity. Coverage is route-specific. The tenant-scoped HMAC chain and Ed25519 checkpoints make exported evidence tamper-evident after the bundled public key is separately matched to a trusted signing key or fingerprint.

What’s Logged

Event Type	Description	Example
`wallet_sign`	Transaction signing request	Agent signed 0.05 ETH to 0xDEX
`wallet_sign_typed`	EIP-712 typed data signing	Agent signed permit for USDC
`wallet_sign_solana`	Solana transaction signing	Agent signed SOL transfer
`api_proxy`	API request through proxy	Agent called OpenAI completions
`policy_evaluate`	Policy evaluation result	Spending limit check passed
`secret_decrypt`	Credential decryption for injection	OpenAI key decrypted for proxy
`approval_required`	Transaction queued for approval	TX exceeds auto-approve threshold
`tx_approved`	Manual approval granted	Tenant admin approved TX
`tx_rejected`	Transaction rejected	Policy denied or admin rejected

Log Entry Structure

Every audit log entry includes:

{
  "id": 12345,
  "tenantId": "acme-cloud",
  "agentId": "agent-7a3f",
  "action": "wallet_sign",
  "resource": "vault/agent-7a3f/sign",
  "result": "allowed",
  "details": {
    "to": "0xDEX_ROUTER",
    "value": "50000000000000000",
    "chainId": 8453,
    "txHash": "0x8d7592b..."
  },
  "policyResults": [
    { "type": "spending-limit", "passed": true },
    { "type": "approved-addresses", "passed": true },
    { "type": "auto-approve-threshold", "passed": true }
  ],
  "costUsd": null,
  "latencyMs": 1240,
  "tokenJti": "jwt-unique-id",
  "createdAt": "2026-03-26T15:08:00Z"
}

Transaction History

Every agent has a complete transaction history:

const history = await steward.getHistory("agent-7a3f");
// Returns all signing requests: signed, rejected, and pending

Transaction records include:

Status — signed, pending, rejected
Policy results — full evaluation details
TX hash — for broadcast transactions
Timestamps — created, signed, resolved

Webhooks

Steward dispatches signed webhooks for key events. Create an endpoint through the webhook API and store the one-time secret returned in the response:

const response = await fetch("http://localhost:3200/webhooks", {
  method: "POST",
  headers: {
    "X-Steward-Key": "your-key",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    url: "https://your-server.com/steward-webhooks",
  }),
});
const { data } = await response.json();
// Persist data.secret in the receiver now; Steward returns it only once.

Webhook events:

approval_required

{
  "type": "approval_required",
  "tenantId": "your-tenant",
  "agentId": "agent-7a3f",
  "data": {
    "txId": "550e8400-...",
    "results": [
      { "type": "auto-approve-threshold", "passed": false, "reason": "..." }
    ]
  },
  "timestamp": "2026-03-26T15:08:00Z"
}

tx_signed

{
  "type": "tx_signed",
  "tenantId": "your-tenant",
  "agentId": "agent-7a3f",
  "data": {
    "txId": "550e8400-...",
    "txHash": "0x8d7592b..."
  },
  "timestamp": "2026-03-26T15:08:01Z"
}

tx_rejected

{
  "type": "tx_rejected",
  "tenantId": "your-tenant",
  "agentId": "agent-7a3f",
  "data": {
    "txId": "550e8400-...",
    "results": [
      { "type": "spending-limit", "passed": false, "reason": "Exceeds daily limit" }
    ]
  },
  "timestamp": "2026-03-26T15:08:00Z"
}

tx_failed

{
  "type": "tx_failed",
  "tenantId": "your-tenant",
  "agentId": "agent-7a3f",
  "data": {
    "error": "Insufficient funds for gas",
    "requestId": "req-123"
  },
  "timestamp": "2026-03-26T15:08:00Z"
}

Compliance

Steward’s audit log supports compliance requirements:

Tamper evidence: HMAC-linked events and Ed25519-signed checkpoints expose modification after the bundled public key is separately matched to a trusted signing key or fingerprint
Retention: configurable per tenant
Export: API endpoints for event export and signed evidence bundles
Trust limit: an operator controlling all relevant keys can fabricate a self-consistent history
Optional third-party time bound: RFC 3161 anchoring can prove a checkpoint existed no later than a trusted TSA time, narrowing but not eliminating the pre-anchor rewrite window

Architecture — How audit logging fits into the system
Tenants API — Configure webhook URLs
Vault API — Transaction history endpoints

Get Started

Authentication

Concepts

Guides

Audit Logging

Audit logging

What’s Logged

Log Entry Structure

Transaction History

Webhooks

Compliance

​Audit logging

​What’s Logged

​Log Entry Structure

​Transaction History

​Webhooks

​Compliance

​Related

Audit logging

What’s Logged

Log Entry Structure

Transaction History

Webhooks

Compliance

Related