Audit & Monitoring

Every governed query is logged to an immutable audit trail. Monitor vendor activity, detect violations, and export data for compliance reporting.

Audit log

Query the audit log with cursor-based pagination:

bash

GET /api/mls/audit?limit=50

Response:

json

{
  "events": [
    {
      "id": "uuid",
      "mls_id": "uuid",
      "vendor_id": "uuid",
      "vendor_name": "AI Real Estate Co",
      "tool_name": "search_properties",
      "method": "tools/call",
      "response_status": 200,
      "latency_ms": 142,
      "fields_served": ["StreetAddress", "City", "ListPrice"],
      "fields_blocked": ["ListAgentEmail", "ListAgentDirectPhone"],
      "result_count": 25,
      "is_violation": false,
      "created_at": "2026-02-15T14:30:00Z"
    }
  ],
  "next_cursor": "2026-02-15T14:29:55Z",
  "next_cursor_id": "uuid",
  "total_count": 1234
}

Filters

Parameter	Type	Description
`vendor_id`	string	Filter by specific vendor
`violations_only`	boolean	Only show events flagged as violations
`tool_name`	string	Filter by MCP tool name
`date_from`	date	Start date (YYYY-MM-DD)
`date_to`	date	End date (YYYY-MM-DD)
`limit`	number	Results per page (1-200, default 50)
`cursor / cursor_id`	string	Pagination cursor from previous response

Cursor pagination

Use the next_cursor and next_cursor_id values to fetch the next page:

bash

GET /api/mls/audit?limit=50&cursor=2026-02-15T14:29:55Z&cursor_id=uuid

When next_cursor is null, you've reached the last page.

Audit event fields

Each audit event records:

-Vendor identity: vendor_id, resolved vendor_name

-Request details: JSON-RPC method, tool_name, response status

-Performance: latency_ms

-Field audit: fields_served (visible), fields_blocked (hidden/masked)

-Governance: result_count, is_violation, violation_type

-Revenue: mls_revenue_usd (per-query revenue credit)

Violation detection

The audit system flags events that indicate potential policy violations. Use the violations_only=true filter to review flagged events. Common violation types include excessive request patterns, unusual access patterns, and governance bypass attempts.

Next: Revenue & Payouts →

←Vendor Management Revenue & Payouts→