Runtime timeline
Everything an agent does, in order: decisions, tool calls, API requests, workflow steps, policy results, and security events. Policy warnings and blocks are highlighted; trust score movement and signature badges appear inline on each event.
In the dashboard
Open Agents → your agent → Runtime timeline. Events with a workflowId carry a chip linking to the workflow's replay. The project-wide view (with search and filters over agent, category, and policy decision) lives at Audit trail.
Over the API
# One agent's timeline (newest first)
GET /api/agents/support-agent/events?limit=100
# Filter by workflow, category, or policy decision
GET /api/agents/support-agent/events?workflowId=wf_refund_8412
GET /api/events?eventCategory=security&policyDecision=block&q=refund
# Each event carries the full trust context:
# {
# "eventId": "evt_…", "seq": 12, "eventCategory": "tool_call",
# "action": "Tool call: refund_lookup",
# "policyDecision": "allow",
# "trustScoreBefore": 82, "trustScoreAfter": 83,
# "signatureValid": true,
# "hash": "8d8f…", "previousHash": "55d7…",
# "timestamp": "2026-07-02T18:00:00.000Z"
# }Grouping by workflow
Pass the same workflowId on every event in a logical unit of work (a ticket, a task, a run). The first event auto-creates the workflow; a status: "completed" or "failed" on logWorkflowStep closes it. A blocked action marks the workflow blocked.
GET /api/agents/support-agent/workflows
# [{ "id": "wf_refund_8412", "name": "Customer refund request",
# "status": "completed", "eventCount": 6, … }]