Audit

Audit events are the durable evidence trail for every governed action in a workspace. Each event records who acted, on what, under which scope, and with what result.

Refer to Audit events for how to query and export the trail. Refer to Audit events concept for how the trail is shaped.

Tool results render enum fields as short tokens (governing, denied, gateway_mcp), and filter arguments accept those same tokens. Refer to Enum rendering reference.

Events

dome_audit_query

Query audit events with optional filters. Returns events with type, agent, timestamp, and data.

{
  "name": "dome_audit_query",
  "arguments": {
    "type": "agent.register,agent.suspend",
    "limit": 10,
    "since": "2025-01-01T00:00:00Z"
  }
}

Returns events in reverse chronological order. Each event includes an ID, type, stage, result when the type has a verdict, shared denial detail on refusals, error detail when handling failed, timestamp, actor, and event-specific payload.

dome_audit_get_event

Get a single audit event by its ID.

{
  "name": "dome_audit_get_event",
  "arguments": {
    "event_id": "evt_01HQXYZ..."
  }
}

Returns the full event record including all metadata, the acting principal, and the complete event payload.

dome_audit_export

Export audit events in a SIEM-friendly format for external processing or archival. Supports the same filters as dome_audit_query, plus a format selector.

{
  "name": "dome_audit_export",
  "arguments": {
    "since": "2025-01-01T00:00:00Z",
    "until": "2025-02-01T00:00:00Z",
    "limit": 5000,
    "format": "ocsf"
  }
}

Usage

dome_usage

Show LLM token consumption and a per-class estimated cost for the active workspace over the last 24 hours. Use it when an assistant needs to summarize workspace spend, build a budget guardrail, or confirm token attribution.

This tool takes no parameters — it always reports the active workspace over the last 24 hours. For dimensional breakdowns (per-agent, per-API-key, per-identity, per-model), read the REST query surface directly.

{
  "name": "dome_usage",
  "arguments": {}
}

Returns the workspace token summary as JSON:

{
  "llm_input_tokens": 412000,
  "llm_cache_read_tokens": 1820000,
  "llm_cache_write_tokens": 88000,
  "llm_output_tokens": 64000,
  "llm_reasoning_tokens": 12000,
  "llm_total_tokens": 2396000,
  "estimated_cost_usd": 3.4521
}

Catalog

dome_audit_catalog_list

List every audit event type. Complete and unpaginated. Requires audit.view.

dome_audit_catalog_show

Show field detail for one event type.

SIEM

dome_audit_siem_list

List continuous SIEM stream destinations for the workspace. Requires audit.view. Only destinations enabled at least once appear.

dome_audit_siem_status

Read stream status for one destination. Requires audit.view. A never-enabled destination returns not found.

dome_audit_siem_enable

Create a forward-only SIEM stream from evidence accepted at enable time. Requires audit.export. If a stream already exists, use resume.

dome_audit_siem_disable

Stop delivery while retaining the cursor. Requires audit.export.

dome_audit_siem_resume

Resume delivery from the cursor, or skip backlog with skip_to_now. Requires audit.export.

Always interpret enabled and state together. A disabled stream retains its previous delivery health, so state=active with enabled absent or false means stopped, not delivering.

Next steps

Prefer the Operate how-tos for query patterns. This page is the tool surface:

• Audit events
• Stream Live Events
• Stream audit evidence to a SIEM
• Event catalog reference
• Event contracts reference