Audit logs

Conto records agent, payment, policy, freeze, and team changes in an append-only audit log. Each entry is linked to the previous one by a SHA-256 hash, so an edited or deleted entry fails verification.

Viewing logs

Dashboard

Go to Audit Logs in the sidebar. Search by user, agent, or resource, or filter by action, resource, actor type, agent, or date range.

Export

Owners and admins on Builder or Enterprise can export up to 100,000 entries as CSV from Audit Logs. Select Export. The export uses the filters currently applied.

SDK

The SDK route returns entries performed by or affecting the calling agent. It needs the audit:read scope, which only admin SDK keys have.

curl "https://conto.finance/api/sdk/audit-logs?resource=payment_request&limit=20" \
  -H "Authorization: Bearer $CONTO_API_KEY"

What gets logged

Payment decision receipts

Conto records a receipt for every PaymentRequest, Transaction, and ApprovalRequest lifecycle change, including successful payments and intermediate or terminal decisions such as approval required, approved, denied, executing, confirmed, failed, cancelled, and expired. Each receipt can correlate the payment request, transaction, and approval request, and records:

What was requested: amount, currency, recipient, purpose, category, agent, and wallet
The decision at that point: status, policy result, approval requirement, reasons, violations, and denial reason
The controls in force: assigned policy versions and rules, wallet limits, counterparty posture, and the approval workflow configuration
Who acted and when: user, agent, API credential, or Conto system attribution with timestamp
Execution evidence: transaction ID, chain transaction hash, block, confirmation, failure, and review status when available

Payment receipts capture lifecycle changes across supported payment flows, including retries. Updates that change nothing are not recorded.

Actions

Action	Description
`CREATE`	Resource created (agent, wallet, policy, etc.)
`UPDATE`	Resource modified
`DELETE`	Resource removed
`APPROVE` / `REJECT`	Approval decision made
`AGENT_FROZEN` / `AGENT_UNFROZEN`	Agent frozen or unfrozen
`FUND` / `WITHDRAW` / `TRANSFER`	Wallet balance changes
`PAYMENT_EXECUTED`	Payment submitted onchain
`PAYMENT_REQUEST`	Payment requested and controls snapshotted
`PAYMENT_APPROVED`	Payment approved
`PAYMENT_EXECUTING`	Payment execution started
`PAYMENT_CONFIRMED`	Payment confirmed onchain
`PAYMENT_DENIED`	Payment blocked by policy
`PAYMENT_FAILED`	Payment transaction failed
`PAYMENT_CANCELLED` / `PAYMENT_EXPIRED`	Payment closed without execution
`APPROVAL_REQUESTED`	Approval workflow receipt created
`APPROVAL_STATUS_CHANGED`	Approval decision or progress recorded
`EXTERNAL_PAYMENT_APPROVAL`	External wallet payment approved
`EXTERNAL_PAYMENT_CONFIRMED`	External wallet payment confirmed
`POLICY_VIOLATION`	Policy rule triggered
`ASSIGN_POLICY` / `REMOVE_POLICY`	Agent policy assignment changed
`LINK_WALLET` / `UNLINK_WALLET`	Agent wallet connection changed
`TRANSACTION_RETRY`	Payment retry requested
`TRUST_SCORE_UPDATE`	Counterparty trust assessment refreshed
`ALERT_CREATED` / `ALERT_RESOLVED`	Alert lifecycle
`SETTINGS_CHANGED`	Organization settings modified
`PERMISSION_GRANTED` / `PERMISSION_REVOKED`	Role or scope changes
`LOGIN` / `LOGOUT`	User session events
`INVITE_MEMBER` / `UPDATE_ROLE`	Team access changed
`PLAN_CHANGED` / `INVOICE_PAID`	Billing lifecycle
`AUDIT_LOG_EXPORTED`	Audit log data exported
`AUDIT_CHAIN_BASELINED`	Historical evidence baseline attested

Resources

Logs track actions on agents, wallets, transactions, policies, organization members, API and SDK keys, alerts, counterparties, approval workflows, payment and budget requests, billing, and supported x402 or MPP payment records.

Log entry fields

Audit responses and exports include these fields for reconciling an event:

Field	Description
`id`	Stable audit entry reference
`action`	Action name, for example `PAYMENT_APPROVED`
`resource`	Resource type, for example `agent`
`actorType`	Who performed it: USER, API, AGENT, or SYSTEM
`createdAt`	When the event occurred
`resourceReference`	Supported resource ID, dashboard label, and link
`changes`	Before and after values for supported fields
`transaction`	Related payment reference and status, when the event has one
`paymentEvidence`	Request, decision reasons, applied policies, and workflow

resourceReference.id is present when the affected record has a supported reference ID. Use it to match an audit entry to API records or a support request. Authentication sessions and generic settings records return a null reference ID.

{
  "id": "log_01JZ...",
  "action": "AGENT_FROZEN",
  "resource": "agent",
  "actorType": "USER",
  "createdAt": "2026-07-15T18:00:00.000Z",
  "resourceReference": {
    "id": "agent_123",
    "label": "Procurement Agent",
    "href": "/agents/agent_123"
  },
  "changes": [
    {
      "field": "status",
      "label": "Status",
      "before": "Active",
      "after": "Suspended"
    }
  ],
  "transaction": null
}

Change detection

When a resource is updated, changes includes only documented fields such as status, name, role, limits, and alert resolution. Arbitrary metadata, network request details, authentication data, and unsupported state fields are not returned in audit responses or exports.

Tamper-evident hash chain

Conto links each organization’s audit entries in a SHA-256 integrity chain covering actions, changes, actor identity, payment references, and timestamps. Modifying an earlier entry makes a later verification check fail. The chain is tamper-evident; external checkpoints provide a separate record for detecting changes to stored history. Owners, admins, managers, and viewers can verify chain integrity for a selected date range. Go to Audit Logs and select Verify. The response looks like this:

{
  "verified": true,
  "totalLogs": 1247,
  "verifiedLogs": 1247,
  "verifiedAt": "2026-08-12T08:14:22.000Z",
  "historicalCoverage": {
    "status": "complete"
  },
  "externalAnchor": {
    "configured": false,
    "status": "not_configured",
    "receipt": null
  }
}

If part of an organization’s history is missing from before the current chain began, historicalCoverage.status is attested_gap and the response lists the missing ranges.

Daily integrity check

Conto verifies every organization’s chain daily. If a check fails, Conto raises a critical Audit trail integrity check failed alert on Alerts & Approvals. The alert resolves after a later check passes.

External checkpoints

External checkpoints are not enabled by default. When they are off, externalAnchor.configured is false and Verify shows “External immutable storage is not configured.” The hash chain still detects edited and deleted entries. When external checkpoints are enabled, Conto saves a signed checkpoint in retention-protected storage and checks it against the audit chain to detect a rollback. externalAnchor.status is pending, verified, behind, or invalid. The receipt shows the latest checkpoint’s manifest hash, covered sequence, and retention deadline, without storage locations or credentials.

IP attribution

Audit entries record the client IP address when one is available.

Get started

Integrate

Payments

Agentic commerce

Spending controls

Operate

Conto Pay

Viewing logs

Dashboard

Export

SDK

What gets logged

Payment decision receipts

Actions

Resources

Log entry fields

Change detection

Tamper-evident hash chain

Daily integrity check

External checkpoints

IP attribution

​Viewing logs

​Dashboard

​Export

​SDK

​What gets logged

​Payment decision receipts

​Actions

​Resources

​Log entry fields

​Change detection

​Tamper-evident hash chain

​Daily integrity check

​External checkpoints

​IP attribution

Viewing logs

Dashboard

Export

SDK

What gets logged

Payment decision receipts

Actions

Resources

Log entry fields

Change detection

Tamper-evident hash chain

Daily integrity check

External checkpoints

IP attribution