Monitoring & Audit
Every message relayed through Swarmd is automatically logged with full context — who sent it, which policies were evaluated, what action was taken, and how long it took. You can query these events, reconstruct full request traces, and monitor agent health.Querying Audit Events
- API
- UI
Available Filters
All filters are optional. Combine them to narrow your results.| Parameter | Type | Description |
|---|---|---|
startTime | ISO 8601 | Events after this time |
endTime | ISO 8601 | Events before this time |
auditType | Enum | Filter by event type (see table below) |
transport | Enum | REST, JSONRPC, or GRPC |
auditAction | Enum | LOG, MASK, BLOCK, WARN, HUMAN_REVIEW_REQUIRED, or ERROR |
correlationId | UUID | Events for a specific request |
sourceAgentId | UUID | Events from a specific source agent |
sourceUserId | UUID | Events from a specific user |
sinkAgentId | UUID | Events targeting a specific agent |
page | Integer | Page number (0-indexed) |
size | Integer | Page size |
Examples
Events for a specific agent in the last 24 hours:Audit Types
| Type | Description |
|---|---|
COMMUNICATION_AUDIT | Standard relay message log |
VALIDATION_RESULT | Request validation outcome |
REGEX_DETECTION | Regex policy match |
PRESIDIO_DETECTION | Presidio PII detection match |
COMPREHEND_DETECTION | AWS Comprehend detection match |
RATE_LIMIT | Rate limit policy evaluation |
SKILL_RESTRICTION | Skill restriction policy evaluation |
HITL | HITL policy triggered |
HITL_GUARD | Message held for human review |
HITL_RESOLUTION | HITL approval resolved |
POLICY_LIFECYCLE | Policy created, updated, or disabled |
X402_PAYMENT_REQUIRED | Payment required for request |
X402_PAYMENT_SUCCESS | Payment completed |
X402_PAYMENT_ATTEMPT | Payment attempted |
X402_PAYMENT_REJECTED | Payment rejected |
Tracing Requests
A trace groups all audit events for a single request using acorrelationId. This lets you see the full lifecycle: incoming request, policy evaluations, relay to agent, response, and any HITL holds.
List Traces
- API
- UI
correlationId):Get a Full Trace
- API
- UI
Agent Health Monitoring
When you register an agent with ahealthCheckUrl, Swarmd periodically checks it and tracks three health statuses:
| Status | Meaning |
|---|---|
HEALTHY | Agent responded with 200 |
DEGRADED | Agent responded but with errors or slow responses |
UNHEALTHY | Agent is not responding |
View Agent Health
- API
- UI
healthStatus field. You can also filter to see only unhealthy agents:What to Monitor
Here are common queries for operational monitoring:| Scenario | Query |
|---|---|
| Failed requests | auditAction=ERROR |
| Blocked by policy | auditAction=BLOCK |
| Pending human reviews | auditType=HITL_GUARD |
| HITL decisions | auditType=HITL_RESOLUTION |
| PII detections | auditType=PRESIDIO_DETECTION |
| Rate limit hits | auditType=RATE_LIMIT |
| Specific agent issues | sinkAgentId=AGENT_ID&auditAction=ERROR |
