Platform
Audit logs
What Sentinel records about API calls, MCP tool calls and connections, so a firm can answer "what was read, and on whose behalf?"
REST API
These events go to the firm's audit log, which admins see under Settings → Audit log. Each is stamped as an API-key call, with the key's ID.
| Event | Recorded when | Details |
|---|---|---|
api_v1_search |
A search runs | The matter, the mode, the query's length and the number of results. The query text itself isn't stored. |
api_v1_document_read |
A document is read with GET /documents/{id} |
The document, its matter, and whether the text was included |
MCP tool calls
Every MCP tool call writes one record, whether it succeeds or fails:
| Field | Description |
|---|---|
user_id |
The Sentinel user the call ran as |
api_key_id |
The connection or API key used |
tool_name |
For example, search_documents |
args |
The arguments the client sent, such as the matter, query and filters |
result_size_bytes |
Size of the result returned |
duration_ms |
How long the call took |
error |
The error message, if the call failed |
created_at |
When the call happened |
Note
The MCP tool-call log isn't shown in the app yet. Firm admins can ask SNT Labs support for an export for a user, matter or date range.
Connections and sign-ins
| Event | Recorded when |
|---|---|
oauth_authorized |
A user signs in and approves an app |
oauth_token_issued |
An app exchanges its code and a connection key is created |
oauth_authorize_failed |
A sign-in is denied, fails, or comes from an account that can't connect |
oauth_token_refused |
A token request is rejected |
api_key_rejected |
A request uses an invalid, revoked or expired key |
Failure events never store the submitted password or key. At most they keep the first 12 characters of a well-formed key (its display prefix, such as sk_live_8f14), so the firm can tell which key was used.