Relay: traces, audit log and export
What is recorded per request and per admin action, how long it is kept, and how it reaches your bucket, dataset or SIEM.
Traces
One row per relayed request:
| Field | Note |
|---|---|
request_id, ts |
also returned in X-Relay-Request-Id |
org, environment, key_prefix |
which key, never the key itself |
wire, model, channel |
wire format, requested model, channel actually used |
tokens_in, tokens_out, cache_read, cache_write |
from the provider's usage object |
cost_usd, usage_estimated |
at list price; see Budgets |
latency_ms, ttfb_ms, status |
end-to-end and time to first byte for streams |
guardrail_request, guardrail_response |
rule ids that fired |
tags |
from X-Relay-Tags |
body_ref |
present only when the environment stores bodies |
Prompt and completion text are not in the trace unless the environment's "store bodies" switch is on; then they are stored separately, encrypted, under the same retention.
Audit log
One row per administrative action: who (user or key), what (environment.update, key.revoke, budget.raise, provider.add, sso.configure, …), the target, and before/after values with secrets masked. Audit rows are retained for the plan's maximum regardless of trace retention and cannot be deleted from the console.
Retention
| Plan | Traces (max) | Audit log |
|---|---|---|
| Team | 30 days | 1 year |
| Business | 90 days | 1 year |
| Enterprise | 365 days | 3 years |
A nightly job deletes traces past the environment's setting. Deletion is logged.
Export
Business and Enterprise environments can export nightly (02:00 UTC) to a destination you own:
- Cloud Storage — newline-delimited JSON, one file per day per environment, written by a Relay service account you grant
Storage Object Creatoron the bucket. - BigQuery — appended to a table in your dataset (
relay_traces,relay_audit); grantBigQuery Data Editoron the dataset. Schema is published and versioned.
Exports contain everything in the tables above; bodies only if stored.
Webhooks (SIEM)
Near-real-time events — budget.warning, budget.exceeded, guardrail.blocked, provider.unhealthy, key.revoked, policy.changed — are POSTed to a URL you configure, signed with HMAC-SHA256 (X-Relay-Signature). Delivery is retried with back-off for 24 hours; failures are visible in the console.
Dashboards
Requests, cost, latency and guardrail hits by environment, model, channel, key and tag, per hour and per day; budget burn-down per environment; provider health over the last 24 hours. Every chart links to the underlying traces.