Guides
Export activity to your own collector
Point a workspace at an OpenTelemetry collector and every audited action arrives there as OTLP log records, for your SIEM, your alerting, your retention policy.
Everything notable that happens in a workspace, sign-ins, key creation, webhook changes, file shares, OAuth consents, API calls that mutate, is recorded in the workspace’s security audit log. Telemetry export streams those same records to an OTLP/HTTP collector you run: Splunk, Datadog, Honeycomb, Elastic, Loki, ClickHouse, or the OpenTelemetry Collector in front of any of them.
Set it up
Workspace admins with the security permission find it under Developer console → Monitor → Telemetry export.
- Endpoint: the collector’s logs URL, usually ending in
/v1/logs. It must be https;http://localhostworks for a collector on the same machine. - Headers: one per line as
Name: value, for exampleAuthorization: Bearer …orDD-API-KEY: …. They are stored sealed and never shown again; leave the box empty on later saves to keep them. - Switches: export on/off, and three opt-ins that are off by default: prompt text, tool arguments, file paths. Nothing sensitive leaves unless you turn it on.
- Send a test record to confirm the collector accepts the payload, then save.
What arrives
Standard OTLP resourceLogs JSON. Resource attributes: service.name = dhanu,
service.version, deployment.environment, dhanu.workspace.id. Each record’s
body is the event type (api_key.create, oauth_consent.grant, …) with the
structure in attributes:
| Attribute | Meaning |
|---|---|
dhanu.event.id | Stable id, dedupe on it |
dhanu.event.type | The event type, same as the body |
dhanu.request.id | The request that caused it, when there was one |
enduser.id, dhanu.actor.email | Who did it |
http.request.method, url.path, http.response.status_code, client.address | The request envelope |
dhanu.workspace.id, dhanu.task.id, dhanu.project.id, dhanu.target.id | What it touched |
dhanu.detail.* | Everything else the event recorded |
Severity is INFO, or ERROR for failed requests, so you can alert on severity
without knowing our event names.
Delivery guarantees
Records are sent in order, in batches, within about a minute of happening, and at least once: a collector that timed out may receive a batch again, which is why the id is stable. A failing collector is retried every minute; after twenty consecutive failures export switches itself off and the settings page says why, so a dead endpoint never becomes an unbounded queue. Save the page again to resume from where it stopped.