Sessions, Logs & Usage

Sessions — who is live

A session is one live token, keyed by its jti. One is recorded every time a token is minted — for an external user via for_user, or for a console member signing in. It expires on its own when the token does, so the list is always "what could act right now", not history.

curl "https://dashboard.agenticfabriq.com/api/v1/sessions?population=external&limit=50" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organization-Id: $ORG_ID"copy

Each item carries:

Filters: population, app_id, auth_level, subject, include_broker, plus limit (up to 200) and offset. Requires sessions.view.

Revoking

curl -X DELETE https://dashboard.agenticfabriq.com/api/v1/sessions/$JTI \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organization-Id: $ORG_ID"

# or
afctl sessions list --population external
afctl sessions revoke <jti>copy

Revocation cuts the token off at its next call, without disabling the account behind it. The check is fail-closed: if the revocation store cannot be reached, the call is refused rather than allowed. Requires sessions.revoke. In the console this is the Sessions page, which shows subject, proof, agent, calls, last seen and expiry with a revoke button on each row.

Every governed call emits an audit event before the response returns. Events are queried through the audit API, which is what the console's Logs page reads.

curl "https://dashboard.agenticfabriq.com/api/v1/audit/events?event_type=TOOL_INVOCATION&page_size=50" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Organization-Id: $ORG_ID" \
  -H "X-Tenant-Id: $TENANT_ID"copy

An event carries:

{
  "event_id": "...",
  "timestamp": "2026-08-16T15:04:05Z",
  "event_type": "TOOL_INVOCATION",
  "action": "MCP_CALL",
  "status": "success",
  "service": "mcp",
  "user_id": "ext:sarah_42",
  "user_email": null,
  "tenant_id": "...",
  "resource_type": "tool",
  "resource_name": "google_gmail_list_messages",
  "http_method": "GET",
  "http_path": "/api/v1/tools/google/gmail/messages",
  "http_status_code": 200,
  "duration_ms": 412,
  "error_message": null,
  "app_id": "org-xxx_my-app",
  "external_user_id": "sarah_42",
  "is_external_user": true,
  "session_jti": "...",
  "metadata": { }
}copy

session_jti is the cross-link between this view and Sessions: given a suspicious call you can find the token that made it, and revoke it.

Useful event_type values: TOOL_INVOCATION, CONNECTION, AUTH, PERMISSION, APPLICATION. In the console, the Logs page splits these into a Tool calls tab and a System events tab over the same data.

Usage is counted per day, per organization, per provider, per user. It is what the console's Usage page draws, and what plan limits are enforced against.

These require the usage.view scope. Members who are not owners see only the users they manage.

The credits balance

GET /api/v1/organizations/{org_id}/credits returns the period's api_calls, credits_available, credits_remaining, base_limit, overage, percent_used, billing_cycle_start, active_users_count and addon_credit_limit. Plan limits are API calls per billing period, and calls are blocked once the limit is reached:

Add-on calls are sold in blocks of 10,000 on Launch and Growth, and land in addon_credit_limit on top of the plan allowance. The owner is warned at 85% of the total. Triggers require a paid plan — on Starter the Triggers surface is replaced by an upgrade prompt. See Pricing for the current figures.

Where each view lives in the console