# Monitor tool calls through your apps

> Find the tool calls that agents make through your apps, read the SQL and the reason for each failure, and export the log. Query text stays 90 days.

Updated: 2026-10-14

Bonnard records each tool call that an agent makes through your apps. The **Observability** page in the console at
`app.bonnard.ai` shows the records, so you can find a failed call or count usage for each customer.

## Requirements

- Membership in your Bonnard workspace. Any role can open **Observability**.
- The Admin role, to change **Track call intent**.

## What Bonnard records

Each row on **Observability** is one record. Bonnard writes a record for:

- Each tool call, for example `sql_query` or `render_chart`.
- Each connection that an app refuses, for example from outside its [audience](https://bonnard.ai/docs/apps/audience.md). It has the action
  `connect`, the status `denied` and no tool.
- Each protocol request from the AI client, for example `tools/list`.
- Some actions outside AI clients, for example a console chart view. These have no app and no environment.

The status is `ok`, `denied` or `error`. `denied` means that Bonnard or the database refused the call, for example a
query on a table that the app hides.

## Read the overview

Select **Observability**. The **Overview** tab shows the last 7 days for all apps.

[Image: The Overview tab of Observability: the All servers, All environments and All tenants filters, the 24h, 7d and 30d range, the Calls, Error rate, Latency p50 / p95 and Rows returned cards, and the Calls over time chart in ok, denied and error]

The menus at the top filter each tab by app, environment and tenant (the value that marks a customer's data in your
database). The app menu is **All servers**. The range is **24h**, **7d** or **30d**, back from now.

**Error rate** counts `denied` and `error` records. **Top tools**, **Top tenants** and **Top client apps** show the 8
with the most records.

## Find a call

1. In the console, select **Observability**, then **Logs**.
2. Optional: select a tool, a status or an auth source. The tool filter offers `explore_schema`, `describe_table`
   and `sql_query`.
3. Select the row of the call.

[Image: The Logs tab of Observability: the All tools, All statuses and All auth filters, Export CSV, the Time, Tenant, Auth, Client, Tool, Status, Latency and Rows columns, and one sql_query call with the status ok]

**Logs** shows the newest records first, 100 at a time. To get older records, select **Load more**.

## Read a call

The panel heading shows the tool, the status, and the date and time. These fields follow.

Table: The fields of a call

| Field | Shows |
| --- | --- |
| **Action** | The kind of call, for example `query` for `sql_query` |
| **Tenant** | The tenant that the call ran as. `_single` on a database with No tenancy |
| **User** | The Bonnard ID of the caller |
| **Role** | The caller's role |
| **Client** | The AI client's OAuth client ID, or `apikey` |
| **Auth source** | How the caller signed in, for example **OAuth** or **API key** |
| **Environment** | `production` or `staging` |
| **Latency** | Milliseconds to answer |
| **Rows** | The number of rows that the call returned |
| **Request id** | The AI client's ID for the request |
| **SQL** | The query, if the call ran one |
| **Reason** | The cause of a `denied` or `error` status |

## Export the log

On **Logs**, select **Export CSV**. The file `audit-log.csv` holds up to `10,000` of the filtered records, newest
first. Its columns are the fields of the call, plus the time, app ID, tool and status.

## Read usage for each tenant

Select **Usage**. Each tenant gets a row with **Calls**, **Rows scanned**, **Active users** and **Errors**.

- **Calls** counts all records, for example protocol requests.
- **Rows scanned** is the same sum as **Rows returned** on **Overview**.
- **Usage** does not count records with no tenant, for example refused connections.
- **Usage** shows a maximum of 100 tenants, the most calls first.

Billing counts calls from the same records, and some records are free, for example `tools/list`. See
[Billing and usage](https://bonnard.ai/docs/operate/billing-and-usage.md).

## Call intent

On the app's **Settings** tab, the switch **Track call intent** is on by default. When the switch is on, each tool
asks the agent why it makes the call. Bonnard stores the answer with the call. The console and the CSV export do not
show it.

## How long Bonnard keeps records

Bonnard deletes the SQL and the reason of a record after 90 days, and the rest of the record after 13 months. The
console shows the last 30 days at most.

## Related

- [The basics](https://bonnard.ai/docs/get-started/the-basics.md): the console's pages.
- [Audience](https://bonnard.ai/docs/apps/audience.md): why a connection shows as denied.
- [Publish and staging](https://bonnard.ai/docs/apps/publish-and-staging.md): production and staging.