Activity
Activity is the record of everything that passed through the gateway. If an agent touched one of your systems, a person changed how the workspace is set up, or a request was refused, it is here.
Go to Gateway → Activity. The page requires admin access.
What is recorded
Section titled “What is recorded”| Recorded | Not recorded |
|---|---|
| Every call to a connected tool, reads included, by anyone | Reading incidents, alerts and the catalog inside Firefight |
| Every change to workspace configuration | Declaring, updating and closing incidents |
| Every refused request, and every request waiting for approval |
Calls that leave Firefight are always recorded, even when they only read, because “what did the agent look at” is the question this page exists to answer. Reading Firefight’s own data is not, since it happens constantly and tells you nothing.
Incident participation by a person is recorded on the incident itself, on its timeline, where it belongs next to what happened. See Incident concepts.
Reading the log
Section titled “Reading the log”Each row is one request, newest first, showing the most recent 200.
| Column | What it tells you |
|---|---|
| When | When the request was made |
| Principal | Who made it, a person, an API key, or an agent |
| Source | Where it came from. Dashboard, Slack, API, or Agent |
| Action | What was asked for, as the capability’s name |
| Decision | allow, deny, or pending |
| Outcome | Whether an allowed action succeeded or failed, with the error when it failed |
| Duration | How long the action took to run |
Decision is the gateway’s answer. deny means the principal did not hold the permission and nothing ran. pending means the request is waiting for approval, and a second row appears when it is decided and runs. See Approvals.
Outcome is what happened after an allow. A row that was allowed but shows no outcome yet is still running.
Use the filter at the top right to show only one decision. Filtering to deny is the quickest way to see what an agent tried and could not do, and filtering to pending shows what is waiting.
What to do with it
Section titled “What to do with it”Look here when an agent did something unexpected, when you are checking what a new integration has been used for, or when someone asks who changed a routing rule. The principal and source columns answer who and how, and the action and outcome columns answer what.
An agent’s own calls appear here like everyone else’s, under the name of the key it connected with. The same log is available at /activity over the API and through the search_activity MCP tool, to an admin’s personal token. See Connect AI agents.