File shape
Exports are comma-separated values (CSV), UTF-8. A typical download name looks like audit-log-entries-YYYY-MM-DD.csv. The first row is the header. One data row is one audit entry on the trail.
Field text may contain commas or newlines; consumers should use a real CSV parser, not split-on-comma.
Marketing demos and fixtures use invented users and content. Customer exports follow that enterprise’s retention and redaction rules. This page documents columns, not a sample of real client work.
Columns (header order)
Headers appear in this order in the export:
- id: stable numeric entry id on the trail.
- response_id: UUID for this AI response / event.
- timestamp_utc: event time in UTC (ISO-8601, e.g. 2026-08-23T18:22:14.802063+00:00).
- source_type: connector / surface key (e.g. claude_code_cli, m365_copilot, browser shadow detectors).
- user_id: account or handle as observed in the environment.
- user_display_name: human-readable name when available.
- ai_system: product label (e.g. Claude Code (Anthropic), Microsoft 365 Copilot).
- model_version: model id or label when known; may be unknown.
- input_text: prompt or user input body.
- input_source: where input entered (e.g. terminal_cli, xero_web_app, browser_extension).
- policy_invoked: policy id applied, including shadow-AI policies when relevant.
- reasoning_summary: short operator-facing summary of what the system did.
- output_text: model or assistant output body.
- downstream_action: what happened after the model replied (session note, draft held, CRM field update, etc.).
- parent_response_id: UUID of a parent event when this row continues a thread; empty if none.
- prev_hash: hex hash of the previous entry on the trail (chain link).
- entry_hash: hex hash of this entry.
- cost_per_response: cost string when metered; may be empty.
Hash chain
entry_hash is this row’s hash. prev_hash points at the older entry’s entry_hash so a reviewer can walk the trail newest-first or oldest-first.
A broken link (prev_hash that does not match the prior row’s entry_hash) is a finding, not a UI glitch. Empty parent_response_id simply means no thread parent; it is not an integrity break.
Empty and unknown values
CSV cells may be empty when a field does not apply (no parent, no cost) or is not yet observed (model_version unknown). Do not invent values on import. Treat empty as null.
How to read an export
- Sort by timestamp_utc or follow prev_hash / entry_hash for chain order.
- Group by user_id or ai_system for toolbox coverage.
- Filter policy_invoked for shadow vs sanctioned use.
- Use response_id / parent_response_id to reconstruct threads.
- Hand the file to reviewers as the trail, not a screenshot of a vendor admin centre.
Related