AI Assistant Audit Console

Overview

The Audit Console gives administrators complete visibility into all AI Assistant interactions within F5 Insight. The system records every user message, assistant response, tool call, tool result, PDF export, and error event in ClickHouse along with user identity, timestamps, provider and model metadata, IP address, and user-agent details.

PII is masked by default, allowing the Audit Console to support compliance, security review, and operational troubleshooting without exposing sensitive data.

What is recorded

Event type Description
user_message When a user sends a message to the AI Assistant
assistant_response When the AI Assistant completes a response
tool_call Each time the assistant calls a backend tool (for example, list_virtual_servers)
tool_result The result returned to the assistant from each tool call
error When a request fails at any stage
data_access When the assistant accesses sensitive data
pdf_export When a user exports a conversation as PDF

Role-based access

Audit Console endpoints require the auditConsole permission group.

Role Read Export
Viewer No No
Operator No No
Admin Yes Yes

PII masking

F5 Insight permanently strips credentials (API tokens, passwords) at write time and never stores them. PII masking is applied at read time.

By default, the following fields are masked in all API responses:

  • message: AI message content
  • tool_arguments: arguments passed to tool calls (listing only)
  • tool_result: data returned by tool calls (listing only)
  • ip_address
  • user_agent

Pass ?view_sensitive=true to any listing or export request to retrieve unmasked data. This parameter is available to any admin who has access to the endpoint. You don’t need any additional permission beyond the auditConsole permission group.

Use the web console

Navigate to System Management ‣ AI Audit Console in the left sidebar to open the log viewer.

Available filters

The following filters are available in the UI:

  • Username: partial match
  • Event type: dropdown selection
  • Tool name: partial match
  • Keyword search: matches message content and tool name
  • Thread ID: exact match
  • Session ID: exact match
  • Date range: from / to date selection
  • View sensitive data toggle: reveals unmasked PII

Export events

Select the Export CSV (download) icon to download events. Exports exceeding 10,000 matching rows require narrowing the filter.

Use the REST API

All audit tasks available in the web console are also available through the F5 Insight REST API, enabling automation and integration with existing tooling.

Authentication

All audit endpoints require a valid JWT access token and the Admin role.

Authorization: Bearer <access_token>

List events

GET /api/audit/events

Query parameters

Parameter Type Description
username string Filter by username (partial match, case-insensitive)
event_type string One of: user_message, assistant_response, tool_call, tool_result, error, data_access, pdf_export
tool string Filter by tool name (partial match, case-insensitive)
thread_id string Exact match on conversation ID
interaction_id string Exact match on interaction ID
session_id string Exact match on session ID
keyword string Case-insensitive search across message content and tool name
date_from ISO 8601 Events on or after this timestamp
date_to ISO 8601 Events on or before this timestamp
page integer Page number, 1-based (default: 1)
size integer Items per page (default: 20, max: 100)
view_sensitive boolean Return unmasked PII fields (Admin only, default: false)

Example request

GET /api/audit/events?event_type=tool_call&date_from=2026-07-01T00:00:00Z&size=50

Response (200 OK)

{
  "events": [
    {
      "event_id": "550e8400-e29b-41d4-a716-446655440000",
      "session_id": "...",
      "thread_id": "...",
      "interaction_id": "...",
      "user_id": "...",
      "username": "user-a",
      "event_type": "tool_call",
      "message": "[MASKED]",
      "tool_name": "list_virtual_servers",
      "tool_arguments": "[MASKED]",
      "tool_result": "[MASKED]",
      "error_message": "",
      "provider": "openai",
      "model": "gpt-5",
      "ip_address": "[MASKED]",
      "user_agent": "[MASKED]",
      "timestamp": "2026-07-01T10:15:30Z",
      "duration_ms": 342,
      "outcome": "success",
      "extra": ""
    }
  ],
  "pagination": {
    "page": 1,
    "pageSize": 20,
    "totalEvents": 1842,
    "totalPages": 93
  }
}

Export events as CSV

Filters are passed as query parameters (same parameter names as GET /api/audit/events).

POST /api/audit/export?username=user-a&event_type=tool_call&date_from=2026-07-01T00:00:00Z

Successful response (10,000 rows or fewer) - 200 OK

{
  "export_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "download_url": "/api/audit/export/3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "sha256": "e3b0c44...",
  "row_count": 342
}

The CSV columns are: event_id, session_id, thread_id, interaction_id, user_id, username, event_type, tool_name, message, provider, model, outcome, ip_address, user_agent, timestamp, duration_ms.

Response when filter matches more than 10,000 rows (413)

{
  "error": "export exceeds row limit",
  "detail": "query matches 25000 rows; synchronous export is limited to 10000 rows.",
  "row_count": 25000,
  "row_limit": 10000
}

Export limits

Limit Value
Per-user concurrent exports 5 exports
Export retention 15 minutes (download before this window expires)

Download a CSV export

GET /api/audit/export/{id}

Returns the CSV as an application/octet-stream download with filename audit-export-{id}.csv. The X-Content-SHA256 response header carries the SHA-256 digest for integrity verification.

Important

The server deletes the file immediately after you download it. Make sure to save the file locally before closing the download.

Response codes

Code Description
200 File downloaded successfully
404 Export ID not found (never existed or already downloaded)
410 Export has expired (15-minute TTL exceeded)

Troubleshooting

No events appear for a known interaction

Check the audit_dead_letter table. If rows are present and resolved = FALSE, ClickHouse might be down or out of disk space. Check ClickHouse container health on the deployment VM.

Export fails with 429 (too many exports)

You already have 5 pending exports. Wait for existing exports to expire (15 minutes) or download them first.

Export fails with 413 (too many rows)

The current filter matches more than 10,000 rows. Add a narrower date range, filter by a specific username, or filter by event type.

PII still masked with view_sensitive=true

Confirm you have the Admin role and that the token is not expired. Operator and Viewer roles can’t access audit data.

Export CSV downloaded but appears empty or header-only

The filter matched 0 rows. Verify the filter parameters are correct and that there are events in the selected date range.