The explorer derives each row from the platform’s authoritative trace, span, model-call ledger, cost, judge, tool-evidence, policy, evidence, online-evaluation, and adjudication records. Saved views, cohorts, tags, action receipts, and export audits store configuration or workflow state only; they do not duplicate semantic trace payloads.
Recommended investigation workflow
1
Start with a bounded failure query
Filter by status, environment, provider, model, tool error, deployment or prompt version, cost, latency, score, alert, review state, provenance, or tag. Use free text only after structured filters have narrowed the result set.
2
Group the result set
Group by status, environment, provider, model, failure category, alert state, review state, provenance, or tag. Compare count, known cost, average duration, p95 model latency, and average score without leaving the current query.
3
Inspect the trace
Open a row and move between Tree, Timeline, Thread, Input / Output, Tools, Scores, Cost, Evidence, and Review. Each section reads the underlying records on demand. When a collection has more than 100 records, use its Load more control until the continuation is complete.
4
Preserve the investigation
Save personal, project, or organization views when table layout matters. Save a cohort when another workflow needs to reuse the query as a named population.
5
Route evidence into action
Select traces and add them to Dataset Hub, open them in an evaluation Playground, create candidate cases or review tasks, tag or compare them, or create a draft online monitor from the current query. Simulate and explicitly activate that draft in Continuous Eval before it samples live traffic.
6
Export only when necessary
Export a bounded redacted CSV or JSONL file. Raw export is an explicit privileged operation and every export attempt is audited.
Query language
Queries are case-insensitive forAND and use one clause per field. Values containing whitespace or punctuation can be quoted. The service parses the query, validates the field/operator pairing and value type, and returns canonical query text. Use the returned text for bookmarks, saved views, pagination, monitor creation, and exports.
Fields
Operators
The query is limited to 2,000 characters, 20 structured filters, and 200 free-text characters. A page contains at most 100 traces. Invalid fields and operators return a specific
INVALID_FIELD or INVALID_OPERATOR response; excessive expressions return QUERY_TOO_COMPLEX instead of running an unbounded database query.
Stable pagination
The first sort defaults to newest creation time. Supported primary sorts are creation time, trace duration, known cost, score, and maximum model latency. The cursor binds the organization, canonical query hash, sort field, direction, value, creation time, and trace database identifier. Reusing it with a different organization, query, or sort returnsINVALID_CURSOR.
Results workspace
The table can show Created, Trace, Input, Output, Status, Environment, Duration, Cost, Model, Tools, Score, Failure, Alert, Review, and Provenance. Choose up to three pinned columns. The table renders only the visible row window plus a small overscan region, so loading thousands of results does not create thousands of DOM elements. Keyboard controls are available directly on the result list:- Up and Down move the active row;
- Space selects or clears the active row;
- Enter opens trace detail;
- Escape closes detail.
Aggregation
The same canonical query can be grouped by up to two fields. Available metrics are:
Aggregations execute over the complete authorized predicate and return
scannedRows, complete, and truncated with every result. The workspace labels a successful result as Exact across n traces; it never presents a safety-bound sample as a whole-population total. Aggregation database work has a 15-second execution budget. If that budget is exceeded, the request fails with QUERY_TOO_COMPLEX instead of returning a partial total.
Trace detail
Each detail mode uses the authoritative organization-scoped records associated with the trace:
Each related collection is limited to 100 records per request. When more records exist,
nextCursors contains a continuation cursor for that collection and truncated remains true. Request the same trace and section with both collection and cursor; append the returned records, then continue until that collection’s cursor is null. A cursor is bound to the authenticated organization, trace, section, collection, and typed last identifier. Reusing it across any of those boundaries returns INVALID_CURSOR.
Saved views and cohorts
A saved view keeps the canonical query, selected and pinned columns, grouping, sort, owner, scope, and default preference.- Personal views can be read and changed only by their owner.
- Project views are readable within the organization and manageable by their owner.
- Organization views are readable within the organization; only organization administrators and owners can create or manage them.
Bulk actions
Select up to 100 traces for a bulk workflow. Every mutating action requires an idempotency key scoped by organization and action type. Replaying the same key with the same request returns the stored result. Reusing it with different content returnsIDEMPOTENCY_CONFLICT.
Bulk responses contain one item per requested trace. A trace from another organization is reported as
not_found; its existence is not disclosed. Partial success remains visible beside the action and can be retried with a new key after the input is corrected.
Redaction, retention, and raw access
Normal query, detail, and export responses pass payload-bearing fields through the Logs Explorer redaction projection. It recursively masks common secrets and credentials and truncates oversized values. Raw content requires both an organization administrator or owner role and the explicitadmin:org scope.
Requests for raw content are explicit (raw: true). Share URLs and saved views do not persist raw mode. Query responses and exports use private, no-store caching semantics where payloads are returned.
Exports
Exports support CSV and JSONL, at most 5,000 rows and 5 MiB. Every attempt records organization, actor, canonical query hash, format, raw request state, redaction state, status, row count, byte count, and completion time. The response includes the audit identifier, row count, and truncation state in headers. Use the platform UI for interactive investigation. Use an export only when another authorized system needs a bounded snapshot.API reference
All routes derive the organization and actor from authenticated context. Supplying an organization identifier in a query string or request body never changes scope.Query request
filters and freeText instead of query: