Download
View as Markdown

Export the Guard record

Every call Porticol decided is kept in a record that cannot change without breaking it. Each entry holds the hash of the entry before it, so a changed or removed row no longer matches.

Check the record

porticol-cli guard log verify

It walks each workspace's chain on this computer and prints:

The record is intact: 128 entries.

When an entry does not match, it names the first one and exits 1. Add --data-dir <path> to check another workspace.

Export it

porticol-cli guard log export --format csv
porticol-cli guard log export --format json --since 2026-11-01 --output guard.json

Entries are written oldest first, with no secret value: a query parameter that looks secret is [redacted], and a body is its hash and a redacted preview.

The Free plan keeps 30 days on this computer; on the server, Team keeps 90 days and Business 180, with export. Export before the older entries are removed.

The CSV columns

The first eight answer a CERT-In request: who made the call, which agent made it, what it was, what Porticol decided, the rule, who approved it, when they did, and when it happened.

Column What it holds
who the account on this computer, when known
agent the coding agent's name, such as claude-code
call the method, host and path, such as DELETE api.acme.com/v1/orders/42
decision allow, deny, ask, or a shadow: decision
rule the policy rule that decided it
approver who answered a held call
approved at when they answered it
time when the call happened

The rest of the row: workspace, entry, agent version, path (how the call arrived: mcp, proxy, hook or gateway), environment, method, host, url path, query, body sha256, body preview, secret references, mode, approval id, status, latency ms, response sha256, previous hash and entry hash.

Exit codes

Code Meaning
0 the record is intact, or the export was written
1 an entry does not match the one before it
3 the workspace, the arguments or the output file could not be read or written

See also