# Export the Guard record

> Check the Guard record's chain and export it, with the columns a CERT-In request asks for.

Canonical: https://porticol.app/docs/guides/guard-log-export

[View as Markdown](https://porticol.app/docs/guides/guard-log-export.md)

Every call Porticol decided is kept in a record that cannot change without breaking it. Each entry holds the hash of the entry before it, so a changed or removed row no longer matches.

## Check the record

```
porticol-cli guard log verify
```

It walks each workspace's chain on this computer and prints:

```
The record is intact: 128 entries.
```

When an entry does not match, it names the first one and exits 1. Add `--data-dir <path>` to check another workspace.

## Export it

```
porticol-cli guard log export --format csv
porticol-cli guard log export --format json --since 2026-11-01 --output guard.json
```

Entries are written oldest first, with no secret value: a query parameter that looks secret is `[redacted]`, and a body is its hash and a redacted preview.

The Free plan keeps 30 days on this computer; on the server, Team keeps 90 days and Business 180, with export. Export before the older entries are removed.

## The CSV columns

The first eight answer a CERT-In request: who made the call, which agent made it, what it was, what Porticol decided, the rule, who approved it, when they did, and when it happened.

| Column | What it holds |
| --- | --- |
| `who` | the account on this computer, when known |
| `agent` | the coding agent's name, such as `claude-code` |
| `call` | the method, host and path, such as `DELETE api.acme.com/v1/orders/42` |
| `decision` | `allow`, `deny`, `ask`, or a `shadow:` decision |
| `rule` | the policy rule that decided it |
| `approver` | who answered a held call |
| `approved at` | when they answered it |
| `time` | when the call happened |

The rest of the row: `workspace`, `entry`, `agent version`, `path` (how the call arrived: `mcp`, `proxy`, `hook` or `gateway`), `environment`, `method`, `host`, `url path`, `query`, `body sha256`, `body preview`, `secret references`, `mode`, `approval id`, `status`, `latency ms`, `response sha256`, `previous hash` and `entry hash`.

## Exit codes

| Code | Meaning |
| --- | --- |
| 0 | the record is intact, or the export was written |
| 1 | an entry does not match the one before it |
| 3 | the workspace, the arguments or the output file could not be read or written |

## See also

- [Guard](https://porticol.app/docs/cli/guard.html)
- [Agent activity](https://porticol.app/docs/ai-agents.html)