Read an Activity Feed

Every credential issued, policy decision, Provider check, and configuration change is recorded as an activity. The Activity feed on an entity’s page shows only the activities that touched that entity, in order; the same record is also visible Zone-wide in the Audit Log and per agent run in Sessions. If an agent was denied a credential, the feed is the fastest place to see it, and the troubleshooting tips below cover when to switch to the other two views.

• Sign in to the Keycard Console with the Viewer Role or higher.
• The entity the activity touched: Activity is a tab on the detail page for a Resource, Provider, Application, or User; Policy Activity has its own entry in the left nav and covers the whole Zone.

Say an agent asked for a credential for a billing API Resource and a policy turned it down. To find out what happened:

1. Open the entity’s Activity feed

   Go to the Resource’s detail page and select the Activity tab. Each row is one activity. For policy activities, open Policy Activity from the left nav instead.

2. Scan the row

   • Outcome shows a red denied indicator. An issued credential would show green allowed, configuration and service activities get a neutral marker, and an inconclusive activity shows a warning.
   • Action names the activity, here Credential issued, with a status message explaining that the request was denied.
   • Actor is who performed it. Here it is the agent, but it can also be a User or Keycard itself.

3. Open the detail panel

   Select the row and read the panel:

   • Overview carries the Event ID, the Request ID, when it occurred, and severity.
   • Reason says why the request was denied, in this case naming the deciding policy.
   • Actor and Related entity identify the agent behind the call and the billing API Resource it targeted.
   • The middle of the panel depends on the activity type. A successful credential issuance shows the grant and scopes, a Provider validation lists each configuration check, and a policy evaluation shows the decision breakdown.
   • Raw OCSF is the full machine-readable record, in the same OCSF shape used for export.

4. Narrow the feed

   Two filters sit above the feed: Outcome (All, Success, or Failure) and Time range (last hour, 24 hours, 7 days, or 30 days). Filter to Failure to see every denial on this entity at once.

Copy the Request ID from the panel’s Overview and search for it in the Audit Log. The activity appears there as an audit event, alongside any others from the same request, confirming you found the decision you were looking for.

• An activity you expect isn’t in the feed: feeds only surface the actions in the Activity Events registry. Deletions, archivals, and lower-level operations land in the Audit Log and in Audit Log Export.
• You need more than the entity’s slice: the feed’s filters stop at Outcome and Time range. Use the Audit Log to filter by action type, request ID, session, or category across the Zone, or open Sessions to follow one agent’s authenticated run in order.
• The same activity shows on two feeds: expected. An activity appears on the feed of each entity it touched, so credentials:issue shows on both the Resource and the Provider it involves.

• Activity Events: the registry of actions each feed surfaces
• Audit Log & Sessions
• Audit Log Export
• Access Policies
• Revoke a Grant