---
title: Read an Activity Feed | Keycard
description: Trace denials, credential issuance, and policy decisions for a Resource, Provider, Application, or User from that entity's Activity feed.
---

Every credential issued, policy decision, [Provider](/concepts/providers/index.md) check, and configuration change is recorded as an activity. The **Activity** feed on an entity’s page shows only the activities that touched that entity, in order; the same record is also visible Zone-wide in the [Audit Log](/admin/audit-log-and-sessions/index.md) and per agent run in [Sessions](/admin/audit-log-and-sessions/index.md). If an agent was denied a credential, the feed is the fastest place to see it, and the [troubleshooting tips](#troubleshooting) below cover when to switch to the other two views.

## Before you begin

- Sign in to the [Keycard Console](https://console.keycard.ai) with the **Viewer** [Role](/admin/roles-and-permissions/index.md) or higher.
- The entity the activity touched: **Activity** is a tab on the detail page for a Resource, Provider, Application, or [User](/concepts/users/index.md); **Policy Activity** has its own entry in the left nav and covers the whole Zone.

## Read an activity

Say an agent asked for a credential for a billing API Resource and a policy turned it down. To find out what happened:

1. **Open the entity’s Activity feed**

   Go to the Resource’s detail page and select the **Activity** tab. Each row is one activity. For policy activities, open **Policy Activity** from the left nav instead.

2. **Scan the row**

   - **Outcome** shows a red **denied** indicator. An issued credential would show green **allowed**, configuration and service activities get a neutral marker, and an inconclusive activity shows a warning.
   - **Action** names the activity, here *Credential issued*, with a status message explaining that the request was denied.
   - **Actor** is who performed it. Here it is the agent, but it can also be a [User](/concepts/users/index.md) or Keycard itself.

3. **Open the detail panel**

   Select the row and read the panel:

   - **Overview** carries the Event ID, the Request ID, when it occurred, and severity.
   - **Reason** says why the request was denied, in this case naming the deciding [policy](/admin/access-policies/index.md).
   - **Actor** and **Related entity** identify the agent behind the call and the billing API Resource it targeted.
   - The middle of the panel depends on the activity type. A successful credential issuance shows the grant and scopes, a Provider validation lists each configuration check, and a policy evaluation shows the decision breakdown.
   - **Raw OCSF** is the full machine-readable record, in the same [OCSF](/admin/audit-log-export/index.md) shape used for export.

4. **Narrow the feed**

   Two filters sit above the feed: **Outcome** (All, Success, or Failure) and **Time range** (last hour, 24 hours, 7 days, or 30 days). Filter to **Failure** to see every denial on this entity at once.

## Verify

Copy the **Request ID** from the panel’s **Overview** and search for it in the [Audit Log](/admin/audit-log-and-sessions/index.md). The activity appears there as an audit event, alongside any others from the same request, confirming you found the decision you were looking for.

## Troubleshooting

- An activity you expect isn’t in the feed: feeds only surface the actions in the [Activity Events registry](/reference/activity-events/index.md). Deletions, archivals, and lower-level operations land in the [Audit Log](/admin/audit-log-and-sessions/index.md) and in [Audit Log Export](/admin/audit-log-export/index.md).
- You need more than the entity’s slice: the feed’s filters stop at Outcome and Time range. Use the [Audit Log](/admin/audit-log-and-sessions/index.md) to filter by action type, request ID, session, or category across the Zone, or open [Sessions](/admin/audit-log-and-sessions/index.md) to follow one agent’s authenticated run in order.
- The same activity shows on two feeds: expected. An activity appears on the feed of each entity it touched, so `credentials:issue` shows on both the Resource and the Provider it involves.

## Related

- [Activity Events](/reference/activity-events/index.md): the registry of actions each feed surfaces
- [Audit Log & Sessions](/admin/audit-log-and-sessions/index.md)
- [Audit Log Export](/admin/audit-log-export/index.md)
- [Access Policies](/admin/access-policies/index.md)
- [Revoke a Grant](/admin/revoke-a-grant/index.md)