---
url: /relyagent-whmcs/features/audit-and-rate-limits.md
description: >-
  Relyagent records one audit row per tool call with a clear status, filters and
  CSV export, and protects your WHMCS with per-minute and per-day rate limits
  that return HTTP 429 when exceeded.
---

# Audit log & rate limits

Relyagent records what your connected AI clients do and caps how fast they can do it — accountability and protection with no extra setup.

## The Audit Log

The **Audit Log** tab records **one row per tool call** — every time a connected AI client runs a tool, success or not. Open it under **Addons → Relyagent → Audit Log**.

![Audit log with filters](/relyagent-whmcs/img/relyagent-audit-and-rate-limits-log.png)
*Addons → Relyagent → Audit Log*

### Statuses

Each row has a status that tells you exactly what happened:

* **Success:** tool executed and returned data normally.
* **Error:** tool executed but encountered an unhandled runtime failure.
* **Sanitized:** prompt-injection filter modified tool output to strip manipulative content.
* **Forbidden:** blocked by a security gate (missing scope, disabled tool group, or inactive dangerous operations).
* **Rate Limited:** refused due to exceeded per-minute or per-day rate caps.

### Filters and export

Filter and export audit records directly from the interface:

* **Filters:** narrow by **date range** (defaults to 7 days), **status**, **tool**, or free-text **search** (client, token, or IP).
* **Export:** click **Export CSV** to download the active filtered dataset for external analysis.

::: tip
A run of **Forbidden** rows usually means a connection is missing a tool, a group is off, or the
dangerous-operations gate is blocking a write. See
[MCP tools](/relyagent-whmcs/features/mcp-tools#dangerous-operations).
:::

## Rate limits

Rate limits protect your WHMCS from a runaway or misbehaving client. They are enforced **per
token** (that is, per connected client) and configured under **Settings → MCP Settings**:

* **Calls / minute** — default **60**, with a hard cap of **10,000**.
* **Calls / day** — default **5000**.

Calls exceeding either threshold receive an **HTTP 429** response and are logged with a **Rate Limited** status. Adjust thresholds in **Settings → MCP Settings** if legitimate traffic reaches these limits.

::: info Accurate client IPs behind a proxy
If your WHMCS sits behind a reverse proxy or CDN you control, enable
**Settings → General → Trust X-Forwarded-For Header** so audit rows capture the real client IP
instead of the proxy's. Leave it off otherwise.
:::