> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manus.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Record format

> The OpenTelemetry schema of Manus audit records — fields, attribute keys, and payload structure

<sup>Questions or issues? Contact us at [api-support@manus.ai](mailto:api-support@manus.ai).</sup>

# Record format

Every audit event is one record with a single schema, delivered two ways:

* **Streamed (push):** an OpenTelemetry [LogRecord](https://opentelemetry.io/docs/specs/otel/logs/data-model/) sent over OTLP. Attribute keys follow the OpenTelemetry [GenAI semantic conventions](https://opentelemetry.io/docs/specs/semconv/gen-ai/), with a few Manus extensions.
* **Exported (API):** one JSON object per line (NDJSON) inside the export archive's `events.ndjson`.

The values are identical; only the field names differ.

## Export line (NDJSON)

Each line in `events.ndjson` is one event:

```json theme={null}
{
  "event_id": "01JABCDE…",
  "team_uid": "team_abc",
  "user_id": "114504",
  "session_uid": "5YX76pz7Dga3yztNVw97Dh",
  "event_name": "TOOL_CALL",
  "outcome": "SUCCESS",
  "occurred_at": "2026-06-09T12:00:00Z",
  "metadata": { "eventId": "01JABCDE…", "eventName": "EVENT_NAME_TOOL_CALL", "genAiToolName": "shell_exec" },
  "payload": { "gen_ai_tool_call_arguments_json": { "command": "ls" } }
}
```

* **Top-level fields** are convenience columns in `snake_case`.
* **`metadata`** is the full record (keys in `camelCase`; see [Metadata fields](#metadata-fields)). Present on every line.
* **`payload`** is present only when the export was created with `include_payload=true` (keys in `snake_case`; see [Payload](#payload-tier-2)).

## OTLP envelope (streamed records)

A streamed record is an OTel LogRecord with:

| Part                       | Value                                                                      |
| -------------------------- | -------------------------------------------------------------------------- |
| Resource `service.name`    | `manus-agent`                                                              |
| Resource `tenant.team_uid` | Team the event belongs to                                                  |
| Resource `tenant.region`   | Tenant data-residency region                                               |
| Scope                      | `manus.audit.tier1` (metadata) or `manus.audit.tier2` (metadata + payload) |
| Time                       | Event time (`occurred_at`)                                                 |
| Observed time              | Ingestion time (`ingested_at`)                                             |
| Severity                   | `INFO` (9), `WARN` (13), or `ERROR` (17)                                   |
| Body                       | Empty for Tier 1; the payload for Tier 2                                   |

## Metadata fields

These are the keys inside the export line's `metadata` object, and the matching attribute on a streamed OTLP record:

| Meaning            | OTLP attribute               | `metadata` key           |
| ------------------ | ---------------------------- | ------------------------ |
| Event ID (ULID)    | `event.id`                   | `eventId`                |
| Schema version     | `schema.version`             | `schemaVersion`          |
| Event type         | `event.name`                 | `eventName`              |
| Outcome            | `outcome`                    | `outcome`                |
| User ID            | `user.id`                    | `userId`                 |
| Session (task) UID | `session.id`                 | `sessionUid`             |
| Request / turn ID  | `request.id`                 | `requestId`              |
| Source channel     | `source_channel`             | `sourceChannel`          |
| Team UID           | *resource* `tenant.team_uid` | `teamUid`                |
| Tenant namespace   | —                            | `tenantNamespace`        |
| Tenant region      | *resource* `tenant.region`   | `tenantRegion`           |
| Event time         | *record time*                | `occurredAt`             |
| Ingestion time     | *observed time*              | `ingestedAt`             |
| Severity           | *severity number / text*     | `severity`               |
| Tool name          | `gen_ai.tool.name`           | `genAiToolName`          |
| Tool call ID       | `gen_ai.tool.call.id`        | `genAiToolCallId`        |
| Tool subtype       | `gen_ai.tool.subtype`        | `genAiToolSubtype`       |
| Connector name     | `gen_ai.tool.connector.name` | `genAiToolConnectorName` |
| Connector ID       | `gen_ai.tool.connector.id`   | `genAiToolConnectorId`   |
| Connector type     | `gen_ai.tool.connector.type` | `genAiToolConnectorType` |
| Agent reply kind   | `agent.reply.kind`           | `agentReplyKind`         |
| Client address     | `client.address`             | `clientAddress`          |
| User agent         | `user_agent.original`        | `userAgent`              |
| Geo country        | `geo.country_iso_code`       | `geoCountry`             |
| Input bytes        | `input.bytes`                | `inputBytes`             |
| Output bytes       | `output.bytes`               | `outputBytes`            |
| Message count      | `message.count`              | `messageCount`           |

Notes on specific fields:

* **`event.name` / `eventName`** — one of `USER_CHAT`, `AGENT_REPLY`, `TOOL_CALL`, `TOOL_RESULT`. Streamed records and the export's top-level `event_name` use the short form (`TOOL_CALL`); the `metadata` object uses the full proto enum (`EVENT_NAME_TOOL_CALL`). The same short-vs-full difference applies to `outcome` (`SUCCESS` vs `OUTCOME_SUCCESS`) and `agentReplyKind` (`notify` / `ask` vs `AGENT_REPLY_KIND_NOTIFY`).
* **`request.id`** — shared by every event in one agent turn; use it to group a user message with the replies and tool calls it triggered.
* **`source_channel`** — how the interaction reached Manus: `in_app` (the Manus web app) or `instant_messaging` (an IM integration such as Slack).
* **Tool attributes** — present on `TOOL_CALL` / `TOOL_RESULT`. `gen_ai.tool.name` is the high-level tool (e.g. `shell_exec`); `gen_ai.tool.subtype` is the model-facing name (e.g. `shell`). The `gen_ai.tool.connector.*` keys are Manus extensions, present only when the tool is a connector (e.g. Slack) — its name, UUID, and type (`mcp`, `native`, …).
* **`agent.reply.kind`** — on `AGENT_REPLY` only: `notify` (a notification) or `ask` (a question to the user).
* **Sizes** — `inputBytes` / `outputBytes` count the content bytes; `messageCount` is the number of messages. In `metadata`, 64-bit integers (`inputBytes`, `outputBytes`) are serialized as strings per protobuf JSON convention; `messageCount` is a number.
* **Reserved** — LLM request/response fields (`gen_ai.request.model`, `gen_ai.usage.*`, …) are reserved for a future version and are not emitted today.

## Payload (Tier 2)

The payload — the `payload` object in an export (when `include_payload=true`), or the body of a streamed Tier 2 record — is a JSON object whose fields depend on the event type. Keys are `snake_case`:

| Field                             | Event types                | Description                                                                    |
| --------------------------------- | -------------------------- | ------------------------------------------------------------------------------ |
| `chat_text`                       | `USER_CHAT`, `AGENT_REPLY` | Message content (plain text or a rich-content array, passed through unchanged) |
| `attachments`                     | `USER_CHAT`, `AGENT_REPLY` | Attached files, if any                                                         |
| `agent_reply_kind`                | `AGENT_REPLY`              | `notify` or `ask`                                                              |
| `gen_ai_tool_call_arguments_json` | `TOOL_CALL`                | The tool's input arguments                                                     |
| `gen_ai_tool_call_result_json`    | `TOOL_RESULT`              | The tool's output                                                              |
| `gen_ai_tool_call_status`         | `TOOL_RESULT`              | Execution status of the tool call                                              |

Only the fields relevant to an event's type are present.

<Warning>
  Inside tool arguments and results, values under secret-like keys (containing `token`, `password`, `secret`, `api_key`, `credential`, …) are replaced with `[REDACTED]` before the payload is stored, streamed, or exported.
</Warning>