---
url: /relyagent-whmcs/features/audit-and-rate-limits.md
description: >-
  Relyagent records one audit row per tool call with a clear status, filters and
  CSV export, and protects your WHMCS with per-minute and per-day rate limits
  that return HTTP 429 when exceeded.
---

# Audit log & rate limits

Relyagent keeps a complete record of what your connected AI clients do, and caps how fast they
can do it. Together the **Audit Log** and **rate limits** give you accountability and protection
without any extra setup.

## The Audit Log

The **Audit Log** tab records **one row per tool call** — every time a connected AI client runs
a tool, whether it succeeded or not. Open it under **Addons → Relyagent → Audit Log**.

![Audit log with filters](/relyagent-whmcs/img/relyagent-audit-and-rate-limits-log.png)
*Addons → Relyagent → Audit Log*

### Statuses

Each row has a status that tells you exactly what happened:

* **Success** — the tool ran and returned normally.
* **Error** — the tool ran but hit a problem completing.
* **Sanitized** — the prompt-injection sanitiser altered the tool's output before returning it,
  removing content that tried to manipulate the AI client.
* **Forbidden** — the call was blocked by a gate: the connection lacked the tool's scope, the
  tool's group was turned off, or a dangerous tool was called with Dangerous Operations off.
* **Rate Limited** — the call was refused because it hit a rate cap (see below).

### Filters and export

You can narrow the log by **date range** (it defaults to the last 7 days), by **status**, by
**tool**, and with a free-text **search** box (for a client, token or IP). An **Export CSV**
button downloads the current view so you can archive it or analyse it elsewhere.

::: tip
A run of **Forbidden** rows usually means a connection is missing a tool, a group is off, or the
dangerous-operations gate is blocking a write. See
[MCP tools](/relyagent-whmcs/features/mcp-tools#dangerous-operations).
:::

## Rate limits

Rate limits protect your WHMCS from a runaway or misbehaving client. They are enforced **per
token** (that is, per connected client) and configured under **Settings → MCP Settings**:

* **Calls / minute** — default **60**, with a hard cap of **10,000**.
* **Calls / day** — default **5000**.

When a client exceeds a limit, the call is refused with **HTTP 429** and the attempt is recorded
in the Audit Log with a **Rate Limited** status. If legitimate usage is hitting the cap, raise
the per-minute or per-day limit in **Settings → MCP Settings**.

::: info Accurate client IPs behind a proxy
If your WHMCS sits behind a reverse proxy or CDN you control, enable
**Settings → General → Trust X-Forwarded-For Header** so audit rows capture the real client IP
instead of the proxy's. Leave it off otherwise.
:::