Data Streams to Your SIEM
Audit and request logs, delivered to your own endpoint
Security teams want admin activity in the SIEM they already watch, and data teams want request costs in the warehouse they already query. Data Streams deliver both as signed HTTPS requests to an endpoint you run. SIEM forwarding sends every Enterprise Audit Logs event; log export sends one metadata event per gateway request with model, provider, tokens, cost, latency, and finish reason. Events never include prompts, completions, or tool payloads, and there is no option to add them. Batches of up to 500 events arrive in order, usually within 30 seconds, each signed with HMAC-SHA256. A stream advances its cursor only when your endpoint accepts a batch, so delivery is at least once, and replay re-sends any window of up to 30 days without moving the live cursor.
Why teams turn it on
Two sources, one mechanism
SIEM forwarding for audit logs and log export for request metadata, each a stream with its own endpoint.
Metadata only, always
Events carry ids, timestamps, models, tokens, cost, and latency. Prompts, completions, and tool calls are never exported.
Signed and verifiable
Every batch carries an X-LLMGateway-Signature HMAC-SHA256 header, plus an optional bearer token for your endpoint.
At-least-once, with replay
Failed batches retry with backoff from 1 minute to 1 hour, and replay backfills up to 30 days. Deduplicate on the event id.
How it works
From decision to deployed in three short steps
- 01
Turn streams on
Data streams are enabled per organization on request. Request log export is a separate switch.
- 02
Add your endpoint
On the Data Streams page, click New stream and enter your HTTPS endpoint and a signing secret, then send a test event to check the response.
- 03
Accept batches
Respond with any 2xx to accept a batch. If your endpoint keeps failing, the stream pauses, owners and admins are notified, and it resumes from where it stopped.
Real-world use cases
Why customers actually adopt this
SIEM correlation
Line up key rotations, permission changes, and policy edits with the rest of your security telemetry.
Chargeback and FinOps
Land per-request cost and token data in your warehouse and bill usage back to teams.
Incident forensics
Replay a 30-day window into a fresh endpoint when an investigation needs the full trail.
Frequently asked
- Do streams ever include prompts or completions?
- No. Events only carry metadata, and there is no option to include payloads.
- What happens when my endpoint is down?
- Deliveries retry with backoff from 1 minute up to 1 hour. A stream pauses after 20 failed deliveries in a row, or after 3 deliveries rejected with a 4xx since the last accepted one. Resume it once the endpoint is fixed and delivery continues from where it stopped.
- Are changes to streams audited?
- Yes. Every stream change is recorded in Enterprise Audit Logs as a data_stream.* action.
More enterprise capabilities
The rest of the enterprise stack
Organization-Wide Analytics
Cost, requests, and tokens totaled across every project, with breakdowns by model, project, API key, and member. Built on pre-aggregated rollups, so any date range stays fast.
Per-Member Budgets & Developer Role
Per-member spend caps enforced at request time, org-wide default developer limits, and a project-scoped Developer role. An over-budget request is rejected before it ever reaches a provider.
Teams & Directory Sync
Group developers under a shared project ceiling, per-developer budgets, and IAM rules. Microsoft Entra groups map onto teams over SCIM.
Enterprise Audit Logs
Tamper-evident audit trails for SOC 2, HIPAA, ISO 27001, and internal investigations. Every config change, key rotation, and admin action — captured, attributed, exportable.
Per-Project Routing Overrides
Override global routing rules at the project level — region, provider order, fallback chain, and cost ceilings. Production stays pinned; experimental teams stay flexible.
Dynamic Routes
Named, versioned routing flows with conditions, classifier branches, A/B splits, and model targets. Call one with dynamic/<name> and roll back instantly.
Enterprise Guardrails
Server-side detection for prompt injection, PII, secrets, and policy violations. Configured centrally, enforced at the gateway, auditable per-request.
Provider Compliance Policies
Require SOC 2, ISO 27001, GDPR, zero data retention, no prompt training, or approved headquarters countries, and the gateway refuses every provider that falls short.
Zero Data Retention
Enforce zero data retention across provider routing, gateway storage, response caches, and the Responses API, for the whole organization or a single API key.
Discord & Slack Alerts
Native webhook integrations for Discord and Slack. Get the enterprise contact-sales form, billing events, guardrail trips, and SLA breaches in the channels your team already monitors.
Single Sign-On (SAML / OIDC)
SAML 2.0 and OIDC SSO with SCIM provisioning, group-based role mapping, and enforced-only access. No local credentials, no shared passkeys, no off-boarding gaps.
Master Keys & Provisioning API
Org-scoped bearer tokens that create projects, gateway API keys, IAM rules, and custom providers from your backend, and report cost per member and model.
Organization Skills
Publish shared agent skills once and let developers install them into Claude Code, Codex, Cursor, OpenCode, and other agents with one CLI command.
White-Label Chat & Playground
Embed or stand up a fully white-labeled chat app and playground under your own domain. Customize branding, default models, system prompts, and feature toggles.
See data streams to your siem on your real workloads
Bring a sample workload to a 30-minute call. We'll wire it up live and show you the actual experience your team will get.