Audit Trail Replay

Audit trails prove what happened. But when an incident occurs and you need to reconstruct exactly what an agent did over a session, scrolling through raw signature records is not practical. You need a timeline that is ordered, verified, and readable.

The Asqav SDK now includes audit trail replay. Feed it a session ID and it returns every action the agent took, in order, with hash chain verification and human-readable explanations for each step.

import asqav

asqav.init(api_key="sk_...")

timeline = asqav.replay("agt_abc123", "sess_xyz789")
print(timeline.summary())

The output shows each step with its action type, timestamp, chain status, and a plain-English description of what happened.

Audit Trail Replay
  Agent: agt_abc123
  Session: sess_xyz789
  Actions: 4
  Chain integrity: PASS

  Steps:
    [0] Called openai API (model: gpt-4)  (chain: ok)
    [1] Queried database customers       (chain: ok)
    [2] Used tool email-sender           (chain: ok)
    [3] Operated on file report.pdf      (chain: ok)

How it works

Replay fetches every signed action for a session from the Asqav API, sorts them by timestamp, and rebuilds the SHA-256 hash chain that links each action to the previous one. If any entry was modified, deleted, or reordered after signing, the chain breaks and the timeline flags it.

Each step gets a human-readable explanation generated from the action type and context. An action typed api:openai with {"model": "gpt-4"} in context becomes "Called openai API (model: gpt-4)". No guessing required.

Offline replay from compliance bundles

You do not always have API access when you need to investigate. Replay also works offline from compliance bundles, the self-contained export packages that include all signed receipts.

from asqav import replay_from_bundle, export_bundle

# Export a bundle (online)
bundle = asqav.export_bundle(signatures, "eu_ai_act")

# Later, replay offline
timeline = replay_from_bundle(bundle)
assert timeline.chain_integrity

This means auditors can verify the full action sequence without needing access to your Asqav account or API. Hand them the bundle, they replay it, chain integrity either passes or it does not.

Exporting timelines

Timelines serialize to JSON for archival, integration with SIEMs, or attaching to incident reports.

# Write to file
timeline.to_file("incident-2026-04-14.json")

# Or get the JSON string
data = timeline.to_json()

The JSON includes every step with its signature ID, verification URL, action type, context, timestamp, and chain validation result. Everything an investigator needs to reconstruct the sequence independently.

When to use it

Incident response is the obvious case. Something went wrong and you need to know exactly what the agent did. But replay is also useful for routine compliance reviews, onboarding auditors who want to see how your agents operate, and debugging agent behavior during development.

Install or upgrade:

pip install --upgrade asqav

Full docs at asqav.com/docs. Source on GitHub. If something doesn't work the way you expect, open an issue.