Skip to main content

​
What You’ll Learn

  • Creating a sandbox with AuditConfig combined with PII redaction and injection defense
  • What the audit log captures (requests, PII counts, block counts, transformations, timestamps)
  • The AuditEntry model and all its fields
  • Shorthand boolean syntax: audit=True for default settings

​
Prerequisites

  • Declaw instance running and DECLAW_API_KEY / DECLAW_DOMAIN set
pip install declaw python-dotenv

​
Code Walkthrough

This example is available in Python. TypeScript support coming soon.

​
1. Create a sandbox with audit logging

Audit logging works best alongside other security features so events are correlated. Here we combine it with PII redaction and injection defense: 
from declaw import (
    Sandbox,
    SecurityPolicy,
    PIIConfig,
    AuditConfig,
    AuditEntry,
)

sbx = Sandbox.create(
    template="base",
    timeout=300,
    security=SecurityPolicy(
        pii=PIIConfig(enabled=True, types=["email", "ssn"], action="redact"),
        injection_defense=True,
        audit=AuditConfig(
            enabled=True,
            log_request_body=True,
            log_response_body=False,
            retention_hours=48,
        ),
    ),
)
AuditConfig fieldDefaultDescription
enabledFalseToggle audit logging on or off.
log_request_bodyTrueInclude HTTP request bodies in audit entries.
log_response_bodyFalseInclude HTTP response bodies (can be large; off by default).
retention_hours24How long audit entries are retained before being purged.

​
2. What the audit log captures

Every HTTP request and response passing through the Declaw proxy produces an AuditEntry:
  • Every HTTP request/response passing through the Declaw proxy
  • PII redaction counts — how many PII instances were redacted per request
  • Injection block counts — how many injection attempts were blocked
  • Transformation application counts — how many rules fired
  • Timestamps for each event
  • Traffic direction (inbound vs outbound)
  • HTTP method, URL, and status code
  • Request body (when log_request_body=True)
  • Response body (when log_response_body=True)
Audit logs are retained for the configured retention period and can be queried for compliance reporting and incident investigation.

​
3. The AuditEntry model

import datetime
from declaw import AuditEntry

sample_entry = AuditEntry(
    timestamp=datetime.datetime.now(),
    method="POST",
    url="https://api.openai.com/v1/chat/completions",
    status_code=200,
    pii_redactions=3,
    injection_blocks=0,
    transformations_applied=1,
    direction="outbound",
)

print(sample_entry.to_dict())
Sample JSON output: 
{
  "timestamp": "2026-04-02T12:00:00.000000",
  "method": "POST",
  "url": "https://api.openai.com/v1/chat/completions",
  "status_code": 200,
  "pii_redactions": 3,
  "injection_blocks": 0,
  "transformations_applied": 1,
  "direction": "outbound"
}
FieldDescription
timestampISO-8601 timestamp of when the request was processed
methodHTTP method (GET, POST, PUT, DELETE, etc.)
urlThe target URL of the request
status_codeHTTP status code of the response (0 if not yet received)
pii_redactionsNumber of PII instances redacted in this request/response
injection_blocksNumber of injection attempts blocked (0 or 1 typically)
transformations_appliedNumber of transformation rules that fired
directionTraffic direction: outbound (to external) or inbound (from external)

​
4. Shorthand boolean syntax

For default settings — log_request_body=True, log_response_body=False, retention_hours=24 — pass True directly: 
sbx = Sandbox.create(
    template="base",
    security=SecurityPolicy(audit=True),
)

​
5. Cleanup

sbx.kill()

​
Expected Output

============================================================
Declaw Audit Logging Example
============================================================

--- Creating Sandbox with Audit Logging ---
Sandbox created: sbx_abc123

Security policy applied:
  pii.enabled:             True
  pii.types:               ['email', 'ssn']
  pii.action:              redact
  injection_defense.enabled:  True
  audit.enabled:           True
  audit.log_request_body:  True
  audit.log_response_body: False
  audit.retention_hours:   48

------------------------------------------------------------
What Audit Logging Captures
------------------------------------------------------------
  - Every HTTP request/response passing through the Declaw proxy
  - PII redaction counts
  - Injection block counts
  - Transformation application counts
  - Timestamps for each event
  - Traffic direction (inbound vs outbound)
  ...

------------------------------------------------------------
AuditEntry Structure
------------------------------------------------------------

Sample audit entry (as JSON):
{
  "timestamp": "2026-04-02T12:00:00.000000",
  "method": "POST",
  "url": "https://api.openai.com/v1/chat/completions",
  "status_code": 200,
  "pii_redactions": 3,
  "injection_blocks": 0,
  "transformations_applied": 1,
  "direction": "outbound"
}

--- Cleaning Up ---
Sandbox killed.

============================================================
Done!
============================================================