# Log Registry API calls with AWS CloudTrail
Log Registry API calls with AWS CloudTrail

 AWS Agent Registry control plane API calls are logged in AWS CloudTrail, providing a complete audit trail of who did what and when. Control plane operations are logged as management events by default.

**Topics**
+ [

# AWS CloudTrail integration
](registry-cloudtrail-integration.md)

# AWS CloudTrail integration
AWS CloudTrail integration

## Event types


 **Management events (logged by default):** CreateRegistry, GetRegistry, UpdateRegistry, DeleteRegistry, ListRegistries, CreateRegistryRecord, GetRegistryRecord, UpdateRegistryRecord, DeleteRegistryRecord, ListRegistryRecords, SubmitRegistryRecordForApproval, UpdateRegistryRecordStatus

## Sample CloudTrail log for CreateRegistryRecord API


```
{
    "eventVersion": "1.09",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "<REDACTED>",
        "arn": "arn:aws:sts::<REDACTED>",
        "accountId": "<REDACTED>",
        "accessKeyId": "<REDACTED>",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "<REDACTED>",
                "arn": "<REDACTED>",
                "accountId": "<REDACTED>",
                "userName": "Admin"
            },
            "attributes": {
                "creationDate": "2026-04-08T00:59:33Z",
                "mfaAuthenticated": "false"
            }
        }
    },
    "eventTime": "2026-04-08T01:33:24Z",
    "eventSource": "bedrock-agentcore.amazonaws.com",
    "eventName": "CreateRegistryRecord",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "<REDACTED>",
    "userAgent": "<REDACTED>",
    "requestParameters": {
        "descriptors": {
            "mcp": {
                "server": {
                    "schemaVersion": "2025-12-11",
                    "inlineContent": "{\n  \"name\": \"io.example/my-server\",\n  \"description\": \"Brief description of server functionality\",\n  \"version\": \"1.0.0\"\n} "
                }
            }
        },
        "recordVersion": "1.0.0",
        "clientToken": "<REDACTED>",
        "name": "record_gk0xk",
        "registryId": "jzjXulIwVksK",
        "descriptorType": "MCP"
    },
    "responseElements": {
        "Access-Control-Expose-Headers": "x-amzn-RequestId,x-amzn-ErrorType,x-amzn-Trace-id,x-amzn-Apigw-id,x-amzn-ErrorMessage,Date",
        "recordArn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:registry/jzjXulIwVksK/record/QamdREmPPkNr",
        "status": "CREATING"
    },
    "requestID": "12345678-1234-1234-1234-123456789012",
    "eventID": "12345678-1234-5678-9abc-123456789012",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management",
    "sessionCredentialFromConsole": "true"
}
```