Codex prompt, response and MCP call log (event_type = CODEX_LOG)
| # | Field | Type | Display name | Description |
|---|---|---|---|---|
| 1 | _time | DATE | Time | |
| 2 | user | STRING | Account | e.g. user01@example.com |
| 3 | client_id | STRING | Client | CODEX_WEB, CODEX_WORK_WEB, CODEX_DESKTOP_APP, CODEX_WORK_DESKTOP |
| 4 | detail_type | STRING | Event | PROMPT_SENT, PROMPT_RESPONSE_RECEIVED, TOOL_CALL_SUGGESTED, TOOL_CALL_COMPLETED, APP_MCP_CALL, APP_MCP_RESULT, ENVIRONMENT_CREATED, ENVIRONMENT_DELETED, PLUGIN_INSTALLED |
| 5 | model | STRING | Model | gpt-5.5, gpt-5.6-luna, gpt-5.6-sol, gpt-5.6-terra, gpt-6-astra |
| 6 | reasoning_effort | STRING | Reasoning effort | low, medium, high, xhigh, max |
| 7 | status | STRING | Status | completed, success, error |
| 8 | call_id | STRING | Call ID | Shared by the TOOL_CALL and MCP events |
| 9 | tool_name | STRING | Tool name | e.g. functions.exec, web.run |
| 10 | tool_type | STRING | Tool type | e.g. custom_tool_call, web_search_call |
| 11 | tool_call_id | STRING | Tool call ID | Repeats call_id on every record observed |
| 12 | tool_input | STRING | Tool input | The command or code the tool was asked to run |
| 13 | mcp_tool_name | STRING | MCP tool name | e.g. notion.search, github.get_repo |
| 14 | mcp_arguments | MAP | MCP arguments | Call arguments |
| 15 | mcp_action | STRING | MCP action | e.g. get_repo, notion-update-page |
| 16 | mcp_connector_name | STRING | MCP connector name | e.g. GitHub |
| 17 | mcp_connector_id | STRING | MCP connector ID | e.g. connector_00000000000000000000000000000000 |
| 18 | mcp_link_id | STRING | MCP link ID | e.g. link_00000000000000000000000000000000 |
| 19 | mcp_resource_uri | STRING | MCP resource URI | |
| 20 | mcp_result_preview | STRING | MCP result preview | Truncated call result |
| 21 | mcp_error_code | STRING | MCP error code | e.g. FORBIDDEN |
| 22 | mcp_error_message | STRING | MCP error message | |
| 23 | content_length | LONG | Body length | |
| 24 | content | STRING | Prompt / response | Prompt text on PROMPT_SENT, response text on PROMPT_RESPONSE_RECEIVED. Codex resends the whole conversation on every prompt, so this grows over a session. |
| 25 | input_tokens | LONG | Input tokens | |
| 26 | output_tokens | LONG | Output tokens | |
| 27 | cached_input_tokens | LONG | Cached input tokens | |
| 28 | reasoning_output_tokens | LONG | Reasoning output tokens | |
| 29 | session_id | STRING | Session ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 30 | turn_id | STRING | Turn ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 31 | service_tier | STRING | Service tier | e.g. default |
| 32 | environment_id | STRING | Environment ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 33 | workspace_id | STRING | Workspace ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 34 | type | STRING | Event type | e.g. AUDIT_LOG |
| 35 | event_id | STRING | Event ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 36 | user_id | STRING | User ID | e.g. user-A1b2C3d4E5f6G7h8I9j0K1l2 |
| 37 | actor_type | STRING | Actor type | ACCOUNT_USER, SERVICE_ACCOUNT |
| 38 | principal_id | STRING | Workspace ID | e.g. 00000000-0000-0000-0000-000000000000 |
| 39 | principal_type | STRING | Workspace type | CHATGPT_WORKSPACE |
| 40 | file_id | STRING | Log file ID | e.g. eclf_0000000000000000000000000000000000 |
| 41 | extra | MAP | Unmapped fields | Fields the API added that this schema does not name yet |