Monitoring

​

Quick start

# 1. Enable telemetry
export CLAUDE_CODE_ENABLE_TELEMETRY=1

# 2. Choose exporters (both are optional - configure only what you need)
export OTEL_METRICS_EXPORTER=otlp       # Options: otlp, prometheus, console, none
export OTEL_LOGS_EXPORTER=otlp          # Options: otlp, console, none

# 3. Configure OTLP endpoint (for OTLP exporter)
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

# 4. Set authentication (if required)
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer your-token"

# 5. For debugging: reduce export intervals, and reset them for production use
export OTEL_METRIC_EXPORT_INTERVAL=10000  # 10 seconds (default: 60000ms)
export OTEL_LOGS_EXPORT_INTERVAL=5000     # 5 seconds (default: 5000ms)

# 6. Run Claude Code
claude

​

Administrator configuration

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://collector.example.com:4317",
    "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer example-token"
  }
}

​

How managed settings lock the OTLP destination

• Endpoints: when you set OTEL_EXPORTER_OTLP_ENDPOINT, Claude Code removes every developer-set per-signal endpoint. Developers can’t point one signal at a different collector, so you don’t need to also set the per-signal endpoint variables in managed settings.
• Protocols: when you set OTEL_EXPORTER_OTLP_PROTOCOL, Claude Code removes every developer-set per-signal protocol.
• Credentials: when you set OTEL_EXPORTER_OTLP_HEADERS, OTEL_EXPORTER_OTLP_CLIENT_KEY, or OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE, Claude Code removes the developer-set per-signal versions of that variable, plus every developer-set endpoint variable, generic or per-signal, since those credentials would otherwise reach a collector the managed settings didn’t choose.
• Exporter selectors: OTEL_METRICS_EXPORTER, OTEL_LOGS_EXPORTER, and the beta OTEL_TRACES_EXPORTER follow normal per-key precedence. A developer’s setting can still disable a signal or switch it to the console exporter, so set the selectors in managed settings too if you need them locked. Across admin sources, OTEL_LOGS_EXPORTER follows the telemetry unit while the other two selectors merge per key. Requires Claude Code v2.1.223 or later.
• Beta tracing endpoints: with detailed beta tracing active, Claude Code exports logs and traces to BETA_TRACING_ENDPOINT instead of through the logs and traces exporters. Claude Code therefore removes a developer-set BETA_TRACING_ENDPOINT whenever any of these managed settings decides either signal’s destination:
  • A generic or logs/traces endpoint or credential
  • An otelHeadersHelper
  • A logs or traces exporter selector set to none, console, or empty, values that keep the signal off a collector
  • CLAUDE_CODE_ENABLE_TELEMETRY turned off
  A metrics-only endpoint or credential doesn’t remove it. Before v2.1.251, a developer-set BETA_TRACING_ENDPOINT redirected the logs and traces that detailed beta tracing exports even when managed settings pinned the collector.

​

Configuration details

​

Common configuration variables

​

mTLS authentication

​

Metrics cardinality control

​

Traces (beta)

​

Span hierarchy

claude_code.interaction
├── claude_code.llm_request
├── claude_code.hook                    (requires detailed beta tracing)
└── claude_code.tool
    ├── claude_code.tool.blocked_on_user
    ├── claude_code.tool.execution
    └── (Agent tool) subagent claude_code.llm_request / claude_code.tool spans

​

Span attributes

​

Dynamic headers

​

Settings configuration

{
  "otelHeadersHelper": "/path/to/generate-otel-headers.sh"
}

​

Script requirements

#!/bin/bash
# Example: Multiple headers
echo "{\"Authorization\": \"Bearer $(get-token.sh)\", \"X-API-Key\": \"$(get-api-key.sh)\"}"

• /status output
• The debug log, when running with --debug or after running /debug in the session
• stderr, in non-interactive sessions started with -p

​

Refresh behavior

​

Multi-team organization support

# Add custom attributes for team identification
export OTEL_RESOURCE_ATTRIBUTES="department=engineering,team.id=platform,cost_center=eng-123"

• Filter metrics by team or department
• Track costs per cost center
• Create team-specific dashboards
• Set up alerts for specific teams

export OTEL_RESOURCE_ATTRIBUTES="org.name=Johns_Organization"
export OTEL_RESOURCE_ATTRIBUTES="org.name=JohnsOrganization"

export OTEL_RESOURCE_ATTRIBUTES="org.name=John%27s%20Organization"

​

Example configurations

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=console
export OTEL_METRIC_EXPORT_INTERVAL=1000

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=prometheus

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=console,otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=http/json

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_METRICS_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=http://metrics.example.com:4318
export OTEL_EXPORTER_OTLP_LOGS_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=http://logs.example.com:4317

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

​

Available metrics and events

​

Standard attributes

• prompt.id: UUID correlating a user prompt with all subsequent events until the next prompt. See Event correlation attributes.
• workspace.host_paths: host workspace directories selected in the desktop app, as a string array
• workflow.run_id: run identifier, prefixed wf_, on the API and tool events emitted by agents that belong to a Workflow tool run. Filtering events by one workflow.run_id reconstructs that run’s API requests and tool results. The identifier covers the agents the workflow script spawns and any agents those spawn in turn, such as skill invocations. It matches the run identifier reported in the Workflow tool result. Absent on all other events. Requires Claude Code v2.1.202 or later
• workflow.name: name of the workflow, its script’s meta.name, emitted alongside workflow.run_id. Built-in workflow names appear verbatim when the run executes the unmodified built-in script. User-authored names, including edited copies of built-in scripts, are replaced with custom unless OTEL_LOG_TOOL_DETAILS=1 is set. Requires Claude Code v2.1.202 or later

​

Repository attributes

​

Metrics

​

Metric details

​

Session counter

• All standard attributes
• start_type: How the session was started. One of "fresh", "resume", "continue", or "agents_view". The "agents_view" value identifies the claude agents dashboard process, a user-launched local UI rather than a conversational session. Filter on this value to separate UI process launches from conversational sessions in your dashboards.

​

Lines of code counter

• All standard attributes
• type: ("added", "removed")
• model: Model identifier for the model that made the change (for example, “claude-sonnet-5”)

​

Pull request counter

• All standard attributes

​

Commit counter

• All standard attributes

​

Cost counter

• All standard attributes
• model: Model identifier (for example, “claude-sonnet-5”)
• query_source: Category of the subsystem that issued the request. One of "main", "subagent", or "auxiliary"
• speed: "fast" when the request used fast mode. Absent otherwise
• effort: Effort level applied to the request: "low", "medium", "high", "xhigh", or "max". Absent when the model doesn’t support effort.
• agent.name: Subagent type that issued the request. Built-in agent names and agents from official-marketplace plugins appear verbatim. Other user-defined agent names are replaced with "custom". Absent when the request was not issued by a named subagent type.
• skill.name: Skill active for the request, set by the Skill tool, a / command, or inherited by a spawned subagent. Built-in, bundled, user-defined, and official-marketplace plugin skill names appear verbatim. Third-party plugin skill names are replaced with "third-party". Absent when no skill is active.
• plugin.name: Owning plugin when the active skill or subagent is provided by a plugin. Official-marketplace plugin names appear verbatim. Third-party plugin names are replaced with "third-party". Absent when neither the skill nor the subagent has an owning plugin.
• marketplace.name: Marketplace the owning plugin was installed from. Only emitted for official-marketplace plugins. Absent otherwise.
• mcp_server.name: MCP server whose tool result this request consumed. Built-in, claude.ai-proxied, and official-registry server names appear verbatim. User-configured server names are replaced with "custom". Absent when the request consumed no MCP tool result. Before v2.1.222, Claude Code set this attribute on every request after an MCP tool call, not only on requests that consumed a tool result, so dashboards that aggregate it show a step down after you upgrade.
• mcp_tool.name: MCP tool whose result this request consumed, with the same redaction and version behavior as mcp_server.name. Absent when the request consumed no MCP tool result.

​

Token counter

• All standard attributes
• type: ("input", "output", "cacheRead", "cacheCreation")
• model: Model identifier (for example, “claude-sonnet-5”)
• query_source: Category of the subsystem that issued the request. One of "main", "subagent", or "auxiliary"
• speed: "fast" when the request used fast mode. Absent otherwise
• effort: Effort level applied to the request. See Cost counter for details.
• agent.name, skill.name, plugin.name, marketplace.name, mcp_server.name, mcp_tool.name: Skill, plugin, agent, and MCP attribution for the request. See Cost counter for definitions and redaction behavior.

​

Code edit tool decision counter

• All standard attributes
• tool_name: Tool name ("Edit", "Write", "NotebookEdit")
• decision: User decision ("accept", "reject")
• source: Where the decision came from. One of "config", "hook", "user_permanent", "user_temporary", "user_abort", or "user_reject". See the Tool decision event for what each value means.
• language: Programming language of the edited file, such as "TypeScript", "Python", "JavaScript", or "Markdown". Returns "unknown" for unrecognized file extensions.

​

Active time counter

• All standard attributes
• type: "user" for keyboard interactions, "cli" for tool execution and AI responses

​

Events

​

Event correlation attributes

• message.uuid on user_prompt and assistant_response
• request_id on the API events, persisted as requestId on the transcript’s assistant entries
• tool_use_id on tool_result and tool_decision events

​

User prompt event

• All standard attributes
• event.name: "user_prompt"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• prompt_length: Length of the prompt
• prompt: Prompt content. Redacted by default. Set OTEL_LOG_USER_PROMPTS=1 to include it
• message.uuid: UUID of the resulting user message, matching the persisted transcript entry. Absent on command dispatches, which can produce zero or many messages. Requires Claude Code v2.1.214 or later
• command_name: Command name when the prompt invokes one. Built-in and bundled command names such as compact or debug are emitted as-is; aliases such as reset emit as typed rather than the canonical name. Custom, plugin, and MCP command names collapse to custom or mcp unless OTEL_LOG_TOOL_DETAILS=1 is set
• command_source: Origin of the command when present: builtin, custom, or mcp. Plugin-provided commands report as custom

​

Assistant response event

• All standard attributes
• event.name: "assistant_response"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• response_length: Length of the response text in characters
• response: Response text, truncated at the content limit (60 KB by default). Redacted to <REDACTED> by default. Set OTEL_LOG_ASSISTANT_RESPONSES=1 to include it. When OTEL_LOG_ASSISTANT_RESPONSES is unset, OTEL_LOG_USER_PROMPTS controls it instead, so set OTEL_LOG_ASSISTANT_RESPONSES=0 to keep responses redacted while prompt logging is on
• model: Model identifier (for example, “claude-sonnet-5”)
• request_id: Anthropic API request ID from the response’s request-id header. Present only when the API returns one
• message.uuid: UUID of the response’s final transcript entry. An API response is persisted as one transcript entry per content block; this is the last one, which the next turn’s parentUuid chains from. Requires Claude Code v2.1.214 or later
• query_source: Subsystem that issued the request, such as "repl_main_thread", "compact", or a subagent name

​

Tool result event

• All standard attributes
• event.name: "tool_result"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• tool_name: Name of the tool
• tool_use_id: Unique identifier for this tool invocation. Matches the tool_use_id passed to hooks, allowing correlation between OTel events and hook-captured data.
• success: "true" or "false"
• duration_ms: Execution time in milliseconds
• error_type: Error category string when the tool failed, such as "Error:ENOENT" or "ShellError"
• error (when OTEL_LOG_TOOL_DETAILS=1): Full error message when the tool failed
• decision_type: Always "accept", since this event is only emitted after the tool runs. Rejected calls don’t produce a tool result
• decision_source: Where the permission decision came from. One of "config", "hook", "user_permanent", or "user_temporary". See the Tool decision event for what each value means. The reject-only sources "user_abort" and "user_reject" never appear on this event.
• tool_input_size_bytes: Size of the JSON-serialized tool input in bytes
• tool_result_size_bytes: Size of the tool result in bytes
• mcp_server_scope: MCP server scope identifier (for MCP tools)
• vcs.ref.head.revision, vcs.ref.head.name, vcs.ref.head.type (when OTEL_LOG_TOOL_DETAILS=1): the commit identity of a successful git commit run by the Bash or PowerShell tool. vcs.ref.head.revision is the commit SHA, vcs.ref.head.name is the branch it was committed on, and vcs.ref.head.type is branch. The name and type are omitted when the commit was made on a detached HEAD. Requires Claude Code v2.1.269 or later
• tool_parameters (when OTEL_LOG_TOOL_DETAILS=1): JSON string containing tool-specific parameters. For Claude Desktop’s built-in servers, in sessions Claude Desktop owns, the mcp_server_name/mcp_tool_name pair is included even with the flag off, the same host-authored exception as the Tool decision event, requiring Claude Code v2.1.214 or later. The parameters vary by tool:
  • For Bash tool: includes bash_command, full_command, timeout, description, and dangerouslyDisableSandbox, plus git_commit_id and git_branch when a git commit command succeeds. git_commit_id is the full commit SHA when the commit is the HEAD of the session’s working directory, and git’s abbreviated SHA otherwise. git_branch is the branch it was committed on, omitted on a detached HEAD
  • For the desktop app’s workspace Bash tool, which also reports tool_name as Bash: includes only bash_command, full_command, and timeout
  • For MCP tools: includes mcp_server_name, mcp_tool_name
  • For Skill tool: includes skill_name
  • For Agent tool or legacy Task tool: includes subagent_type
• tool_input (when OTEL_LOG_TOOL_DETAILS=1): JSON-serialized tool arguments. Individual values over 512 characters are truncated, and the full payload is bounded to ~4 K characters. Applies to all tools including MCP tools.

​

API request event

• All standard attributes
• event.name: "api_request"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• model: Model used (for example, “claude-sonnet-5”)
• cost_usd: Estimated cost in USD
• cost_usd_micros: Estimated cost in millionths of a US dollar, emitted as an integer
• duration_ms: Request duration in milliseconds
• input_tokens: Number of input tokens
• output_tokens: Number of output tokens
• cache_read_tokens: Number of tokens read from cache
• cache_creation_tokens: Number of tokens used for cache creation
• request_id: Anthropic API request ID from the response’s request-id header, such as "req_011...". Present only when the API returns one.
• client_request_id: Client-generated UUID sent as the x-client-request-id request header; see the event correlation attributes table for when it’s present. Requires Claude Code v2.1.214 or later
• speed: "fast" or "normal", indicating whether fast mode was active
• query_source: Subsystem that issued the request, such as "repl_main_thread", "compact", or a subagent name
• effort: Effort level applied to the request: "low", "medium", "high", "xhigh", or "max". Absent when the model doesn’t support effort.
• agent.name, skill.name, plugin.name, marketplace.name, mcp_server.name, mcp_tool.name: Skill, plugin, agent, and MCP attribution for the request. See Cost counter for definitions and redaction behavior.

​

API error event

• All standard attributes
• event.name: "api_error"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• model: Model used (for example, “claude-sonnet-5”)
• error: Error message
• status_code: HTTP status code as a number. Absent for non-HTTP errors such as connection failures.
• duration_ms: Request duration in milliseconds
• attempt: Total number of attempts made, including the initial request (1 means no retries occurred)
• request_id: Anthropic API request ID from the response’s request-id header, such as "req_011...". Present only when the API returns one.
• client_request_id: Client-generated UUID sent as the x-client-request-id request header. Available even when a failure such as a timeout or connection error never produced a server request_id; see the event correlation attributes table for when it’s present. Requires Claude Code v2.1.214 or later
• speed: "fast" or "normal", indicating whether fast mode was active
• query_source: Subsystem that issued the request, such as "repl_main_thread", "compact", or a subagent name
• effort: Effort level applied to the request. Absent when the model doesn’t support effort.
• agent.name, skill.name, plugin.name, marketplace.name, mcp_server.name, mcp_tool.name: Skill, plugin, agent, and MCP attribution for the request. See Cost counter for definitions and redaction behavior.

​

API refusal event

• All standard attributes
• event.name: "api_refusal"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• model: Model identifier from the request
• request_id: Anthropic API request ID from the response’s request-id header, such as "req_011...". Present only when the API returns one.
• query_source: Subsystem that issued the request, such as "repl_main_thread", "compact", or a subagent name. See api_request for definitions.
• speed: Either "fast" when Fast mode is active, or "normal"
• attempt: Retry attempt number. The first attempt is 1.
• effort: Effort level applied to the request. Absent when the model doesn’t support effort.
• server_fallback_hop: true when the API’s server-side model fallback already retried this refusal on a different model, so the user did not see this particular refusal. false when the request ended in a refusal. A single turn can emit both a true hop event and a later false final event when the fallback model also refuses.
• has_category: true when the API response carried a stop_details.category of "cyber", "bio", "frontier_llm", or "reasoning_extraction". false when the response carried no category or a value outside that set. Absent when server_fallback_hop is true, because hop blocks don’t carry stop_details.
• has_explanation: true when the API response carried a stop_details.explanation, otherwise false. Absent when server_fallback_hop is true.
• category: The stop_details.category value from the API response. One of "cyber", "bio", "frontier_llm", or "reasoning_extraction". Only present when OTEL_LOG_TOOL_DETAILS=1 is set and has_category is true.
• agent.name, skill.name, plugin.name, marketplace.name, mcp_server.name, mcp_tool.name: Skill, plugin, agent, and MCP attribution for the request. See Cost counter for definitions and redaction behavior.

​

API request body event

• All standard attributes
• event.name: "api_request_body"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• body: JSON-serialized Messages API request parameters, such as the system prompt, messages, and tools, truncated at the content limit (60 KB by default). Extended-thinking content in prior assistant turns is redacted. Emitted only in inline mode (OTEL_LOG_RAW_API_BODIES=1).
• body_ref: Absolute path to a <dir>/<uuid>.request.json file containing the untruncated body. Emitted only in file mode (OTEL_LOG_RAW_API_BODIES=file:<dir>).
• body_length: Untruncated body length. UTF-8 bytes when OTEL_LOG_RAW_API_BODIES=file:<dir>, or UTF-16 code units when =1
• body_truncated: "true" when inline truncation occurred. Absent in file mode and when no truncation occurred.
• model: Model identifier from the request parameters
• query_source: Subsystem that issued the request (for example, "compact")

​

API response body event

• All standard attributes
• event.name: "api_response_body"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• body: JSON-serialized Messages API response, including the id, content blocks, usage, and stop reason, truncated at the content limit (60 KB by default). Extended-thinking content is redacted. Emitted only in inline mode (OTEL_LOG_RAW_API_BODIES=1).
• body_ref: Absolute path to a <dir>/<request_id>.response.json file containing the untruncated body. Emitted only in file mode (OTEL_LOG_RAW_API_BODIES=file:<dir>).
• body_length: Untruncated body length. UTF-8 bytes when OTEL_LOG_RAW_API_BODIES=file:<dir>, or UTF-16 code units when =1
• body_truncated: "true" when inline truncation occurred. Absent in file mode and when no truncation occurred.
• model: Model identifier
• query_source: Subsystem that issued the request
• request_id: Anthropic API request ID from the response’s request-id header, such as "req_011...". Present only when the API returns one.

​

Tool decision event

• All standard attributes
• event.name: "tool_decision"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• tool_name: Name of the tool (for example, “Read”, “Edit”, “Write”, “NotebookEdit”)
• tool_use_id: Unique identifier for this tool invocation. Matches the tool_use_id passed to hooks, allowing correlation between OTel events and hook-captured data.
• decision: Either "accept" or "reject"
• tool_source: Always present. The tool’s provenance, as a closed set of CLI-authored values. Requires Claude Code v2.1.214 or later
  • "builtin": the CLI’s own tools
  • "mcp": MCP servers generally
  • "sdk_host_builtin_mcp": an in-process server built into Claude Desktop itself, in a session Claude Desktop owns. Claude Desktop owns a session it started from one of its own entrypoints, claude-desktop, claude-desktop-3p, or local-agent, when that session isn’t a nested child; nested sessions, including sessions Claude Code itself spawns, report these servers as "mcp"
• source: Where the decision came from:
  • "config": Decided automatically without prompting, based on project settings, allow or deny rules in the user’s personal settings, enterprise managed policy, --allowedTools or --disallowedTools flags, the active permission mode, a session-scoped grant from an earlier prompt in the same interactive CLI session, or because the tool is inherently safe. The event doesn’t indicate which of these sources matched. Claude Code also reports "config" when the permission prompt request itself fails, for example when the Agent SDK’s canUseTool callback or the --permission-prompt-tool tool returns an invalid result, or when the input stream closes while the request is pending. Before v2.1.216, Claude Code reported these failures as "user_reject".
  • "hook": A PreToolUse or PermissionRequest hook returned the decision.
  • "user_permanent": Emitted when the user chose “Yes, and don’t ask again for …” at a permission prompt, which saves an allow rule to their personal settings. In the interactive CLI this is emitted only for that choice itself; later calls that match the saved rule emit "config" instead. In Agent SDK or non-interactive -p sessions, both the initial choice and later rule matches emit "user_permanent". Treated as an accept.
  • "user_temporary": Emitted when the user chose “Yes” at a permission prompt for a one-time approval, or chose an option that grants access for the rest of the session on a file edit or read prompt. In the interactive CLI this is emitted only for the choice itself; later calls allowed by that session-scoped grant emit "config" instead. In Agent SDK or non-interactive -p sessions, both the choice and later matches emit "user_temporary". Treated as an accept.
  • "user_abort": Emitted when the user dismissed the permission prompt without answering. In Agent SDK and non-interactive -p sessions, this includes interrupting the turn while a canUseTool or --permission-prompt-tool permission request is pending; before v2.1.216, Claude Code reported that interrupt as "user_reject". Treated as a reject.
  • "user_reject": Emitted when the user chose “No” when prompted. In the interactive CLI this is emitted only for that choice itself; calls that match a deny rule in the user’s personal settings emit "config" instead. In Agent SDK or non-interactive -p sessions, calls that match a deny rule in personal settings emit "user_reject". Treated as a reject.
• tool_parameters (when OTEL_LOG_TOOL_DETAILS=1): JSON string containing tool-specific parameters. Same shape as the Tool result event, minus post-execution fields such as git_commit_id. Values may differ from tool_result for an accepted call if the permission decision rewrites the tool input via updatedInput. Use this attribute to see which command was rejected when decision is "reject".
  • For "sdk_host_builtin_mcp" tools: mcp_server_name and mcp_tool_name are included even when OTEL_LOG_TOOL_DETAILS is off, because the host application defines these names; without them, a rejected call to one of these built-in servers would be unattributable on the default stream. For user-configured MCP servers, the event’s tool_name is always the literal "mcp_tool", and the server and tool names appear only in tool_parameters with the flag on; argument content requires the flag everywhere. Requires Claude Code v2.1.214 or later
  • For Bash tool: includes bash_command, full_command, timeout, description, dangerouslyDisableSandbox. The desktop app’s workspace bash tool also reports tool_name as Bash, but includes only bash_command, full_command, and timeout
  • For MCP tools: includes mcp_server_name, mcp_tool_name
  • For Skill tool: includes skill_name
  • For Agent tool or legacy Task tool: includes subagent_type

​

Permission mode changed event

• All standard attributes
• event.name: "permission_mode_changed"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• from_mode: The previous permission mode, for example "default", "plan", "acceptEdits", "auto", or "bypassPermissions"
• to_mode: The new permission mode
• trigger: What caused the change. One of "shift_tab", "exit_plan_mode", "auto_gate_denied", or "auto_opt_in". Absent when the transition originates from the SDK or bridge

​

Auth event

• All standard attributes
• event.name: "auth"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• action: "login" or "logout"
• success: "true" or "false"
• auth_method: Authentication method, such as "oauth"
• error_category: Categorical error kind when the action failed. The raw error message is never included
• status_code: HTTP status code as a string when the action failed with an HTTP error

​

MCP server connection event

• All standard attributes
• event.name: "mcp_server_connection"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• status: "connected", "failed", or "disconnected"
• transport_type: Server transport, such as "stdio", "sse", or "http"
• server_scope: Scope the server is configured at, such as "user", "project", or "local"
• duration_ms: Connection attempt duration in milliseconds
• error_code: Error code when the connection failed
• is_plugin: true when the server is provided by a plugin, false otherwise
• plugin_id_hash (when is_plugin is true): Stable hash of the plugin name and marketplace, for grouping events by plugin without exposing the name. Claude Code computes it as described under the plugin loaded event
• plugin.name (when is_plugin is true): Name of the plugin that provides the server. For third-party plugins this is the literal string "third-party" unless OTEL_LOG_TOOL_DETAILS=1; this protects third-party plugin names from appearing in logs by default. Plugins from official Anthropic sources are always identified by name. The plugin_id_hash and plugin.name attributes flow to your own monitoring backend and are not sent to Anthropic
• server_name (when OTEL_LOG_TOOL_DETAILS=1): Configured server name
• error (when OTEL_LOG_TOOL_DETAILS=1): Full error message when the connection failed

​

Internal error event

• All standard attributes
• event.name: "internal_error"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• error_name: Error class name, such as "TypeError" or "SyntaxError"
• error_code: Node.js errno code such as "ENOENT" when present on the error

​

Plugin installed event

• All standard attributes
• event.name: "plugin_installed"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• marketplace.is_official: "true" if the marketplace is an official Anthropic marketplace, "false" otherwise
• install.trigger: "cli" or "ui"
• plugin.name: Name of the installed plugin. For third-party marketplaces this is included only when OTEL_LOG_TOOL_DETAILS=1
• plugin.version: Plugin version when declared in the marketplace entry. For third-party marketplaces this is included only when OTEL_LOG_TOOL_DETAILS=1
• marketplace.name: Marketplace the plugin was installed from. For third-party marketplaces this is included only when OTEL_LOG_TOOL_DETAILS=1

​

Plugin loaded event

• All standard attributes
• event.name: "plugin_loaded"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• plugin.name: name of the plugin. For plugins outside the official marketplace and built-in bundle the value is "third-party" unless OTEL_LOG_TOOL_DETAILS=1
• marketplace.name: marketplace the plugin was installed from, when known. Redacted to "third-party" under the same condition as plugin.name
• plugin.version: version from the plugin manifest. Included only when the name is not redacted and the manifest declares a version
• plugin.scope: provenance category for the plugin: "official", "community", "org", "user-local", or "default-bundle"
• enabled_via: how the plugin came to be enabled: "default-enable", "org-policy", "admin-install", "seed-mount", or "user-install". The "admin-install" value means the plugin is set to required or auto-install for your organization in Organization settings > Plugins. Before v2.1.246, Claude Code reported these plugins as "user-install" or "seed-mount"
• plugin_id_hash: deterministic hash of the plugin name and marketplace, sent only to your configured exporter. Lets you count the distinct third-party plugins loaded across your fleet without recording their names. For plugins synced from claude.ai, Claude Code hashes the plugin name with the marketplace name that claude.ai reports for the plugin, or with synced otherwise. Before v2.1.246, Claude Code didn’t use the marketplace name claude.ai reports in the hash
• has_hooks: whether the plugin contributes hooks
• has_mcp: whether the plugin contributes MCP servers
• host_owned_mcp: true when the SDK host manages this plugin’s MCP connections and Claude Code skipped reading the plugin’s MCP server configuration, false otherwise. Requires Claude Code v2.1.172 or later
• skill_path_count: number of skill directories the plugin declares
• command_path_count: number of command directories the plugin declares
• agent_path_count: number of agent directories the plugin declares
• safe_mode: "true" when the session was started with --safe-mode, "false" otherwise. In safe mode this event reports configured inventory only; the plugin’s commands, skills, hooks, and MCP servers don’t load. Requires Claude Code v2.1.169 or later

​

Skill activated event

• All standard attributes
• event.name: "skill_activated"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• skill.name: Name of the skill. For user-defined and third-party plugin skills the value is the placeholder "custom_skill" unless OTEL_LOG_TOOL_DETAILS=1
• invocation_trigger: How the skill was triggered ("user-slash", "claude-proactive", or "nested-skill")
• skill.source: Where the skill was loaded from (for example, "bundled", "userSettings", "projectSettings", "plugin")
• skill.kind: "workflow" when the skill is a workflow skill. Absent otherwise
• plugin.name (when OTEL_LOG_TOOL_DETAILS=1 or the plugin is from an official marketplace): Name of the owning plugin when the skill is provided by a plugin
• marketplace.name (when OTEL_LOG_TOOL_DETAILS=1 or the plugin is from an official marketplace): Marketplace the owning plugin was installed from, when the skill is provided by a plugin

​

At mention event

• All standard attributes
• event.name: "at_mention"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• mention_type: Type of mention ("file", "directory", "agent", "mcp_resource", "peer"). The "peer" value means you mentioned one of your other Claude Code sessions. Requires Claude Code v2.1.232 or later
• success: Whether the mention resolved successfully ("true" or "false")

​

API retries exhausted event

• All standard attributes
• event.name: "api_retries_exhausted"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• model: Model used
• error: Final error message
• status_code: HTTP status code as a number. Absent for non-HTTP errors.
• total_attempts: Total number of attempts made
• total_retry_duration_ms: Total wall-clock time across all attempts
• speed: "fast" or "normal"

​

Hook registered event

• All standard attributes
• event.name: "hook_registered"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• hook_event: hook event type, such as "PreToolUse" or "PostToolUse"
• hook_type: hook implementation type: "command", "prompt", "mcp_tool", "http", or "agent"
• hook_source: where the hook is defined: "userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings", or "pluginHook"
• safe_mode: "true" when the session was started with --safe-mode, "false" otherwise. Requires Claude Code v2.1.169 or later
• hook_matcher (when OTEL_LOG_TOOL_DETAILS=1): the matcher string from the hook configuration, when one is set
• plugin.name (when hook_source is "pluginHook"): name of the contributing plugin. For plugins outside the official marketplace and built-in bundle the value is "third-party" unless OTEL_LOG_TOOL_DETAILS=1
• plugin_id_hash (when hook_source is "pluginHook"): deterministic hash of the plugin name and marketplace, sent only to your configured exporter. Lets you count distinct contributing plugins without recording their names. Claude Code computes it as described under the plugin loaded event

​

Hook execution start event

• All standard attributes
• event.name: "hook_execution_start"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• hook_event: Hook event type, such as "PreToolUse" or "PostToolUse"
• hook_name: Full hook name including matcher, such as "PreToolUse:Write"
• num_hooks: Number of matching hook commands
• managed_only: "true" when only managed-policy hooks are permitted
• hook_source: "policySettings" or "merged"
• safe_mode: "true" when the session was started with --safe-mode, "false" otherwise. Requires Claude Code v2.1.169 or later
• hook_definitions: JSON-serialized hook configuration. Included only when both detailed beta tracing and OTEL_LOG_TOOL_DETAILS=1 are enabled

​

Hook execution complete event

• All standard attributes
• event.name: "hook_execution_complete"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• hook_event: Hook event type
• hook_name: Full hook name including matcher
• num_hooks: Number of matching hook commands
• num_success: Count that completed successfully
• num_blocking: Count that returned a blocking decision
• num_non_blocking_error: Count that failed without blocking
• num_cancelled: Count cancelled before completion
• total_duration_ms: Wall-clock duration of all matching hooks
• managed_only: "true" when only managed-policy hooks are permitted
• hook_source: "policySettings" or "merged"
• safe_mode: "true" when the session was started with --safe-mode, "false" otherwise. Requires Claude Code v2.1.169 or later
• hook_definitions: JSON-serialized hook configuration. Included only when both detailed beta tracing and OTEL_LOG_TOOL_DETAILS=1 are enabled

​

Hook plugin metrics event

• All standard attributes
• event.name: "hook_plugin_metrics"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• plugin_id: plugin identifier in <name>@<marketplace> form
• hook_event: hook event type that emitted the metrics
• Up to 20 plugin-emitted metric keys. Names match ^[a-z][a-z0-9_]{0,39}$. Values are boolean or number.

​

Compaction event

• All standard attributes
• event.name: "compaction"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• trigger: "auto" or "manual"
• success: "true" or "false"
• duration_ms: Compaction duration
• pre_tokens: Approximate token count before compaction
• post_tokens: Approximate token count after compaction
• error: Error message when compaction failed
• precompute_reuse: Only set when trigger is "manual". Auto-compaction can prepare a summary in the background before the context window fills, and this attribute records whether /compact reused that prepared summary. "hit" means it was reused; "miss_custom_instructions", "miss_hook", and "miss_not_ready" give the reason a fresh summary was computed instead. Requires Claude Code v2.1.153 or later

​

Subagent completed event

• All standard attributes
• event.name: "subagent_completed"
• event.timestamp: ISO 8601 timestamp
• event.sequence: monotonically increasing counter for ordering events within a session
• agent_type: The subagent type. Built-in agent names and agents from official-marketplace plugins appear verbatim; other agent names are replaced with "custom" unless OTEL_LOG_TOOL_DETAILS=1 is set
• agent.source: Where the agent definition came from: built-in, plugin, or the settings source that defined a custom agent, such as userSettings or projectSettings
• is_built_in: Whether the subagent is a built-in agent type
• is_async: Whether the subagent ran in the background
• total_tokens: The token footprint of the subagent’s final API request: that one request’s input, cache creation, cache read, and output tokens, roughly the subagent’s context size at completion. Not a sum across the run
• total_tool_uses: Number of tool calls the subagent made across the whole run
• duration_ms: Run time in milliseconds
• model: The model the subagent was resolved to run
• final_model: The model that produced the subagent’s final response, which differs from model after a mid-run switch such as a fallback. Requires Claude Code v2.1.212 or later
• model_swapped: Whether more than one model served the subagent’s requests. Requires Claude Code v2.1.212 or later
• plugin_id_hash, plugin.name: Present for plugin-provided agents. Official-marketplace plugin names appear verbatim; other plugin names are replaced with "third-party" unless OTEL_LOG_TOOL_DETAILS=1 is set

​

Feedback survey event

• All standard attributes
• event.name: "feedback_survey"