> ## Documentation Index > Fetch the complete documentation index at: https://docs.openlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Palantir Foundry > Monitor Palantir Foundry AIP Agents and AIP Logic functions in Openlayer Openlayer connects to Palantir Foundry to monitor [AIP Chatbots](https://www.palantir.com/docs/foundry/chatbot-studio/overview) and AIP Logic query functions. AIP Chatbots were formerly called AIP Agents. The integration ingests production executions from Foundry log exports and writes them to the Openlayer projects linked to your enabled agents and functions. ## How it works Once connected, Openlayer: 1. **Registers targets** — discover or register AIP Chatbots, and register AIP Logic functions by function RID or Query API name. 2. **Links Openlayer projects** — enabling an agent or function links it to an Openlayer project and inference pipeline. These projects display a Foundry mark in the projects list, project header, sidebars, command menu, and configured integrations. 3. **Syncs executions** — polls the Chatbot Studio session-log stream for agents and one or more OpenTelemetry telemetry streams for AIP Logic functions. 4. **Builds traces** — maps each completed production execution into an Openlayer trace. Only enabled targets are ingested. Executions from unregistered agents and functions are dropped rather than registered automatically. > [!NOTE] > > Cron sync uses the Chatbot Studio session-log dataset rather than AIP Agents > v2 `listSessions`. That API only returns sessions for the calling user and > originating client, so it does not expose Studio traffic from other users. *** ## Prerequisites Before connecting, you need: * A Foundry enrollment with at least one AIP Chatbot or AIP Logic function. * OAuth2 client credentials for a third-party application or a bearer token. The application or token must be allowed to use the Foundry APIs below. * The appropriate log export created by a Foundry Org Admin: * For AIP Agents, a Chatbot Studio session-log export using the **Palantir JSON** schema. * For AIP Logic, a log export using the **OpenTelemetry** schema that covers the projects containing the functions you want to monitor. * An Openlayer workspace where you are an **admin**. Your enrollment URL must use HTTPS and contain only the hostname, such as `https://example.palantirfoundry.com`, with no path. | Foundry API | When Openlayer uses it | Legacy OAuth client scope | | - | - | - | | Streams | Read either log stream | `api:streams-read` | | AIP Agents | Discover and register AIP Chatbots | `api:aip-agents-read` | | Filesystem and Compass | Discover chatbots, resolve their paths, and name Logic files registered by RID | `api:filesystem-read` | | Functions | Register a function by Query API name, and name functions registered by RID | `api:functions-read` | | Ontologies | Name action types registered by RID | `api:ontologies-read` | > [!NOTE] > > For a restricted Developer Console application, allow the matching `api:use-*` > operations and resources in [Application > restrictions](https://www.palantir.com/docs/foundry/developer-console/application-restrictions/). > Openlayer does not request specific scopes when exchanging client credentials, > so the application's Foundry restrictions and service-user permissions > determine what the token can access. A bearer token must carry equivalent API > access. Functions and Ontologies access are optional for AIP Logic: without > them, a target registered by RID keeps its RID as a placeholder name. To name > a Logic file, the service user also needs at least Viewer access to the > project that contains it. ### Create the log exports In **Control Panel**, a Foundry Org Admin selects the organization and opens **Log observability settings**. Create an export that covers the relevant projects, then copy its streaming dataset RID. Use the **Palantir JSON** schema for the AIP Agent session-log export. Use the **OpenTelemetry** schema for the AIP Logic telemetry export. These are separate streams; do not use the Palantir JSON schema for AIP Logic. Allow up to five minutes for rows to appear. > [!WARNING] > > Markings are not inherited by the exported dataset. Prompts and user input can > appear in the stream, so configure the export's projects and access controls > appropriately. *** ## Set up the integration ### Step 1: Connect your enrollment 1. In Openlayer, go to **Settings → Integrations**. 2. Select **Palantir Foundry**. 3. Under **Connect**, enter: * **Enrollment URL** — your HTTPS Foundry enrollment hostname with no path. * **Authentication** — select **OAuth2 client credentials** or **Bearer token**. * For **OAuth2 client credentials**, enter your **Client ID** and **Client secret**. * For **Bearer token**, enter your **Bearer token**. * **Session-log dataset RID (optional)** — the RID from your Org Admin's log export. * **Stream branch** — the dataset branch, which defaults to `master`. 4. Click **Connect**. Openlayer verifies the hostname and selected credentials before saving the connection. ![Palantir Foundry connect](https://mintcdn.com/openlayer-44/p2Nha6ZfPRFIpGwK/images/integrations/palantir_foundry_hero.png?fit=max\&auto=format\&n=p2Nha6ZfPRFIpGwK\&q=85\&s=601eb239eebf1c13b03b597fe40e62fe) > [!NOTE] > > You can connect without entering a dataset RID. Ingestion for each target type > remains inactive until you configure its corresponding stream under > **Settings**. After connecting, **Overview** shows the selected **Authentication** method and, for OAuth2 client credentials, the **Client ID**. It also shows **Telemetry streams**, listing each stream's dataset RID, when you add an AIP Logic telemetry stream. The integration detail page has **General**, **AIP Agents**, and **AIP Logic** tabs. ### Step 2: Discover or register AIP Agents On the **AIP Agents** tab, click **Discover agents** (the refresh button once agents are listed) to walk the Compass folders visible to your credentials for AIP Chatbot files. You can also click **Register agent** and provide either: * The agent RID from the Chatbot Studio URL. * A Foundry filesystem path, such as `/Org/Project/My Agent`. Discovery only finds Compass files with the `AIP_AGENTS_AGENT` type. ![The AIP Agents tab of the Palantir Foundry integration in Openlayer, listing four AIP agents with their agent RIDs and imported sessions, two enabled and two with an Enable button](https://mintcdn.com/openlayer-44/i_IVq7qGt9U6VbHF/images/integrations/palantir_foundry_agents.png?fit=max\&auto=format\&n=i_IVq7qGt9U6VbHF\&q=85\&s=fa4da703f68dfb1a573e5e7d91b4a326) ### Step 3: Enable chatbots Click **Enable** for each chatbot you want to monitor. Openlayer links a project and inference pipeline, then starts ingesting matching executions. The **AIP Agents** tab shows each chatbot and its number of imported sessions. To stop ingesting future traces for a chatbot, open its **Agent options** menu and select **Disable**. Existing traces remain available. ### Step 4: Configure log streams On the **General** tab under **Settings**, enter the **Session-log dataset RID** for AIP Agents, then click **Save session-log stream**. For AIP Logic, add each OpenTelemetry export under **Telemetry streams** with **Add stream**. A connection can read several exports. Each stream is synced and backfilled on its own and shows its own status, so a failing stream does not stop session-log sync or the other streams. Every stream feeds every enabled AIP Logic function on the connection, and executions already stored are skipped, so overlapping exports do not create duplicate runs. Openlayer reads a stream once before adding it to check access. The add is rejected if the dataset RID is invalid, the stream is already added, or Openlayer cannot read it. Reading requires Streams API access (`api:streams-read`) and Viewer access to the dataset. The stream's first sync is queued when it is added. **Remove stream** stops reading a stream and keeps registered functions, projects, and stored runs. Connections that had a single telemetry dataset RID keep it as their first telemetry stream, continuing from where it left off. Turn on **Periodic sync** to poll the session-log stream and every telemetry stream every 15 minutes, or click **Sync now** to queue a manual sync. Periodic sync requires at least one dataset RID and access to the Streams API. Under **Connection health**, click **Test connection** to check your stored credentials. Openlayer reports invalid credentials, missing API access, missing resource permissions, or Foundry availability problems separately. *** ## Monitor AIP Logic query functions Before registering a function, configure the OpenTelemetry log export in Foundry and add it under **Telemetry streams** on the **General** tab. AIP Logic ingestion remains inactive until you add at least one telemetry stream. On the **AIP Logic** tab, select **Register function** and identify the function by **Function RID** or **Query API name**. Registering by function RID is recommended and works for functions that are not published as Queries. Registering by Query API name requires access to the Functions API to resolve the RID. When you register by function RID, Openlayer uses the Functions API, if allowed, only to fetch the function's Foundry display name and description. You can also register a Logic file RID (`ri.eddie.…`) or an action type RID (`ri.actions.…`). When Foundry cannot name a target registered by RID, Openlayer still registers it and shows the RID as a placeholder name: * A function takes its name from its next synced execution, with no extra access. **Backfill history** also names it from executions that are already stored. A project Openlayer created for the function is renamed with it while the project still has its generated name. * A Logic file or action type needs the access listed under [Prerequisites](#prerequisites). After you grant it, register the target again. Re-registering and syncing replace only placeholder names. A name you set in Openlayer is never overwritten. Select **Enable**, then choose **Create new project** or **Map to existing project**. The table shows **Function** and **Runs**, with no version column. Only enabled functions are ingested; executions from unregistered functions are dropped. Select **Disable** to stop ingesting future executions for a function. Existing traces remain available. **Backfill history** re-reads one telemetry stream from the oldest record Foundry still retains, so you can ingest executions that ran before a function was registered. Every enabled function is re-read from that stream; other streams are not affected. When the connection has more than one stream, choose which one to backfill. You can also backfill a stream from its options menu under **Telemetry streams**. Executions already stored are skipped, so backfill does not create duplicate runs. A long history arrives over several syncs, and backfill recovers only what the stream still retains. While the replay runs, live executions from that stream appear after it catches up. The button stays disabled until you add a telemetry stream. **Rename** changes only the name shown in Openlayer; ingestion still matches the function RID, and registering the function again keeps that name. **Remove function** deletes the registration and stops future ingestion, keeps the function's project, pipeline, and existing runs, and requires the same permission as registering. *** ## Ingest a single session The session-log stream is the primary sync source. If you have a gateway-originated session's three identifiers, you can ingest that session directly: 1. Open the chatbot row's **Agent options** menu and select **Ingest**. 2. Enter the **Session RID** and **Session trace ID**. The agent RID is already known from the chatbot row. 3. Click **Ingest**. This action uses `getSessionTrace` and only works when you have the IDs from the originating client. Palantir documents that these sessions expire after approximately 24 hours. *** ## Trace mapping ### AIP Chatbots Openlayer maps Palantir JSON session-log events as follows: | Foundry event | Openlayer trace data | | - | - | | `session_metadata` | Root metadata, including agent, version, session, caller | | `user_request` | Root input and retriever contexts | | `system`, `user`, or `assistant_chat_message` | Chat completion spans | | `tool_call` and `tool_call_result` | Tool spans | | `final_response` | Root output | | `execution_error` | Root error | Model, token, and cost data appear only when sibling language-model usage events share the same `traceId`. Chatbot events do not always include these usage events. ### AIP Logic functions Each call to a registered function becomes its own run, rooted at that function's execution. When an AIP Chatbot or another function calls a registered function, each call counts as a separate run, and the caller's own steps are not included in the function's trace. | Function execution | Openlayer trace data | | - | - | | Arguments | Root inputs, one input per argument | | Result | Root output | | Start time and duration | Latency | | Non-success request status | Step error | | Foundry trace and parent IDs | Trace metadata | | Language-model calls | Chat completion steps labeled with the model name, such as `gpt-4.1-mini` | | Function calls (*Executing function*) | Tool steps named for the called function, with its arguments and result | | Action calls (*Execute Action*) | Tool steps named for the action type | Other spans appear as regular steps. Chat completion steps include the prompt, completion, and token data when those fields are present in the telemetry export. Because Foundry does not export the provider or cost, Openlayer infers it for OpenAI (`gpt-`, `chatgpt-`, and o-series), Anthropic (`claude`), Google (`gemini`), Mistral (`mistral`, `mixtral`, `codestral`, and `ministral`), and xAI (`grok`) model families. Cost is estimated at the model family's list price. Other model families show no provider or cost. Every other field Foundry exports for a step is kept in the step's metadata under a single nested `foundryExport` value, grouped by the part of the export it came from, such as `logAttributes`, `resource`, or `request`. Because the value is nested, these fields are not separate filterable metadata columns. ![Trace details for a Foundry AIP Agent session: retrieved context, system, user, and assistant chat messages, the lookup\_policy\_terms and score\_fraud\_risk tool calls, and language model usage, with 1,697 total tokens](https://mintcdn.com/openlayer-44/p2Nha6ZfPRFIpGwK/images/integrations/palantir_foundry_trace.png?fit=max\&auto=format\&n=p2Nha6ZfPRFIpGwK\&q=85\&s=2f08e91c5e9e4cea0bdcb728abf0140f) *** ## Disconnecting To disconnect, open **Settings → Integrations → Palantir Foundry** and click **Disconnect**. Disconnecting stops syncing and deletes registered AIP Agent and AIP Logic function records. Existing Openlayer traces are preserved. ## Troubleshooting **Sync fails with a missing dataset RID.** Configure the stream for the target type under **Settings**: the session-log dataset RID for AIP Agents, or a telemetry stream for AIP Logic. AIP Agent session logs use the Palantir JSON schema; AIP Logic telemetry uses the OpenTelemetry schema. **No chatbots appear after discovery.** Discovery only finds `AIP_AGENTS_AGENT` Compass files. Confirm that the application is allowed to use the AIP Agents and Filesystem APIs and that its service user can see the folders containing your chatbots. You can also register a chatbot by RID or filesystem path. **Test connection reports "Foundry rejected these credentials."** For OAuth2 client credentials, confirm the **Client ID** and **Client secret**. For bearer token authentication, confirm the **Bearer token**. **Test connection reports "Foundry accepted these credentials but the application is not allowed to use the Filesystem API."** Allow the named API for the application in Foundry, then reconnect. For a restricted Developer Console application, update its operation restrictions. For a legacy OAuth client, add the corresponding `api:*` scope. **Test connection reports "Missing resource permissions."** Confirm that the Foundry service user can access the requested chatbot, filesystem, or session-log resource. **Foundry denies an API call.** The error names the denied call. Confirm that the application is allowed to use that API and that its service user can see the requested resource. **Test connection reports "Could not reach Foundry."** Confirm that the enrollment URL is an available HTTPS hostname with no path, then try again. **An enabled chatbot has zero traces.** Confirm that the session-log export covers the chatbot's project, uses the Palantir JSON schema, and has started receiving rows. The chatbot must be enabled, and executions remain pending until they include a `final_response` or `execution_error`. **An enabled AIP Logic function has zero runs.** Confirm that a telemetry stream's export uses the OpenTelemetry schema, covers the function's project, and has started receiving rows. If a stream under **Telemetry streams** shows **error**, hover the status to see its last error. Confirm that you registered the function's RID; registering by RID is the recommended path. Executions appear on the next sync after they reach the export. For executions that ran before you registered the function, use **Backfill history** on the **AIP Logic** tab. Openlayer waits for a run's top-level span before writing the run, so a run whose top-level span arrives after its steps, which is common during backfill, can take up to about 30 minutes to appear. **An AIP Logic chat completion step has no cost.** Openlayer estimates cost only when the model name matches its price list. An unrecognized model family shows neither a provider nor cost; a recognized family can show a provider without cost when its model name does not match the price list. Existing stored runs are not repriced, and **Backfill history** skips runs that are already stored. **Adding a telemetry stream is rejected.** Confirm that the dataset RID is the export's streaming dataset RID and is not already added. The application needs Streams API access (`api:streams-read`), and its service user needs Viewer access to the dataset. **An AIP Logic function or project shows a RID instead of a name.** Foundry could not name the target when you registered it, so Openlayer kept the RID as a placeholder. A function is named on the next sync that reads one of its executions; use **Backfill history** if it has no new executions. For a Logic file or action type, grant the access listed under [Prerequisites](#prerequisites), then register the target again. See [Monitor AIP Logic query functions](#monitor-aip-logic-query-functions). **A single-session ingest is not ready.** Confirm that `getSessionTrace` reports a complete session and that you entered the correct session trace ID. Path A sessions expire after approximately 24 hours. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.