# Monitor your surface > Use the surface Monitoring tab, Capture, and the global dashboard to see your test requests, confirm policy decisions, and learn where to look when something goes wrong. By the end of this page, you will have seen the test requests from the previous guides appear in four views, confirming that traffic is routing, identity is being derived, and the policy is enforcing correctly. The test requests you already sent provide the traffic used in this page. No new surface configuration is required. ## Prerequisites - Completed [Add identity and access control](/products/affinidi-trust-fabric/agent-gateway/get-started/secure-a-surface.md). - The echo server is still running. - You have sent at least one request using the test commands from the previous guide. ## Steps See request traffic in the Monitoring tab Each surface has a Monitoring tab that shows per-surface charts updated in near real time. Select Surfaces in the sidebar and open the surface you created in [Create your first surface](/products/affinidi-trust-fabric/agent-gateway/get-started/create-first-surface.md). Select the Monitoring tab. In the Connections Over Time chart, look for data points from the requests you sent. Datasets with no data are automatically hidden. The chart can show up to five series: - Connections: Total requests received. - Rule Accepts: Requests that passed OPA policy evaluation and were forwarded. - Rule Denies: Requests denied by the surface OPA policy (the 403 responses). - Failed: Requests that produced an error response for the caller, including identity validation failures (the 422 responses from the no-extension test in the previous guide). - Gateway Faults: Upstream errors unrelated to policy (for example, a backend timeout). Below the connections chart, the Connection Latency Over Time chart shows response times at p50 (Median), p95, p99, and Average. With the echo server as the backend, all percentiles should be under a few milliseconds. Inspect a payload with Capture Capture streams individual requests through each pipeline stage so you can see exactly what the gateway did to a payload. Still on the Monitoring tab, select Capture to open the Capture panel. Send the identity-bearing request from [Add identity and access control](/products/affinidi-trust-fabric/agent-gateway/get-started/secure-a-surface.md) Step 2 again, replacing and with your values: ```bash curl -k -X POST "https://" \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "method": "message/send", "id": "capture-test", "params": { "message": { "role": "user", "messageId": "msg-capture", "extensions": ["https://fabric.affinidi.io/extensions/agent-identity/v1"], "metadata": { "https://fabric.affinidi.io/extensions/agent-identity/v1": { "agentIdentity": { "agentId": "my-test-agent" } } }, "parts": [{ "kind": "text", "text": "Capture test" }] } } }' ``` Caution The -k flag disables TLS certificate verification. Use this for local testing only. Remove it in production. A row appears in the capture history. Select it to open the pipeline view. The pipeline shows the payload at each stage: - Source Agent (top): The agent or client that sent the request. - 1. Inbound Request (from source agent): The original payload received at the gateway, exactly as it arrived. The raw agentIdentity block is visible here. - 2. Outbound (to target): The transformed payload forwarded to the echo server. The raw agentIdentity block is replaced by a signed agent-identity-credential/v1 extension carrying a Verifiable Presentation. - 3. Inbound Response (from target): The raw response received from the echo server. - 4. Outbound Result (to source agent): The final response returned to your curl. - Source Agent (bottom): The same agent, now receiving the response. Stages 2 and 3 appear only when the gateway captures data for those legs. For a simple echo server test, you will typically see Source Agent → 1. Inbound Request → 4. Outbound Result → Source Agent. Tip When something behaves unexpectedly, start with Capture before checking logs or metrics. The pipeline view shows the exact payload at each stage, making it the fastest way to confirm whether the problem is in identity injection, policy evaluation, or backend routing. Read the log stream Select the Monitoring tab and scroll to the Channel Logs section at the bottom. This section shows only logs for that surface; no filtering is required. Entries from your test requests appear here, scoped to this surface. To see the full gateway log stream, select Logs under the Monitoring section in the sidebar. That page shows all gateway output in real time without any surface scoping. Check the gateway-wide dashboard Select Dashboard in the sidebar. Four stat cards summarise gateway activity: - Total Agent Identities: The number of distinct agent DIDs seen by the gateway. - Agent Surfaces: The number of configured surfaces. A fault badge appears if any surface is in a fault state. - Total Connections: Total requests received in the configured time window. - Avg Latency: Average request and response latency over the time window, shown separately for request and response. The Aggregated Connections Over Time chart shows traffic across all surfaces. Use the time-interval dropdown in the chart header to change the bucket size (30 seconds to 6 hours). The Surface Distribution chart shows each surface’s share of total traffic as a pie or bar chart. ## Other monitoring tools The Monitoring section in the sidebar contains additional tools you will use as your deployment grows: - Metrics: Hierarchical breakdown of traffic by source, identity, and destination across all surfaces. - Logs: Full gateway log stream across all surfaces in one place. - Audit: Structured audit log of configuration changes and access decisions. - Tasks: Confirm that a listener is running and restart it if a surface is not receiving traffic. - System: Separate an infrastructure problem from a configuration problem when the gateway is slow. ## Next steps - [Observability](/products/affinidi-trust-fabric/agent-gateway/concepts/observability.md): How the gateway produces traces, metrics, and structured logs, and how to export them to an external backend. - [How-to guides](/products/affinidi-trust-fabric/agent-gateway/how-to-guides.md): Add source authentication, outbound routing, and trust registry checks to your surfaces.