# Monitor your surface

> Use the surface Monitoring tab, response headers, and the rejection breakdown to see your test requests, confirm cost tracking, and learn where to look when something goes wrong.

By the end of this page, you will have seen the test requests from the previous guides appear in three places, confirming that traffic is routing, cost is being metered, and guardrail rejections are being classified correctly.

The test requests you already sent provide the traffic used in this page. No new surface configuration is required.

## Prerequisites

- Completed [Add guardrails and a budget](/products/affinidi-trust-fabric/agent-stream/get-started/add-guardrails-and-budget.md).

- You have sent at least one request using the test commands from the previous guides.

## Steps

See request traffic in the Monitoring tab

Each surface has its own Monitoring tab, scoped to that surface alone, with several more charts below the one shown here.

Under SURFACES in the sidebar, select LLM, then open the surface you created in [Create your first LLM Surface](/products/affinidi-trust-fabric/agent-stream/get-started/create-first-surface.md). Select the Monitoring tab.

Look for the following, updated in near real time:

- Summary cards: Main LLM, Judge, and Jury latency and token figures, plus total cost, for the selected window.

- Surface Traffic Over Time and Error Rate Over Time: request volume and the share of requests that failed.

- Connection Latency Over Time: response time at p50, p95, and p99.

- Token Usage Over Time: input and output token consumption for every request this surface handled, including the test calls from the previous guides.

Because metering runs per stage, if this surface has Judge or Jury enabled, their cost and token figures appear as separate series rather than folded into one combined number for the whole request. See [Cost and usage governance →](/products/affinidi-trust-fabric/agent-stream/concepts/cost-and-usage-governance.md).

Read cost and usage from the response headers

Send any test request again, this time with curl -i to see the response headers:

```bash
curl -k -i -X POST "https:///v1/chat/completions" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [
      { "role": "user", "content": "One more test request." }
    ]
  }'
```
Caution

The -k flag disables TLS certificate verification. Use this for local testing only; remove it in production.

A buffered response carries x-agent-stream-* headers: trace ID, provider, model, token counts, cached-token count, cost, cache hit or miss, and the ingress wire format the caller used. A client can read cost and usage figures directly from these headers without parsing the response body. A streamed response carries the request-time subset of the same headers. See [Observability →](/products/affinidi-trust-fabric/agent-stream/concepts/observability.md) for the full signal list.
Tip

The trace ID in x-agent-stream-trace-id is the fastest way to correlate one specific curl call with its entry in the Monitoring tab or in an exported trace, if this appliance has OpenTelemetry export configured.

Check the rejection breakdown

Still on the Monitoring tab, find the Rejections by category card. Every guardrail block that actually rejects a request, not one that only masks or redacts a value, is classified into a stable taxonomy and charted here, per surface and stage.

The masked email request from [Add guardrails and a budget](/products/affinidi-trust-fabric/agent-stream/get-started/add-guardrails-and-budget.md) does not appear here at all: masking is not a rejection. If you send a request that Prompt Guard actually rejects, expect the entry to land under Uncategorized rather than PII for now, since a built-in pattern’s rejection doesn’t yet carry a category of its own, a known gap, not a sign you’ve misconfigured anything. If you crossed the monthly cap from that guide, the 429 usage-limit rejection appears here too.

## Confirm

Confirm the following three views all show data from your test traffic:

- The Monitoring tab’s summary cards and traffic chart show non-zero spend.

- The curl -i response in step 2 includes an x-agent-stream-cost-usd header.

- Sending a request Prompt Guard actually rejects produces an entry in the rejection breakdown (currently under Uncategorized, not PII — see the note above).

## Other monitoring tools

Beyond the per-surface Monitoring tab, the appliance also offers:

- A real-time management dashboard showing cost, tokens, latency, and throughput across every surface, with per-surface breakdowns.

- Exports to a native Langfuse connector, OpenTelemetry OTLP, a Prometheus scrape endpoint, or a content-capturing webhook, so the same telemetry reaches tools your team already runs. See [Observability →](/products/affinidi-trust-fabric/agent-stream/concepts/observability.md).

- Governance records, a signed, tamper-evident transcript of what entered and left a surface, if recording is enabled. See [Governance records →](/products/affinidi-trust-fabric/agent-stream/concepts/governance-records.md).

## Next steps

- [Observability](/products/affinidi-trust-fabric/agent-stream/concepts/observability.md): The full telemetry model and how to export it to your own stack.

- [Teams and attribution](/products/affinidi-trust-fabric/agent-stream/concepts/teams-and-attribution.md): Attribute this surface’s usage to individual members and teams.

- [Governance records](/products/affinidi-trust-fabric/agent-stream/concepts/governance-records.md): The signed, tamper-evident transcript of what entered and left a surface.

- [How-to guides](/products/affinidi-trust-fabric/agent-stream/how-to-guides.md): Configure routing, resilience, and additional guardrail layers on your surfaces.