Explorer
Searching traces, reading a trace and its spans, error groups, the live tail and saved views, and which capability each of them needs.
Traces in the app is the explorer: a filtered list of traces with the sampling denominators beside it, a trace page with the span tree, timings and cost breakdown, a span drawer that opens bodies only for those allowed to read them, an Errors page of error groups, a live tail and saved views. Nothing here reads a body by accident: the list and the trace page never carry bodies, and the span drawer asks for them separately under trace.read_body.
Status (25 October 2026). The traces component is built in the application (ingestion, explorer, settings, exports and deletions pages are live in the shell); its requirements EV-002 to EV-009 are not yet marked implemented in the requirements ledger and are being verified now. Nothing on this page is marked verified.
Who sees what
| Capability | What it opens |
|---|---|
trace.read |
the list, trace pages, attributes, events, links, usage and cost, receipts |
trace.read_body |
input, output, tool arguments and results, retrieval queries — what the capture policy stored |
query.save |
saving a view; changing or deleting someone else's needs project.admin |
trace.export, trace.delete |
exports and deletions, on their own page (Retention, export and deletion) |
The trace_reader role holds the first three; see Roles and access.
Searching
Filters are the same rows for an ad-hoc search, a saved view and an export:
| Filter | Meaning |
|---|---|
from, to |
started at or after / before (epoch ms) |
environment, target, purpose, status |
one value each; status includes running |
q, name, trace_id |
name or trace id; name contains; exact trace id |
kind, error_type |
the trace has a span of that kind / with that error type |
attribute |
an attribute key equals a value (span or resource attributes) |
min_duration_ms, max_duration_ms, has_cost |
duration bounds; whether any span reported a cost |
At most 30 filters. Pages hold 50 traces by default and at most 200, newest first, with a cursor. A count is answered exactly up to 10,000 and as "more than" beyond that, and the list says what moment it is as of.
The sampling denominators
Beside every list the explorer shows, for the window and environment chosen, how many spans were received, stored, rejected, duplicated, sampled out and refused for quota or size — summed from hourly counters, not estimated. See Sampling and backpressure.
A trace
The trace page shows started, duration, spans, purpose, tokens and cost for application spans, Kept by (the sampling decision), received, target and subject, then the span tree. Three notices appear when they apply: the root span has not arrived, the trace was kept because of an error, and only part of the trace is shown (a page answers at most 5,000 spans and says so).
Where the time went is latency by span kind, total and self time. What it cost lists each figure with its purpose and its source — ledger, provider_report or estimate — and never adds purposes or sources together. Spans quoting the same ledger_ref count once (the deepest), a parent whose children report usage is their aggregate and is not counted again, and a counted span with no cost is shown as missing, never as 0.
A span
The span drawer shows status, error, purpose, started, duration, model, tool, usage, cost, subject, bodies, external judges, source schema and received; then span attributes, the resource (from OpenTelemetry), events, links and retrieved documents. A cost the producer called a ledger figure is marked: EvalBook verifies ledger figures only for its own calls.
Bodies load only for a reader with trace.read_body, and only as the capture policy stored them; which paths were redacted is shown. A body that was never captured, was purged by retention or was deleted is reported as such, never as an empty value. External judges says whether an LLM judge may be given this span's bodies (see Redaction and capture).
Errors
Traces → Errors groups error spans by fingerprint for a window and environment: the error, the span name, occurrences, traces, first and last seen and the latest example, most frequent first. The 50 most frequent are shown. Groups are computed from the spans EvalBook holds, so sampled-out traces are not in them.
Live tail
The list's tail shows traces received or changed since the last look, oldest change first, with a cursor.
Saved views
Saved views keep a name, a description and the filter rows — not the time window. A view is Only me (private) or Everyone on the project. Running a view is an ordinary search under the runner's own authorization; it never widens what they may see.
The same through the API
GET traces/api/list, show, span, errors, tail, facets and summary take the filters as a query string (?status=error&kind=llm&attr_key=customer.tier&attr_value=gold) with a session or an API key whose scopes allow reading; span additionally requires trace.read_body.