OpenTelemetry (OTLP)

What it does

Safeguard receives OpenTelemetry logs, metrics and traces over OTLP/HTTP from your own exporters: Claude Code, OpenAI Codex, or any OpenTelemetry Collector. Telemetry from Claude Code and Codex becomes AI agent events, AI Detection & Response (AIDR) detections in Detection & Response, and events in Security Operations. Telemetry from other sources is kept as generic telemetry when the token's policy allows it. The card is OpenTelemetry (OTLP) on the Project/Product tab of Integrations.

Public vs private

Supported auth methods

OTLP over HTTP only (http/protobuf or http/json, gzip accepted). OTLP over gRPC is not offered: it needs HTTP/2 end to end, and Safeguard's public edge answers HTTP/1.1. Set your exporter's protocol to http/protobuf (or http/json), never grpc.

Permissions required

Safeguard issues the credential, so there is nothing to grant in a vendor account. The ingest token only lets an exporter send telemetry to your workspace; it cannot read anything back. Least privilege: issue one token per fleet or team, so you can revoke one group without touching the others.

Ingest token

Least privilege: one token per group of machines, content kept off, retention as short as your policy allows (30 days by default).

Who can manage tokens in Safeguard

Token types

Expiry: ingest tokens do not expire on their own. Rotate them on your normal credential schedule (for example every 90 days) and whenever a machine image or configuration that holds one leaves your control. A workspace can hold up to 50 active tokens.

What we never need: your Anthropic or OpenAI keys, your Claude or ChatGPT account, prompt or tool-detail logging (OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, Codex log_user_prompt), or gRPC.

Step-by-step setup

Create the credential in Safeguard

1. Open Integrations, choose the Project/Product tab and click the OpenTelemetry (OTLP) card.
2. Under Issue an ingest token, enter a Name (for example "Engineering laptops") and click Issue token.
3. Copy the token. Safeguard shows it only once; if it is lost, rotate it.

The endpoint base is https://api.safeguard.sh/gpt/api/v1/otlp. Exporters that take a base URL append /v1/logs, /v1/metrics and /v1/traces themselves.

Claude Code

Set these where Claude Code runs (shell profile, or the env block of Claude Code's settings):

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_METRICS_EXPORTER=otlp
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
export OTEL_EXPORTER_OTLP_ENDPOINT=https://api.safeguard.sh/gpt/api/v1/otlp
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer sg_otlp_YOUR_TOKEN"

To roll it out to every machine, put the same values in the env block of Claude Code's managed settings:

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://api.safeguard.sh/gpt/api/v1/otlp",
    "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer sg_otlp_YOUR_TOKEN"
  }
}

Leave OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, OTEL_LOG_ASSISTANT_RESPONSES and OTEL_LOG_TOOL_CONTENT unset unless your policy allows content. Even when they are set, Safeguard drops that content unless the token's Keep content policy is on.

Codex

Add this to ~/.codex/config.toml. Codex sends its events as logs, so the endpoint is the full logs URL:

[otel]
environment = "prod"
log_user_prompt = false

[otel.exporter.otlp-http]
endpoint = "https://api.safeguard.sh/gpt/api/v1/otlp/v1/logs"
protocol = "binary"

[otel.exporter.otlp-http.headers]
"x-safeguard-ingest-token" = "${SAFEGUARD_OTLP_TOKEN}"

Then set SAFEGUARD_OTLP_TOKEN to your token in the environment Codex runs in.

Or with an OpenTelemetry Collector

Add an otlp_http exporter (named otlphttp before Collector 0.161; the old name still works) and list it in each pipeline you want to send:

exporters:
  otlp_http/safeguard:
    endpoint: https://api.safeguard.sh/gpt/api/v1/otlp
    encoding: proto
    compression: gzip
    headers:
      Authorization: "Bearer ${env:SAFEGUARD_OTLP_TOKEN}"

service:
  pipelines:
    logs:
      exporters: [otlp_http/safeguard]
    metrics:
      exporters: [otlp_http/safeguard]
    traces:
      exporters: [otlp_http/safeguard]

Connect it in Safeguard

1. Open Integrations, choose the Project/Product tab and click OpenTelemetry (OTLP).
2. Issue a token as above. The Set up an exporter tabs (Claude Code, Codex, OTel Collector) show the snippets with the token you just issued.
3. Start your exporter. Under Received, Log records, Data points and Spans count up within a minute (Claude Code exports metrics every 60 seconds and logs every 5 seconds by default).

Webhooks and triggers

This integration has no webhooks; your exporters push telemetry as it happens.

What we read and store

• Read: only what your exporters send to the endpoint with your token. Safeguard never connects to Claude, Codex or OpenAI for this integration.
• Stored: AI agent events (session, tool decisions and results, model calls, tokens and cost, sub-agent links), AIDR detections in Detection & Response, Security Operations events, and, when Keep other telemetry is on, generic telemetry with its attributes cut to an allowlist. Kept for the token's retention (30 days by default).
• Redacted on arrival, always: credentials in every kept value, including API keys (Anthropic, OpenAI, AWS, GitHub, GitLab, Slack, Stripe, Google, npm, Safeguard), private keys, bearer tokens, passwords in key=value pairs and credentials in URLs. Each becomes [REDACTED:<kind>].
• Not stored: prompt, tool input, response and message content (only their length) unless the token's Keep content policy is on; then it is redacted and cut to 2,048 characters, stored but never searchable. The ingest token itself is stored only as a hash.
• Limits: a request body of up to 4 MiB (16 MiB once decompressed) and 10,000 records; 20 requests a second per token and 60 per workspace. Over a limit, Safeguard answers 413 or 429 with Retry-After, and OTLP exporters retry on their own.
• No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Rotation and disconnect

• Rotate: in the token list click Rotate, set a Grace period (minutes) of up to 60 if the exporters need time to update, and copy the new token into every exporter. The old token stops working when the grace period ends.
• Disconnect: click Revoke on the token. Exporters using it are refused from then on; what was already received stays until its retention ends. Remove the OTLP settings from Claude Code, Codex or the Collector.

Vendor references

• Claude Code: Monitoring (OpenTelemetry), checked 2026-10-16.
• Codex: Advanced configuration, OpenTelemetry, checked 2026-10-16.
• OpenTelemetry Protocol (OTLP) specification, checked 2026-10-16.
• OpenTelemetry Collector OTLP/HTTP exporter, checked 2026-10-16.