Skip to main content
Openlayer connects to Palantir Foundry to monitor AIP Chatbots and AIP Logic query functions. AIP Chatbots were formerly called AIP Agents. The integration ingests production executions from Foundry log exports and writes them to the Openlayer projects linked to your enabled agents and functions.

​
How it works

Once connected, Openlayer:
  1. Registers targets — discover or register AIP Chatbots, and register AIP Logic functions by function RID or Query API name.
  2. Links Openlayer projects — enabling an agent or function links it to an Openlayer project and inference pipeline. These projects display a Foundry mark in the projects list, project header, sidebars, command menu, and configured integrations.
  3. Syncs executions — polls the Chatbot Studio session-log stream for agents and the OpenTelemetry telemetry stream for AIP Logic functions.
  4. Builds traces — maps each completed production execution into an Openlayer trace.
Only enabled targets are ingested. Executions from unregistered agents and functions are dropped rather than registered automatically.
Cron sync uses the Chatbot Studio session-log dataset rather than AIP Agents v2 listSessions. That API only returns sessions for the calling user and originating client, so it does not expose Studio traffic from other users.

​
Prerequisites

Before connecting, you need:
  • A Foundry enrollment with at least one AIP Chatbot or AIP Logic function.
  • OAuth2 client credentials for a third-party application or a bearer token. The application or token must be allowed to use the Foundry APIs below.
  • The appropriate log export created by a Foundry Org Admin:
    • For AIP Agents, a Chatbot Studio session-log export using the Palantir JSON schema.
    • For AIP Logic, a log export using the OpenTelemetry schema that covers the projects containing the functions you want to monitor.
  • An Openlayer workspace where you are an admin.
Your enrollment URL must use HTTPS and contain only the hostname, such as https://example.palantirfoundry.com, with no path.
For a restricted Developer Console application, allow the matching api:use-* operations and resources in Application restrictions. Openlayer does not request specific scopes when exchanging client credentials, so the application’s Foundry restrictions and service-user permissions determine what the token can access. A bearer token must carry equivalent API access. Functions access is optional when you register functions by RID.

​
Create the log exports

In Control Panel, a Foundry Org Admin selects the organization and opens Log observability settings. Create an export that covers the relevant projects, then copy its streaming dataset RID. Use the Palantir JSON schema for the AIP Agent session-log export. Use the OpenTelemetry schema for the AIP Logic telemetry export. These are separate streams; do not use the Palantir JSON schema for AIP Logic. Allow up to five minutes for rows to appear.
Markings are not inherited by the exported dataset. Prompts and user input can appear in the stream, so configure the export’s projects and access controls appropriately.

​
Set up the integration

​
Step 1: Connect your enrollment

  1. In Openlayer, go to Settings → Integrations.
  2. Select Palantir Foundry.
  3. Under Connect, enter:
    • Enrollment URL — your HTTPS Foundry enrollment hostname with no path.
    • Authentication — select OAuth2 client credentials or Bearer token.
    • For OAuth2 client credentials, enter your Client ID and Client secret.
    • For Bearer token, enter your Bearer token.
    • Session-log dataset RID (optional) — the RID from your Org Admin’s log export.
    • Stream branch — the dataset branch, which defaults to master.
  4. Click Connect.
Openlayer verifies the hostname and selected credentials before saving the connection. Palantir Foundry connect
You can connect without entering a dataset RID. Ingestion for each target type remains inactive until you configure its corresponding stream under Settings.
After connecting, Overview shows the selected Authentication method and, for OAuth2 client credentials, the Client ID. It also shows Telemetry dataset when you configure the AIP Logic stream. The integration detail page has General, AIP Agents, and AIP Logic tabs.

​
Step 2: Discover or register AIP Agents

On the AIP Agents tab, click Discover agents to walk the Compass folders visible to your credentials for AIP Chatbot files. You can also click Register agent and provide either:
  • The agent RID from the Chatbot Studio URL.
  • A Foundry filesystem path, such as /Org/Project/My Agent.
Discovery only finds Compass files with the AIP_AGENTS_AGENT type. Palantir Foundry agents

​
Step 3: Enable chatbots

Click Enable for each chatbot you want to monitor. Openlayer links a project and inference pipeline, then starts ingesting matching executions. The AIP Agents tab shows each chatbot and its number of imported sessions. To stop ingesting future traces for a chatbot, open its Agent options menu and select Disable. Existing traces remain available.

​
Step 4: Configure log streams

On the General tab under Settings, enter the Session-log dataset RID for AIP Agents and the Telemetry stream dataset RID (AIP Logic) for AIP Logic, then click Save log streams. Turn on Periodic sync to poll the stream every 15 minutes, or click Sync now to queue a manual sync. Periodic sync requires at least one dataset RID and access to the Streams API. Under Connection health, click Test connection to check your stored credentials. Openlayer reports invalid credentials, missing API access, missing resource permissions, or Foundry availability problems separately.

​
Monitor AIP Logic query functions

Before registering a function, configure the OpenTelemetry log export in Foundry and save its RID as the Telemetry stream dataset RID (AIP Logic) on the General tab. AIP Logic ingestion remains inactive until this RID is set. On the AIP Logic tab, select Register function and identify the function by Function RID or Query API name. Registering by function RID is recommended and works for functions that are not published as Queries. Registering by Query API name requires access to the Functions API to resolve the RID. Registering by function RID does not use the Functions API, including during monitoring. Select Enable, then choose Create new project or Map to existing project. The table shows Function and Runs, with no version column. Only enabled functions are ingested; executions from unregistered functions are dropped. Select Disable to stop ingesting future executions for a function. Existing traces remain available. Backfill history re-reads the telemetry export from the oldest record Foundry still retains, so you can ingest executions that ran before a function was registered. The read position belongs to the connection, and one backfill covers every enabled function. Executions already stored are skipped, so backfill does not create duplicate runs. A long history arrives over several syncs, and backfill recovers only what the export still retains. While the replay runs, live executions appear after it catches up. The button stays disabled until you set the Telemetry stream dataset RID (AIP Logic). Rename changes only the name shown in Openlayer; ingestion still matches the function RID, and registering the function again keeps that name. Remove function deletes the registration and stops future ingestion, keeps the function’s project, pipeline, and existing runs, and requires the same permission as registering.

​
Ingest a single session

The session-log stream is the primary sync source. If you have a gateway-originated session’s three identifiers, you can ingest that session directly:
  1. Open the chatbot row’s Agent options menu and select Ingest.
  2. Enter the Session RID and Session trace ID. The agent RID is already known from the chatbot row.
  3. Click Ingest.
This action uses getSessionTrace and only works when you have the IDs from the originating client. Palantir documents that these sessions expire after approximately 24 hours.

​
Trace mapping

​
AIP Chatbots

Openlayer maps Palantir JSON session-log events as follows: Model, token, and cost data appear only when sibling language-model usage events share the same traceId. Chatbot events do not always include these usage events.

​
AIP Logic functions

Each call to a registered function becomes its own run, rooted at that function’s execution. When an AIP Chatbot or another function calls a registered function, each call counts as a separate run, and the caller’s own steps are not included in the function’s trace. Other spans appear as regular steps. Chat completion steps include the prompt, completion, token, and cost data when those fields are present in the telemetry export. Palantir Foundry trace

​
Disconnecting

To disconnect, open Settings → Integrations → Palantir Foundry and click Disconnect. Disconnecting stops syncing and deletes registered AIP Agent and AIP Logic function records. Existing Openlayer traces are preserved.

​
Troubleshooting

Sync fails with a missing dataset RID. Configure the dataset RID for the target type under Settings. AIP Agent session logs use the Palantir JSON schema; AIP Logic telemetry uses the OpenTelemetry schema. No chatbots appear after discovery. Discovery only finds AIP_AGENTS_AGENT Compass files. Confirm that the application is allowed to use the AIP Agents and Filesystem APIs and that its service user can see the folders containing your chatbots. You can also register a chatbot by RID or filesystem path. Test connection reports “Foundry rejected these credentials.” For OAuth2 client credentials, confirm the Client ID and Client secret. For bearer token authentication, confirm the Bearer token. Test connection reports “Foundry accepted these credentials but the application is not allowed to use the Filesystem API.” Allow the named API for the application in Foundry, then reconnect. For a restricted Developer Console application, update its operation restrictions. For a legacy OAuth client, add the corresponding api:* scope. Test connection reports “Missing resource permissions.” Confirm that the Foundry service user can access the requested chatbot, filesystem, or session-log resource. Foundry denies an API call. The error names the denied call. Confirm that the application is allowed to use that API and that its service user can see the requested resource. Test connection reports “Could not reach Foundry.” Confirm that the enrollment URL is an available HTTPS hostname with no path, then try again. An enabled chatbot has zero traces. Confirm that the session-log export covers the chatbot’s project, uses the Palantir JSON schema, and has started receiving rows. The chatbot must be enabled, and executions remain pending until they include a final_response or execution_error. An enabled AIP Logic function has zero runs. Confirm that the export uses the OpenTelemetry schema, covers the function’s project, and has started receiving rows. Confirm that you registered the function’s RID; registering by RID is the recommended path. Executions appear on the next sync after they reach the export. For executions that ran before you registered the function, use Backfill history on the AIP Logic tab. A single-session ingest is not ready. Confirm that getSessionTrace reports a complete session and that you entered the correct session trace ID. Path A sessions expire after approximately 24 hours.