Shield Agent AI

← Docs hub

Customer guide

Import traces into KYA

Already running LangSmith, Langfuse, Phoenix, or a plain OpenTelemetry pipeline? kya import converts those exports into the same local trail your receipt and kya certify read, so existing runs count as evidence too.

kya import --from langsmith ./runs.json
kya import --from langfuse ./observations.jsonl
kya import --from phoenix ./traces.json
kya import --from otel ./otraces.json
  • Imports land as observe-mode events (host: import, reasonCode: IMPORTED); error runs become DENY / IMPORTED_ERROR.
  • Latency and token counts map across when the source carries them.
  • Files over 50MB are refused. Malformed records are skipped, never fatal.
  • Persisted fields pass the same redaction and secret scan as any trail write.

Real usage in the trail

MCP evaluates carry latencyMs. Host payloads with a usage object (and imported traces) carry tokensIn / tokensOut, which are preferred over the static per-event estimate. The showback card on the receipt reports real versus estimated usage and states how many window events had real data.

Hosted import

The hosted console accepts the same exports: upload at /app/kya/import or post to POST /api/v1/kya/import?from=langsmith|langfuse|phoenix|otel (or from=agt, see Import the AGT audit log) with your workspace API key. Mapping is byte-identical to the CLI (shared golden fixtures prove it). Hosted bodies cap at 10MB and each plan has a monthly imported-event allowance: Free 10k, Starter 100k, Pro 500k, Scale unlimited. Over the allowance the request is refused with 402 and nothing is written.

Hosted session ingest also stores merchant-scoped usage that metrics roll up. See observe sessions and the session ingest API.

Continuous sync (Scale)

On Scale you can skip uploads entirely: register a LangSmith or Langfuse connector at /app/kya/connectors (or via POST /api/v1/kya/connectors) and the platform polls your projects every 15 minutes, streaming new runs into the same governed trail through the same mapper and quota path. Credentials are encrypted at rest and never returned by the API; each connector tracks its own cursor, last sync, and status, and a failed connector never blocks the others.

Docs hub · Install · How KYA works · Source