Skip to main content
Applies to:
  • Plan -
  • Deployment -

​
Summary

Overview: Service tokens for log ingestion require specific permission combinations to write logs successfully to Braintrust projects. Key insight: Log writes use merge/update operations internally, requiring update permissions even for new log creation.

​
How log ingestion permissions work

​
Required permissions

PermissionPurposeRequired for ingestion?
updatePerforms the actual log write (insert or merge)Yes
readRead project metadata / fetch logs backOnly if the token also reads/fetches
deleteDelete log rowsOnly for deletes

​
Why Logs Create alone fails

Logs Create permission is insufficient because:
  • All log writes use a merge/update operation internally
  • The system does not distinguish between inserting new logs and updating existing ones
  • Even “new” log entries follow the update code path

​
Permission scoping

Service tokens support fine-grained scoping. For least privilege, grant update on Project Log (and read on Project only if the token must also fetch logs). Granting update directly on the Project also enables ingestion via inheritance, but it cascades to experiments, datasets, prompts, etc., so prefer the narrower scope. Avoid Project Delete or Manage ACLs unless explicitly needed.