> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leme.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Axiom

> Let agents explore your logs and events in Axiom with read-only APL queries

Connect Axiom and your agents can dig through your logs and events without anyone writing a query by hand: find the errors behind an incident, quantify how often something happens, pull the numbers for a status update.

**This integration is read-only.** Agents list datasets, inspect fields, and run APL queries — they never ingest, modify, or delete data.

## What agents can do

| Capability             | Details                                                                |
| ---------------------- | ---------------------------------------------------------------------- |
| List datasets          | Discover what's in the workspace before querying.                      |
| Inspect dataset fields | Field names and types, so queries are written against the real schema. |
| Run APL queries        | Read-only queries with sensible result limits.                         |

## Try asking

* *"How many 5xx errors did the API log in the last 24 hours?"*
* *"What are the most common error messages in the worker dataset this week?"*
* *"Show the latency trend for checkout requests since Monday."*
* *"Did anything unusual happen in the logs around 14:30 UTC yesterday?"*
* *"Which datasets do we have, and how fresh are they?"*

## Connect Axiom

<Steps>
  <Step title="Create an API token in Axiom">
    In your Axiom workspace settings, create an **advanced API token** with only what agents need:

    * list datasets;
    * read dataset fields;
    * run APL queries.

    Restrict it to the datasets agents should be allowed to query. The token starts with `xaat-`.
  </Step>

  <Step title="Open Integrations">
    In the Leme dashboard, go to **Integrations** and select **Axiom**.
  </Step>

  <Step title="Paste the token">
    Keep the default edge unless your Axiom administrator gave you a regional one (see below), paste the token, and select **Connect Axiom**. Leme validates the token by listing datasets before saving.
  </Step>

  <Step title="Enable it on your agents">
    Attach the connection to the agents that should use it.
  </Step>
</Steps>

<Note>
  Use an Axiom **API token**, not a Personal Access Token. API tokens support least privilege; PATs grant broad account control.
</Note>

Axiom is a **shared** connection: every enabled agent queries through the same token, so the token's dataset restrictions are the boundary for all of them.

## Edge setting

Most teams keep the default `api` edge. Change it only if your Axiom administrator tells you queries should use a regional edge:

| Edge                    | Use when                                                  |
| ----------------------- | --------------------------------------------------------- |
| `api`                   | You're not sure, or your workspace uses the default edge. |
| `us-east-1.aws.edge`    | Your Axiom administrator gave you the US East 1 edge.     |
| `eu-central-1.aws.edge` | Your Axiom administrator gave you the EU Central 1 edge.  |

## Permissions

| Action                                      | Category | Default |
| ------------------------------------------- | -------- | ------- |
| List datasets, read fields, run APL queries | Read     | Allow   |

Nothing else to configure — the integration has no write actions. Access scoping happens on the Axiom side, through the token's dataset restrictions. See [Permissions & approvals](/permissions) for the general model.

## Security notes

The token is stored encrypted and never shown again after setup. Rotate it in Axiom if it may have been exposed, when its owner leaves, or when your permission model changes — then reconnect in Leme with the new token.

## Troubleshooting

<AccordionGroup>
  <Accordion title="The token is rejected before reaching Axiom">
    Check the format: Axiom API tokens start with `xaat-`. Personal Access Tokens are not accepted.
  </Accordion>

  <Accordion title="Setup fails during validation">
    The token can't list datasets. Recreate it with dataset read permission, or use a token with sufficient scope.
  </Accordion>

  <Accordion title="Queries fail after connecting">
    Either the edge doesn't match your workspace — confirm it with your Axiom administrator and reconnect — or the token isn't allowed to query that dataset.
  </Accordion>

  <Accordion title="The agent doesn't see a dataset">
    The token is restricted to specific datasets and that one isn't included. Extend the token's dataset access in Axiom.
  </Accordion>
</AccordionGroup>