See your AI usage in 10 minutes

Point your AI traffic through Joopler and watch a live, signed record of every AI interaction appear on your dashboard. No agent to install, no certificate, nothing decrypted. You change one proxy setting and you are monitoring.

The prod fleet is live at proxy.joopler.com (observe mode, TLS).

You do not need any of this to start. AI assets and Agent discovery find what is running from the systems you have already connected, with no change to any runtime. This page is for capturing the calls themselves.

What you need

• A Joopler workspace where you are signed in as an admin.
• One machine, agent runtime, or CI job that calls an AI provider (OpenAI, Anthropic, Google, and others), so you have traffic to see.

Step 1: Create a proxy token

1. Go to AI usage in the left nav.
2. Click Issue proxy token and give it a name, for example Corp egress.
3. Copy the token that appears. It starts with jpx_ and is shown once. Store it like a password.

The token identifies your workspace and is scoped to usage reporting only. You can revoke it anytime from the same screen.

Step 2: Point your traffic at the proxy

Set your HTTPS proxy to the Joopler egress endpoint, with your token as the password and the person or system name as the username:

https_proxy=https://alice@yourco.com:jpx_YOUR_TOKEN@proxy.joopler.com
http_proxy=https://alice@yourco.com:jpx_YOUR_TOKEN@proxy.joopler.com

• The username (alice@yourco.com) is recorded as the acting user on each event. Use a real identifier so your reports attribute usage correctly.
• To cover a fleet of laptops, push the same proxy setting through your MDM.

Where that setting actually lives

"Set your HTTPS proxy" is a different job on every platform, and a container or a Windows service will not pick up a variable you exported in a shell. The AI usage page generates these for you with your own endpoint already filled in; here is where each one goes.

Three that catch people out:

# docker-compose.yml - on the container, not the host
services:
  agent:
    image: your-image
    environment:
      HTTPS_PROXY: "https://alice@yourco.com:jpx_YOUR_TOKEN@proxy.joopler.com"

# /etc/systemd/system/<service>.service.d/proxy.conf
# A unit does not read /etc/environment.
[Service]
Environment="HTTPS_PROXY=https://alice@yourco.com:jpx_YOUR_TOKEN@proxy.joopler.com"

# Windows: a service reads its environment when it starts.
[Environment]::SetEnvironmentVariable("HTTPS_PROXY", "https://alice@yourco.com:jpx_YOUR_TOKEN@proxy.joopler.com", "Machine")
Restart-Service <service>

.NET's HttpClient honours HTTPS_PROXY. An IIS-hosted app reads it from the app pool's environment. Node's AWS SDK v3 is the one common client that ignores these variables and needs an explicit proxy agent.

Check that it worked

One call through the proxy, then refresh AI usage. The event appears within seconds, and if it does not, the proxy setting did not reach the process.

https_proxy=https://alice@yourco.com:jpx_YOUR_TOKEN@proxy.joopler.com \
  curl https://api.anthropic.com/v1/models \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01"

Observe mode vs terminate mode

• Observe (default, no CA). Records who reached which provider and when, and tunnels the encrypted bytes unread. No TLS interception, zero device setup.
• Terminate (your CA configured). Decrypts AI traffic to run the full inspection pipeline (model policy, DLP, prompt-injection detection, output inspection) and can block on policy. It uses your organization's existing MITM CA; without a CA the proxy stays in observe mode. Non-AI hosts are never decrypted.

Observing and recording AI traffic is available on every plan. Actually blocking or redacting it - the enforcement in terminate mode - is a Growth-plan feature; on lower plans the proxy records everything but does not block. See Enforcement is a Growth plan feature.

Every inspected event becomes a signed, hash-chained, timestamped evidence record on your AI usage dashboard, next to your reverse-proxy, ingested, and tool-call events.