> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Flags and Traces

> List what your policies flagged, mark false positives, and look up a trace ID

`unbound flags` lists terminal commands that a tool policy flagged and PII or secrets that a data security guardrail found. `unbound trace` shows everything recorded for one trace ID.

Listing requires Admin, Manager or Analytics Viewer. Marking a false positive requires Admin.

## Terminal runs

```bash theme={null}
unbound flags terminal
unbound flags terminal --action block,warn --time-window SEVEN_DAYS
unbound flags terminal mark-fp 81234 --risk-score 8 --comment "Our build script"
```

| Flag | Filters by |
| - | - |
| `--action <actions>` | `block`, `approval`, `warn`, `audit`. Default all four |
| `--policy <ids>` | Tool policy IDs |
| `--trace <trace-id>` | One trace ID |
| `--tool <types>` | AI tool, e.g. `CLAUDE_CODE,CURSOR` |
| `--family <families>` | Command family |

`mark-fp` takes the run's ID and its Risk value, 1 to 10. It saves the same feedback as rejecting a risk score in the dashboard, and the run's Feedback column then reads *False positive*.

## Data security

```bash theme={null}
unbound flags data-security
unbound flags data-security --guardrail Secrets --findings false-positive
unbound flags data-security mark-fp 5521
```

| Flag | Filters by |
| - | - |
| `--guardrail <names>` | Guardrail names or IDs, e.g. `PII,Secrets` |
| `--action <actions>` | `block`, `redact`, `route`, `audit` |
| `--findings <which>` | `real` (default), `false-positive`, `all`. With `--trace` the default is `all` |
| `--trace <trace-id>` | One trace ID |
| `--reveal` | Show detected values and prompts |

Each row is one detection. `mark-fp` takes its Action ID, and the gateway then skips that value for your whole organization, as **Mark as False Positive** does in [Data Security](/dashboard/analytics/data).

<Warning>
  The CLI masks detected values in the table and in `--json`. `--reveal` prints them in clear text.
</Warning>

Both list commands also take `--page` (10 rows per page), `--json`, `--wide`, and the time flags from [Analytics](/cli/analytics#filters).

## Look up a trace ID

```bash theme={null}
unbound trace 3f2a6c1e-8b7d-4e2f-9a1c-5d6e7f8a9b0c
unbound trace 3f2a6c1e-8b7d-4e2f-9a1c-5d6e7f8a9b0c --json
```

The trace ID is the UUID a user sees under a blocked or warned action. `trace` searches Logs, Terminal Runs (last 3 months) and Data Security (last 3 months, false positives included). Prompts and detected values stay hidden unless you pass `--reveal`.

It exits `1` if a source fails, for example because your role can't read it, or matches more than 10 pages. The other sources still print.

<Note>
  Requires CLI 1.16.21 or later.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.