The unique ID generated for every request coming to AWS KMS involving XKS keys is also forwarded to the XKS proxy. You can use the log data (if available) from your XKS proxy or external key manager to reconcile requests made to AWS KMS with the ones made to your external key manager. This feature allows you to verify that all requests to use keys in your external key manager originated from a call you initiated to AWS KMS either directly or through an integrated AWS service.