سجل الطلبات

What is recorded

Every /v1 request made with a verified token is recorded after its response has been sent, including the ones that were refused once your token was accepted: an access-restriction 403, a per-token 429, a 404 for a record that does not exist, and a server error. For each one the log holds:

• method
• route template
• status
• duration
• error code
• caller IP address
• request id
• replay flag

The route is its template (/v1/products/:id, never the path you sent), and the error code is the one in the response body’s details.code. The request id is the one in the x-request-id response header, so a support conversation can find the exact call.

What is never recorded

• request bodies
• query strings
• credentials

A query string such as /v1/customers?q= can carry a customer’s name or phone number, so it is not stored, and the database refuses a route that contains one.

Failed credential checks are only counted

A request whose token names a real key but presents the wrong secret, or uses a key that has been revoked or has expired, is not recorded. It adds one to an hourly count the Business owner sees on the key’s activity page. A request with a token that matches no key at all is neither recorded nor counted. Either way the response you receive is the same generic 401.

How long it is kept

30 days by default, after which a daily job deletes the rows. An operator may set a different window. The log is best-effort: it never delays or fails your request, so in rare cases (a restart, a busy database) a request can go unrecorded, and the owner’s page says when that has happened.