Logging

The gateway always records a basic log entry for each request. The dashboard uses these entries for the traffic and latency charts. The logging policy can add potentially sensitive data to the log entries of matched requests: headers, bodies, and query data. You can opt into each capture individually. Without an enabled logging policy, the gateway stores only the basic entries. To capture data for all traffic, add a logging policy with no match conditions. To capture data only for specific routes, add match conditions to the policy.

Always logged

The gateway records this data for every request:

HTTP method, host, and path
Status code
Request ID and timestamp
Deployment and instance identifiers
Region
Latency breakdown

Metric	Description
Total latency	End-to-end time from when the gateway received the request
Instance latency	Time your app spent processing the request
Gateway latency	Overhead added by the gateway (policy evaluation, routing)

Opt-in capture

A logging policy has five independent settings. Each one adds data to the log entries of matched requests:

Setting	Captured data
Request headers	Request headers, user agent, and client IP
Response headers	Response headers
Request body	Request body, up to the capture limit
Response body	Response body, up to the capture limit
Query data	Query string and query parameters

The request headers setting includes the user agent and client IP because they identify the client. Query data is a separate setting because URLs can contain secrets, for example ?api_key=.... If more than one enabled logging policy matches a request, the gateway combines their settings. The gateway redacts sensitive values before it stores them. It always redacts the Authorization header. It also redacts headers and query parameters that carry API keys for the API key policy.

Redact body fields

When an OpenAPI validation policy matches a request, the logging policy reads x-unkey-redact from the OpenAPI specification. Set x-unkey-redact: true on a sensitive JSON property. The gateway replaces its value with [REDACTED] in stored request and response bodies.

properties:
  token:
    type: string
    x-unkey-redact: true

Omit x-unkey-redact when a field does not need redaction. A value of false has the same effect. The gateway always redacts authorization headers and credentials that a KeyAuth policy defines.

View logs

You can see the logs in the Requests tab of your project in the Unkey dashboard. You can filter by:

Status code
HTTP method
Path
Deployment
Environment

The dashboard supports live streaming for real-time monitoring.

Retention

Log retention depends on your plan. See quotas.

Getting Started

Platform

Build & Deploy

Networking

Observability

CLI

Security

Keyspaces

AI Code Gen

Audit Logs

CLI

Errors

Always logged

Opt-in capture

Redact body fields

View logs

Retention

​Always logged

​Opt-in capture

​Redact body fields

​View logs

​Retention

Always logged

Opt-in capture

Redact body fields

View logs

Retention