The logging policy records the full HTTP request and response for every matched request. Use it to debug issues, audit API usage, and understand traffic patterns without adding instrumentation to your application.
What gets logged
The gateway captures the following for each request:
Request data
- HTTP method, host, path, and query string
- Request headers (Authorization headers are redacted)
- Request body
Response data
- Status code
- Response headers
- Response body
Metadata
- Request ID
- Timestamp
- Deployment and instance identifiers
- Client IP address and user agent
- Region
Latency breakdown
Redact body fields
When an OpenAPI validation policy matches a request, the logging policy reads
x-unkey-redact from the OpenAPI specification.
Set x-unkey-redact: true on a sensitive JSON property. The gateway replaces
its value with [REDACTED] in stored request and response bodies.
Omit x-unkey-redact when a field does not need redaction. A value of false
has the same effect. The gateway always redacts authorization headers and
credentials that a KeyAuth policy defines.
View logs
Logs are available in the Requests tab of your project in the Unkey dashboard. You can filter by:
- Status code
- HTTP method
- Path
- Deployment
- Environment
The dashboard supports live streaming for real-time monitoring.
Retention
Logs are retained for 30 days. Last modified on August 12, 2026
