Skip to main content
The gateway logs the method, host, path, status, and latency of every request routed to your , including requests it rejects. A logging policy also saves headers, query data, or bodies for the requests it matches. Use it to debug a route. It never rejects a request or changes what your app receives. To add one, open the app, go to Policies, click Add policy, and set Type to Logging.

​
Settings

Each setting turns on one kind of data. In the dashboard all five start on, so check the switches before you save. In the API they all default to false, so a policy with none set saves nothing extra.
​
boolean
default:"false"
Save request headers, plus the user agent and client IP.
​
boolean
default:"false"
Save response headers.
​
boolean
default:"false"
Save the request body, up to 1 MiB.
​
boolean
default:"false"
Save the response body, up to 1 MiB.
​
boolean
default:"false"
Save the query string and parameters. It’s separate from headers because URLs often carry secrets like ?api_key=....
Example: capture everything on one debugging route

​
What gets saved

  • Several matching policies combine. A request matched by a requestHeaders policy and a requestBody policy gets both saved. A policy with no match expressions applies to every request.
  • Bodies are cut off at 1 MiB in each direction in the log. The request and response themselves are never cut. Streaming requests are covered too.
  • Requests rejected by a gateway policy are logged too. Matching logging policies apply whether they appear before or after the policy that rejects the request. Saved response bodies contain the gateway’s error response.
  • For rejected requests, body capture stops after 1 MiB or 1 second, whichever comes first. A slow or interrupted upload can have a partial body in the log.

​
What’s always redacted

These are replaced with [REDACTED] before anything is saved:
  • The Authorization header.
  • Every header and query parameter listed as a key location in any API key authentication policy, even turned-off ones. When a query parameter is redacted, the saved query string can be in a different order or encoding than the original.
  • Body fields marked x-unkey-redact: true in your OpenAPI spec, when an OpenAPI validation policy is on.
Body redaction also applies to rejected requests, even when rejection prevents OpenAPI validation from running. If the gateway can’t load the matching redaction rules, it doesn’t save bodies.

​
Where to see the data

Saved data shows up in the ’s Requests view in the dashboard and in the gateway_requests_v1 analytics table. The header, query, and body columns are empty for requests no logging policy matched.

​
Next steps

OpenAPI validation policy

Mark body fields for redaction with x-unkey-redact.

Gateway policies

Match expressions that pick which requests to capture.
Last modified on October 22, 2026