Analytics & logs
What Apikee records for every validation attempt, and what you can ask of it.
In server mode every validation attempt — accepted or rejected — is written to the request log with credentials redacted. That log is what the overview charts, the per-client usage and the rate-limit counters are built from.
What is recorded
| Which key and client | By id, never the raw key |
| Which endpoint | METHOD:::/path |
| Outcome | Accepted, or which of the eight checks failed |
| Status and duration | |
| Caller IP and headers | Credential headers redacted |
| Optional payload | Only what your SDK chooses to send |
Logs live in MongoDB, separately from the PostgreSQL data that holds clients and keys — so log volume never threatens the store that matters most.
The overview
Each environment has a dashboard covering:
- Request volume over time
- Error rate, split by failure reason
- Latency, including p99
- Per-endpoint breakdown — which routes carry the traffic
- Per-client breakdown — who is calling, and how close to their limits
The log viewer
The Developer tab carries a searchable viewer and a per-entry inspector. This is the tool for answering "why is this consumer getting 403?" — the entry names the check that failed, so you can tell an IP allow-list rejection from a disabled client from a missing scope without guessing.
Over the API
curl "https://apikee.example.com/api/v1/project/payments-api-production/logs" \
-H "x-api-key: apikee_..."See Projects.
Rate-limit accounting
Template limits are evaluated against these same
records across four independent windows — hour, day, week, month. A throttled caller
receives 429 with a Retry-After header.
Because rate limiting is the last of the eight checks, an invalid or revoked key is rejected before it can consume any of a tenant's budget. A brute-force attempt against one customer cannot exhaust that customer's quota.
Retention
Logs grow with traffic. Apikee does not impose a retention policy — set one on the MongoDB collection to match your needs and your obligations. The PostgreSQL side is unaffected either way.
Asking questions of this data in plain language is what the AI assistant is for — "which endpoints errored in the last 24 hours?" reads the same records.