API observability

Hand-drawn sketch: Logged the call, not the contents. Most API logs record that a request succeeded, never which objects it returned.

Most API logs record that a call succeeded. Very few record which object it touched.

That distinction decides whether you can investigate anything. "GET /customers/… returned 200" cannot distinguish routine work from somebody enumerating your customer base. Logging the object identifier, and the caller, is what turns an access log into something you can answer questions with.

Checked against the primary source.

API observability

More on API security