API Traffic Log Record Data Structure

Data Structure Fields

Field Name	Data/Description Stored in Field	Java Mapping Type	Field that must be enabled in settings to be included in message
@timestamp	Time Stamp	Instant	Definition Information
aci	Apinizer Correlation ID	String	Definition Information
ei	Environment ID	String	Definition Information
pi	Project ID	String	Definition Information
appi	Application ID	String	API Proxy Information
appin	Application Name	String	API Proxy Information
api	API Proxy ID	String	API Proxy Information
apn	API Proxy Name	String	API Proxy Information
eat	API Type	String	API Proxy Information
aprp	API Proxy Relative Path	String	API Proxy Information
apmi	API Proxy Method ID	String	API Proxy Information
apmn	API Proxy Method Name	String	API Proxy Information
xff	X Forwarded For	String	Request Information
hr1ra	Http Request Remote Address	String	Request Information
hr1hm	Http Request Http Method	String	Request Information
hr1ct	Http Request Content Type	String	Request Information
hr1pi	Http Request Path Info	String	Request Information
uok	Username or Key	String	Request Information
ack	API Client Key	String	Request Information
cot	Client Owner Type	String	Request Information
coi	Client Owner Id	String	Request Information
coo	Client Organization Id	String	Request Information
hr1cp	Http Request Context Path	String	Request Information
hr1qs	Http Request Query String	String	Request Information (Only when "Trace" is enabled)
hr1ru	Http Request Remote User	String	Request Information (Only when "Trace" is enabled)
hr1rsi	Http Request Requested Session Id	String	Request Information (Only when "Trace" is enabled)
hr1r1u	Http Request Request URI	String	Request Information (Only when "Trace" is enabled)
hr1ce	Http Request Character Encoding	String	Request Information (Only when "Trace" is enabled)
hr1cl	Http Request Content Length	Integer	Request Information (Only when "Trace" is enabled)
hr1p	Http Request Protocol	String	Request Information (Only when "Trace" is enabled)
hr1s	Http Request Scheme	String	Request Information (Only when "Trace" is enabled)
hr1sn	Http Request Server Name	String	Request Information (Only when "Trace" is enabled)
hr1sp	Http Request Server Port	Integer	Request Information (Only when "Trace" is enabled)
loc	Location	GeoLocation{Double lat, Double lon}	Request Information
hr1rh	Http Request Remote Host	String	Request Information (Only when "Trace" is enabled)
hr1rp	Http Request Remote Port	Integer	Request Information (Only when "Trace" is enabled)
hr1ln	Http Request Local Name	String	Request Information (Only when "Trace" is enabled)
hr1la	Http Request Local Address	String	Request Information (Only when "Trace" is enabled)
hr1lp	Http Request Local Port	String	Request Information (Only when "Trace" is enabled)
trqpt	TimeRequestPipelineTotal	Integer	Metric Information
trspt	TimeResponsePipelineTotal	Integer	Metric Information
rrc	RoutingRetryCount	Integer	Metric Information
rfc	RoutingFailoverCount	Integer	Metric Information
trt	TimeRoutingTotal	Integer	Metric Information
tapt	TimeApiProxyTotal	Integer	Metric Information
ch	CacheHit	Boolean	Metric Information
sr1t	SizeRequestTotal	Integer	Metric Information
sr2t	SizeResponseTotal	Integer	Metric Information
sc	Status Code	Integer	Response Information
rt	Result Type	Enum	Response Information
et	Error Type	Enum	Response Information
pet	Parent Error Type	Enum	Response Information
fcrp	From Client Read Only Parameter	Map<String,String>	Header from Client
fcrh	From Client Read Only Header	Map<String,String>	Param from Client
fcrb	From Client Read Only Body	String	Body from Client
tbap	To Backend API Parameter	Map<String,String>	Header to Backend API
tbah	To Backend API Header	Map<String,String>	Parameter to Backend API
tba	To Backend API Body	String	Body to Backend API
fbarh	From Backend API Read Only Header	Map<String,String>	Header from Backend API
fbarb	From Backend API Read Only Body	String	Body from Backend API
tch	To Client Header	Map<String,String>	Header to Client
tcb	To Client Body	String	Body to Client
pxt	Policy Execution Times	Nested<Object>	Policy Execution Times

Note

The uok field carries only a resolved identity, never the credential the client presented. When an authentication policy rejects a request before any identity can be resolved, the field falls back to the identity resolved by the rate limiting policy, and to anonymous when there is none. You can therefore correlate rejected requests through the aci field instead of searching for a token or key value.

Warning

The order of fields may change.

Example JSON Data

Example JSON data created:

{
  "@timestamp" : "2023-10-16T14:48:07.662Z",
  "aci" : "<correlation id>",
  "ei" : "<environment id>",
  "pi" : "<project id>",
  "appi" : "<api proxy group id>",
  "appin" : "<api proxy group name>",
  "api" : "<api proxy id>",
  "apn" : "<api proxy name>",
  "eat" : "REST",
  "aprp" : "<api proxy relative path>",
  "apmi" : "<api proxy method id>",
  "apmn" : "<api proxy method name>",
  "xff" : "<x-forwarded-for>",
  "hr1ra" : "<client address>",
  "hr1hm" : "<HTTP Method>",
  "hr1ct" : "<Content-Type>",
  "hr1pi" : "<http request path info>",
  "uok" : "<username or key>",
  "hr1cp" : "<http request context path>",
  "ra" : "<backend api address>",
  "rrc" : 0,
  "rfc" : 0,
  "trqpt" : 20,
  "trspt" : 30,
  "trt" : 100,
  "tapt" : 150,
  "sr1t" : 100,
  "sr2t" : 250,
  "ch" : false,
  "sc" : 200,
  "et" : "APIPROXY",
  "pet" : "API_PROXY",
  "rt" : "SUCCESS",
  "hr1qs" : "<Http Request Query String>",
  "hr1ru" : "<Http Request Remote User>",
  "hr1rsi" : "<Http Request Requested Session Id>",
  "hr1r1u" : "<Http Request Request URI>",
  "hr1ce" : "<Http Request Character Encoding>",
  "hr1cl" : 100,
  "hr1p" : "<Http Request Protocol>",
  "hr1s" : "<Http Request Scheme>",
  "hr1sn" : "<Http Request Server Name>",
  "hr1sp" : 443,
  "loc" : {
   "lat" : 45.405,
   "lon" : 11.1617
   },
  "hr1rh" : "<Http Request Remote Host>",
  "hr1rp" : 8443,
  "hr1ln" : "<Http Request Local Name>",
  "hr1la" : "<Http Request Local Addr>",
  "hr1lp" : 443,
  "fcrp" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "fcrh" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "fcrb" : "<request body from client>",
  "tbap" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "tbah" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "tba" : "<request body to backend api>",
  "fbarh" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "fbarb" : "<body response from backend api>",
  "tch" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "tcb" : "<body response to client>"
}

Info

You can examine the list of values in the "rt" field in the "Result Type Values" table on the Error Messages page.

You can examine the list of values in the "pet" field in the "Parent Error Type Values" table on the Error Messages page.

You can examine the list of values in the "et" field in the "Error Type Values" table on the Error Messages page.

Policy Execution Times (pxt)

pxt is written only when Policy execution times is enabled on the log target (off by default). It is a nested array; each item describes one policy execution on that request.

Key	Field	Type	Description
o	Order	Integer	Execution order. Also encodes the pipeline region: 0-9999 request, 10000-19999 response, 20000+ error. The position within the region is o % 10000.
t	Policy Type	String	Policy type slug, for example jwt-auth, content-filter, ai-semantic-cache.
d	Duration	Integer	Policy duration in milliseconds.
f	Flag	String	Single character, absent on ordinary records. S stream end, K skipped (condition not met), X skipped stream end, T list truncated.

The policy name is not stored: it is usually an auto-generated identifier and carries no meaning. No body, header or parameter content is written to pxt — for that level of detail use Trace.

"pxt": [
  { "o": 1, "t": "jwt-auth", "d": 12 },
  { "o": 2, "t": "rate-limit", "d": 3 },
  { "o": 10001, "t": "content-filter", "d": 41 },
  { "o": 10002, "t": "ai-semantic-cache", "d": 8, "f": "S" }
]

On a relational (SQL/JDBC) log target the same data is written to the policy_exec_times column as a single capped CSV of order:type:duration triplets:

1:jwt-auth:12|2:rate-limit:3|10001:content-filter:41|10002:ai-semantic-cache:8[S]

If a request runs an unusually large number of policies, the list is cut off instead of growing without bound, and the cut is marked rather than silent — the two representations mark it differently. On Elasticsearch and MongoDB a final item is appended with t set to +truncated, f set to T, no o, and d holding the count of policies that were left out (not a duration). On the policy_exec_times CSV the string itself is cut and |+N is appended at the end (N = the number of triplets omitted) — a value ending in …|+12 means 12 policy records did not fit in the column.

The policy_exec_times column does not exist in installations upgraded from an earlier version; it must be added once per environment database with the ALTER script on the 2026.09.1 — Log Table ALTER Scripts page. New installations already get the column from the Apinizer Log Table Creation Commands page. Which policies are recorded and on which targets is configured on the API Traffic Settings page.