API Traffic Log Record Data Structure

Data Structure Fields

Field Name	Data/Description Stored in Field	Java Mapping Type	Field that must be enabled in settings to be included in message
@timestamp	Time Stamp	Instant	Definition Information
aci	Apinizer Correlation ID	String	Definition Information
ei	Environment ID	String	Definition Information
pi	Project ID	String	Definition Information
appi	Application ID	String	API Proxy Information
appin	Application Name	String	API Proxy Information
api	API Proxy ID	String	API Proxy Information
apn	API Proxy Name	String	API Proxy Information
eat	API Type	String	API Proxy Information
aprp	API Proxy Relative Path	String	API Proxy Information
apmi	API Proxy Method ID	String	API Proxy Information
apmn	API Proxy Method Name	String	API Proxy Information
xff	X Forwarded For	String	Request Information
hr1ra	Http Request Remote Address	String	Request Information
hr1hm	Http Request Http Method	String	Request Information
hr1ct	Http Request Content Type	String	Request Information
hr1pi	Http Request Path Info	String	Request Information
uok	Username or Key	String	Request Information
ack	API Client Key	String	Request Information
cot	Client Owner Type	String	Request Information
coi	Client Owner Id	String	Request Information
coo	Client Organization Id	String	Request Information
hr1cp	Http Request Context Path	String	Request Information
hr1qs	Http Request Query String	String	Request Information (Only when "Trace" is enabled)
hr1ru	Http Request Remote User	String	Request Information (Only when "Trace" is enabled)
hr1rsi	Http Request Requested Session Id	String	Request Information (Only when "Trace" is enabled)
hr1r1u	Http Request Request URI	String	Request Information (Only when "Trace" is enabled)
hr1ce	Http Request Character Encoding	String	Request Information (Only when "Trace" is enabled)
hr1cl	Http Request Content Length	Integer	Request Information (Only when "Trace" is enabled)
hr1p	Http Request Protocol	String	Request Information (Only when "Trace" is enabled)
hr1s	Http Request Scheme	String	Request Information (Only when "Trace" is enabled)
hr1sn	Http Request Server Name	String	Request Information (Only when "Trace" is enabled)
hr1sp	Http Request Server Port	Integer	Request Information (Only when "Trace" is enabled)
loc	Location	GeoLocation{Double lat, Double lon}	Request Information
hr1rh	Http Request Remote Host	String	Request Information (Only when "Trace" is enabled)
hr1rp	Http Request Remote Port	Integer	Request Information (Only when "Trace" is enabled)
hr1ln	Http Request Local Name	String	Request Information (Only when "Trace" is enabled)
hr1la	Http Request Local Address	String	Request Information (Only when "Trace" is enabled)
hr1lp	Http Request Local Port	String	Request Information (Only when "Trace" is enabled)
trqpt	TimeRequestPipelineTotal	Integer	Metric Information
trspt	TimeResponsePipelineTotal	Integer	Metric Information
rrc	RoutingRetryCount	Integer	Metric Information
rfc	RoutingFailoverCount	Integer	Metric Information
trt	TimeRoutingTotal	Integer	Metric Information
tapt	TimeApiProxyTotal	Integer	Metric Information
ch	CacheHit	Boolean	Metric Information
sr1t	SizeRequestTotal	Integer	Metric Information
sr2t	SizeResponseTotal	Integer	Metric Information
sc	Status Code	Integer	Response Information
rt	Result Type	Enum	Response Information
et	Error Type	Enum	Response Information
pet	Parent Error Type	Enum	Response Information
afr	Authentication Failure Reason	Enum	Response Information (LDAP authentication policy only)
fcrp	From Client Read Only Parameter	Map<String,String>	Header from Client
fcrh	From Client Read Only Header	Map<String,String>	Param from Client
fcrb	From Client Read Only Body	String	Body from Client
tbap	To Backend API Parameter	Map<String,String>	Header to Backend API
tbah	To Backend API Header	Map<String,String>	Parameter to Backend API
tba	To Backend API Body	String	Body to Backend API
fbarh	From Backend API Read Only Header	Map<String,String>	Header from Backend API. Contains only the headers sent by the target API; headers added by the gateway (such as RateLimit-*, Retry-After, WWW-Authenticate) are not included
fbarb	From Backend API Read Only Body	String	Body from Backend API
tch	To Client Header	Map<String,String>	Header to Client. Contains the response headers written to the client, including those added by the gateway
tcb	To Client Body	String	Body to Client
pxt	Policy Execution Times	Nested<Object>	Policy Execution Times

Note

The uok field carries only a resolved identity, never the credential the client presented. When an authentication policy rejects a request before any identity can be resolved, the field falls back to the identity resolved by the rate limiting policy, and to anonymous when there is none. You can therefore correlate rejected requests through the aci field instead of searching for a token or key value.

Why Was an API Request Rejected by LDAP Authentication?

When an LDAP authentication policy rejects a request, the afr field records one of these reasons:

• Sign-in failed: the credentials were rejected, or the account is locked, disabled, or expired in the directory.
• User not found: the search for the user returned no result.
• Role missing: the user was verified, but does not carry a role the policy requires.
• Directory unreachable: the directory could not be reached at all — a network, TLS, or timeout problem.

The afr value is never returned to the client; it is only available in the traffic log for operators. When the directory is unreachable, the request is rejected with a service-unavailable error instead of the usual 401 authentication error, because the request could not be evaluated at all.

Warning

The order of fields may change.

Sparse Fields

The fields below are written only when they apply to the request, for example only on AI traffic or only when a routing failure was recorded. Other records do not carry them, and the field groups in the table above do not control them.

Client and Subscription

Field Name	Data/Description Stored in Field	Java Mapping Type
usub	Stable user ID: the sub claim of an IdP token, or the client itself for a client_credentials token	String
uids	Token issuer (iss) of an IdP token; apinizer for a token issued by Apinizer	String
ocid	OAuth client the token was issued to (azp, otherwise client_id)	String
subi	Subscription ID	String
subp	Subscription product ID	String
subpl	Subscription plan ID	String
subo	Consumer organization ID of the subscription	String

Routing, Canary and Mirror

Field Name	Data/Description Stored in Field	Java Mapping Type
apr	API Proxy revision	String
ra	Routing address	String
icr	Whether the request was routed as a canary request	Boolean
crs	Canary routing status	Enum
mc	Number of mirror requests sent	Integer
msc	Number of successful mirror requests	Integer
mfc	Number of failed mirror requests	Integer
mtd	Total duration of the mirror requests	Long
ma	Mirror addresses	List<String>

Routing Diagnostics

Field Name	Data/Description Stored in Field	Java Mapping Type
rfr	Routing failure reason	String
rco	Confidence of the failure reason (HIGH, MEDIUM, LOW)	String
rec	Exception class name	String
red	Sanitized and truncated exception message	String
rdsel	Upstream selection time (ns)	Long
rddns	DNS resolve time (ns)	Long
rdtcp	TCP connect time (ns)	Long
rdtls	TLS handshake time (ns)	Long
rdttfb	Time to first byte (ns); -1 when there was no response	Long
rdbrd	Response body read time (ns)	Long
rdpw	Time spent waiting for a connection from the pool (ns)	Long
usc	Raw status code returned by the backend (separate from the status returned to the client)	Short
uip	Upstream ip:port actually connected to	String
crf	Whether a pooled connection was reused	Boolean
rtr	Whether the request reached a backend that responded	Boolean
gw	Worker pod/host that processed the request	String
pll	Connections leased in the pool	Short
plp	Pending connection requests in the pool	Short
pla	Available connections in the pool	Short
plm	Maximum connections in the pool	Short
cct	Configured connect timeout (ms)	Integer
crt	Configured read timeout (ms)	Integer
ccrt	Configured connection-request (pool lease) timeout (ms)	Integer
cwms	Time spent writing the response to the client (ms); -1 for streaming responses	Integer

MCP

Field Name	Data/Description Stored in Field	Java Mapping Type
mcptn	Name of the MCP tool called by the request	String
mcpjrid	JSON-RPC correlation ID	String
mcprc	Outcome class of a tools/call: OK, TOOL_ERROR, JSONRPC_ERROR, TRANSPORT, POLICY_REJECT	String
mcpap	Approval state of a tools/call held for approval	String
mcptno	Distinct names of the outbound MCP tools called during the request, comma-separated (cut at 256 characters, marked with ,…)	String
mcptco	Total number of outbound tool calls during the request	Integer

A2A

Field Name	Data/Description Stored in Field	Java Mapping Type
a2atk	A2A task ID	String
a2act	A2A context ID (multi-turn correlation)	String
a2ats	Latest A2A task state, for example COMPLETED or FAILED	String
a2asno	Distinct names of the outbound agent skills called during the request, comma-separated (cut at 256 characters)	String
a2aaco	Total number of outbound agent calls during the request	Integer

AI

Field Name	Data/Description Stored in Field	Java Mapping Type
aip	LLM provider type (for example openai, anthropic)	String
aipid	ID of the LLM provider record that served the request	String
aim	Model name	String
aidt	Deployment type: CLOUD, ON_PREM, or OTHER	String
aiti	Prompt (input) tokens	Long
aito	Completion (output) tokens	Long
aitc	Cached prompt tokens	Long
aicm	Cost in micro USD (cost × 1,000,000)	Long
aicim	Input token cost in micro USD	Long
aicom	Output token cost in micro USD	Long
aiccm	Cached token cost in micro USD	Long
aittft	Time to first token (ms)	Long
aitpot	Average time per output token (ms)	Long
ailat	Total latency (ms)	Long
aigtms	Total time of the guardrail stage (ms)	Long
aiinf	Upstream LLM HTTP latency (ms)	Long
aiovh	Gateway overhead: total minus guardrail minus inference (ms)	Long
aisch	Whether the semantic cache returned a hit	Boolean
aigh	Guard that was triggered	String
aigc	Category of the triggered rule	String
aigv	Verdict of the external guardrail: SAFE, UNSAFE, TIMEOUT, ERROR, or SKIP	String
aipd	Whether PII was detected	Boolean
aifr	Finish reason (stop, length, tool_use, content_filter)	String
aistr	Whether the response was streamed	Boolean
aivk	Identity of the authenticated caller (the principal, not a record ID)	String
aitid	AI trace record reference	String
aiff	Primary provider that failed over	String
aiqsc	Soft-cap percentage that was crossed (for example 80)	Integer
aiqao	Whether an ALERT_ONLY overflow fired and the request proceeded	Boolean
aircl	Label returned by the route classifier	String
aircs	Route classifier outcome: MATCHED, NONE, UNKNOWN_LABEL, TIMEOUT, ERROR, TRUNCATED, BACKOFF, NO_PROVIDER, or NO_INPUT	String
aircms	Route classifier call latency (ms)	Long
aircti	Route classifier prompt tokens	Long
aircto	Route classifier completion tokens	Long
airccm	Route classifier cost in micro USD (not included in aicm)	Long
aivs	Why the request continued without the vector layer (RAG, semantic cache, or Topic Guard)	String

Example JSON Data

Example JSON data created:

{
  "@timestamp" : "2023-10-16T14:48:07.662Z",
  "aci" : "<correlation id>",
  "ei" : "<environment id>",
  "pi" : "<project id>",
  "appi" : "<api proxy group id>",
  "appin" : "<api proxy group name>",
  "api" : "<api proxy id>",
  "apn" : "<api proxy name>",
  "eat" : "REST",
  "aprp" : "<api proxy relative path>",
  "apmi" : "<api proxy method id>",
  "apmn" : "<api proxy method name>",
  "xff" : "<x-forwarded-for>",
  "hr1ra" : "<client address>",
  "hr1hm" : "<HTTP Method>",
  "hr1ct" : "<Content-Type>",
  "hr1pi" : "<http request path info>",
  "uok" : "<username or key>",
  "hr1cp" : "<http request context path>",
  "ra" : "<backend api address>",
  "rrc" : 0,
  "rfc" : 0,
  "trqpt" : 20,
  "trspt" : 30,
  "trt" : 100,
  "tapt" : 150,
  "sr1t" : 100,
  "sr2t" : 250,
  "ch" : false,
  "sc" : 200,
  "et" : "APIPROXY",
  "pet" : "API_PROXY",
  "rt" : "SUCCESS",
  "hr1qs" : "<Http Request Query String>",
  "hr1ru" : "<Http Request Remote User>",
  "hr1rsi" : "<Http Request Requested Session Id>",
  "hr1r1u" : "<Http Request Request URI>",
  "hr1ce" : "<Http Request Character Encoding>",
  "hr1cl" : 100,
  "hr1p" : "<Http Request Protocol>",
  "hr1s" : "<Http Request Scheme>",
  "hr1sn" : "<Http Request Server Name>",
  "hr1sp" : 443,
  "loc" : {
   "lat" : 45.405,
   "lon" : 11.1617
   },
  "hr1rh" : "<Http Request Remote Host>",
  "hr1rp" : 8443,
  "hr1ln" : "<Http Request Local Name>",
  "hr1la" : "<Http Request Local Addr>",
  "hr1lp" : 443,
  "fcrp" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "fcrh" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "fcrb" : "<request body from client>",
  "tbap" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "tbah" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "tba" : "<request body to backend api>",
  "fbarh" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "fbarb" : "<body response from backend api>",
  "tch" : [ {
    "k" : "key1",
    "v" : "value1"
  }, {
    "k" : "key2",
    "v" : "value2"
  }, {
    "k" : "key3",
    "v" : "value3"
  } ],
  "tcb" : "<body response to client>"
}

Info

You can examine the list of values in the "rt" field in the "Result Type Values" table on the Error Messages page.

You can examine the list of values in the "pet" field in the "Parent Error Type Values" table on the Error Messages page.

You can examine the list of values in the "et" field in the "Error Type Values" table on the Error Messages page.

Policy Execution Times (pxt)

pxt is written only when Policy execution times is enabled on the log target (off by default). It is a nested array; each item describes one policy execution on that request.

Key	Field	Type	Description
o	Order	Integer	Execution order. Also encodes the pipeline region: 0-9999 request, 10000-19999 response, 20000+ error. The position within the region is o % 10000.
t	Policy Type	String	Policy type slug, for example jwt-auth, content-filter, ai-semantic-cache.
d	Duration	Integer	Policy duration in milliseconds.
f	Flag	String	Single character, absent on ordinary records. S stream end, K skipped (condition not met), X skipped stream end, T list truncated.

The policy name is not stored: it is usually an auto-generated identifier and carries no meaning. No body, header or parameter content is written to pxt — for that level of detail use Trace.

"pxt": [
  { "o": 1, "t": "jwt-auth", "d": 12 },
  { "o": 2, "t": "rate-limit", "d": 3 },
  { "o": 10001, "t": "content-filter", "d": 41 },
  { "o": 10002, "t": "ai-semantic-cache", "d": 8, "f": "S" }
]

On a relational (SQL/JDBC) log target the same data is written to the policy_exec_times column as a single capped CSV of order:type:duration triplets:

1:jwt-auth:12|2:rate-limit:3|10001:content-filter:41|10002:ai-semantic-cache:8[S]

If a request runs an unusually large number of policies, the list is cut off instead of growing without bound, and the cut is marked rather than silent — the two representations mark it differently. On Elasticsearch and MongoDB a final item is appended with t set to +truncated, f set to T, no o, and d holding the count of policies that were left out (not a duration). On the policy_exec_times CSV the string itself is cut and |+N is appended at the end (N = the number of triplets omitted) — a value ending in …|+12 means 12 policy records did not fit in the column.

The policy_exec_times column does not exist in installations upgraded from an earlier version; it must be added once per environment database with the ALTER script on the 2026.09.1 — Log Table ALTER Scripts page. New installations already get the column from the Apinizer Log Table Creation Commands page. Which policies are recorded and on which targets is configured on the API Traffic Settings page.