Skip to main content

Request IDs and logs

Every response has an id​

Every response — success, error, 401, 429, even a 404 for a route that does not exist — carries X-Request-Id, a UUID we generate:

HTTP
X-Request-Id: a104b335-e76a-41e4-a1d6-9c80eb27e15c

Log it next to your own record of the call. It is the fastest way to a precise answer from support, and it is how you find the request again yourself.

  • An X-Request-Id you send is ignored and replaced. There is no client-chosen correlation id; store ours against yours.
  • Browser code can read it: the header is exposed to cross-origin requests.
  • The error body does not repeat it — take it from the header.

Look a request up​

Requests made with an API key are logged. Each log entry's id is the request's X-Request-Id:

HTTP
GET /v1/request-logs/a104b335-e76a-41e4-a1d6-9c80eb27e15c
JSON
{
  "id": "a104b335-e76a-41e4-a1d6-9c80eb27e15c",
  "method": "POST",
  "path": "/v1/banking/payouts",
  "status_code": 202,
  "duration_ms": 174,
  "api_key_id": "c730dfd3-9f63-4d15-ab4b-82b31457b2ed",
  "ip_address": "203.0.113.24",
  "idempotency_key": "qs-payout-inv-2026-0042",
  "request_body": {"amount": "25.00", "currency": "EUR", "reference": "<redacted>", "…": "…"},
  "response_body": {"id": "632d9e69-4ff8-4ede-8c5d-2cee4026aa84", "status": "settled", "…": "…"},
  "created_at": "2026-10-15T20:01:52Z"
}

api_key_id is the key's id from GET /v1/api-keys — for a master key, the master key's own id, which that list does not show. Bodies are stored as redacted JSON — secrets, tokens and some free-text fields are replaced with <redacted>. A body that was absent, larger than 16 KB or not JSON is left out of the entry, as are ip_address and idempotency_key when there was none.

The list, newest first:

HTTP
GET /v1/request-logs?limit=100&before=<id of the last entry you saw>

{"logs": [...], "has_more": true, "next_cursor": "…"}. limit is 1–500, default 100. The list has no filters — by path, status or key — so look a specific request up by its id.

Who can read logs: a dashboard session, a master key or a secret key. Restricted and publishable keys get 403 — the bodies contain your data.

What is not logged​

  • Requests made with a dashboard session — the log is the record of your integration's traffic.
  • Requests refused before they reach the log: 401 (no valid credential), 429 (rate limited), and Cxc-Account refusals.
  • The log routes themselves and the event stream.
  • Public and sandbox-tool routes.

A delegated request is logged under the account whose credential made it, not the managed account it acted for.

There is no stated retention period; do not use the log as your own archive.

Usage​

GET /v1/usage/summary returns requests_7d, requests_7d_delta_pct, error_rate_pct, total_volume and avg_settlement_secs; GET /v1/usage/timeseries?window=7d|30d|90d returns daily request counts. The request figures count the same API-key traffic the log does. total_volume and avg_settlement_secs are computed from an older transfer record and do not include payouts made through /v1/banking/* — for an integration on this API they read 0 and null. Same access rules as the log.