Purpose of API logs

API logs help confirm which system called an API, which interface was called, when it was called, whether the request succeeded, what status was returned, whether an error occurred, which IP address sent the request, and how long processing took.

With this information, institutions can understand actual API usage more clearly.

Logged information

An API log can include request time, Request ID, Organization ID, API Key identifier, calling source, source IP, HTTP Method, API Endpoint, request parameter summary, HTTP Status Code, response result, Error Code, Error Message, request processing time, User Agent, and other technical information.

For security reasons, passwords, Secret values, Token values, full API Keys, and other sensitive credentials should not be recorded in plain text.

Request status

API logs can record different call results, such as Success, Authentication Failed, Permission Denied, Invalid Request, Rate Limit Exceeded, Resource Not Found, Server Error, Timeout, IP Not Allowed, and Signature Verification Failed.

Administrators can use status codes or error messages to quickly identify why a request failed.

Common HTTP status codes

Common API HTTP statuses include 200 or 201 for successful requests, 400 for request parameter errors, 401 for authentication failure, 403 for missing permission or restricted source, 404 for missing interface or resource, 429 for rate-limit excess, 500 for internal system errors, and 503 for temporarily unavailable service.

The exact response result should follow the corresponding API documentation.

Log query

Institutions can query API logs by time range, API Endpoint, Request ID, Organization ID, API Key, source IP, HTTP Status, Error Code, and call result.

For example, administrators can query all failed API requests in the past 24 hours, or review all calls made by a specific API Key in the past 7 days.

A Request ID can also be used to locate one exact request.

Request ID

Each API request should have a unique Request ID.

When an interface issue occurs, the institution can provide the Request ID to the technical team to quickly locate the corresponding request record.

For example: Request ID = req_8F92A17C. The technical team can use that ID to confirm request time, called interface, request source, response result, error reason, and system processing flow.

Troubleshooting errors

When an API call fails, teams can first check whether the API Key is correct, whether API permissions are enabled, whether the request signature is valid, whether the source IP is in the whitelist, whether request parameters are complete, whether the endpoint is correct, whether the request rate exceeded limits, whether the external network is normal, and whether the system returned an Error Code.

API logs provide important evidence for investigating these issues.

Working with IP whitelist

If the institution enables API IP whitelist rules, the system can check the source IP when receiving a request.

For example: institution server -> API request -> source IP check -> IP is not in whitelist -> request is rejected -> API log records the failure.

Administrators can view the rejected request source IP directly from the logs.

Working with API permissions

API Keys can be assigned different interface permissions.

For example, API Key A may only read customer data, while API Key B may read orders and submit orders.

If an API Key calls an unauthorized endpoint, the system can reject the request and generate a corresponding log. This helps institutions confirm whether API permissions are configured correctly.

Performance monitoring

API logs can also be used to observe interface response behavior.

For example: Endpoint = /api/orders, Response Time = 85 ms, Status = 200.

If an endpoint continuously shows high response time or a large number of failed requests, the technical team can investigate system performance or integration behavior.

Example

For example, an institution server calls the order query API.

The log can show: Request Time = 2026-08-28 20:41:12, Method = GET, Endpoint = /api/orders/12345, Source IP = 203.0.113.10, Status = 200, Response Time = 72 ms.

This means the API request completed successfully. If the request failed with Status = 403 and Error Code = IP_NOT_ALLOWED, it means the source IP was not allowed to access the API.

Security notes

API logs may contain business information and should be managed according to the institution's data-security policy.

Recommended practices include not recording plaintext passwords, not recording complete API Secret values, not recording complete Token values, masking sensitive fields, limiting API log viewing permissions, periodically checking abnormal API calls, and investigating frequent failed requests.

Notes

API logs mainly record Finger Manager API call activity and help institutions monitor interfaces, manage integrations, perform security audit, and troubleshoot issues.

Together with operation logs, login logs, IP whitelist rules, and API permissions, API logs provide a more complete system access and technical audit record.