API logs
Every request you made, with both bodies and the reason it failed.
Every call to the API is recorded: the method, the path, the status, how long it took, the headers and both bodies. When a call did not do what you expected, this is the only place that can tell you what you actually sent.
API logsstatus: error
| Method | Endpoint | Status | Duration | Version |
|---|---|---|---|---|
| POST | /payments | 201 | 412 ms | 2026-09-01 |
| POST | /payments/trx_CSUGajfv9xh0XQ5wu2lx | 200 | 88 ms | 2026-09-01 |
| POST | /transfers | 201 | 690 ms | 2026-09-01 |
| POST | /payments/trx_9mWvL2xR7tB5nY4hC6dF | 402 | 1203 ms | 2026-09-01 |
| GET | /balance | 200 | 42 ms | 2026-09-01 |
| POST | /payments | 500 | 5012 ms | 2026-08-01 |
Filters
Nine filters, all combinable, all reflected in the URL so a filtered view can be shared.
| Filter | What it matches |
|---|---|
| Search | Full text over the URL, the request id, the IP, the method and the error message |
| Status | success for under 400, error for 400 and above, or one exact code |
| Method | GET, POST, PUT, PATCH, DELETE |
| Endpoint | A substring of the URL |
| IP address | A substring of the caller's IP |
| Date start, date end | Whole calendar days |
| Min duration, max duration | Milliseconds, for finding the slow tail |
There is no query language
Search is plain text, not a syntax. status:5xx matches nothing, because it is looked for
literally. Use the status selector for codes and the search box for strings.
Results are paginated 50 at a time, newest first.
What a row carries
| Field | Note |
|---|---|
request_id | The correlation id, also returned to you as X-Request-Id |
method, path, full_url | The full URL includes the query string |
status_code, status_label | |
duration_ms | Server side, excluding your network |
ip_address | The caller |
error_message | Present only when the call failed |
api_version | The version this call was served with |
api_key_id, secret_key_id, sync_key_id, pulse_key_id | Which key was used |
slave_team_id | Set when the call acted on a connected account |
The key columns are the fastest way to find calls made by a component you forgot about: an old worker still holding a rotated key shows up as its own key id.
The detail panel
Selecting a row opens the full record: request headers, response headers, request body, response body, user agent and, when the call threw, the error trace.
This is where you settle arguments with yourself. The body shown is what the API received, after your framework, your HTTP client and your serialiser had their turn with it.
Bodies are truncated above a threshold
The request body is stored up to roughly 250 KB and the response up to 500 KB. A larger payload is cut, so a very large export or list response will not round trip exactly.
What is hidden, and what is deliberately not
Secrets are redacted before the log is written, so nothing sensitive is stored at all.
| Redacted | Kept visible |
|---|---|
Authorization, X-API-Key, Cookie, Grant-Authorization, X-Sync headers | Every other header |
password, cvv, cvc, pin, pan, private_key | phone, email, name, address |
card.number at any depth, and a bare number field | account_number, iban, phone_number |
exp_month, exp_year, expiry_date | Amounts, currencies, metadata, references |
The second column is a deliberate decision: business fields stay readable because a log you cannot read is a log you cannot debug with. Card data is the only thing masked on principle.
Your key is never in the log
If you are looking for which key made a call, use the key id columns. The Authorization header
itself is stored as ***REDACTED***.
Correlating with your own logs
Every API response carries X-Request-Id. Log it on your side, and any support conversation or
Konsole search becomes a single lookup instead of a hunt through timestamps.
curl -i https://api.wajub.com/payments \
-H "Authorization: sk.kZ3qP8mWvL2xR7tB5nY4hC6dF9jS1aG0eU3i…" \
-d amount=25000 -d currency=XAF \
| grep -i x-request-idExport
The current filter set can be exported as CSV or JSON, capped at 10,000 rows per export. The CSV carries the id, method, path, status, duration, IP, error and timestamp; the JSON carries the full records.
Exports count against your plan's monthly max_exports allowance. Past it, the export returns a
403 telling you so rather than a truncated file.