Access log
Every call a key makes is recorded for 30 days. This surface is the one your own code drives unattended, so “what has my integration been doing” needs an answer that does not depend on asking us.
What is recorded
Metadata about the call, and nothing from inside it: the method and path, the query string, the status, how long it took, the response size, the calling address, the user agent and a request id for correlating with our own logs.
Request and response bodies are not recorded. What a change did to a record belongs to the audit trail instead.
Refusals are in there too
A call refused for a key we recognise is recorded with the status it was refused with, so a revoked credential that is still calling every minute shows up rather than going quiet. That is usually the first sign that a system nobody remembers is still pointed at Zenly.
Recorded, whatever the status.
Recorded. Revoked, expired, throttled, wrong plan or inactive organization all land here with their status.
Not recorded. There is no organization it could belong to, so there is no log it belongs in.
Not recorded. Reading the OpenAPI document needs no key, so those calls belong to nobody.
Retention
30 days, after which entries are purged. The log is append-only, so an entry cannot be rewritten or deleted once it is there. Reading it back is owner-only, like the keys themselves.