> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instantcampaign.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API request log

> See every call made to the InstantCampaign API, with the payload it carried, the response, the key that made it, and what it produced.

The **API request log** records every call to the public API, together with its request and response bodies. Each entry links to what the call created: the email, the event, the contact or the journey run. Use it to answer questions like "why did this customer get that email, with which data, and from which key?" without digging through your own application logs.

<Note>
  Opening the API log needs the **API keys: manage** permission: workspace **Owners**, **Admins**, or a custom role that grants it.
</Note>

## Open the log

Go to **Settings → Developers → API log**. Calls are listed newest first, with these columns:

| Column        | Shows                                                        |
| ------------- | ------------------------------------------------------------ |
| **When**      | Date and time of the call                                    |
| **Request**   | Method and path                                              |
| **Status**    | HTTP status: green for 2xx, amber for 4xx, red for 5xx       |
| **Recipient** | The `to` or `email` from the request body, when there is one |
| **API key**   | The key that made the call                                   |
| **Duration**  | How long the call took                                       |

Click **Load more** at the bottom to page back through older calls.

## Find a specific call

* **Status**: choose **All statuses**, `2xx`, `4xx` or `5xx`. Choose `4xx` to find calls your app sent incorrectly.
* **Path**: choose **All paths** or one API area, such as `/api/v1/transactional`, `/api/v1/events`, `/api/v1/contacts`, `/api/v1/lists`, `/api/v1/webhooks`, `/api/public/events`, `/api/public/journeys/trigger`, `/api/forms` or `/api/mcp`.
* **Search**: enter a recipient address, an external id (for example the order id you sent as `externalId`) or a record id, then click **Search**.

## Inspect a call

Click a row to open its details:

* The **Request body** and **Response body**, formatted as JSON (or **No body**).
* **Produced**: what the call created. The **Message** (opens it in the message log) and the **Contact** are links. The **Event** and the **Journey run** are shown by their id.

It also works the other way round: in **Analytics → Message Log**, a transactional message's details include a link to **Open the API request that created this message**.

## What is recorded

| Source           | Calls                                                                                                                   |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Public API       | Every `/api/v1/…` call: transactional send, validate and status lookups, events, contacts, lists, webhook subscriptions |
| Public endpoints | Website event tracking (`/api/public/events`) and journey triggers (`/api/public/journeys/trigger`)                     |
| Forms            | Subscription form submissions                                                                                           |
| MCP              | Calls from AI assistants through the [MCP server](/guides/developers/mcp-server)                                        |

**Not recorded:** activity in the app itself, website page-view beacons, incoming webhooks from email providers or Shopify, and calls with an unknown key (they cannot be attributed to a workspace).

## Privacy and size limits

* **Secrets are redacted.** Any field whose name looks like a password, secret, token, authorization header, API key or credential is stored as `[redacted]`.
* **Attachments are not stored.** Only the length of an attachment's content is kept.
* **Large bodies are truncated.** Request bodies over 64 KB and response bodies over 16 KB are stored as a shortened preview marked `_truncated`.

<Warning>
  Request bodies can contain personal data, such as the recipient address, the contact fields you send and your `data` payload. Anyone who can open the API log can read it. Keep that in mind when you decide who gets the Owner or Admin role, or a custom role with **API keys: manage**.
</Warning>

## Retention

Requests are kept for 90 days and then deleted automatically.

## Troubleshooting with the log

| You see                                                | It usually means                                                                                                            |
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
| `401` entries missing                                  | Calls with an unknown key are not logged. Check that your app sends `Authorization: Bearer ic_…` with a current key         |
| `403` with `insufficient_scope` in the response        | The key lacks a scope. See [API keys](/guides/developers/api-keys)                                                          |
| `422` with `MISSING_VARIABLES` on a transactional send | The template needs variables the request did not provide. See [Transactional email](/guides/developers/transactional-email) |
| `200` with `"deduplicated": true`                      | The same `externalId` was sent before, so no new email was sent                                                             |