Guides
Observability and Security
Record request metadata and monitor quality, cost, and latency while protecting prompts and personal data.
Production systems should track success rates, latency, tokens, quality, and costs together. Logs must support diagnosis without exposing API keys or sensitive content.
Recommended log fields
| Category | Fields | Purpose |
|---|---|---|
| Request | Internal trace ID, APIQIK request ID, model, stream mode | Trace individual calls across services. |
| Performance | Total duration, TTFT, output duration, queue wait | Distinguish network, queueing, and generation bottlenecks. |
| Result | HTTP status, error type, finish_reason | Diagnose failures and truncation. |
| Usage | Input, output, and total tokens | Attribute costs and detect anomalies. |
| Business | Scenario, tenant, feature, rollout group | Compare quality and costs across product flows. |
Request IDs and tracing contract
- Clients can generate a unique ID for each business operation; the platform returns its own request ID.
- Error, successful, and streaming responses should be correlated with the same platform request ID.
- Cross-node retries remain associated with the original external request, with internal attempts retained for platform diagnostics.
- Support requests should include the platform request ID, UTC time, model, status, and a redacted error object, never a complete key.
- If using OpenTelemetry, define trace/span correlation rules without recording prompts or secrets in attributes by default.
Core metrics
- Success rate: Break down by model, scenario, and status so averages do not hide local problems.
- Latency: Monitor P50, P95, P99, and streaming TTFT separately.
- Cost: Track token usage per request, user, feature, and day.
- Quality: Combine user feedback, automated evaluations, and human sampling.
- Capacity: Monitor in-flight requests, queue depth, rejections, and
429rates.
Log redaction
Never log complete keys. Redact the entire
Authorizationheader. If keys must be distinguished, retain only an irreversible fingerprint or a few trailing characters.
- Do not log complete prompts or responses by default; sample and redact according to compliance requirements.
- Detect and mask phone numbers, email addresses, identity numbers, payment details, and other personal data.
- Restrict log access, retention periods, and export scope.
- Establish auditable deletion and data-retention procedures.
Timeouts, Retries, and Concurrency
Set connection and overall timeouts, use exponential backoff, and manage concurrency with bounded queues.
Framework and Tool Integrations
Connect APIQIK to AI frameworks and developer tools with a custom OpenAI Base URL, then verify compatibility with minimal requests.