Meet compliance and audit requirements

Compliance requirements usually boil down to four questions: who called what, what the call content was, whether sensitive information leaked, and how long it's retained before deletion. The gateway's logging, redaction, audit, and security configuration answer these respectively.

Mapping common compliance requirements

Compliance requirement	Gateway capability	Configured at
Who called which model and when	Request logs + access key name/group	Logs viewer
Request/response content retention	Log body capture (including SSE disk spill)	Log and log-body storage
Sensitive-information redaction	Response-script redaction + log-body masking	Response redaction with scripts
Login and permission audit	Console sessions, roles, audit logs	Console login and roles
Retention period and deletion	Log retention days, body capture limit	Log and log-body storage

Request and response retention

• Each request has a unique z-request-id header (<iso8601>-<uuid4>), injected into the request header, mirrored to the response header, forwarded to the upstream, and embedded in all structured logs. This ID is how you locate a specific request. See Export billing Excel and troubleshoot logs.
• Log details contain four segments: client request / upstream request / upstream response / error. The streaming response body is recorded by a background task after the stream ends; an abnormally interrupted stream is marked body_incomplete.

Sensitive-information redaction (two layers)

The two redaction layers each handle one segment

• Response-script redaction: changes what is returned to the client (e.g. strip PII, delete images).
• Log-body masking: changes the log body stored in the database, without affecting what is returned to the client. The two are independent; to redact secrets in the log body you must do it at the log-body masking layer — don't expect the response script to change log storage.

• Response-script redaction: see the PII redaction section of Response redaction with scripts.
• Log-body masking fields: see Log and log-body storage.

Login and permission audit

• Console account (admin / monitor) permissions: see Console login and roles.
• Login anti-brute-force: consecutive login failures reaching a threshold auto-bans that IP temporarily (default 5 failures ban for 300 seconds).
• Sessions slide-renew every 24 hours; after an admin resets a password, disables, or deletes an account, related sessions are revoked and the other party's login page shows the reason (password_changed / disabled_by_admin).
• SSO enterprise login (authenticating people who call the gateway via an IdP): see Configure SSO enterprise login.
• Upstream SSO credentials (logging into upstreams like Kiro to obtain refresh credentials, in the opposite direction): see Upstream SSO login.

Retention period and deletion

• log_retention_days controls the log retention days. Lower it to speed up cleanup; raise it to extend the traceability window.
• logging.max_body_size_mb limits the capture size of each body — set it to 0 to skip body capture (but you lose content-retention ability; weigh against compliance needs).
• Streaming body disk usage is controlled by stream_body_max_disk_mb.

See Log and log-body storage for field semantics.

FAQ

Q: How do I keep call auditing without capturing bodies? Keep request metadata (model, status code, latency, tokens, key name/group) without capturing bodies: set max_body_size_mb to 0. Logs still have call records, just no request/response body content.

Q: Where do I view the audit log? The two are different: configuration-change and security-event audit is in Console → Settings → Audit (admin only), see Audit and security configuration; the per-API-call request logs are in Console → logs viewer, filterable by time/model/status code/key, or locate precisely by z-request-id, and in multi-instance the Live SSE aggregates logs from all instances.

Q: If the redaction script fails, will the original content leak? It depends on script_error_mode: with log-and-continue (default), a script failure passes the original content through; for strict compliance, set it to log-and-reject, which rejects the request outright when the script fails. See Script API reference.

Next: Troubleshoot from symptoms for troubleshooting; Audit and security configuration for fields; Access control design for design.