Useful AI API Support Logs Without Keys or Private Payloads
Build a minimal failure record across client, model gateway, and tools, then remove credentials, signed URLs, private content, and unsafe error text before sharing.
A useful AI API failure report usually starts with a timestamp, endpoint, version, and failed stage. A large chat screenshot often supplies less diagnostic value and more private data. Redacting Authorization is only one step: payloads, tool results, signed URLs, and local paths can also expose sensitive information.
Checked on November 10, 2026, this guide uses OWASP logging guidance and Nbility's connection, error, and log documentation. The suggested fields are a support template, not a promise that Nbility collects all of them or evidence of a real incident.
Identify the path that failed
An agent can call a model, read files, invoke MCP tools, and contact a business system. A model gateway cannot reconstruct independent tool traffic from its own request logs.
Write a short sequence: client start, model request, tool action, model follow-up, display. Find the last confirmed step and identify whose records cover the next one. The MCP roles and remote recovery guide help separate these responsibilities.
A minimal record to fill in
All values here are illustrative or placeholders, including the duration:
{
"observed_at": "2026-11-10T09:00:00Z",
"client": "CLIENT_NAME_AND_VERSION",
"stage": "model_stream",
"api_path": "/v1/chat/completions",
"model": "YOUR_MODEL_ID",
"stream": true,
"http_status": 200,
"content_type": "text/event-stream",
"elapsed_ms": 12000,
"last_complete_event_type": "APP_PROTOCOL_EVENT",
"terminal_event_seen": false,
"exception_class": "ReadError",
"support_request_ref": "REPLACE_FOR_PRIVATE_SUPPORT"
}
Use observed fields and mark unavailable evidence as unavailable. Include a time zone. Prefer a monotonic timer for a process's duration rather than interpreting clock skew between machines as network delay. APP_PROTOCOL_EVENT is a placeholder, not a defined API event.
A real request ID can help private support locate server records. For a public post, stable aliases such as REQ-A can preserve relationships while you retain the mapping privately.
The OWASP Logging Cheat Sheet recommends interaction correlation and warns against directly logging access tokens, session identifiers, passwords, and sensitive personal data. It also treats events from other trust zones as potentially incomplete, forged, or malicious.
Look beyond obvious key prefixes
| Artifact | Common hidden exposure | Safer evidence |
|---|---|---|
| Verbose curl output | Authorization, proxy credentials, cookies | Command structure and status without sensitive headers |
| Full URL | Query tokens, signatures, customer IDs | Necessary host and path shape |
| HAR export | Bodies, forms, cookies, sessions | Locally inspected minimal sample |
| Error and stack trace | Paths, arguments, private text | Exception class and necessary call location |
| Image or recording | Accounts, notifications, people, metadata | Public fixtures or a properly redacted copy |
Searching for a prefix such as sk- is insufficient. Bot tokens, signed URLs, connection strings, and business identifiers have different forms. Pattern scans assist a review; they do not replace it. If a credential was exposed, deleting the screenshot does not revoke it. Follow the service's revocation and replacement process; see API key safety.
Prefer allowed fields over whole-object dumps
Choose diagnostic fields explicitly and encode structured logs. Logging an entire request and deleting a few top-level keys afterward can miss nested tool results, custom fields, or error objects carrying the same data.
Validate types and bound lengths for externally controlled fields. Correctly encode line breaks and delimiters so input cannot impersonate a new log entry. OWASP specifically discusses CR/LF injection; parameterized strings alone do not solve every output-encoding problem. Raw exception messages can contain full requests too.
If full inputs are necessary, define authority, access, storage, and deletion separately. Consider copies held by tools, gateways, and support systems as well as the application log.
Review the artifact before choosing its audience
Make a local copy and substitute public input where possible. Confirm that it still explains the failure, then inspect credentials, cookies, signed queries, paths, personal data, and attachments. Public community posts and private support need different scopes.
For Nbility, locate the model request in request logs and check the error format. Private support may need the timestamp, model ID, and request reference. If HTTP succeeded but streaming did not finish, also use the SSE boundary checks.
We did not test redaction software with real secrets, and this template is not a guarantee against every disclosure path. It helps preserve useful evidence while reducing unnecessary private copies.
