API logs

The Logs page lists every request your API keys and AI tools made to Notix in the last 30 days, newest first. Open one to see what was sent and, when it failed, what Notix answered.

What is logged

• Every request made with one of your API keys, from your code, an SDK, the SMTP relay or the Notix MCP server.
• Every tool call your AI makes through the hosted MCP server, logged as the API request it made.
• A request Notix refused, such as a key without the right permission or a request over a rate limit.

Not logged:

• The health check.
• Reading the logs themselves, so opening the Logs page never fills it.
• The hosted MCP connection itself, unless Notix refused it. Each tool call is still logged on its own.

A request with no valid API key has no team to belong to, so it is not in anyone's logs.

What each row keeps

Every API response carries an X-Request-Id header. Keep it in your own logs: it finds the same request on the Logs page, and it helps Notix support find it too.

Rows are kept for 30 days, then deleted. The network, the User-Agent and the time together are still personal data, which is why they are kept no longer than that.

Request and response bodies

Notix keeps a safe copy of each body, never the raw text:

• Request body. Only a JSON body is kept, and only a redacted copy of it:
• Replaced by "[redacted]", however deep it sits: any field whose name says it holds a key, token, secret, password, code (such as verificationCode), IP address (such as clientIp), signature, email or SMS body (html, text, textBody, content, message), attachment or CSV upload, contact names, and whole objects of free-form data such as template variables, dynamic_template_data, properties, data, metadata and headers.
• Masked: recipients and contact fields such as to, cc, bcc, email and phone, shown as a***@example.com or ***1234. A recipient's display name is not kept.
• Checked by value: an API key, a Bearer token, a JWT or a long token is hidden wherever it appears, a link keeps only its site (no path or query, where reset links live), and email addresses and phone numbers in text are masked. In a subject, numbers of 4 to 8 digits (such as a one-time code) are hidden.
• Strings are cut to 1,000 characters, lists to 50 items, and the whole body to 16 KB. A body over 256 KB, and the body of a refused request (401, 403 or 429), are not kept.
• Response body. Kept only for an error: the error's code and message, with the same value checks. A successful response is never kept, because it can hold your contacts and your messages.

The query string and the Authorization header are never kept.

Find a request

1. 1

   Open Logs

   Go to Logs in the console.

2. 2

   Filter

   Pick a time range: the last 1, 7, 15 or 30 days. Narrow it by status (a class such as 4xx, or one status such as 404), method, source or API key, or type part of an endpoint, such as /v1/emails.

3. 3

   Open it

   Click a row to see everything Notix kept about it, bodies included.

Export

A team admin can download the filtered list as a CSV file. It holds at most 10,000 rows, newest first, and only the fields in the table above: no bodies.

Read logs with the API

List API requests returns a page of requests, newest first. Filter with days, status, method, source, apiKeyId and path, and page with cursor and limit (up to 100 a page). Pass nextCursor back as cursor for the next page.

curl "https://app.usenotix.dev/api/v1/logs?status=4xx&days=7" \
  -H "Authorization: Bearer $NOTIX_API_KEY"

import { Notix } from "notix-js";

const notix = new Notix(process.env.NOTIX_API_KEY);

const { data } = await notix.logs.list({ status: "4xx", days: 7 });
const first = data?.data[0];

if (first) {
  const { data: detail } = await notix.logs.get(first.id);
  console.log(detail?.responseBody);
}

An AI connected through MCP can use the list_api_logs and get_api_log tools to find out why a call failed.

Who can read logs

In the console, every team member can read the list. Only a team admin can see request and response bodies, and only a team admin can export the list. On the API the bodies come back only for a key a team admin or the owner made, checked on every call; for any other key requestBody and responseBody are null and bodiesHidden is true.