Correlate the request. Minimize everything else.

A request ID is safe to log. A request body is not automatically safe. Build dashboards and alerts from bounded metadata, not copied payloads.

Request-ID lifecycle

1. The caller may send a valid x-request-id.
2. The public route prefers that value; otherwise it may use a valid platform request ID or generate req_*.
3. The response mirrors the chosen ID in x-request-id.
4. An error response also places the same value in error.requestId.
5. The SDK requires an exact response-header match and reuses one ID across its retry attempts.

const requestId = "website-catalog-" + crypto.randomUUID()

try {
  await casset.getCatalog("connor", { requestId })
} catch (error) {
  if (error instanceof CassetApiError) {
    console.error("Casset request failed", {
      requestId: error.requestId,
      kind: error.name,
    })
  }
}

Safe logging

Local sandbox request inspection

The authenticated local Developer Portal shows process-local request metadata: request ID, method, normalized route template, status, a process-local App relationship when present, stable error code, and timestamp. Do not copy the App ID into application logs. The request-inspection list does not show Authorization values, credential hashes, webhook signing secrets, exact request bodies, or response bodies. The wider process-local console snapshot can include structured webhook event objects with sandbox identifiers and a credential prefix; treat that display as sensitive and never copy it into logs. Plaintext credentials and signing secrets remain absent.

• Inspection is disabled with the rest of the sandbox in production.
• State resets with the process and is not a durable audit ledger.
• It proves local request semantics; it is not production monitoring.

Privacy guarantees at the API boundary

• Database selection filters to published, non-private artists before public response construction.
• Unknown, private, and unpublished artists share one 404 shape.
• Artist responses omit internal IDs, raw theme data, accounts, credentials, and private state.
• Catalog responses select only active Track title, kind, and duration.
• Errors are private, no-store; local sandbox responses are no-store, private.
• Strict parsers reject extra fields rather than accepting accidental disclosure.

Debugging without leaking data

1. Record request ID, route template, status, error code, retryable, and elapsed time.
2. Confirm whether the source was an exact mock, the deployed public route, a local public route, or the credentialed local sandbox.
3. Reproduce with a fresh request ID and the smallest public fixture.
4. For a contract failure, compare schema names and documented fields without pasting a private payload into a ticket.
5. For a local credential failure, revoke and issue a new value; never transmit the old value for diagnosis.
6. Share only sanitized metadata and the request ID with a maintainer.

What is intentionally absent

There is no public tracing API, production developer log stream, durable developer audit ledger, usage analytics dashboard, or production webhook observability product. The private operator API is not a developer telemetry channel.

See Errors for request-ID protocol failures and Availability for the exact production boundary.