Call Logging

Every proxied call produces one record. Replay needs the real request to re-send and the real response to judge against, so bodies are captured in full (up to a 10 MB cap per direction — the cap truncates the log entry, never the proxied traffic):

ts, request_id, upstream, method, path, provider
workflow, run_id, run_source, callsite_id
requested_model, routed_model, model, shadow, stream
status, latency_ms, ttfb_ms
input_tokens, output_tokens, cache_read_tokens, cache_creation_tokens
request_headers (redacted), request_body, response_body
client_ip, user_agent, error

Token counts come from the provider's own usage metadata — on streamed OpenAI responses the gateway injects stream_options.include_usage into the forwarded request so usage is always metered, and input tokens are normalized to uncached counts across providers so costs compare fairly.

Request headers are logged with authorization, x-api-key, api-key, and cookie replaced by the literal string REDACTED. Your provider key is forwarded to the provider but never written to the log; your vk_ key is stripped before forwarding and never logged either.

The gateway tees response bytes into a capped buffer while relaying them to you; parsing and log writes happen after the last byte is delivered, on a background queue. Time-to-first-token is unaffected. Under extreme back-pressure the queue drops records rather than slow your traffic, and drops are surfaced in gateway logs.

Records land in ClickHouse (table llm_calls) in batches. Self-hosted deployments can use a durable JSONL file sink instead — the entire analysis pipeline works identically against it. The record schema is the same contract everywhere: the log, the dashboard, and the artifacts all speak the same field names.