Skip to content
Anvil

Logging and limits

Logging

Section titled “Logging”
Where What
Audit log changed records (actor type api, the client UUID and api:<name>; before the client is authenticated the system actor api), api.request for every write, administration: api.client.permissions_changed, api.token.created, api.token.revoked, api.client.signing_rotated, api.client.signing_disabled, changes of clients
Access log (anvil_api_access_log) every call: client, token id, method, endpoint, status, duration, number of records, IP, request id; kept $apiAccessLogDays (90) days (anvil:prune)
Security events 401, 403 and 429 as access.denied; 401 and 429 at most once a minute per IP

Limits

Section titled “Limits”
  • No files (multipart), no batch requests, no field selection, no CORS for browsers, no webhooks yet.
  • Clients belong to one tenant.
  • People cannot use the API with their account (no personal tokens, no OAuth); the authentication is an interface (ApiAuthenticator) to add them later.