Request logs

Request logs help you diagnose API integrations by recording request metadata, sanitized headers, request and response bodies, response status, and resource context. You can inspect them from the Request Logs view in the Space Invoices dashboard.

Data retention

Space Invoices uses separate retention windows for log payloads and idempotency:

Data or behavior	Retention
Request body	90 days
Response body	90 days
Request metadata, including method, path, status, timestamps, account/entity context, and request ID	Retained after bodies are removed
X-Request-Id idempotency replay	24 hours from the first request

After 90 days, request and response bodies are removed from live, sandbox, and account-level logs. The metadata row remains available for filtering, operational analysis, and audit context, so an older log can show null for req_body and res_body.

Cleanup runs on a schedule, so bodies may remain visible briefly after crossing the 90-day boundary.

Idempotency is a separate window

Keeping a request log does not keep its idempotency key active. The API replays a matching document-creation or expense-payment request for 24 hours only. After 24 hours, reusing the same X-Request-Id starts a new operation, even while the original request and its body are still visible in logs.

See Idempotency for retry behavior and reconciliation guidance.

Sensitive data

Authorization credentials and known sensitive headers are redacted before storage. You should still avoid placing secrets, certificates, raw payment credentials, or unrelated personal data in API request bodies.

Use request logs for debugging and operational evidence, not as permanent application storage.