Observability
What you can observe of your integration (headers, identifiers, the Platform Usage page), what Noryo logs for each attempt, and what it never logs.
Observing an integration rests on two sources: what each response tells you, and the Usage page of Platform. On its side, Noryo keeps one log line per attempt, which support looks up from the Noryo-Request-Id.
What each response tells you
| Signal | Where | What it is for |
|---|---|---|
Noryo-Request-Id | Header of every response | Identifying the attempt, quoting it to support |
HTTP status and code | Status, error body | Sorting errors: to fix, to retry |
enrichment.status, enrichment.reason | 200 body | Measuring coverage: share of resolved, partial, not_found |
usage.billable, usage.units | 200 body of POST routes | Tracking consumption |
Noryo-Idempotency-Replayed | Header of POST 200s | Counting replays, and not counting their usage twice |
usage.deduplicated | 200 body of POST routes | Counting transactions sent again |
Noryo-RateLimit-Remaining | Header of every 200 and of 429s | Anticipating the rate limit |
enrichment.environment | 200 body | Checking that a Production key really serves Production |
What is worth logging
One line per attempt, with: the Noryo-Request-Id, your Idempotency-Key, the route, the HTTP status, the error code if any, enrichment.status, Noryo-Idempotency-Replayed, and your own latency measurement. With these fields you can compute your error rate, retry rate, coverage and consumption without depending on another source.
Log neither the Authorization header nor the key's secret.
The Platform Usage page
The Merchant API section of the Usage page covers the workspace's last thirty days:
| View | Content |
|---|---|
| Per day | Calls, units, and the split resolved, partial, not_found, engine_error, 429, refreshes |
| Recent calls | request_id, date, enrichment_id, result, call type, units |
It only counts calls that produced a result: attempts refused before computation (401, validation 400, 429 from your bucket) and replays do not appear. It shows neither latencies nor HTTP codes: those measurements only exist in Noryo's operational log. For complete tracking, your own logs remain the reference.
What Noryo logs for each attempt
Noryo writes one line per HTTP attempt, refused attempts included: a 401 or a 415 also leaves its line. That line carries the attempt identifier, the route (as a template, never the path typed), the method, the status, the public code, the environment, the result status, whether it was a replay or rate-limited, and the time spent per step: authentication, rate limiting, engine, settlement.
To link lines without designating anyone, the workspace and the key appear as pseudonyms, and the Idempotency-Key and external_transaction_id as truncated HMAC fingerprints, from which the value cannot be recovered.
What Noryo never logs
- the
Authorizationheader, a key's secret, its verifier; - the raw descriptor;
- the raw value of an
Idempotency-Keyor anexternal_transaction_id; - the request body, and the merchant identity returned.
That is why support will ask you for a Noryo-Request-Id, and never for your descriptor or your key.
Published on 2026-10-09 10:18 UTC (version 2).