# Observability

> What you can observe of your integration (headers, identifiers, the Platform Usage page), what Noryo logs for each attempt, and what it never logs.

Observing an integration rests on two sources: what each response tells you, and the [Usage](https://platform.noryo.app/usage) page of Platform. On its side, Noryo keeps one log line per attempt, which support looks up from the `Noryo-Request-Id`.

## What each response tells you

| Signal | Where | What it is for |
|---|---|---|
| `Noryo-Request-Id` | Header of every response | Identifying the attempt, quoting it to support |
| HTTP status and `code` | Status, error body | Sorting errors: to fix, to retry |
| `enrichment.status`, `enrichment.reason` | `200` body | Measuring coverage: share of `resolved`, `partial`, `not_found` |
| `usage.billable`, `usage.units` | `200` body of `POST` routes | Tracking consumption |
| `Noryo-Idempotency-Replayed` | Header of `POST` `200`s | Counting replays, and not counting their `usage` twice |
| `usage.deduplicated` | `200` body of `POST` routes | Counting transactions sent again |
| `Noryo-RateLimit-Remaining` | Header of every `200` and of `429`s | Anticipating the rate limit |
| `enrichment.environment` | `200` body | Checking that a Production key really serves Production |

## What is worth logging

One line per attempt, with: the `Noryo-Request-Id`, your `Idempotency-Key`, the route, the HTTP status, the error `code` if any, `enrichment.status`, `Noryo-Idempotency-Replayed`, and your own latency measurement. With these fields you can compute your error rate, retry rate, coverage and consumption without depending on another source.

Log neither the `Authorization` header nor the key's secret.

## The Platform Usage page

The Merchant API section of the [Usage](https://platform.noryo.app/usage) page covers the workspace's last thirty days:

| View | Content |
|---|---|
| Per day | Calls, units, and the split `resolved`, `partial`, `not_found`, `engine_error`, `429`, refreshes |
| Recent calls | `request_id`, date, `enrichment_id`, result, call type, units |

It only counts calls that produced a result: attempts refused before computation (`401`, validation `400`, `429` from your bucket) and replays do not appear. It shows neither latencies nor HTTP codes: those measurements only exist in Noryo's operational log. For complete tracking, your own logs remain the reference.

## What Noryo logs for each attempt

Noryo writes one line per HTTP attempt, refused attempts included: a `401` or a `415` also leaves its line. That line carries the attempt identifier, the route (as a template, never the path typed), the method, the status, the public code, the environment, the result status, whether it was a replay or rate-limited, and the time spent per step: authentication, rate limiting, engine, settlement.

To link lines without designating anyone, the workspace and the key appear as **pseudonyms**, and the `Idempotency-Key` and `external_transaction_id` as **truncated HMAC fingerprints**, from which the value cannot be recovered.

## What Noryo never logs

- the `Authorization` header, a key's secret, its verifier;
- the raw descriptor;
- the raw value of an `Idempotency-Key` or an `external_transaction_id`;
- the request body, and the merchant identity returned.

That is why support will ask you for a `Noryo-Request-Id`, and never for your descriptor or your key.

---

Canonical page: https://developer.noryo.app/en-GB/merchant/operations/observability