See every decision, change without risk.

Logs are structured JSON and contain no personal data in clear: identifiers are hashed, prompts and bodies are never logged, and a refused API key is named by its identifier, never by its value. Each line is correlated by trace_id, including a fatal error, which is structured as well.

The level is set in observability.log_level (debug, info, warn, error, fatal) and reloads hot. On the caller side, every error response carries a request_id and a trace_id: the details stay in the log, where operators find them from the identifier the client passes on.

Metrics are indexed by contract operation, by upstream and by tenant: throughput, latency by quantile, response codes, in-flight requests, tokens. Dimensions come from the contract and the token, with nothing to configure, and a dashboard searches for POST /orders, not /orders/8f21c.

Cardinality is bounded by design: a thousand distinct paths and a thousand tenants produce a bounded number of series, which the tests check. Metrics are exposed on /metrics and exported over OTLP; dedicated families cover reloads, cache, delegation, inference and open streams.

The W3C traceparent is propagated, or created if missing, from the edge to the upstream and the model: a trace crosses the gateway without breaking context. Each executed policy adds an attribute, a degradation is marked, and external policy calls show up as child spans. On sampled requests, the routing, identity and policy stages have their own spans.

Export goes through observability.otlp_endpoint to your OTLP collector; an empty endpoint disables export, and that is a valid configuration. Sampling is adaptive: observability.sampling.max_per_second caps root traces per replica, and the parent's decision is honoured.

The API catalogue is built from the contracts loaded by the gateway, never from separate input: facets, a side panel per operation, a miniature policy chain, traffic per operation and export. An operation's owner is declared in the contract with x-flexway-owner - a team and a team channel, never a person - and a retirement date with x-flexway-sunset, which requires deprecated: true.

The Compliance tab computes rules over the catalogue, such as operations without an owner or deprecated without a date; a retirement date set on an operation that is not deprecated is refused at load. This information is never read on the request path.

A developer portal - catalogue, try-it and keys for the consumers of your APIs - is upcoming, as a surface separate from the console.

The traffic dashboard reads by operation, upstream and tenant, against the previous period, with trend and breakdown. An operation's detail shows throughput, errors by code, latencies and breakdown by tenant; two freely chosen windows can be overlaid on the same curves, and every configuration reload leaves a marker on them.

An end-to-end trace opens from the console. With no trace backend, the console receives the gateway's OTLP and keeps slow or failed requests through tail sampling, within count, duration and size bounds per replica, shown as a waterfall with the time spent in routing, identity, policies and upstream attempts. A log of recent errors can be filtered by operation, upstream and tenant.

The console works without an external metrics backend: it collects the metrics pushed by the gateway, keeps 35 days of detail and daily aggregates over 13 months, on a persistent volume. If you already have your own backends (metrics.url, traces.url), it reads them instead.

The Upstreams screen shows each upstream's circuit breaker state, ejections and timeouts, with the next scheduled trial, transitions and the codes written by the gateway. It reads as cards or as a table, with a 24-hour band and a detail view per upstream.

The gateway's own health reads per replica: each one's status according to its rule and the freshness of its last report, a draining replica announced as such, and a rule that flags a replica gone silent. A replica shutting down cleanly can thus be told apart from a lost one.