Request log fields and how they connect API activity to company credentials.
持久化字段
| Field | Description |
|---|---|
method | HTTP method. |
path | Original URL with query string. |
normalizedPath | Path without query string. |
statusCode | Final HTTP status. |
durationMs | Request duration in milliseconds. |
profileId | Resolved Developer Profile (internal Mongo id, kept for relations and audit). |
profileCode | Resolved Developer Profile code (dp_ prefix) sent in X-Travelandz-Id. |
profileKey | Public key used by the request. |
credentialId | Embedded credential/API key _id; preferred key for API-key audit views. |
companyId | Associated company. |
ip | Express-resolved IP; depends on TRUST_PROXY. |
origin | Hostname from Origin or Referer. |
userAgent | User agent. |
requestId | Public Travelandz request id returned as request_id in error bodies and X-Travelandz-Request-Id in response headers when available. |
gdsprovider | Provider inferred from the path when applicable. |
provider | Internal provider/source identifier for support and audit only. This value is never returned in public error JSON. |
providerRequestId | External-source request id, if one was provided upstream. Kept internally only. |
providerErrorCode | External-source error code captured for support matching. |
providerErrorType | External-source error type captured for support matching. |
providerStatus | External-source HTTP status captured for support matching. |
travelandzErrorCode | Travelandz public error code selected by the normalization layer. |
errorCode | Structured error code when present in the response. |
errorMessage | Short error message. |
requestContentLength | Request content length. |
responseContentLength | Response content length. |
Credential traceability
Use credentialId for exact joins between dashboard credentials and logs. Use profileKey when the UI only has the public key, or when diagnosing historical records created before credential identifiers were surfaced.
Security
Public error responses must only include code, message and request_id when normalized. Logs must never include Authorization, bearer tokens, decrypted secret keys or raw third-party provider credentials.