Service
The audit line
One JSON line per call: who, which key, method, path, status, bytes, duration, cost. Never a body, never a header, never a query string.
A broker that logged only successes would make a caller probing the allowlist invisible, which is exactly the traffic worth seeing. So every exit writes a line — forwarded, refused as unknown, refused as not permitted, refused as off-policy, rate-limited, upstream unreachable — with the same fields.
What the line never contains matters more than what it does. Never a request or response body. Never a request header — not "every header except the one we added": an allowlist of headers-not-to-log is the same enumeration mistake as a blocklist of ways-to-print-an-environment, one layer down. Never a query string: several live conventions put the key there, and a query-mode service puts our own credential there. The path is recorded up to the first question mark and no further. The line is built from primitives only, so there is nowhere to put a header map even by accident.
Because the upstream and policy fields carry the label, a line says which of a service's keys served the call. Spend, and a leak, are attributable to one account rather than to "Tavily".
Written to /var/log/authinjector/audit.jsonl on the host. Yours to ship wherever logs go.
Am I in your service area?
Enter your postal code or city and we'll check the drive time from our shop.
