Logs

Two logs, both yours to read: what your application asked the API, and what happened to every webhook delivery. Neither contains a body, a header, a token or another club’s data.

Requests

httpthe request log

GET /v1/developer-organizations/{developerOrganizationId}/applications/{applicationId}/requests
    ?tenantId=…&status=429&cursor=…&limit=50

{
  "items": [
    {
      "requestId": "01a0…",              // what the API returned in X-Request-Id
      "tenantId": "…",
      "method": "GET",
      "route": "/tenants/:tenantId/members",  // the template, never the identifiers
      "status": 200,
      "rateLimited": false,
      "durationMs": 12,
      "occurredAt": "…",
      "correlationId": "…"
    }
  ],
  "pageInfo": { "hasNextPage": true, "nextCursor": "…" }
}

Every request your application makes is here for thirty days, including the ones the API refused — a 403 is exactly what you want to see when a scope is missing, and a 429 is what rate limiting looks like. The route is a template rather than the path, so the log cannot leak the identifiers your request carried. Quote the requestId when you write to support; it is the same identifier in our own logs.

Deliveries

httpthe delivery log, and a replay

GET /v1/developer-organizations/{developerOrganizationId}/applications/{applicationId}/webhook-subscriptions/{subscriptionId}/deliveries
    ?status=dead

GET /v1/developer-organizations/{developerOrganizationId}/webhook-deliveries/{deliveryId}
{
  "delivery": { "status": "dead", "attempts": 8, "lastStatusCode": 503, "lastError": "HTTP 503", … },
  "attempts": [
    { "attemptNumber": 1, "attemptedAt": "…", "statusCode": 503, "durationMs": 40, "outcome": "failed", "error": "HTTP 503" },
    …
  ]
}

POST /v1/developer-organizations/{developerOrganizationId}/webhook-deliveries/{deliveryId}/replay

Every attempt is kept: when, what your endpoint answered, how long it took, and our own words about why it failed — never your endpoint’s response body, which is yours.

Note

These are not server logs. What the platform logs for its operators — stack traces, query timings, the internal shape of a failure — stays with the platform. What reaches you is what you need to debug an integration and nothing that would let you debug somebody else’s.