Frequently asked questions

Short answers to the questions teams ask before and after installing ApiTraffic. Each links to the page with the details.

Product #

What is ApiTraffic?

ApiTraffic records every request your API serves as one searchable record: the request and response, how long it took and where the time went, the outbound calls it made, and the firewall’s verdict on it. You read it in the web app, through the REST API, or from an AI coding agent through the MCP server. See How ApiTraffic works.

Can I try it without installing anything?

Yes. Every account can open a read-only demo bucket, Sample: Acme Store API, with live traffic and every feature populated. See Sample data. When you are ready, the Quickstart takes about five minutes.

Can I try ApiTraffic before I pay?

Yes. Every new account starts with a trial that needs no card. To keep capturing traffic after the trial, choose a paid plan. Plans and prices are on the pricing page.

Compatibility #

Which Node.js versions are supported?

SDK 2.x (@apitraffic/node and the per-framework packages) requires Node.js 20 or later. The 1.x packages still run on Node 18, which is end of life.

Which frameworks are supported?

@apitraffic/node works with the framework you already have; it does not install one. The individual packages (@apitraffic/express, -fastify, -koa, -hapi) are still supported if you want only request logging. See Integrations overview.

My API is not written in Node. Can I still use ApiTraffic?

The SDKs are for Node.js. For anything else, you can route traffic through the ApiTraffic proxy to get the request log, without the outbound calls your app makes on its own, APM or the in-process firewall. Choose Something else on the setup page to generate a proxy URL. See Integrations overview.

Does it work with TypeScript and ES modules?

Yes. The packages ship type declarations, and ApiTrafficOptions types every option. ES-module apps start APM with node --import instead of -r; see Set up APM.

Can I use it alongside Datadog, New Relic or my own OpenTelemetry?

Yes. If your app already runs OpenTelemetry, add the ApiTraffic span processor to your own setup instead of the bundled preload. With Datadog or New Relic running, the bundled APM setup steps aside on its own. Request capture and the firewall are not affected either way. See Set up APM.

Performance and reliability #

Does ApiTraffic slow down my API?

Capture is designed to stay off your request path: the SDK records each request in-process and returns immediately, and payloads are batched, compressed and sent in the background. No network call to ApiTraffic happens between your handler and your response.

The firewall is evaluated in your process, so it costs nothing until a policy is enabled: its engine is not loaded before then. Performance monitoring adds OpenTelemetry instrumentation to the libraries it covers. The middleware is public on GitHub, and we recommend measuring it against your own service in staging.

If ApiTraffic is down, does my API go down?

No. Requests are served normally, startup is not blocked, and telemetry is retried briefly from a bounded in-memory queue and then dropped. The firewall keeps enforcing the last policy it loaded. The one exception is a setting you must turn on yourself, offlineWafMode: 'closed'. See If ApiTraffic is unreachable.

Can I turn the firewall off without a deploy?

Yes. Switch the policy to Monitor, or disable it, under Account → Firewall (WAF); running servers pick that up without a deploy. On the server side, API_TRAFFIC_WAF_ENABLED=false turns the firewall off even when ApiTraffic is unreachable.

Data captured #

What data does ApiTraffic capture?

For each inbound request: the method, URL and query, request and response headers, request and response bodies, status code and timing, plus any tags and traces you add in code and the firewall verdict. The SDK also captures the outbound HTTP calls your app makes while serving it. With performance monitoring, it records spans for database, cache, queue and outbound operations. With server health turned on, it samples CPU, memory and event-loop metrics from each server. See How ApiTraffic works.

How do I keep sensitive data out of ApiTraffic?

Three layers:

1. Default masking. Credential-shaped body keys and query parameters, such as password, token and secret, are masked by default.
2. Redaction rules. Mask or remove card numbers, personal data, headers and JSON fields. Rules set to Redact at API run inside your process, so the original value never leaves your server; the SDK sends nothing until your rules have loaded. See Redactions.
3. Exclusions. Stop whole routes, such as health checks or internal admin endpoints, from being captured at all. See Exclusions.

Are large bodies captured?

Bodies up to 512 KB each are captured by default; a larger body is replaced with a placeholder that gives its size. Binary bodies, and streams the SDK cannot copy as they are sent (such as file downloads), are replaced with a short placeholder. You can change the cap with maxBodyBytes. See Troubleshooting.

Storage, retention and deletion #

How long is my data kept?

For your plan’s retention window, and then it expires. Each plan’s window is listed on the pricing page. Request metadata, captured bodies and APM spans are separate entitlements with their own windows, so bodies and spans can expire before the request record does.

Where is my data stored, and who can see it?

Data is encrypted in transit and at rest. Inside your account, access is role-based (owner, admin, member), and multi-factor authentication can be required for everyone. Outside it, only our sub-processors handle data, each for a specific function on our instructions. For our current sub-processor list, a data processing agreement or questions about data residency, email [email protected]. See the security page and privacy policy.

Do you use my data to train models?

We do not sell personal information, and we do not use the telemetry in your account to train models for anyone else. See the privacy policy.

How do I delete my data?

The account owner can purge captured traffic (and, optionally, saved work, rules, settings and automations) at any time, or close the account. When an account is closed, its telemetry is deleted. Records we are legally required to keep, such as invoices, are kept only as long as that requirement lasts. See Purge data or close your account.

Is ApiTraffic certified for SOC 2 or other compliance standards?

We do not claim certifications we do not hold. For the current status of certifications, penetration testing, data residency or a questionnaire, email [email protected]. See the security page.

Plans and usage #

What happens when I reach my plan’s allowance?

We email you at 80% and again at 100% of an allowance in each billing period. Past the allowance, your plan either bills the extra at a published rate or stops capture until the period resets. Your application keeps running either way. See Plan, usage and billing.

Does the sample data count toward my usage?

No. The sample bucket does not count toward your plan’s bucket limit or your usage. See Sample data.

Related #

• Quickstart: Install the SDK and see your own traffic in five minutes.

• Troubleshooting: Fixes for missing data, blocked traffic and connection problems.

• How ApiTraffic works: The model behind buckets, environments, requests and tokens.

• Sign-in and security: Multi-factor authentication and sign-in controls.