# ApiTraffic

> ApiTraffic records every request your Node API serves and makes - with latency, errors, a security verdict and a searchable payload on one record - and exposes it to your team and your AI agents.

ApiTraffic is API monitoring for Node.js: request logging and search, application performance monitoring, alerts and incidents, API drift detection, regression tracking and an in-application web application firewall.

It has first-party SDKs for Express, Fastify, NestJS, Koa, Hapi, Meteor, Sails, LoopBack, Strapi and AdonisJS, and a proxy URL for any other stack. AI coding agents can query captured traffic and these docs through the ApiTraffic MCP server.

Every docs page is also available as Markdown by appending `.md` to its URL, the complete corpus is at https://www.apitraffic.io/llms-full.txt, and ApiTraffic's MCP server can search these docs with the `search_docs` tool.

## Product

- [Traffic & search](https://www.apitraffic.io/platform)
- [Performance](https://www.apitraffic.io/apm)
- [Alerts & drift](https://www.apitraffic.io/monitoring)
- [Firewall](https://www.apitraffic.io/waf)
- [AI & MCP](https://www.apitraffic.io/ai)
- [Integrations](https://www.apitraffic.io/integrations)
- [Pricing](https://www.apitraffic.io/pricing)

## Framework guides

- [Express](https://www.apitraffic.io/express)
- [Fastify](https://www.apitraffic.io/fastify)
- [NestJS](https://www.apitraffic.io/nestjs)
- [Koa](https://www.apitraffic.io/koa)
- [Hapi](https://www.apitraffic.io/hapi)
- [Meteor](https://www.apitraffic.io/meteor)
- [Sails](https://www.apitraffic.io/sails)
- [LoopBack](https://www.apitraffic.io/loopback)
- [Strapi](https://www.apitraffic.io/strapi)
- [AdonisJS](https://www.apitraffic.io/adonisjs)

## Guides - Get started

- [Welcome to ApiTraffic](https://www.apitraffic.io/docs.md): ApiTraffic records every API request with its payload, latency breakdown and firewall verdict. Start here to install the SDK, explore and connect agents.
- [Quickstart: see your own API traffic in five minutes](https://www.apitraffic.io/docs/quickstart.md): Sign up, install the ApiTraffic SDK for Express, NestJS, Fastify, Koa, hapi, AdonisJS, LoopBack, Sails, Meteor or Strapi, and watch your first request arrive in ApiTraffic.
- [How ApiTraffic works](https://www.apitraffic.io/docs/concepts.md): The ApiTraffic model: accounts, roles, environments, buckets, requests, spans, firewall verdicts, redaction, exclusions, retention and tokens.
- [Explore the sample data](https://www.apitraffic.io/docs/sample-data.md): A read-only demo bucket of live traffic from a fictional store: what is in it, how to turn it on or off, and a guided tour of its incidents.

## Guides - Connect your app

- [Choose an integration](https://www.apitraffic.io/docs/integrations/overview.md): Pick the right ApiTraffic SDK for your Node.js app: the unified @apitraffic/node package, a per-framework package, the Strapi plugin, or the proxy.
- [Install the Node SDK](https://www.apitraffic.io/docs/integrations/node.md): Add @apitraffic/node to an Express, Fastify, Koa or hapi app: one package with request capture, the firewall and APM, enabled from your account.
- [Connect an Express app](https://www.apitraffic.io/docs/integrations/express.md): Add ApiTraffic to an Express 4.17+ or 5 API: install, middleware order, credentials, what is captured, firewall, APM and troubleshooting.
- [Connect a Fastify app](https://www.apitraffic.io/docs/integrations/fastify.md): Add ApiTraffic to a Fastify 4 or 5 API: plugin registration and encapsulation, credentials, hooks, what is captured, firewall, APM and troubleshooting.
- [Connect a Koa app](https://www.apitraffic.io/docs/integrations/koa.md): Add ApiTraffic to a Koa 2.13+ or 3 API: middleware order, body parsing, error handling, @koa/router routes, firewall, APM and troubleshooting.
- [Connect a hapi app](https://www.apitraffic.io/docs/integrations/hapi.md): Add ApiTraffic to a hapi 21 API: plugin registration, credentials, payloads, error responses, firewall, APM and troubleshooting.
- [Connect a NestJS app](https://www.apitraffic.io/docs/integrations/nestjs.md): Add ApiTraffic to a NestJS API: install the module, set credentials, see what is recorded, and turn on the firewall, APM, tagging and tracing.
- [Connect a Meteor app](https://www.apitraffic.io/docs/integrations/meteor.md): Add ApiTraffic to a Meteor server's WebApp: install, mount, credentials, what is recorded, firewall, APM, tagging and troubleshooting.
- [Connect a LoopBack 4 app](https://www.apitraffic.io/docs/integrations/loopback.md): Add ApiTraffic to a LoopBack 4 API as a component: install, register, credentials, what is recorded, firewall, APM and troubleshooting.
- [Connect an AdonisJS app](https://www.apitraffic.io/docs/integrations/adonisjs.md): Add ApiTraffic to an AdonisJS 6 or 7 API: install the provider and middleware, credentials, what is recorded, firewall, APM and troubleshooting.
- [Connect a Sails app](https://www.apitraffic.io/docs/integrations/sails.md): Add ApiTraffic to a Sails API as a hook: install, credentials, what is recorded, firewall, APM, tagging, tracing and troubleshooting.
- [Connect a Strapi app](https://www.apitraffic.io/docs/integrations/strapi.md): Add the @apitraffic/strapi plugin to a Strapi 5 app: install, register the middleware, configure credentials, verify and troubleshoot.
- [SDK configuration reference](https://www.apitraffic.io/docs/integrations/configuration.md): Every ApiTraffic Node SDK option and environment variable, its default and effect, how code, environment and account settings combine, and the per-request APIs.
- [Outbound requests](https://www.apitraffic.io/docs/outbound-requests.md): How the ApiTraffic SDK captures the API calls your app makes, links them to the inbound request, and the cases where a body or a call is not captured.
- [Monitor your servers](https://www.apitraffic.io/docs/integrations/servers.md): See every server running the ApiTraffic SDK: health, CPU, memory and event-loop delay, load distribution across the fleet, restarts and config status.

## Guides - Explore traffic

- [Bucket dashboard](https://www.apitraffic.io/docs/traffic/dashboard.md): Read the bucket dashboard: attention signals, summary tiles, throughput and response-time charts, and the panels for slow endpoints, errors, firewall and drift.
- [Browse the request log](https://www.apitraffic.io/docs/traffic/request-log.md): Browse every request ApiTraffic captured: the All, Inbound, Outbound, Errors and Captures views, what each row shows, time ranges and paging.
- [Search and filter requests](https://www.apitraffic.io/docs/traffic/search.md): The ApiTraffic search language: every field, operator and value format, exclusions, body search, limits, the filter builder and ready-made queries.
- [Request details](https://www.apitraffic.io/docs/traffic/request-details.md): What an opened request shows: request and response, connection timings, firewall decision, related requests, tags, span waterfall, traces and AI prompts.
- [Tags and dimensions](https://www.apitraffic.io/docs/tags.md): Tag requests with your own context, such as a customer id, and manage those tags in Settings → Dimensions
- [Compare Requests](https://www.apitraffic.io/docs/compare-requests.md): Put two requests side by side and see exactly how their headers and bodies differ
- [Resend Request](https://www.apitraffic.io/docs/resend-request.md): Open a captured request in the request editor, change anything about it, send it again, and see the new attempt in your request log next to the original
- [Save searches as stream views](https://www.apitraffic.io/docs/traffic/saved-views.md): Save a request search as a stream view so your whole team can reopen it, edit it, and attach workflows to it.
- [Endpoints and endpoint handling](https://www.apitraffic.io/docs/endpoint-handling.md): Browse your API's endpoints and their metrics, and learn how ApiTraffic groups request paths into endpoints and how to tune it per bucket.
- [Detect API drift](https://www.apitraffic.io/docs/traffic/drift.md): Drift detection learns each endpoint's normal request and response shape and behavior, then flags breaking, additive, behavioral and dependency changes.
- [Is my data delayed?](https://www.apitraffic.io/docs/traffic/is-my-data-delayed.md): What the delayed, rate limited and paused banners and bucket labels mean, why traffic can take a few minutes to appear, and what to do about each.

## Guides - Performance

- [How APM works](https://www.apitraffic.io/docs/apm/overview.md): What ApiTraffic APM records inside each request, how spans are attributed and grouped, and what it costs your application.
- [Set up APM](https://www.apitraffic.io/docs/apm/setup.md): Start the ApiTraffic OpenTelemetry bridge in your Node application to capture database, cache, queue and outbound spans for every request.
- [Performance analytics](https://www.apitraffic.io/docs/apm/analytics.md): Use the Performance pages to find the endpoint, query, dependency or line of code that costs your API the most time, and what changed after a deploy.
- [APM capture settings](https://www.apitraffic.io/docs/apm/capture-settings.md): Control what APM spans carry: query parameters and Redis keys for a limited time, code location and stack depth, and whether query text is stored.

## Guides - Reports and alerts

- [Reports](https://www.apitraffic.io/docs/reports.md): Group your traffic by endpoint, customer or any tag, measure it, compare it with an earlier period, and save it to share or put on a dashboard
- [Span reports](https://www.apitraffic.io/docs/span-reports.md): Build reports over the operations inside your requests: slowest database queries, outbound time by vendor, failed calls by type and N+1 queries
- [Dashboards](https://www.apitraffic.io/docs/dashboards.md): Put saved reports side by side and look at all of them through one filter and time range, for example one customer's traffic
- [Alerts](https://www.apitraffic.io/docs/alerts.md): Get told when your API breaks: incidents, who was notified and why, and what counts as broken
- [Channels](https://www.apitraffic.io/docs/alerts/channels.md): Send alerts to Slack, email, webhooks, PagerDuty and Jira, test them, and see every delivery
- [Routing](https://www.apitraffic.io/docs/alerts/routing.md): Decide who hears about which incidents: routes, escalation, reminders, quiet hours and digests
- [Silences](https://www.apitraffic.io/docs/alerts/silences.md): Stop notifications during maintenance or for a known problem, without hiding incidents
- [Webhook payloads](https://www.apitraffic.io/docs/alerts/webhook-payloads.md): The JSON body of alert webhooks, the event types, and how to verify the signature

## Guides - Security and data controls

- [Web application firewall](https://www.apitraffic.io/docs/waf/overview.md): How the ApiTraffic firewall inspects requests inside your Node app: Monitor and Enforcing modes, managed and custom rules, verdicts, cost and plans.
- [Set up the firewall](https://www.apitraffic.io/docs/waf/setup.md): Set up the ApiTraffic firewall end to end: confirm the SDK, create a policy in Monitor mode, review what it catches, then switch to Enforcing.
- [Create and manage firewall policies](https://www.apitraffic.io/docs/waf/policies.md): Create, edit, test and assign ApiTraffic firewall policies: managed rules, lists, rate limits, custom rules, block responses, outbound and behavioral layers.
- [Choose what a blocked request receives](https://www.apitraffic.io/docs/waf/block-responses.md): Reusable firewall block responses: the status code, content type, body and headers a request blocked by an ApiTraffic WAF policy receives, shared across policies and enforced offline.
- [Block or allow countries](https://www.apitraffic.io/docs/waf/country-lists.md): Allow or deny requests by country with firewall country lists and criteria rules, with or without an edge such as Cloudflare in front of your API. Country data: IP Geolocation by DB-IP.
- [Flag and block abusive IPs with AbuseIPDB](https://www.apitraffic.io/docs/waf/ip-reputation.md): Look client IPs up in AbuseIPDB, flag or block requests from abusive ones, block AbuseIPDB's blacklist on the first request, and report an abusive IP in one click. Your servers never wait on a lookup.
- [Redact sensitive data](https://www.apitraffic.io/docs/data/redactions.md): Create redaction rules that mask card numbers, emails, tokens and your own fields in your API or before storage, and see what the SDK masks by default.
- [Exclude requests from capture](https://www.apitraffic.io/docs/data/exclusions.md): Create exclusion rules so health checks and other noise are never sent to ApiTraffic, never stored and never counted toward your usage.
- [Create endpoint rules](https://www.apitraffic.io/docs/data/endpoint-rules.md): Create, test and manage endpoint rules that name a group of paths as one endpoint, scope them to inbound or outbound traffic, and mark long-lived connections.

## Guides - Collaborate and automate

- [Collections](https://www.apitraffic.io/docs/collections.md): Group captured requests into named collections to keep examples, reproduce bugs and share a set of requests with your team or outside it.
- [Share requests and collections](https://www.apitraffic.io/docs/sharing.md): Create public links to a captured request or a collection, set an expiry, see every active link and revoke them, and know what a link exposes.
- [Event markers](https://www.apitraffic.io/docs/events.md): Mark deploys, incidents, rollbacks and config changes on your traffic charts, from the app, the API, your CI pipeline, an AI assistant or Git.
- [Workflows](https://www.apitraffic.io/docs/workflows.md): Run an automated flow every time a captured request matches a stream view: notify your team, open a ticket or call your own systems with the request's data.

## Guides - AI and integrations

- [Connect AI assistants with the MCP server](https://www.apitraffic.io/docs/integrations/mcp-server.md): Connect Claude, Claude Code, Cursor, VS Code, Windsurf and other MCP clients to your ApiTraffic traffic with OAuth or an MCP token, and learn what they can do.
- [MCP Tools](https://www.apitraffic.io/docs/integrations/mcp-tools.md): Every tool the ApiTraffic MCP server exposes to AI assistants, with its arguments.
- [Connected apps and OAuth](https://www.apitraffic.io/docs/integrations/oauth.md): See and disconnect the applications acting for people on your account, and build a client that signs in to ApiTraffic with OAuth 2.1.
- [Embed the request log in your app](https://www.apitraffic.io/docs/integrations/embed.md): Embed an ApiTraffic request log directly into your application, with per-token control over which requests and request details it can show.
- [Embedded Reports and Dashboards](https://www.apitraffic.io/docs/integrations/embed-reports.md): Show your customers their own usage, errors and latency inside your app: a saved report or dashboard, filtered to each customer by a token your server signs.
- [Git integrations](https://www.apitraffic.io/docs/git-integrations/overview.md): Connect GitHub, GitLab or Bitbucket so every push, tag and release becomes an event marker on your charts and ApiTraffic knows which commit was running.
- [Connect GitHub](https://www.apitraffic.io/docs/git-integrations/github.md): Install the ApiTraffic GitHub App, link a repository to a bucket and map branches to environments so pushes, tags and releases become event markers.
- [Connect GitLab](https://www.apitraffic.io/docs/git-integrations/gitlab.md): Authorize ApiTraffic on gitlab.com, link a project to a bucket and map branches to environments so pushes, tags and releases become event markers.
- [Connect Bitbucket](https://www.apitraffic.io/docs/git-integrations/bitbucket.md): Authorize ApiTraffic on Bitbucket Cloud, link a repository to a bucket and map branches to environments so pushes and tags become event markers.
- [Account activity events](https://www.apitraffic.io/docs/webhooks/overview.md): The events that record what happens inside your ApiTraffic account, who did what and when, and how to read them from the app or the API.
- [Account activity event reference](https://www.apitraffic.io/docs/webhooks/reference.md): The payload of every account activity event, generated from the AsyncAPI contract.

## Guides - Account and administration

- [Manage environments](https://www.apitraffic.io/docs/account/environments.md): Separate production, staging and development traffic with environments: create, rename and delete them, choose the default, and switch between them.
- [Manage buckets and bucket settings](https://www.apitraffic.io/docs/account/buckets.md): Create buckets for each application or service, configure endpoint learning, APM capture, host telemetry and drift detection, and delete buckets.
- [Team and roles](https://www.apitraffic.io/docs/account/team.md): Invite teammates to your ApiTraffic account, choose between the Owner, Admin and Member roles, and remove people or revoke invitations.
- [Sign-in and security](https://www.apitraffic.io/docs/account/security.md): Sign in with a password or Google, GitHub, Microsoft or Atlassian, set up MFA with an authenticator app, passkey or text message, and require it for your team.
- [Client IP addresses](https://www.apitraffic.io/docs/account/client-ip-addresses.md): Choose how every request in your account keeps its client's IP address: the full address, only its network, or none. Countries work in every mode.
- [Create and manage API tokens](https://www.apitraffic.io/docs/account/api-tokens.md): Create ingest tokens for your SDKs and API tokens for scripts, choose a role, replace and delete tokens, and keep them safe.
- [Plan, usage and billing](https://www.apitraffic.io/docs/account/billing.md): Choose or change your ApiTraffic plan, track usage against allowances, manage cards, billing address and invoices, and see what happens when a trial ends.
- [Ingest rate limits and sampling](https://www.apitraffic.io/docs/account/ingest-rate-limits.md): How many records per second each plan records, what happens to traffic over the limit (your API is never slowed down), how sampling keeps a representative picture, and where you see what was not recorded.
- [Notification preferences](https://www.apitraffic.io/docs/account/notifications.md): Choose which ApiTraffic emails you receive, from usage warnings and alerts to product updates, and which account emails are always sent.
- [Account history](https://www.apitraffic.io/docs/account/activity-log.md): See everything that happened in your ApiTraffic account and who did it: team changes, sign-ins, tokens, billing, buckets, data rules and support access.
- [Grant support access](https://www.apitraffic.io/docs/account/support-access.md): Give ApiTraffic support temporary, recorded access to your account so they can troubleshoot, see what they can and can't do, and revoke it at any time.
- [Purge data or close your account](https://www.apitraffic.io/docs/account-data.md): Clear your account's data, up to a complete reset, or close the account and have its data deleted 30 days later.

## Guides - Reference

- [Troubleshooting](https://www.apitraffic.io/docs/troubleshooting.md): Fixes by symptom: no data, SDK cannot reach ApiTraffic, missing bodies, redaction, firewall, APM spans, outbound calls, MCP, API errors and plan limits.
- [Frequently asked questions](https://www.apitraffic.io/docs/faq.md): Answers about what ApiTraffic captures, performance overhead, supported Node versions and frameworks, data storage, retention and deletion.
- [Metrics Reference](https://www.apitraffic.io/docs/reference/metrics.md): What every number in ApiTraffic measures, how it is derived, and what to look for.
- [Offline definitions](https://www.apitraffic.io/docs/reference/offline-definitions.md): Commit a pinned copy of your redaction rules, exclusions and firewall policy so a server that starts while ApiTraffic is unreachable still applies them.
- [If ApiTraffic is unreachable](https://www.apitraffic.io/docs/reference/unreachable.md): What the ApiTraffic SDK does to your application when ApiTraffic, or your network path to it, is down: requests, startup, telemetry, redaction and the firewall.
- [Shutting down](https://www.apitraffic.io/docs/reference/shutdown.md): Stop the ApiTraffic SDK cleanly in scripts, workers, tests and servers with shutdown(), and deliver captured data before a serverless freeze with flush().
- [CLI](https://www.apitraffic.io/docs/reference/cli.md): Reference for @apitraffic/cli: pull and check pinned offline definitions in CI, with authentication, flags, exit codes, JSON output and troubleshooting.

## API reference - Getting started

- [ApiTraffic REST API](https://www.apitraffic.io/docs/api-reference/introduction.md): Base URL, versioning, authentication, errors, pagination and rate limits for the ApiTraffic REST API, with an overview of every resource.
- [Authentication API](https://www.apitraffic.io/docs/api-reference/authentication.md): Read the signed-in user's profile, check which account a token belongs to, end a session, and mint short-lived embed tokens with the ApiTraffic REST API.
- [API tokens API](https://www.apitraffic.io/docs/api-reference/api-tokens.md): List, create, rename, change the role of and delete the API tokens that scripts, integrations and SDKs use to call ApiTraffic.
- [MCP tokens API](https://www.apitraffic.io/docs/api-reference/mcp-tokens.md): List, create, rename, rescope and revoke the MCP tokens that AI assistants use to query your ApiTraffic data through the MCP server.

## API reference - Core resources

- [Environments API](https://www.apitraffic.io/docs/api-reference/environments.md): List, create, rename and delete environments, and choose the account's default environment, with the ApiTraffic REST API.
- [Buckets API](https://www.apitraffic.io/docs/api-reference/buckets.md): List, create, configure and delete buckets, and download the settings ApiTraffic SDKs load: redactions, exclusions, firewall, APM and host telemetry.
- [Requests API](https://www.apitraffic.io/docs/api-reference/requests.md): Search a bucket's captured requests, read one in full with its spans and timings, find what ran beside it, and generate AI fix and performance prompts.
- [Stream views API](https://www.apitraffic.io/docs/api-reference/stream-views.md): List, create, update and delete stream views (named request filters on a bucket) and read the latest requests that match one.
- [Metrics API](https://www.apitraffic.io/docs/api-reference/metrics.md): Read request totals, throughput by status class, response-time percentiles and the weekly traffic pattern for an environment, bucket or filtered request set.
- [Reports API](https://www.apitraffic.io/docs/api-reference/reports.md): Run report definitions, list the template gallery, and manage saved reports, their history and dashboards
- [Dimensions](https://www.apitraffic.io/docs/api-reference/dimensions.md): Tag keys, their classification and promotion, the customer catalogue and dropped-tag diagnostics
- [APM API](https://www.apitraffic.io/docs/api-reference/apm.md): Read where request time goes, which endpoints and operations consume it, what regressed after a deploy, slow examples, dependencies and distributed traces.
- [Spans API](https://www.apitraffic.io/docs/api-reference/spans.md): Aggregate the database, cache, outbound HTTP and queue operations inside requests, chart one over time, drill back to its requests and look up fingerprints.
- [Endpoints API](https://www.apitraffic.io/docs/api-reference/endpoints.md): Read the endpoints ApiTraffic detected in a bucket with their traffic and latency, manage endpoint rules, and triage attention signals.
- [Drift API](https://www.apitraffic.io/docs/api-reference/drift.md): Read and triage API drift findings, their baselines and evidencing requests, check drift scan health, and generate AI investigation prompts.
- [Hosts API](https://www.apitraffic.io/docs/api-reference/hosts.md): Read host telemetry from your API's servers: the server list, fleet summary, metric series, per-server traffic, saturation, restarts and latency correlation.

## API reference - Data management

- [Redactions API](https://www.apitraffic.io/docs/api-reference/redactions.md): List, create, update and delete the redaction rules that remove card numbers, tokens and other sensitive data from captured requests before they are stored.
- [Exclusions API](https://www.apitraffic.io/docs/api-reference/exclusions.md): List, create, update and delete the exclusion rules that stop matching traffic, such as health checks, from being captured by ApiTraffic.
- [WAF API](https://www.apitraffic.io/docs/api-reference/waf.md): Manage web application firewall policies, browse managed rulesets, test a policy against requests before saving it, and read firewall analytics.
- [Events API](https://www.apitraffic.io/docs/api-reference/events.md): Create, list, update and delete event markers (deploys, incidents, config changes) that appear on your ApiTraffic charts, typically from CI/CD.
- [Collections and shares API](https://www.apitraffic.io/docs/api-reference/collections-and-shares.md): Group captured requests into collections, create and revoke public share links for requests and collections, list active links and read a shared link.
- [Account data API](https://www.apitraffic.io/docs/api-reference/account-data.md): Purge an account's captured data by kind, close the account now or at the end of the paid period, cancel a scheduled close, and read the history of both.
- [Account settings API](https://www.apitraffic.io/docs/api-reference/account-settings.md): Change the account's name, billing email, sample data, query text and client IP settings, and turn Allow overage on or off.

## API reference - Automation

- [Workflows API](https://www.apitraffic.io/docs/api-reference/workflows.md): Create, list, read and delete the workflows that run when requests match a stream view, and open the workflow builder for a signed-in user.
- [Alerting](https://www.apitraffic.io/docs/api-reference/alerting.md): Incidents, notification channels, routes, silences and the delivery log
- [Account activity API](https://www.apitraffic.io/docs/api-reference/activity.md): Read the account's history (who created a token, changed a rule, signed in or deleted a bucket, and when) and the catalog of event types that can appear in it.

## Blog

- [W3C Trace Context in Node.js: correlating requests across services with traceparent](https://www.apitraffic.io/blog/w3c-trace-context-node): W3C Trace Context in Node.js: propagate traceparent with OpenTelemetry or 30 lines of code, add trace IDs to logs and follow one request across services.
- [What small Node teams should log in the AI-attack era](https://www.apitraffic.io/blog/what-small-node-teams-should-log-in-the-ai-attack-era): Bots are over half of web traffic. Learn the minimum request fields to log in your Node.js API, the attack patterns to watch, and when to block them.
- [Deploy markers: tying a latency regression to the release that caused it](https://www.apitraffic.io/blog/deploy-markers-regressions): Add deploy markers to a Node API: bake in the commit SHA, log the version per request, send markers from CI and compare p95 before and after each release.
- [Node.js large file upload handling without running out of memory](https://www.apitraffic.io/blog/nodejs-large-file-upload): Handle a Node.js large file upload safely: stream with busboy or @fastify/multipart, set limits, use presigned S3 URLs and patch 2026 multipart parser CVEs.
- [Third-party API latency: measuring vendor slowness and failures in Node](https://www.apitraffic.io/blog/third-party-api-latency): Measure third-party API latency and failures in Node.js with diagnostics_channel: per-vendor p95, 429s, timeouts and retries for every fetch, with no wrappers.
- [SSRF in Node.js: the fetch() you didn't mean to make](https://www.apitraffic.io/blog/ssrf-in-nodejs): Prevent SSRF in Node.js: why URL string checks fail, a tested safeFetch() for fetch and undici that blocks private IPs and redirects, plus a checklist.
- [Cursor vs offset pagination: an API design that survives big tables and scrapers](https://www.apitraffic.io/blog/cursor-vs-offset-pagination): Cursor vs offset pagination for Node.js APIs: why OFFSET slows down on big tables, how to build keyset pagination in Postgres, and how to slow down scrapers.
- [API alerting best practices: what to page on for a Node API](https://www.apitraffic.io/blog/api-alerting-best-practices): API alerting best practices for small Node teams: which symptoms to page on, what to ticket, how to cut noise, with prom-client code and Prometheus rules.
- [API key security for Node APIs: prefixes, hashing, scopes and rotation](https://www.apitraffic.io/blog/api-key-security): API key security for Node APIs: generate prefixed keys, store SHA-256 hashes, verify with scopes in Express and rotate keys without downtime.
- [Zod validation in Express and Fastify: request bodies, query strings and useful errors](https://www.apitraffic.io/blog/zod-validation-express-fastify): Zod validation for Node APIs: an Express 5 middleware, Fastify type provider setup, strict schemas, query coercion and 400 errors your clients can act on.
- [API log retention and cost: how much request logging a small team needs](https://www.apitraffic.io/blog/api-log-retention): Set an API log retention policy for a small team: what to keep and for how long, how to estimate logging costs, sample safely and automate deletion.
- [Node.js event loop lag: the metric that explains "random" slowness](https://www.apitraffic.io/blog/nodejs-event-loop-lag): Measure Node.js event loop lag with monitorEventLoopDelay and eventLoopUtilization, find the code that blocks it, and fix the "random" slowness in your API.
- [CORS misconfiguration in Express and Fastify: how to find it and test for it](https://www.apitraffic.io/blog/cors-misconfiguration-express): Find and fix CORS misconfiguration in Express and Fastify: reflected origins, unanchored regexes and null, plus curl probes and a CI test in one afternoon.
- [Idempotency keys in Node.js: safe retries for POST endpoints without double charges](https://www.apitraffic.io/blog/idempotency-keys-node): Add an idempotency key to Node.js POST endpoints: Express and Postgres middleware, 409 and 422 handling, key expiry, and retry-safe clients. No double charges.
- [Node.js memory leak debugging with heap snapshots](https://www.apitraffic.io/blog/nodejs-memory-leak-heap): Find a Node.js memory leak with heap snapshots: confirm it with memoryUsage, capture snapshots safely, and compare them in Chrome DevTools to find the cause.
- [Node.js log levels that mean something: a logging policy for small teams](https://www.apitraffic.io/blog/nodejs-log-levels): A Node.js log levels policy for small teams: what each level means, why 4xx is not an error, logging failures once, and changing levels without a deploy.
- [Fastify hooks for logging and auth: onRequest, preHandler and onResponse explained](https://www.apitraffic.io/blog/fastify-hooks-logging-auth): Fastify hooks explained for v5: authenticate in onRequest, authorize in preHandler, log in onResponse with elapsedTime, and fix hooks that run twice.
- [BOLA vulnerability in Node APIs: how to fix IDOR and catch it in your logs](https://www.apitraffic.io/blog/bola-vulnerability-node-api): Fix a BOLA vulnerability in Node APIs: scope queries by tenant, test cross-account access, and spot IDOR enumeration in your request logs before data leaks.
- [How to find N+1 queries in a Node.js API before your users do](https://www.apitraffic.io/blog/n-plus-1-queries-node): Find N+1 queries in a Node.js API by counting queries per request with AsyncLocalStorage, catch them in tests, and fix them with batched queries or DataLoader.
- [Express 5 migration: what breaks in your API and how to fix it](https://www.apitraffic.io/blog/express-5-migration): Express 5 migration guide for APIs: fix route wildcards and optional params, req.query and req.body changes, res.status errors and async error handling.
- [SLOs and an error budget for a small API team, without the enterprise ceremony](https://www.apitraffic.io/blog/error-budget-small-api-team): Set an error budget and SLOs for a Node API in an afternoon: choose SLIs, compute the budget from request logs, add burn-rate alerts and a simple policy.
- [Credential stuffing detection for Node APIs: spotting it in your login logs](https://www.apitraffic.io/blog/credential-stuffing-detection): Credential stuffing detection for Node APIs: what to log on login, the signals that matter, and code and SQL that find compromised accounts in an afternoon.
- [How to log outbound HTTP requests in Node.js](https://www.apitraffic.io/blog/log-outbound-http-requests): Log outbound HTTP requests in Node.js from fetch and axios with diagnostics_channel, then use per-host error rates and p95 to catch failing third-party APIs.
- [Node.js fetch timeout: deadlines with AbortSignal and undici](https://www.apitraffic.io/blog/nodejs-fetch-timeout): How to set a Node.js fetch timeout with AbortSignal.timeout and AbortSignal.any, tune undici defaults, and configure Express and Fastify server timeouts.
- [Node.js rate limiting: fixed window vs sliding window vs token bucket](https://www.apitraffic.io/blog/nodejs-rate-limiting): Node.js rate limiting compared: fixed window, sliding window and token bucket in JavaScript, plus 429 and Retry-After, Redis and what to ship first.
- [Node.js health checks that tell the truth: liveness vs readiness](https://www.apitraffic.io/blog/nodejs-health-check): Build a Node.js health check that tells the truth: separate liveness and readiness in Express and Fastify, with timeouts, caching and Kubernetes probes.
- [How to redact sensitive data in logs for Node.js APIs](https://www.apitraffic.io/blog/redact-sensitive-data-logs): Redact sensitive data in logs from Node.js APIs: Pino redact paths, safe error serializers, URL scrubbing, body allowlists and a test that catches leaks.
- [Node.js graceful shutdown: stop dropping requests on every deploy](https://www.apitraffic.io/blog/nodejs-graceful-shutdown): Node.js graceful shutdown for Express and Fastify: handle SIGTERM, drain keep-alive connections and close pools so deploys stop dropping requests.
- [API latency percentiles: how to read p50, p95 and p99 without fooling yourself](https://www.apitraffic.io/blog/api-latency-percentiles): Learn to read API latency percentiles: what p50, p95 and p99 mean, why averages and merged p95s lie, and a Node.js middleware that records them per route.
- [AsyncLocalStorage request IDs: follow one request through a Node.js API](https://www.apitraffic.io/blog/asynclocalstorage-request-id): Add an AsyncLocalStorage request ID to every log line in Express or Fastify, return it to callers and forward it downstream, so one request is easy to follow.
- [Pino logging in Node.js: a practical structured logging setup for Express and Fastify](https://www.apitraffic.io/blog/pino-logging-nodejs): Set up Pino logging in Node.js in an afternoon: one logger module, pino-http for Express, Fastify loggerInstance, request IDs, levels and redaction.