Request log and prompt capture
What Stav records for every request, what it never stores by default, and how to capture request content for a limited window when you need to debug.
The request log
Every request to the API gets a row in Your workspace → Monitor → Request log. By default the row holds metadata, not content:
| You see | For example |
|---|---|
| Time, status, request ID | The X-Stav-Request-Id you got back |
| Model and Inference Provider | What actually served the request |
| Route and sovereignty | Which Router or model was addressed, and the country the compute ran in |
| Usage, cost, latency, TTFT | Tokens, credits charged, timings |
| API key and user | Which key made the call |
Open a row for the detail panel: Overview, Routing (why the Smart Router chose that endpoint), Signals, and — only if content was captured — Request and Response.
Quote the request ID when you contact support. It finds the row.
Content is not stored by default
A workspace starts at Never permitted. No prompt or response text is stored, for any reason, and the capture option does not appear in the request log.
Allowing capture
The workspace Owner sets the permission under Your workspace → Govern → Prompt capture:
- Never permitted — the default.
- Permitted — Owners and Admins may open a capture window, up to a maximum length.
The Owner also chooses how long captured text is kept (1, 7 or 30 days). Request metadata keeps its own 90-day retention.
Permission alone stores nothing. Capture happens only while a window is open. An Owner or Admin opens one from Your workspace → Monitor → Request log; it always expires, and can be closed early.
While a window is open, Stav stores the full request — system prompt, messages, tools and parameters — plus the request as sent to the provider. Secrets, card numbers and certificates are masked before anything is written. Credentials in headers are never stored. A request over 256 KB has its longest values shortened and marked. Embeddings requests store the request only.
Capturing your own traffic
Under Your workspace → Govern → Prompt capture → Me, any member can capture the requests made with their own personal keys, for 1, 4, 8 or 24 hours. Nobody else can read those — not your admins, not Stav — unless you share them from the same page, for a limited time, with your workspace's Owner and Admins or with Stav support.
The Owner can switch personal capture off for the whole workspace. An open personal window then closes within about 15 seconds.
Stav's access
Stav support cannot read captured content unless the Owner turns on Stav support may read captured prompts. Opening a window does not turn it on. Every view by Stav lands in your audit log.
Captured content is never used for training.