Connect Axiom with Unkey

Stream Unkey audit logs, key verifications, gateway HTTP requests, runtime logs, and rate-limit decisions to Axiom.

Unkey provides infrastructure for building and operating APIs. Connect Unkey with Axiom to send audit logs, key verifications, gateway HTTP requests, runtime logs, and rate-limit decisions to an Axiom dataset.

Prerequisites

Create an Axiom account.
Create a dataset in Axiom where you send your data.
Create an API token in Axiom with permissions to ingest data to the dataset you have created.

Create an Unkey account.

Supported event streams

Each log drain sends one event stream. To send all five streams, create five drains. You can send them to the same Axiom dataset and use the stream field to distinguish them, or use a separate dataset for each stream.

Stream	`stream` value	Events
Audit logs	`audit_logs`	Workspace actions, such as creating projects or changing configuration
Key verifications	`key_verifications`	API key verification results, including successful and rejected verifications
Gateway HTTP requests	`gateway_requests`	Recorded HTTP requests served through Unkey's gateway
Runtime logs	`runtime_logs`	Collected application output, including structured logs and multiline messages
Rate limits	`ratelimits`	Recorded API rate-limit decisions, including passed and blocked checks

Set up an Axiom log drain

Create a log drain in your Unkey workspace.

In the Unkey dashboard, select your workspace, and then go to Settings > Log Drains.
Click Create Log Drain.
Select Axiom as the destination.
Enter a descriptive name for the log drain.
In Stream, select Audit logs, Key verifications, Gateway HTTP requests, Runtime logs, or Rate limits.
Optional: Configure stream filters to limit which events Unkey sends.
Enter the name of your Axiom dataset and your Axiom API token.
Click Create Log Drain.
Repeat these steps for each additional stream you want to send.

Drains start at creation time. Historical backfill isn't supported. Unkey sends events asynchronously in batches, so events can take several minutes to appear in Axiom.

Explore your Unkey events

After you create a drain, open the Stream tab in Axiom to verify that events arrive in your dataset. Filter by stream to inspect an event type.

Each event includes _time, when it occurred, and stream, its event type.

Audit logs

The audit_logs stream records who performed a workspace action and which resources it affected.

JSON

{
  "_time": "2026-09-10T12:34:56.789Z",
  "stream": "audit_logs",
  "id": "evt_123",
  "action": "key.create",
  "occurred_at": "2026-09-10T12:34:56.789Z",
  "actor": {
    "id": "user_123",
    "type": "user",
    "name": "Ada",
    "metadata": null
  },
  "targets": [
    {
      "id": "key_123",
      "type": "key",
      "name": "Production API key",
      "metadata": null
    }
  ],
  "context": {
    "location": "203.0.113.10",
    "user_agent": "Mozilla/5.0"
  },
  "metadata": null,
  "description": "Created Production API key",
  "correlation_id": "req_123"
}

See Unkey audit log event types for the complete list of actions.

Key verifications

The key_verifications stream records API key verification outcomes.

JSON

{
  "_time": "2026-09-10T12:34:56.789Z",
  "stream": "key_verifications",
  "request_id": "req_123",
  "key_space_id": "ks_production",
  "key_id": "key_123",
  "identity": {
    "id": "id_123",
    "externalId": "customer_123"
  },
  "region": "eu-west-1",
  "source": { "type": "api" },
  "outcome": "VALID",
  "tags": ["paid"],
  "spent_credits": 1
}

See Unkey key verification payloads for field details.

Gateway HTTP requests

The gateway_requests stream records gateway request metadata, response status, latency, and captured request details.

JSON

{
  "_time": "2026-09-10T12:34:56.789Z",
  "stream": "gateway_requests",
  "request_id": "req_123",
  "project_id": "proj_store",
  "app_id": "app_backend",
  "environment_id": "env_production",
  "deployment_id": "dep_release",
  "region": "eu-west-1",
  "request": {
    "method": "GET",
    "host": "api.example.com",
    "path": "/orders",
    "query_string": "status=paid",
    "query_params": { "status": ["paid"] },
    "headers": ["Accept: application/json"],
    "body": "",
    "user_agent": "store-client/1.0",
    "ip_address": "203.0.113.10"
  },
  "response": {
    "status": 200,
    "headers": ["Content-Type: application/json"],
    "body": "{\"orders\":[]}"
  },
  "latency": { "total": 52, "instance": 41, "gateway": 11 }
}

Captured details follow your Unkey logging policy. See Unkey gateway request payloads for field details and capture limits.

Runtime logs

The runtime_logs stream forwards collected application output, including multiline messages and nested structured attributes.

JSON

{
  "_time": "2026-09-10T12:34:56.789Z",
  "stream": "runtime_logs",
  "log_id": "rlog_123",
  "severity": "error",
  "message": "Payment failed",
  "attributes": { "order": { "id": 42 }, "retry": false },
  "project_id": "proj_store",
  "app_id": "app_backend",
  "environment_id": "env_production",
  "deployment_id": "dep_release",
  "region": "eu-west-1"
}

See Unkey runtime log payloads for field details and handling of application output.

Rate limits

The ratelimits stream exports recorded decisions from ratelimit.limit and ratelimit.multiLimit. These are rate-limit checks, not audit events for configuration changes.

JSON

{
  "_time": "2026-09-10T12:34:56.789Z",
  "stream": "ratelimits",
  "request_id": "req_123",
  "namespace_id": "rl_payments",
  "identifier": "customer_123",
  "passed": false,
  "limit": 100,
  "remaining": 0,
  "reset_at": 1789043756789,
  "tokens": 3,
  "source": "api"
}

See Unkey rate-limit payloads for field details and which decisions are recorded.

Delivery and troubleshooting

For delivery status, retention, retries, and troubleshooting, see the Unkey log drain documentation.