Audit at the persistence layer
Enforced at the framework boundary — bypass is rejected, not policed by convention. Who, what, when, from where; immutable, exportable, regulator-shaped.
Platform teams · Telemetry
Real-time telemetry. Auditor-grade evidence. Same plane.
Every request, every change, every grant — captured at the framework boundary, indexed in Elasticsearch, queryable by humans and exportable to regulators.
The problem
Observability and audit are usually two separate budgets — and two separate gaps.
Ops gets a dashboard. Compliance gets a spreadsheet. The two don't reconcile, and when a regulator asks 'what happened on Wednesday at 14:32', someone joins three tools and prays. Apinizer treats both as the same plane: the audit ledger is queryable telemetry, and the telemetry is auditor-grade.
Capabilities
What Apinizer does here
Elasticsearch-backed analytics
Every request indexed in real time — request, response, latency, headers (with PII masked), and the policy chain that handled it.
Anomaly detection
EMA + Bollinger bands on traffic shape, latency, and error rate. Set sensitivity once; the gateway opens alarms only when the curve actually breaks.
Severity-aware alarms
Four grades, nine action types, fifteen-plus connectors. P1 reaches on-call; P3 lands in the daily digest.
Forensic timelines
Join request logs to audit events to policy changes — for any window, any consumer, any endpoint. A single query answers the regulator.
Per-tier dashboards
Platform sees everything. Project owners see their domain. Environment operators see the lane they run. Same data, different scopes.
Use cases
In production, this looks like…
- Banking
Istanbul Tier-1 bank ships BDDK quarterly evidence as one export
What used to be a three-week project becomes a saved query. Every grant, change, and request joins on one timeline.
3 weeks → 1 query
- Healthcare
Munich hospital network detects a quiet PHI exfiltration attempt
Traffic shape on a low-volume endpoint drifted 4× in three hours. Anomaly fired in 12 minutes; SOC stopped the integration before the next batch.
12 min to detection
- Government
Riyadh ministry serves a regulator's 'who, what, when' query in 90 seconds
Audit is queryable — not a forensic build-out. The regulator's request closes the same business day.
- Telecom
Madrid carrier joins customer support tickets to API audit timelines
Support ticket → consumer → audit chain → root cause. Mean time to explain drops from days to minutes.
- Insurance
Amsterdam insurer alerts on claim-pricing drift in 8 minutes
Bollinger bands on pricing API response distribution. A bad model push moved the curve; alarm fired before customers noticed.
8 min to alarm
- Energy
Prague utility audits SCADA gateway access for 14000 sessions
Operators see only their substation; auditors see the union. The annual compliance file is generated automatically on December 31.
- Public sector
Rome ministry exports GDPR Article 30 records of processing
Personal-data flows joined to consent records, retention windows, and access logs. Article 30 is a saved view, not a yearly project.
- Banking
Baku bank catches an SLA breach on payments before the regulator does
Anomaly + severity-aware fan-out: P1 reached on-call in 90 seconds; root cause posted to the SOC in 7 minutes.
How it works
Capture, index, query, alarm — in one plane.
- Step 01
Capture
Every request, change, grant, and view is captured at the framework boundary — no opt-in, no convention.
- Step 02
Index
Telemetry and audit land in Elasticsearch in real time. PII masked on the way in; raw bodies optional and scoped.
- Step 03
Query
Platform, project, environment views; saved searches; ad-hoc joins. Regulator-shaped exports on a schedule.
- Step 04
Alarm
Anomaly + severity policy fan out across nine action types and fifteen-plus connectors. P1 to on-call, P3 to digest.
Recommended products
What we'd reach for first
Analytics Engine
Elasticsearch-backed real-time analytics for every request and policy decision.
Open the Analytics pageMonitoring
Uptime probes, anomaly detection, and severity-aware action chains in one module.
Open the Monitoring pageAPI Gateway
The runtime where audit is enforced at the persistence layer, not bolted on later.
Open the Gateway pageAI Gateway
Same observability and audit for LLM, MCP, and agent traffic.
Open the AI Gateway pageResources
Keep going
Observability overview
How telemetry and audit share the same plane — and what regulators look for.
Analytics Engine
Real-time per-endpoint, per-consumer, per-region telemetry on Elasticsearch.
Monitoring
Uptime, anomaly detection, severity-aware alarms — one module.
Compliance posture
Mapping to BDDK, KVKK, GDPR, ISO 27001 evidence requirements.
APIops manifests
Changes flow through Git; audit captures the apply, the actor, and the diff.
Architecture overview
Where audit and telemetry live in the data plane.
Telemetry meets evidence
One plane for ops and audit.
A 30-minute walkthrough — capture, index, query, alarm — on a Kubernetes of your choice.