# Observability & audit — Use case > Real-time API and AI telemetry on top of Elasticsearch, audit enforced at the persistence layer, and an evidence packet the regulator actually accepts. *Platform teams · Telemetry · For platform teams* ## Real-time telemetry. Auditor-grade evidence. Same plane. Every request, every change, every grant — captured at the framework boundary, indexed in Elasticsearch, queryable by humans and exportable to regulators. [Request a demo](https://calendly.com/apinizer/15min) · [Read the docs](https://apinizer.com/developers/docs) --- ## The problem *The problem* ### Observability and audit are usually two separate budgets — and two separate gaps. Ops gets a dashboard. Compliance gets a spreadsheet. The two don't reconcile, and when a regulator asks 'what happened on Wednesday at 14:32', someone joins three tools and prays. Apinizer treats both as the same plane: the audit ledger is queryable telemetry, and the telemetry is auditor-grade. --- ## Capabilities ### Audit at the persistence layer Enforced at the framework boundary — bypass is rejected, not policed by convention. Who, what, when, from where; immutable, exportable, regulator-shaped. ### Elasticsearch-backed analytics Every request indexed in real time — request, response, latency, headers (with PII masked), and the policy chain that handled it. ### Anomaly detection EMA + Bollinger bands on traffic shape, latency, and error rate. Set sensitivity once; the gateway opens alarms only when the curve actually breaks. ### Severity-aware alarms Four grades, nine action types, fifteen-plus connectors. P1 reaches on-call; P3 lands in the daily digest. ### Forensic timelines Join request logs to audit events to policy changes — for any window, any consumer, any endpoint. A single query answers the regulator. ### Per-tier dashboards Platform sees everything. Project owners see their domain. Environment operators see the lane they run. Same data, different scopes. --- ## Real-world examples ### Banking **Scenario:** Istanbul Tier-1 bank ships BDDK quarterly evidence as one export **Outcome:** What used to be a three-week project becomes a saved query. Every grant, change, and request joins on one timeline. **Metric:** 3 weeks → 1 query ### Healthcare **Scenario:** Munich hospital network detects a quiet PHI exfiltration attempt **Outcome:** Traffic shape on a low-volume endpoint drifted 4× in three hours. Anomaly fired in 12 minutes; SOC stopped the integration before the next batch. **Metric:** 12 min to detection ### Government **Scenario:** Riyadh ministry serves a regulator's 'who, what, when' query in 90 seconds **Outcome:** Audit is queryable — not a forensic build-out. The regulator's request closes the same business day. ### Telecom **Scenario:** Madrid carrier joins customer support tickets to API audit timelines **Outcome:** Support ticket → consumer → audit chain → root cause. Mean time to explain drops from days to minutes. ### Insurance **Scenario:** Amsterdam insurer alerts on claim-pricing drift in 8 minutes **Outcome:** Bollinger bands on pricing API response distribution. A bad model push moved the curve; alarm fired before customers noticed. **Metric:** 8 min to alarm ### Energy **Scenario:** Prague utility audits SCADA gateway access for 14000 sessions **Outcome:** Operators see only their substation; auditors see the union. The annual compliance file is generated automatically on December 31. ### Public sector **Scenario:** Rome ministry exports GDPR Article 30 records of processing **Outcome:** Personal-data flows joined to consent records, retention windows, and access logs. Article 30 is a saved view, not a yearly project. ### Banking **Scenario:** Baku bank catches an SLA breach on payments before the regulator does **Outcome:** Anomaly + severity-aware fan-out: P1 reached on-call in 90 seconds; root cause posted to the SOC in 7 minutes. --- ## Capture, index, query, alarm — in one plane. - **01 · Capture** — Every request, change, grant, and view is captured at the framework boundary — no opt-in, no convention. - **02 · Index** — Telemetry and audit land in Elasticsearch in real time. PII masked on the way in; raw bodies optional and scoped. - **03 · Query** — Platform, project, environment views; saved searches; ad-hoc joins. Regulator-shaped exports on a schedule. - **04 · Alarm** — Anomaly + severity policy fan out across nine action types and fifteen-plus connectors. P1 to on-call, P3 to digest. --- ## Recommended modules - [Analytics Engine](https://apinizer.com/products/analytics-engine) — Elasticsearch-backed real-time analytics for every request and policy decision. - [Monitoring](https://apinizer.com/products/monitoring) — Uptime probes, anomaly detection, and severity-aware action chains in one module. - [API Gateway](https://apinizer.com/products/api-gateway) — The runtime where audit is enforced at the persistence layer, not bolted on later. - [AI Gateway](https://apinizer.com/products/ai-gateway) — Same observability and audit for LLM, MCP, and agent traffic. --- ## Resources - [Observability overview](https://docs.apinizer.com/en) — How telemetry and audit share the same plane — and what regulators look for. - [Analytics Engine](https://apinizer.com/products/analytics-engine) — Real-time per-endpoint, per-consumer, per-region telemetry on Elasticsearch. - [Monitoring](https://apinizer.com/products/monitoring) — Uptime, anomaly detection, severity-aware alarms — one module. - [Compliance posture](https://apinizer.com/solutions/kvkk-gdpr-bddk-compliance) — Mapping to BDDK, KVKK, GDPR, ISO 27001 evidence requirements. - [APIops manifests](https://apinizer.com/developers/apiops) — Changes flow through Git; audit captures the apply, the actor, and the diff. - [Architecture overview](https://docs.apinizer.com/en/concepts/architecture) — Where audit and telemetry live in the data plane. --- ## Related use cases - [Three-tier permissions](https://apinizer.com/solutions/three-tier-permissions) — For platform teams - [AI observability](https://apinizer.com/solutions/ai-observability) — For AI teams - [KVKK / GDPR / BDDK compliance](https://apinizer.com/solutions/kvkk-gdpr-bddk-compliance) — For executives - [API lifecycle management](https://apinizer.com/solutions/api-lifecycle-management) — For platform teams --- ## Next step *Telemetry meets evidence* **One plane for ops and audit.** A 30-minute walkthrough — capture, index, query, alarm — on a Kubernetes of your choice. [Book a Demo](https://calendly.com/apinizer/15min) · [Read the docs](https://apinizer.com/developers/docs) --- ## Links - Products: https://apinizer.com/products - AI Gateway: https://apinizer.com/products/ai-gateway - Solutions: https://apinizer.com/solutions - Pricing: https://apinizer.com/pricing - Developers: https://apinizer.com/developers - Documentation: https://docs.apinizer.com/index-en - Blog: https://apinizer.com/blog - Contact: https://apinizer.com/company/contact © 2026 Apinizer. All rights reserved.