Log the request, yes — enough of it to reconstruct an incident and to hold the platform accountable. Timestamp, consumer identity, operation, status, latency, request ID. That is the raw material for debugging, for capacity planning, for billing, and for the audit trail that makes an API governable at all.
Do not log what you do not need. Never log credentials, tokens, or full authorization headers. Be extremely deliberate about request and response bodies, because that is where personal and regulated data lives, and a debug logger that captures payloads is how sensitive data ends up in a system with none of the controls the original datastore had.
The part people skip is retention. Decide how long, on purpose, and then enforce it. Logs kept forever are a liability that grows: they are discoverable, breachable, and they turn into a behavioral record of your users long after the operational value has expired.
That is the uncomfortable part worth sitting with. There is a point where session management becomes surveillance, and the mechanics on both sides of that line are identical. The only difference is intent, retention, and who can see it. If you would not be comfortable explaining your logging to the people whose activity it records, that is the signal to change it.
