Configuration
Set options in the config block of the dms-api entry of antelope.config.ts. Retentions use milliseconds; body sizes use bytes.
"dms-api": {
source: { type: "package", package: "@antelopejs/dms-api", version: ">=0.4.0 <1.0.0" },
config: {
statisticsLifetime: 60 * 24 * 60 * 60 * 1000, // 60 days
requestLogRetention: 14 * 24 * 60 * 60 * 1000, // 14 days
requestSlownessThreshold: 500,
requestLogCaptureHeaders: ["content-type", "user-agent", "x-webhook-signature"],
testerSourceSecret: process.env.API_TESTER_SECRET,
},
},
Options
| Option | Type | Default | Description |
|---|---|---|---|
statisticsLifetime | number (ms) | 90 days | How long per-day statistics are kept: 30, 60 or 90 days. The 30D period compares itself with the 30 days before, so it needs 60 days or more. |
requestLogRetention | number (ms) | 30 days | How long full request logs are kept, independently of the statistics. 1 to 366 days. |
requestSlownessThreshold | number (ms) | 1000 | A request at or above it is flagged slow; a route whose p95 reaches it is listed as Slow. 50 to 600,000, in steps of 50. |
requestLogMaxBodySize | number (bytes) | 65536 (64 KB) | Request and response bodies above it are stored truncated and flagged. 0 to 10,240 KB; 0 turns body capture off. |
requestLogCaptureHeaders | string[] | content-type, content-length, user-agent, accept, accept-encoding, host, referer, origin | The request headers stored, in lower case. Secret-looking headers (authorization, cookies, API keys) are never stored. An empty list stores none. |
authMiddlewareNamePatterns | string[] (regex sources) | ^auth_, ^requireAuth, ^session_ | Middleware names matching one of these mark a route as authenticated in its documentation. |
authMiddlewareCallbacks | string[] | [] | Exact middleware names that mark a route as authenticated, alongside the patterns. |
testerSourceSecret | string | random per instance | Key the Tester's tokens are signed with. Set the same value on every instance behind one console. |
Settings page overrides
Values saved on the API settings page override the module configuration at runtime, without a restart.
| Setting choice | Effect |
|---|---|
| Use default | Returns a field to its module default and removes its override. |
| Retention values | Have no Use default button, since lowering a retention deletes data. |
| Empty list of captured headers | Keeps an explicit override: no header is captured. |
The route scope (own routes, module routes, all routes) is a setting only; it has no configuration option.
Public API origin
The cURL and fetch snippets of a route and a request are written against the DMS's public API origin, its apiBaseUrl (read with GetApiBaseUrl()). Set it in the DMS configuration to the URL clients reach your API at, such as https://api.example.com. Under ajs dms dev it follows the dev server.
Data handling
Request logs can contain application data. Before collecting real traffic:
- Review the capture and retention settings.
- Use synthetic requests for screenshots or shared demos.
Values under keys that look secret (password, token, authorization, cookie, card numbers and so on) are replaced with [REDACTED] in bodies and query strings before storage. That list is fixed.