# Sails API monitoring, latency and firewall - ApiTraffic > Log every request to your Sails API with its latency and security verdict on the same record. Installs as Sails middleware - no agent, no sidecar, no host to instrument. Source: https://dev.apitraffic.io/sails Sails · First-party SDK # Half your Sails API’s traffic isn’t human.Do you know what it did? An installable hook: add the dependency and lift. It puts itself first in your HTTP middleware order, so it sees every request - including the ones your policies turn away. Source: [Imperva 2026 Bad Bot Report](https://www.imperva.com/blog/bad-bot-report-2026-bots-agentic-age/) [Start your free trial](https://dev.app.apitraffic.io/signup?src=framework-sails) `npm i @apitraffic/sails` ``` // npm i @apitraffic/sails // // config/apitraffic.js module.exports.apitraffic = { token: process.env.API_TRAFFIC_TOKEN, bucket: process.env.API_TRAFFIC_BUCKET, }; ``` Sails loads the hook from your dependencies when it lifts. With the two environment variables set, this file is optional. `@apitraffic/sails` records each request with the route Sails matched, and the firewall runs ahead of your policies, enabled from your account like everywhere else. `tag()`, `trace()` and `span()` work in policies, helpers and middleware as well as in your actions, and `sails.lower()` delivers what was captured before the server closes. Node 20+ · types included · [read the middleware source](https://github.com/apitraffic/apitraffic-node) Sails ## What this looks like in Sails ### Policies reject before your action exists The 401s and 403s your policies produce are traffic worth looking at - a key probing endpoints it has never touched shows up here first. The hook runs ahead of the router, so they are recorded with their final status and whatever your policy tagged. ### Blueprint routes are generated, not declared Blueprints mean endpoints exist that nobody typed. Those are exactly the routes worth discovering - traffic arriving at a generated endpoint that is not in anyone’s spec - and they are recorded like every other request. ### Lifting the app is not deploying an agent Nothing changes about how you lift, host or scale. It is one dependency and, if you want it, one config file - the same conventions as every other Sails hook. The record ## Every Sails request, with its queries and its verdict attached One pass through one middleware: the payload, every query and outbound call it caused, and the firewall's decision - on one record, watched for incidents, drift and regressions. Pricing ## Simple, published pricing Every plan and what it includes, read live from our billing system - with a free trial and no credit card to start. ### Solo **$79**per month [Start free trial](https://dev.app.apitraffic.io/signup?src=pricing-solo&plan=price_1U3BwjGd1hpzf7btq2CR6aLv)Retention: 30 days of request history Usage & limits - 1M requests · Captured requests (then $5.00 per 1,000 requests) - 5 records/s · Ingest rate - 5 buckets · Buckets - 2 environments · Environments - 1 seat · Team members - Unlimited · API tokens Logging & search - 30 days · Retention window - Collections - Saved stream views - 10 views · Saved views per account - Custom reports - 5 keys · Promoted tag keys - Unlimited · Exclusion rules - Unlimited · Custom redaction rules APM & performance - Deploy & incident markers - 10 rules · Endpoint rules Host telemetry - Host telemetry - Unlimited · Reporting servers - Unlimited · Host samples Firewall - Web application firewall - 2 policies · WAF policies per account Embeds & sharing - 10 reports and dashboards · Embedded reports and dashboards - Share links AI & MCP - AI diagnoses Alerts & drift - Alerting - 1 channel · Alert channels - Certificate monitoring - 5 hosts · Monitored certificate hosts - Outbound destination watch Integrations - Git integration - 5 repositories · Linked repositories Most Popular ### Team **$249**per month [Start free trial](https://dev.app.apitraffic.io/signup?src=pricing-team&plan=price_1U3BwuGd1hpzf7btoaYjrHtI)Retention: 180 days of request history Usage & limits - 10M requests · Captured requests (then $5.00 per 1,000 requests) - 5 records/s · Ingest rate - 20 buckets · Buckets - 5 environments · Environments - 20 seats · Team members - Unlimited · API tokens Logging & search - 180 days · Retention window - Collections - Saved stream views - 50 views · Saved views per account - Custom reports - 20 keys · Promoted tag keys - Unlimited · Exclusion rules - Unlimited · Custom redaction rules APM & performance - APM - Deploy & incident markers - 50 rules · Endpoint rules Host telemetry - Host telemetry - Unlimited · Reporting servers - Unlimited · Host samples Firewall - Web application firewall - 10 policies · WAF policies per account Embeds & sharing - Embeds - Unlimited · Embedded reports and dashboards - Share links AI & MCP - AI diagnoses - MCP server - MCP request replay Alerts & drift - Alerting - Unlimited · Alert channels - API drift detection - Attention signals - Certificate monitoring - 25 hosts · Monitored certificate hosts - Outbound destination watch Integrations - Git integration - 20 repositories · Linked repositories ### Business **$899**per month [Start free trial](https://dev.app.apitraffic.io/signup?src=pricing-business&plan=price_1U3Bx4Gd1hpzf7btpq1EyIth)Retention: 360 days of request history Usage & limits - 25M requests · Captured requests (then $5.00 per 1,000 requests) - 20 records/s · Ingest rate - 100 buckets · Buckets - 100 environments · Environments - Unlimited · Team members - Unlimited · API tokens Logging & search - 360 days · Retention window - Collections - Saved stream views - Unlimited · Saved views per account - Custom reports - 50 keys · Promoted tag keys - Unlimited · Exclusion rules - Unlimited · Custom redaction rules APM & performance - APM - Deploy & incident markers - Unlimited · Endpoint rules Host telemetry - Host telemetry Firewall - Web application firewall - Unlimited · WAF policies per account Embeds & sharing - Embeds - Unlimited · Embedded reports and dashboards - Share links AI & MCP - AI diagnoses - MCP server - MCP request replay Alerts & drift - Alerting - Unlimited · Alert channels - API drift detection - Attention signals - Certificate monitoring - Unlimited · Monitored certificate hosts - Outbound destination watch Integrations - Git integration - Unlimited · Linked repositories [Compare all plan features](#compare) Every plan starts with a 7-day free trial - no credit card to begin, and nothing is charged unless you choose a plan. Prices in the currency shown, excluding tax. Overage is billed per unit and rounded to the cent on the invoice. Objections ## The questions we actually get **Cloudflare decides whether a request gets in. We record what happened after it did.** Those are different jobs, and the gap between them is where most API incidents live. Your edge sees strangers - unknown IPs, bad signatures, known-bad patterns - and it’s good at that. What it can’t see is a legitimate, authenticated key behaving unlike itself: enumerating IDs one at a time, pulling fifty times its normal volume on a Sunday, or walking endpoints it has never touched before. That traffic passes every edge check, because it’s a customer. Keep Cloudflare. We’re the layer inside your app where the caller has a name, a history, and a bill. **Datadog is a much broader product.** If you need to monitor a Kafka cluster, build custom dashboards for forty services, and correlate across your whole estate, use Datadog - we’re not that, and we’re not trying to be. We answer one question well: who called your API, and what happened. Because logging, timing, and screening run in one middleware, you get one record per request with the trace and the security verdict already on it. Nothing to correlate by request ID across three products and three clocks at 2am. The other difference is structural. There’s no host agent to deploy, so there’s no per-host meter and no bill that grows every time you add a container. What we don’t do: infrastructure monitoring, RUM, log ingestion from things that aren’t your API, or 800 integrations. **Fair question, and the right one to ask about middleware in a single-threaded runtime.** Nothing that matters runs on your request path. We capture metadata in-process, hand it to a buffer, and ship batches asynchronously off the event loop. No network call, no serialisation of large payloads, and no synchronous work between your handler and the response. Don’t take our word for it: the [middleware is public on GitHub](https://github.com/apitraffic/apitraffic-node), so you can read exactly what runs on your request path - and measure it against your own service on staging before it goes anywhere near production. **No. The middleware fails open.** If our collector is unreachable, requests complete exactly as they would without us. Telemetry queues into a bounded in-memory buffer and is dropped once that buffer is full - it never grows without limit, and it never blocks a response. You lose visibility for the duration of the outage. You don’t lose traffic. Enforcement is a separate question, and the answer is better than fail-open usually implies. Verdicts are evaluated in your process against the policy you last synced, not by calling us - so a rule that was live when the connection dropped is still live now. During an outage you stop receiving policy changes; you do not stop being protected. The kill switch works the same way: `API_TRAFFIC_WAF_ENABLED=false` takes effect without a deploy and without reaching us, which is the case that matters when we are the problem. **Yes, through the proxy URL - and the SDKs are Node because that is where we can go deepest.** For any other stack, generate a proxy URL for your bucket: the same URL as your API call with only the hostname changed. Calls sent through it land in your request log, searchable, grouped by endpoint and watched by alerting, from any language and with no code to install. The SDKs add what only an in-process middleware can see: your route definitions (`/users/:id` as one endpoint instead of forty thousand paths), the outbound calls your app makes, the queries behind each request, and a firewall that inspects the parsed request. That is why the first-party SDKs are for Node frameworks. **You decide what is kept, and the secrets are masked before you configure anything.** From the very first request, credential headers - `Authorization`, cookies, API key and CSRF headers - and secret-looking keys in bodies and query strings are masked inside your process, before anything is sent. On top of that, redaction rules mask your own fields, either in your app so the value never leaves your server or on our side just before storage. Exclusion rules keep a route out entirely, or log its requests without their bodies. Everything you see afterwards - the request log, share links, embeds, the API and the MCP server - sees only the redacted value. **Keep them. Application logs are what your code chose to say. We record what actually crossed the wire.** The difference shows up on the requests you didn’t write a log line for: the ones that 404’d before reaching a handler, the ones that failed auth, the ones hitting a route someone shipped last quarter and forgot. Those don’t appear in your app logs precisely because your code never ran - and they’re disproportionately the ones worth looking at. There’s also no correlation step. The timing and the verdict are already on the record; you’re not grepping a log drain and joining it to something else by hand. The middleware is [public on GitHub](https://github.com/apitraffic/apitraffic-node) if you’d rather read it than take our word for what it does on the request path. **ApiTraffic tells you - alerts are on every plan.** Every endpoint is compared with its own normal, and a change has to be a multiple of normal, big in real terms and statistically real before anyone is told. Related alerts become one incident, sent to Slack, email, PagerDuty, Jira or a webhook following your routing. Drift detection adds breaking API changes, and deploy markers let you see which release changed what. [How alerting works](/monitoring) Other frameworks [Express](/express)[Fastify](/fastify)[NestJS](/nestjs)[Koa](/koa)[Hapi](/hapi)[Meteor](/meteor)[LoopBack](/loopback)[Strapi](/strapi)[AdonisJS](/adonisjs) ## Know what your API did - before your customers tell you. One npm install and one line of code. Your first requests arrive in minutes, with their queries, their firewall verdict and a baseline for every endpoint already building. [Start your free trial](https://dev.app.apitraffic.io/signup?src=framework-sails-closing) Free trial · No credit card · Set up in minutes