data_governance.payload_storage: enabled retains bounded, credential-redacted request and response content so authorized operators can inspect one exchange through the console or Admin API.
For approved local troubleshooting, independent payload_logging.enabled: true emits bounded request, response, error, and streaming-chunk JSON events to stdout. Either destination can be enabled alone or both can be enabled. Credential-bearing fields and recognizable gateway token strings are redacted, but ordinary application content remains sensitive.
Restart the gateway after changing either setting. Filter local or container stdout for "event":"llm_payload". With database capture enabled, use Overview → Recent requests → View or GET /admin/requests/{request_id}. The list endpoint exposes availability flags without embedding bodies, and tenant-scoped authorization applies to detail reads.
It stores operational metadata such as tenant/application/key identifiers, request ID, route, model/provider, status, token counts, estimated cost, latency, and timestamps. Defaults are 30 days for request metadata and 365 days for administrator audit events:
payload_retention_days, deletes request metadata, audit events, delivered signal notifications, and finalized budget-ledger entries after their schedules, and clears expired administrator sessions, OIDC login transactions, Platform handoff identifiers, and prior key-rotation hashes. Reserved budget entries are never removed before reconciliation. Inspect policy, lease, last completion, counts, and error through GET /admin/data-governance. Administrators can trigger POST /admin/data-governance/retention/run; the action and automatic changes are audited. Worker failure degrades /ready as data_retention_ready: false.
Set budget_ledger_retention_days to the contractual or legal minimum required by the deployment. Per-request settled/released rows expire after that window; budget-period aggregates, alerts, keys, identities, and catalog state remain until the tenant/account lifecycle removes them. Export and deletion requests require an authorized operator procedure, including financial/legal-hold review and backup-expiry handling. Provider-side payload processing and retention remain governed by your provider agreement.