An API log is a record of requests made to an application interface. It usually captures who made the request, when it happened, what endpoint was called, and whether the action succeeded or failed. In cloud services and SaaS platforms, these logs are often the best evidence of how data was queried, exported, or modified.
API logs matter in cyber security because attackers often prefer programmatic access over obvious malware. Stolen tokens, abused integrations, and scripted account use can generate many requests in a short time, including unusual searches or bulk data downloads. Defenders use API logs to spot spikes in exports, repeated enumeration, failed-authentication bursts, and access from unexpected clients or locations. They are also useful for verifying whether a ransomware claim or data-theft allegation matches real activity.