You're assuming they were in the URL and that only the URL was logged. APIs are extremely fraught, because users like to build integrations that jam credential

You're assuming they were in the URL and that only the URL was logged. APIs are extremely fraught, because users like to build integrations that jam credentials into the wrong places until they get a 200. You haven't lived until you've added a regexp for your API keys appearing in the wrong HTTP headers