The client uses Microsoft.Extensions.Logging and an ILogger<T> category for every client, resolver, and resource. The standard resilience pipeline emits its own structured retry, timeout, circuit-breaker, and rate-limiter telemetry. No separate logging abstraction or static logger is required.
Debug: an HTTP method and logical operation before a request; named-connection resolution; contextual credential resolution by tenant/company identifier and whether it is user-scoped.Information: successful operation status and elapsed milliseconds; page sizes and returned counts; client/connection initialization including the effective versioned User-Agent and Accept-Language values.Warning: non-success status, elapsed time, correlation ID, retry decisions, and missing named connections.The structured properties are suitable for normal ASP.NET Core logging providers and observability pipelines.
{
"Logging": {
"LogLevel": {
"Default": "Information",
"DevOp.DK.Plus": "Information",
"DevOp.DK.Plus.Http.Resilience": "Warning",
"Polly": "Warning"
}
}
}
Set DevOp.DK.Plus to Debug while diagnosing request flow. Resilience telemetry categories can vary with the Microsoft package version; configure them through the application's logging or OpenTelemetry pipeline. A custom handler or network tracing system installed by the consuming application is outside this guarantee and must apply its own redaction.
The DK Plus client removes the default IHttpClientFactory loggers for its named clients and emits its own redacted structured events. This matters because token-management endpoints carry a credential in the URI path.
The DK Plus client does not log:
DkPlusCredentials.AccessToken is excluded from System.Text.Json serialization, and DkPlusCredentials.ToString() always prints [REDACTED]. Unexpected credential-provider exception messages are neither retained nor logged because an application provider could accidentally include secret material.
Operation names, status codes, durations, page numbers/counts, configured connection names, effective accepted languages, and response correlation IDs are logged. Some resource-level informational events include non-secret resource names or counts.
DkPlusRequestException contains a query-free request URI and a response body capped at 32 KiB for explicit error handling. Token path values are redacted from the URI. ResponseBody may still contain remote-system or customer data, so do not log it automatically. Prefer status, operation, and correlation ID:
catch (DkPlusRequestException exception)
{
logger.LogWarning(
"DK Plus {Operation} failed with {StatusCode}; correlation {CorrelationId}",
exception.Operation,
exception.StatusCode,
exception.CorrelationId);
}
Caller cancellation propagates to HTTP and delay operations and is not converted into a DK Plus failure. Resilience timeouts become DkPlusTimeoutException, and locally rejected open-circuit requests become DkPlusCircuitOpenException; both retain the implementation exception as InnerException.
Context-aware clients also expose specific failures:
DkPlusContextMissingException when no automatic context exists;DkPlusConnectionNotFoundException when the application provider cannot authorize a connection;DkPlusAuthenticationException for missing, failed, or expired credentials;DkPlusAuthorizationException for an untrusted endpoint or request destination;DkPlusRateLimitException for HTTP 429, including RetryAfter when supplied.The devop-dk tool disables client diagnostic logging by default. Normal command output is written to stdout, while friendly errors are written to stderr without requiring logging. This keeps interactive output quiet and --json output safe to pipe into tools such as jq.
Opt in temporarily for one command with an environment variable:
devop-dk --verbose table records ARCUST --fields Number,Name
DKPLUS_LOG_LEVEL=Warning devop-dk table records ARCUST --fields Number,Name
DKPLUS_LOG_LEVEL=Debug devop-dk connection test
The global --verbose option enables Information-level logging for that invocation and can appear before or after the command. DKPLUS_LOG_LEVEL remains available when a specific level such as Debug or Trace is required.
Or persist a preferred level:
devop-dk config set logLevel Warning
devop-dk config set logLevel None
When enabled, client diagnostics are written to stderr. The CLI only registers its stderr logging provider when the resolved level is not None. This CLI policy does not change library behavior: applications using DevOp.DK.Plus continue to control ILogger<T> through their own logging configuration and providers.
Expected CLI failures do not print stack traces. The error formatter may extract one bounded, single-line value from recognized JSON fields (Message, message, detail, or title). Email addresses are redacted and credential-related messages are suppressed. It never logs or prints the complete raw response body.