feat(infra): add external API request/response logging interceptor (STA-242) (#247)

Add ExternalApiLoggingInterceptor in platform-infra that logs HTTP method,
URL, headers (redacted), request/response bodies, and latency for all
external API calls. Activated via app.external-api.logging.enabled=true
(disabled by default — zero overhead in production).

Wired into all 17 RestClient adapters across 6 services via @nullable
constructor injection. Enabled in all 10 sandbox profiles.

Closes #246

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Puneethkumarck

api-gateway-iam/api-gateway-iam/src/main/resources/application-sandbox.yml

@@ -6,6 +6,9 @@
 app:
   security:
     enabled: false
+  external-api:
+    logging:
+      enabled: true
 
 api-gateway-iam:
   jwt:

blockchain-custody/blockchain-custody/src/main/java/com/stablecoin/payments/custody/infrastructure/provider/dev/DevCustodyAdapter.java

@@ -4,11 +4,13 @@
 import com.stablecoin.payments.custody.domain.port.SignRequest;
 import com.stablecoin.payments.custody.domain.port.SignResult;
 import com.stablecoin.payments.custody.domain.port.TransactionStatus;
+import com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.http.MediaType;
 import org.springframework.http.client.JdkClientHttpRequestFactory;
+import org.springframework.lang.Nullable;
 import org.springframework.stereotype.Component;
 import org.springframework.web.client.RestClient;
 import org.web3j.crypto.Credentials;
@@ -25,6 +27,8 @@
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 
+import static com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor.applyTo;
+
 @Slf4j
 @Component
 @ConditionalOnProperty(name = "app.custody.provider", havingValue = "dev")
@@ -38,10 +42,14 @@ public class DevCustodyAdapter implements CustodyEngine {
     private final DevCustodyProperties properties;
     private final Map<String, RestClient> restClients;
     private final Map<String, TxMapping> txMappings;
+    @Nullable
+    private final ExternalApiLoggingInterceptor loggingInterceptor;
 
     @org.springframework.beans.factory.annotation.Autowired
-    public DevCustodyAdapter(DevCustodyProperties properties) {
+    public DevCustodyAdapter(DevCustodyProperties properties,
+                             @Nullable ExternalApiLoggingInterceptor loggingInterceptor) {
         this.properties = properties;
+        this.loggingInterceptor = loggingInterceptor;
         this.restClients = new ConcurrentHashMap<>();
         this.txMappings = new ConcurrentHashMap<>();
 
@@ -50,6 +58,7 @@ public DevCustodyAdapter(DevCustodyProperties properties) {
 
     DevCustodyAdapter(DevCustodyProperties properties, Map<String, RestClient> restClients) {
         this.properties = properties;
+        this.loggingInterceptor = null;
         this.restClients = new ConcurrentHashMap<>(restClients);
         this.txMappings = new ConcurrentHashMap<>();
     }
@@ -226,9 +235,9 @@ private RestClient createRestClient(String rpcUrl) {
         var requestFactory = new JdkClientHttpRequestFactory(httpClient);
         requestFactory.setReadTimeout(Duration.ofMillis(properties.readTimeoutMs()));
 
-        return RestClient.builder()
+        return applyTo(RestClient.builder()
                 .baseUrl(rpcUrl)
-                .requestFactory(requestFactory)
+                .requestFactory(requestFactory), loggingInterceptor)
                 .build();
     }
 

blockchain-custody/blockchain-custody/src/main/java/com/stablecoin/payments/custody/infrastructure/provider/evm/EvmRpcAdapter.java

@@ -3,6 +3,7 @@
 import com.stablecoin.payments.custody.domain.model.ChainId;
 import com.stablecoin.payments.custody.domain.port.ChainRpcProvider;
 import com.stablecoin.payments.custody.domain.port.TransactionReceipt;
+import com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor;
 import io.github.resilience4j.bulkhead.annotation.Bulkhead;
 import io.github.resilience4j.circuitbreaker.annotation.CircuitBreaker;
 import io.github.resilience4j.retry.annotation.Retry;
@@ -11,6 +12,7 @@
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.http.MediaType;
 import org.springframework.http.client.JdkClientHttpRequestFactory;
+import org.springframework.lang.Nullable;
 import org.springframework.stereotype.Component;
 import org.springframework.web.client.RestClient;
 import tools.jackson.databind.JsonNode;
@@ -25,6 +27,8 @@
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
+import static com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor.applyTo;
+
 @Slf4j
 @Component
 @ConditionalOnProperty(name = "app.custody.evm.enabled", havingValue = "true")
@@ -38,7 +42,8 @@ public class EvmRpcAdapter implements ChainRpcProvider {
     private final Map<String, RestClient> restClients;
     private final EvmChainProperties properties;
 
-    public EvmRpcAdapter(EvmChainProperties properties) {
+    public EvmRpcAdapter(EvmChainProperties properties,
+                         @Nullable ExternalApiLoggingInterceptor loggingInterceptor) {
         this.properties = properties;
         this.restClients = new ConcurrentHashMap<>();
 
@@ -51,9 +56,9 @@ public EvmRpcAdapter(EvmChainProperties properties) {
             var requestFactory = new JdkClientHttpRequestFactory(httpClient);
             requestFactory.setReadTimeout(Duration.ofMillis(config.readTimeoutMs()));
 
-            var client = RestClient.builder()
+            var client = applyTo(RestClient.builder()
                     .baseUrl(config.rpcUrl())
-                    .requestFactory(requestFactory)
+                    .requestFactory(requestFactory), loggingInterceptor)
                     .build();
 
             restClients.put(chainName, client);

blockchain-custody/blockchain-custody/src/main/java/com/stablecoin/payments/custody/infrastructure/provider/fireblocks/FireblocksCustodyAdapter.java

@@ -6,6 +6,7 @@
 import com.stablecoin.payments.custody.domain.port.SignRequest;
 import com.stablecoin.payments.custody.domain.port.SignResult;
 import com.stablecoin.payments.custody.domain.port.TransactionStatus;
+import com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor;
 import io.github.resilience4j.bulkhead.annotation.Bulkhead;
 import io.github.resilience4j.circuitbreaker.annotation.CircuitBreaker;
 import io.github.resilience4j.retry.annotation.Retry;
@@ -14,6 +15,7 @@
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.http.MediaType;
 import org.springframework.http.client.JdkClientHttpRequestFactory;
+import org.springframework.lang.Nullable;
 import org.springframework.stereotype.Component;
 import org.springframework.web.client.RestClient;
 import tools.jackson.databind.json.JsonMapper;
@@ -32,6 +34,8 @@
 import java.util.Map;
 import java.util.UUID;
 
+import static com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor.applyTo;
+
 @Slf4j
 @Component
 @ConditionalOnProperty(name = "app.custody.provider", havingValue = "fireblocks")
@@ -50,7 +54,8 @@ public class FireblocksCustodyAdapter implements CustodyEngine {
     private final FireblocksProperties properties;
     private final RSAPrivateKey privateKey;
 
-    public FireblocksCustodyAdapter(FireblocksProperties properties) {
+    public FireblocksCustodyAdapter(FireblocksProperties properties,
+                                    @Nullable ExternalApiLoggingInterceptor loggingInterceptor) {
         this.properties = properties;
 
         var httpClient = HttpClient.newBuilder()
@@ -61,9 +66,9 @@ public FireblocksCustodyAdapter(FireblocksProperties properties) {
         var requestFactory = new JdkClientHttpRequestFactory(httpClient);
         requestFactory.setReadTimeout(Duration.ofSeconds(properties.timeoutSeconds()));
 
-        this.restClient = RestClient.builder()
+        this.restClient = applyTo(RestClient.builder()
                 .baseUrl(properties.baseUrl())
-                .requestFactory(requestFactory)
+                .requestFactory(requestFactory), loggingInterceptor)
                 .build();
 
         this.privateKey = parsePrivateKey(properties.apiSecret());

blockchain-custody/blockchain-custody/src/main/java/com/stablecoin/payments/custody/infrastructure/provider/solana/SolanaRpcAdapter.java

@@ -3,6 +3,7 @@
 import com.stablecoin.payments.custody.domain.model.ChainId;
 import com.stablecoin.payments.custody.domain.port.ChainRpcProvider;
 import com.stablecoin.payments.custody.domain.port.TransactionReceipt;
+import com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor;
 import io.github.resilience4j.bulkhead.annotation.Bulkhead;
 import io.github.resilience4j.circuitbreaker.annotation.CircuitBreaker;
 import io.github.resilience4j.retry.annotation.Retry;
@@ -11,6 +12,7 @@
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.http.MediaType;
 import org.springframework.http.client.JdkClientHttpRequestFactory;
+import org.springframework.lang.Nullable;
 import org.springframework.stereotype.Component;
 import org.springframework.web.client.RestClient;
 import tools.jackson.databind.JsonNode;
@@ -23,6 +25,8 @@
 import java.time.Duration;
 import java.util.Map;
 
+import static com.stablecoin.payments.platform.infrastructure.http.ExternalApiLoggingInterceptor.applyTo;
+
 @Slf4j
 @Component
 @ConditionalOnProperty(name = "app.custody.solana.enabled", havingValue = "true")
@@ -36,7 +40,8 @@ public class SolanaRpcAdapter implements ChainRpcProvider {
     private final RestClient restClient;
     private final SolanaChainProperties properties;
 
-    public SolanaRpcAdapter(SolanaChainProperties properties) {
+    public SolanaRpcAdapter(SolanaChainProperties properties,
+                            @Nullable ExternalApiLoggingInterceptor loggingInterceptor) {
         this.properties = properties;
 
         var httpClient = HttpClient.newBuilder()
@@ -47,9 +52,9 @@ public SolanaRpcAdapter(SolanaChainProperties properties) {
         var requestFactory = new JdkClientHttpRequestFactory(httpClient);
         requestFactory.setReadTimeout(Duration.ofMillis(properties.readTimeoutMs()));
 
-        this.restClient = RestClient.builder()
+        this.restClient = applyTo(RestClient.builder()
                 .baseUrl(properties.rpcUrl())
-                .requestFactory(requestFactory)
+                .requestFactory(requestFactory), loggingInterceptor)
                 .build();
 
         log.info("[SOLANA-RPC] Configured RestClient rpcUrl={} commitment={} usdcMint={}",

blockchain-custody/blockchain-custody/src/main/resources/application-sandbox.yml

@@ -22,6 +22,9 @@ spring:
 app:
   security:
     enabled: false
+  external-api:
+    logging:
+      enabled: true
   custody:
     provider: dev
     evm:

blockchain-custody/blockchain-custody/src/test/java/com/stablecoin/payments/custody/infrastructure/provider/evm/EvmRpcAdapterRetryTest.java

@@ -142,7 +142,7 @@ EvmChainProperties evmChainProperties() {
 
         @Bean
         EvmRpcAdapter evmRpcAdapter(EvmChainProperties properties) {
-            return new EvmRpcAdapter(properties);
+            return new EvmRpcAdapter(properties, null);
         }
     }
 }

blockchain-custody/blockchain-custody/src/test/java/com/stablecoin/payments/custody/infrastructure/provider/evm/EvmRpcAdapterSandboxTest.java

@@ -48,7 +48,7 @@ static void setUp() {
                         "https://eth-sepolia.g.alchemy.com/v2/" + apiKey,
                         11155111L, ETH_SEPOLIA_USDC, 10000, 30000)
         ));
-        adapter = new EvmRpcAdapter(properties);
+        adapter = new EvmRpcAdapter(properties, null);
     }
 
     @Nested

blockchain-custody/blockchain-custody/src/test/java/com/stablecoin/payments/custody/infrastructure/provider/evm/EvmRpcAdapterTest.java

@@ -38,7 +38,7 @@ void setUp(WireMockRuntimeInfo wmRuntimeInfo) {
                         wmRuntimeInfo.getHttpBaseUrl(), 84532L,
                         USDC_CONTRACT, 5000, 10000)
         ));
-        adapter = new EvmRpcAdapter(properties);
+        adapter = new EvmRpcAdapter(properties, null);
     }
 
     @Nested

blockchain-custody/blockchain-custody/src/test/java/com/stablecoin/payments/custody/infrastructure/provider/fireblocks/FireblocksCustodyAdapterRetryTest.java

@@ -232,7 +232,7 @@ FireblocksProperties fireblocksProperties() {
 
         @Bean
         FireblocksCustodyAdapter fireblocksCustodyAdapter(FireblocksProperties properties) {
-            return new FireblocksCustodyAdapter(properties);
+            return new FireblocksCustodyAdapter(properties, null);
         }
     }
 }