Python: Refine DevUI request logging

python/packages/devui/agent_framework_devui/_server.py

@@ -837,18 +837,15 @@ async def create_response(request: AgentFrameworkRequest, raw_request: Request)
                     return await openai_executor.execute_sync(request)
 
                 # Route to local Agent Framework executor (original behavior)
-                raw_body = await raw_request.body()
-                logger.info(f"Raw request body: {raw_body.decode()}")
-                logger.info(f"Parsed request: metadata={request.metadata}")
-
                 # Get entity_id from metadata
                 entity_id = request.get_entity_id()
-                logger.info(f"Extracted entity_id: {entity_id}")
 
                 if not entity_id:
                     error = OpenAIError.create("Missing entity_id in metadata. Provide metadata.entity_id in request.")
                     return JSONResponse(status_code=400, content=error.to_dict())
 
+                logger.info("Extracted entity_id: %s", entity_id)
+
                 # Get executor and validate entity exists
                 executor = await self._ensure_executor()
                 try:
@@ -944,7 +941,6 @@ async def create_conversation(raw_request: Request) -> dict[str, Any] | JSONResp
 
                     try:
                         metadata = request_data.get("metadata")
-                        logger.debug(f"Creating OpenAI conversation with metadata: {metadata}")
                         conversation = await client.conversations.create(metadata=metadata)
                         logger.info(f"Created OpenAI conversation: {conversation.id}")
                         return conversation.model_dump()

python/packages/devui/tests/devui/test_server.py

@@ -4,6 +4,7 @@
 
 import asyncio
 import inspect
+import logging
 import sys
 import tempfile
 from pathlib import Path
@@ -653,6 +654,33 @@ def test_devserver_auth_can_be_explicitly_disabled(monkeypatch):
     assert response.status_code == 200
 
 
+def test_responses_endpoint_does_not_log_request_content(caplog):
+    """Request input and metadata must not be written to server logs."""
+    server = _server_with_mock_agent(host="127.0.0.1", auth_enabled=False)
+    app = server.get_app()
+    input_marker = "private-input-marker"
+    metadata_marker = "private-metadata-marker"
+    caplog.set_level(logging.DEBUG, logger="agent_framework_devui._server")
+
+    with TestClient(app, base_url="http://127.0.0.1") as client:
+        response = client.post(
+            "/v1/responses",
+            json={
+                "input": input_marker,
+                "metadata": {"entity_id": "mock", "private_value": metadata_marker},
+                "stream": False,
+            },
+        )
+
+    assert response.status_code == 404
+    assert any(
+        record.name == "agent_framework_devui._server" and record.getMessage() == "Extracted entity_id: mock"
+        for record in caplog.records
+    )
+    assert input_marker not in caplog.text
+    assert metadata_marker not in caplog.text
+
+
 def test_devserver_rejects_non_loopback_no_auth(monkeypatch):
     """Non-loopback binds must not be network-reachable without authentication."""
     monkeypatch.delenv("DEVUI_AUTH_TOKEN", raising=False)