# AccessLogField $context variables that can be used to customize access log pattern. - Source: [`aws-apigateway/lib/access-log.ts`](https://github.com/aws/aws-cdk/blob/v2.277.0/packages/aws-cdk-lib/aws-apigateway/lib/access-log.ts#L82) - Type last changed: v2.222.0 · 4 Nov 2025 ## Example ```ts apigateway.AccessLogFormat.custom(JSON.stringify({ requestId: apigateway.AccessLogField.contextRequestId(), sourceIp: apigateway.AccessLogField.contextIdentitySourceIp(), method: apigateway.AccessLogField.contextHttpMethod(), userContext: { sub: apigateway.AccessLogField.contextAuthorizerClaims('sub'), email: apigateway.AccessLogField.contextAuthorizerClaims('email') } })) ``` ## Initializer ```ts new AccessLogField() ``` ## Methods - `contextAccountId(): string` (static) — Use `contextCallerAccountId` or `contextOwnerAccountId` instead - `contextApiId(): string` (static) — The identifier API Gateway assigns to your API. - `contextAuthenticateError(): string` (static) — The error message returned from an authentication attempt. - `contextAuthenticateLatency(): string` (static) — The authentication latency in ms. - `contextAuthenticateStatus(): string` (static) — The status code returned from an authentication attempt. - `contextAuthorizeError(): string` (static) — The authorization error message. - `contextAuthorizeLatency(): string` (static) — The authorization latency in ms. - `contextAuthorizer(property: string): string` (static) — The stringified value of the specified key-value pair of the `context` map returned from an API Gateway Lambda authorizer function. **Parameters** - `property` — key of the context map. - `contextAuthorizerClaims(property: string): string` (static) — A property of the claims returned from the Amazon Cognito user pool after the method caller is successfully authenticated. **Parameters** - `property` — A property key of the claims. - `contextAuthorizerError(): string` (static) — The error message returned from an authorizer. - `contextAuthorizerIntegrationLatency(): string` (static) — The authorizer latency in ms. - `contextAuthorizerIntegrationStatus(): string` (static) — The status code returned from a Lambda authorizer. - `contextAuthorizerLatency(): string` (static) — The authorizer latency in ms. - `contextAuthorizerPrincipalId(): string` (static) — The principal user identification associated with the token sent by the client and returned from an API Gateway Lambda authorizer (formerly known as a custom authorizer). - `contextAuthorizerRequestId(): string` (static) — The AWS endpoint's request ID. - `contextAuthorizerStatus(): string` (static) — The status code returned from an authorizer. - `contextAuthorizeStatus(): string` (static) — The status code returned from an authorization attempt. - `contextAwsEndpointRequestId(): string` (static) — The AWS endpoint's request ID. - `contextCallerAccountId(): string` (static) — The API callers AWS account ID. - `contextConnectionId(): string` (static) — A unique ID for the connection that can be used to make a callback to the client. - `contextCustomDomainBasePathMatched(): string` (static) — The path for an API mapping that an incoming request matched. Applicable when a client uses a custom domain name to access an API. For example if a client sends a request to https://api.example.com/v1/orders/1234, and the request matches the API mapping with the path v1/orders, the value is v1/orders. - `contextDomainName(): string` (static) — The full domain name used to invoke the API. This should be the same as the incoming `Host` header. - `contextDomainPrefix(): string` (static) — The first label of the `$context.domainName`. This is often used as a caller/customer identifier. - `contextErrorMessage(): string` (static) — A string containing an API Gateway error message. - `contextErrorMessageString(): string` (static) — The quoted value of $context.error.message, namely "$context.error.message". - `contextErrorResponseType(): string` (static) — A type of GatewayResponse. This variable can only be used for simple variable substitution in a GatewayResponse body-mapping template, which is not processed by the Velocity Template Language engine, and in access logging. - `contextErrorValidationErrorString(): string` (static) — A string containing a detailed validation error message. - `contextEventType(): string` (static) — The event type: CONNECT, MESSAGE, or DISCONNECT. - `contextExtendedRequestId(): string` (static) — The extended ID that API Gateway assigns to the API request, which contains more useful information for debugging/troubleshooting. - `contextHttpMethod(): string` (static) — The HTTP method used. Valid values include: `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, and `PUT`. - `contextIdentityAccountId(): string` (static) — The AWS account ID associated with the request. - `contextIdentityApiKey(): string` (static) — For API methods that require an API key, this variable is the API key associated with the method request. For methods that don't require an API key, this variable is - `contextIdentityApiKeyId(): string` (static) — The API key ID associated with an API request that requires an API key. - `contextIdentityCaller(): string` (static) — The principal identifier of the caller making the request. - `contextIdentityClientCertIssunerDN(): string` (static) — The distinguished name of the issuer of the certificate that a client presents. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. - `contextIdentityClientCertPem(): string` (static) — The PEM-encoded client certificate that the client presented during mutual TLS authentication. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. - `contextIdentityClientCertSerialNumber(): string` (static) — The serial number of the certificate. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. - `contextIdentityClientCertSubjectDN(): string` (static) — The distinguished name of the subject of the certificate that a client presents. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. - `contextIdentityClientCertValidityNotAfter(): string` (static) — The date after which the certificate is invalid. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. - `contextIdentityClientCertValidityNotBefore(): string` (static) — The date before which the certificate is invalid. Present when a client accesses an API by using a custom domain name that has mutual TLS enabled. Present only in access logs if mutual TLS authentication fails. - `contextIdentityCognitoAuthenticationProvider(): string` (static) — The Amazon Cognito authentication provider used by the caller making the request. Available only if the request was signed with Amazon Cognito credentials. - `contextIdentityCognitoAuthenticationType(): string` (static) — The Amazon Cognito authentication type of the caller making the request. Available only if the request was signed with Amazon Cognito credentials. - `contextIdentityCognitoIdentityId(): string` (static) — The Amazon Cognito identity ID of the caller making the request. Available only if the request was signed with Amazon Cognito credentials. - `contextIdentityCognitoIdentityPoolId(): string` (static) — The Amazon Cognito identity pool ID of the caller making the request. Available only if the request was signed with Amazon Cognito credentials. - `contextIdentityPrincipalOrgId(): string` (static) — The AWS organization ID. - `contextIdentitySourceIp(): string` (static) — The source IP address of the TCP connection making the request to API Gateway. Warning: You should not trust this value if there is any chance that the `X-Forwarded-For` header could be forged. - `contextIdentityUser(): string` (static) — The principal identifier of the user making the request. Used in Lambda authorizers. - `contextIdentityUserAgent(): string` (static) — The User-Agent header of the API caller. - `contextIdentityUserArn(): string` (static) — The Amazon Resource Name (ARN) of the effective user identified after authentication. - `contextIntegrationErrorMessage(): string` (static) — A string that contains an integration error message. - `contextIntegrationLatency(): string` (static) — The integration latency in ms. - `contextIntegrationStatus(): string` (static) — For Lambda proxy integration, this parameter represents the status code returned from AWS Lambda, not from the backend Lambda function. - `contextOwnerAccountId(): string` (static) — The API owner's AWS account ID. - `contextPath(): string` (static) — The request path. For example, for a non-proxy request URL of https://{rest-api-id.execute-api.{region}.amazonaws.com/{stage}/root/child, this value is /{stage}/root/child. - `contextProtocol(): string` (static) — The request protocol, for example, HTTP/1.1. - `contextRequestId(): string` (static) — The ID that API Gateway assigns to the API request. - `contextRequestOverrideHeader(headerName: string): string` (static) — The request header override. If this parameter is defined, it contains the headers to be used instead of the HTTP Headers that are defined in the Integration Request pane. - `contextRequestOverridePath(pathName: string): string` (static) — The request path override. If this parameter is defined, it contains the request path to be used instead of the URL Path Parameters that are defined in the Integration Request pane. - `contextRequestOverrideQuerystring(querystringName: string): string` (static) — The request query string override. If this parameter is defined, it contains the request query strings to be used instead of the URL Query String Parameters that are defined in the Integration Request pane. - `contextRequestTime(): string` (static) — The CLF-formatted request time (dd/MMM/yyyy:HH:mm:ss +-hhmm). - `contextRequestTimeEpoch(): string` (static) — The Epoch-formatted request time. - `contextResourceId(): string` (static) — The identifier that API Gateway assigns to your resource. - `contextResourcePath(): string` (static) — The path to your resource. For example, for the non-proxy request URI of `https://{rest-api-id.execute-api.{region}.amazonaws.com/{stage}/root/child`, The $context.resourcePath value is `/root/child`. - `contextResponseLatency(): string` (static) — The response latency in ms. - `contextResponseLength(): string` (static) — The response payload length. - `contextResponseOverrideHeader(headerName: string): string` (static) — The response header override. If this parameter is defined, it contains the header to be returned instead of the Response header that is defined as the Default mapping in the Integration Response pane. - `contextResponseOverrideStatus(): string` (static) — The response status code override. If this parameter is defined, it contains the status code to be returned instead of the Method response status that is defined as the Default mapping in the Integration Response pane. - `contextRouteKey(): string` (static) — The selected route key. - `contextStage(): string` (static) — The deployment stage of the API request (for example, `Beta` or `Prod`). - `contextStatus(): string` (static) — The method response status. - `contextWafError(): string` (static) — The error message returned from AWS WAF. - `contextWafLatency(): string` (static) — The AWS WAF latency in ms. - `contextWafResponseCode(): string` (static) — The response received from AWS WAF: `WAF_ALLOW` or `WAF_BLOCK`. Will not be set if the stage is not associated with a web ACL. - `contextWafStatus(): string` (static) — The status code returned from AWS WAF. - `contextWebaclArn(): string` (static) — The complete ARN of the web ACL that is used to decide whether to allow or block the request. Will not be set if the stage is not associated with a web ACL. - `contextXrayTraceId(): string` (static) — The trace ID for the X-Ray trace.