Start here. This is the direct spoken answer to practice first.
Why this question matters
Many API incidents are dependency incidents wearing an API mask. Good dependency telemetry separates app code from SQL, Redis, queues, and downstream HTTP calls.
I would capture dependency name, operation, duration, success or failure, timeout status, retry count, and correlation id. For SQL, I want query duration, query count per request, query tags for important endpoints, and enough plan or query identity to investigate safely. For Redis, I want command latency, timeout count, hit/miss where the app can provide it, and key pattern rather than raw keys with sensitive data.