diff --git a/pkg/services/tree/signature.go b/pkg/services/tree/signature.go
index d15438e81..82a368479 100644
--- a/pkg/services/tree/signature.go
+++ b/pkg/services/tree/signature.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 
+	"git.frostfs.info/TrueCloudLab/frostfs-node/internal/logs"
 	core "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
 	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/api/refs"
@@ -19,6 +20,7 @@ import (
 	frostfsecdsa "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto/ecdsa"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
+	"go.uber.org/zap"
 )
 
 type message interface {
@@ -65,6 +67,17 @@ func (s *Service) verifyClient(ctx context.Context, req message, cid cidSDK.ID,
 	}
 
 	if err = s.checkAPE(ctx, bt, cnr, cid, op, role, pubKey); err != nil {
+		var chainRouterErr *checkercore.ChainRouterError
+		if errors.As(err, &chainRouterErr) {
+			s.log.Debug(ctx, logs.APECheckDeniedRequest,
+				zap.Stringer("status", chainRouterErr.Status()),
+				zap.String("operation", chainRouterErr.Request().Operation()),
+				zap.Any("target", chainRouterErr.Target()),
+				zap.Any("request_properties", chainRouterErr.Request().Properties()),
+				zap.Any("resource_name", chainRouterErr.Resource().Name()),
+				zap.Any("resource_properties", chainRouterErr.Resource().Properties()),
+			)
+		}
 		return apeErr(err)
 	}
 	return nil