Reference
View as MarkdownLogs API
Logs.
16 operations. Every call needs a session cookie or an Authorization: Bearer nct_… token unless marked Public. Conventions, errors and scopes
/deployments/{deploymentId}/logsBuild and deploy logs of a deployment
Without follow returns the persisted lines as {items:[{id,stream,line,createdAt}]} (at most 10,000 lines). With follow=true streams data: {stream,line,ts} until the deployment finishes, then event: end. The debug stream (the agent's verbose trace: docker calls, health probe attempts, route changes, timings; at most 500 lines) is left out unless streams asks for it.
| Parameter | In | Type | Description |
|---|---|---|---|
deploymentIdrequired | path | string | |
follow | query | boolean | Stream lines as server-sent events until the deployment finishes |
streams | query | string | Which streams to return: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug |
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
401Unauthorized403Forbidden404Not Found422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/deployments/{deploymentId}/logs/downloadDownload a deployment's build and deploy log as a file
The persisted lines of the deployment (at most 10,000, plus 500 debug lines when asked for) as format=txt (default; <time> [<stream>] <line>, runtime lines without the tag) or format=ndjson ({ts, stream, line} per line), in the order they were recorded, optionally limited to a from/to time range. Secret values are redacted. Audited as deployment.logs.download.
| Parameter | In | Type | Description |
|---|---|---|---|
deploymentIdrequired | path | string | |
format | query | enum: txt | ndjson | txt (default) or ndjson. |
streams | query | string | Which streams to include: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug |
from | query | string (date-time) | Only lines at or after this time (RFC 3339). |
to | query | string (date-time) | Only lines before this time (RFC 3339). |
Response 200 · The log as a file (`Content-Disposition: attachment`): plain text, one line per log line, or NDJSON (`{ts, stream, line, …}` per line). Secret values are masked. A range longer than the cap ends with a truncation note. · application/x-ndjson
401Unauthorized403Forbidden404Not Found422Unprocessable Entity500Internal Server Errordebug
Errors are RFC 9457 application/problem+json with a stable code field.
/environments/{environmentId}/logsMerged runtime logs of every service of an environment
Same shape as the service log endpoint; entries also carry serviceId and serviceName.
| Parameter | In | Type | Description |
|---|---|---|---|
environmentIdrequired | path | string | |
tail | query | integer (int64) | |
follow | query | boolean | Stream new lines as server-sent events |
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity500Internal Server Error503Service Unavailable
Errors are RFC 9457 application/problem+json with a stable code field.
/environments/{environmentId}/logs/historyStored runtime logs of an environment
The same as the service endpoint for every service of the environment, merged by time. Entries carry serviceId and serviceName. Services whose server is offline are listed in unavailable instead of failing the request.
| Parameter | In | Type | Description |
|---|---|---|---|
environmentIdrequired | path | string | |
from | query | string (date-time) | Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps. |
to | query | string (date-time) | Only lines before this time (RFC 3339). Default: now. |
q | query | string | A log search query (the same language as the log views): free text, "phrases", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log. |
limit | query | integer (int64) | Page size (default 500, max 2000). |
cursor | query | string | Opaque cursor from a previous page's nextCursor. |
order | query | enum: desc | asc | desc (default): newest first. asc: oldest first. |
Response 200 · OK · application/json
- capturingbooleanrequired
- LogHistoryEntry[] | nullrequired
- neweststring (date-time)
- nextCursorstring
- oldeststring (date-time)The oldest line the server still has.
- partialboolean
- queryErrorsstring[] | nullThe parts of the query that were ignored.
- LogHistoryUnavailable[] | nullServices whose history could not be read (their server is offline, for example).
400Bad Request401Unauthorized403Forbidden404Not Found422Unprocessable Entity500Internal Server Error502Bad Gateway504Gateway Timeout
Errors are RFC 9457 application/problem+json with a stable code field.
/log-drainsList log drains
Destinations the servers ship runtime logs to. Credentials are never returned; servers carries the drain's health as each server's agent reports it. Requires the admin scope.
Response 200 · OK · application/json
- LogDrainView[] | nullrequired
401Unauthorized403Forbidden500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/log-drainsAdd a log drain
Kinds: loki (push URL, tenant, labels; basic auth or bearer token), otlp (OTLP/HTTP logs URL; bearer token and/or headers), syslog (RFC 5424 over UDP, TCP or TCP+TLS) and http (JSON batches to any intake: Datadog, Better Stack, Axiom; credentials as headers, bearer or basic). Every connected server ships its lines from its own host, starting from the moment the drain is saved. Requires the admin scope.
Request body · application/json · required
- allProjectsbooleanDefault true: every project of the team. false: only projectIds.
- bufferMbinteger (int64)Undelivered backlog kept on disk per server (default 256, min 8).
- DrainConfigBodyrequired
- enabledbooleanDefault true.
- kindenum: loki | otlp | syslog | httprequired
- namestringrequired
- projectIdsstring[] | null
- querystringOnly ship lines matching this log search query.
- LogDrainSecretsInput
- serviceIdsstring[] | nullNarrow the scope to these services.
Response 201 · Created · application/json
- allProjectsbooleanrequired
- bufferMbinteger (int64)requiredUndelivered backlog a drain keeps on each server's disk.
- createdAtstring (date-time)required
- enabledbooleanrequired
- headerNamesstring[] | nullrequiredNames of the stored extra headers; their values are secret.
- HTTPDrainConfig
- idstringrequired
- kindenum: loki | otlp | syslog | httprequired
- LokiDrainConfig
- namestringrequired
- OTLPDrainConfig
- projectIdsstring[] | nullrequired
- querystringrequiredOnly lines matching this log search query are shipped (empty: every line).
- map of stringrequiredA mask for each credential that is set (token, username, password); never its value.
- LogDrainServerStatus[] | nullrequiredThe drain's health on each server that reported it.
- serviceIdsstring[] | nullrequired
- SyslogDrainConfig
- LogDrainTestStaterequired
- updatedAtstring (date-time)required
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/log-drains/{drainId}Get a log drain
| Parameter | In | Type | Description |
|---|---|---|---|
drainIdrequired | path | string |
Response 200 · OK · application/json
- allProjectsbooleanrequired
- bufferMbinteger (int64)requiredUndelivered backlog a drain keeps on each server's disk.
- createdAtstring (date-time)required
- enabledbooleanrequired
- headerNamesstring[] | nullrequiredNames of the stored extra headers; their values are secret.
- HTTPDrainConfig
- idstringrequired
- kindenum: loki | otlp | syslog | httprequired
- LokiDrainConfig
- namestringrequired
- OTLPDrainConfig
- projectIdsstring[] | nullrequired
- querystringrequiredOnly lines matching this log search query are shipped (empty: every line).
- map of stringrequiredA mask for each credential that is set (token, username, password); never its value.
- LogDrainServerStatus[] | nullrequiredThe drain's health on each server that reported it.
- serviceIdsstring[] | nullrequired
- SyslogDrainConfig
- LogDrainTestStaterequired
- updatedAtstring (date-time)required
401Unauthorized403Forbidden422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/log-drains/{drainId}Update a log drain
Omitted fields stay as they are; empty credentials keep the stored ones (secrets.clear removes some). The kind cannot change.
| Parameter | In | Type | Description |
|---|---|---|---|
drainIdrequired | path | string |
Request body · application/json · required
- allProjectsboolean
- bufferMbinteger (int64)
- DrainConfigBody
- enabledboolean
- namestring
- projectIdsstring[]
- querystring
- LogDrainSecretsInput
- serviceIdsstring[]
Response 200 · OK · application/json
- allProjectsbooleanrequired
- bufferMbinteger (int64)requiredUndelivered backlog a drain keeps on each server's disk.
- createdAtstring (date-time)required
- enabledbooleanrequired
- headerNamesstring[] | nullrequiredNames of the stored extra headers; their values are secret.
- HTTPDrainConfig
- idstringrequired
- kindenum: loki | otlp | syslog | httprequired
- LokiDrainConfig
- namestringrequired
- OTLPDrainConfig
- projectIdsstring[] | nullrequired
- querystringrequiredOnly lines matching this log search query are shipped (empty: every line).
- map of stringrequiredA mask for each credential that is set (token, username, password); never its value.
- LogDrainServerStatus[] | nullrequiredThe drain's health on each server that reported it.
- serviceIdsstring[] | nullrequired
- SyslogDrainConfig
- LogDrainTestStaterequired
- updatedAtstring (date-time)required
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/log-drains/{drainId}Delete a log drain
Servers stop shipping and forget the drain's position.
| Parameter | In | Type | Description |
|---|---|---|---|
drainIdrequired | path | string |
Response 204 · No Content
No body.
401Unauthorized403Forbidden422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/log-drains/{drainId}/testSend a test line through a drain
Sends one test line from a connected server's agent, which is where reachability and credentials count, and returns the outcome (ok, a message, the HTTP status). The result is also kept on the drain's test state. Works on a disabled drain.
| Parameter | In | Type | Description |
|---|---|---|---|
drainIdrequired | path | string |
Request body · application/json · required
- serverIdstringSend from this server. Default: the first connected one.
Response 200 · OK · application/json
- messagestringrequired
- okbooleanrequired
- serverIdstringrequired
- serverNamestringrequired
- statusCodeinteger (int64)
401Unauthorized403Forbidden409Conflict422Unprocessable Entity500Internal Server Error503Service Unavailable504Gateway Timeout
Errors are RFC 9457 application/problem+json with a stable code field.
/servers/{serverId}/log-settingsA server's log history settings
Capture on or off, retention days and size caps, with the usage the agent last reported.
| Parameter | In | Type | Description |
|---|---|---|---|
serverIdrequired | path | string |
Response 200 · OK · application/json
- capturebooleanrequiredCapture the runtime output of this server's services. Off: nothing new is stored; what is stored stays until it expires.
- maxServerBytesinteger (int64)requiredCap for the whole server; the oldest lines of any service go first.
- maxServiceBytesinteger (int64)requiredCap per service; the oldest lines go first.
- onlinebooleanrequired
- retentionDaysinteger (int64)required
- LogServerUsage
401Unauthorized403Forbidden422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/servers/{serverId}/log-settingsChange a server's log history settings
Retention 1-90 days (default 7); size caps of at least 32 MB (defaults 500 MB per service, 5 GB per server; the oldest lines go first). The agent applies them at once.
| Parameter | In | Type | Description |
|---|---|---|---|
serverIdrequired | path | string |
Request body · application/json · required
- capturebooleanrequired
- maxServerBytesinteger (int64)required
- maxServiceBytesinteger (int64)required
- retentionDaysinteger (int64)required
Response 200 · OK · application/json
- capturebooleanrequiredCapture the runtime output of this server's services. Off: nothing new is stored; what is stored stays until it expires.
- maxServerBytesinteger (int64)requiredCap for the whole server; the oldest lines of any service go first.
- maxServiceBytesinteger (int64)requiredCap per service; the oldest lines go first.
- onlinebooleanrequired
- retentionDaysinteger (int64)required
- LogServerUsage
401Unauthorized403Forbidden422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.
/services/{serviceId}/logsRuntime logs of a service
Without follow returns {items:[{ts,line}]}. With follow=true streams server-sent events data: {ts,line,serviceId}. Secret values are redacted. 503 server_offline when the server is not connected.
| Parameter | In | Type | Description |
|---|---|---|---|
serviceIdrequired | path | string | |
tail | query | integer (int64) | |
follow | query | boolean | Stream new lines as server-sent events |
component | query | string | Compose stacks only: show one component's lines (without it, every component, each line prefixed '<component> | ') |
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity500Internal Server Error503Service Unavailableserver_offline
Errors are RFC 9457 application/problem+json with a stable code field.
/services/{serviceId}/logs/downloadDownload a service's stored runtime logs as a file
The service's runtime log from the server's own history (7 days by default) as format=txt (default; one <time> <line> per line) or format=ndjson ({ts, stream, replica, deploymentId, line} per line), oldest first, within an optional from/to range and q filter. Secret values are redacted exactly as in the log view. At most 200,000 lines: a longer range ends with a truncation note, so narrow it. The history comes from the server's agent: 503 server_offline while it is offline, 409 history_disabled when capture is off. Audited as service.logs.download.
| Parameter | In | Type | Description |
|---|---|---|---|
serviceIdrequired | path | string | |
component | query | string | Compose stacks only: only the lines of this component. |
from | query | string (date-time) | Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps. |
to | query | string (date-time) | Only lines before this time (RFC 3339). Default: now. |
q | query | string | A log search query (the same language as the log views). |
format | query | enum: txt | ndjson | txt (default) or ndjson. |
Response 200 · The log as a file (`Content-Disposition: attachment`): plain text, one line per log line, or NDJSON (`{ts, stream, line, …}` per line). Secret values are masked. A range longer than the cap ends with a truncation note. · application/x-ndjson
400Bad Request401Unauthorized403Forbidden404Not Found409Conflicthistory_disabled422Unprocessable Entity500Internal Server Error502Bad Gateway503Service Unavailableserver_offline504Gateway Timeout
Errors are RFC 9457 application/problem+json with a stable code field.
/services/{serviceId}/logs/historyStored runtime logs of a service
A page of the service's runtime log from the server's own history (7 days by default), within an optional time range, filtered by the log search language. The server's agent answers, so history is unavailable (503 server_offline) while the server is offline. Secret values are redacted. Page with nextCursor; partial: true means the scan stopped early and the cursor continues it.
| Parameter | In | Type | Description |
|---|---|---|---|
serviceIdrequired | path | string | |
component | query | string | Compose stacks only: only the lines of this component (stored lines keep the '<component> | ' prefix the agent adds). |
from | query | string (date-time) | Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps. |
to | query | string (date-time) | Only lines before this time (RFC 3339). Default: now. |
q | query | string | A log search query (the same language as the log views): free text, "phrases", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log. |
limit | query | integer (int64) | Page size (default 500, max 2000). |
cursor | query | string | Opaque cursor from a previous page's nextCursor. |
order | query | enum: desc | asc | desc (default): newest first. asc: oldest first. |
Response 200 · OK · application/json
- capturingbooleanrequired
- LogHistoryEntry[] | nullrequired
- neweststring (date-time)
- nextCursorstring
- oldeststring (date-time)The oldest line the server still has.
- partialboolean
- queryErrorsstring[] | nullThe parts of the query that were ignored.
- LogHistoryUnavailable[] | nullServices whose history could not be read (their server is offline, for example).
400Bad Request401Unauthorized403Forbidden404Not Found409Conflict422Unprocessable Entity500Internal Server Error502Bad Gateway503Service Unavailableserver_offline504Gateway Timeout
Errors are RFC 9457 application/problem+json with a stable code field.
/task-runs/{runId}/logsOutput of a task run
Without follow returns the stored lines as {items:[{id,stream,line,createdAt}]} (redacted, at most 10,000 lines). With follow=true streams data: {stream,line,ts} until the run finishes, then event: end with {status,exitCode}.
| Parameter | In | Type | Description |
|---|---|---|---|
runIdrequired | path | string | |
follow | query | boolean | Stream lines as server-sent events until the run finishes |
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
401Unauthorized403Forbidden404Not Found422Unprocessable Entity500Internal Server Error
Errors are RFC 9457 application/problem+json with a stable code field.