Skip to content

Logs API

Logs.

16 operations. Every call needs a session cookie or an Authorization: Bearer nct_… token unless marked Public. Conventions, errors and scopes

GET/deployments/{deploymentId}/logs

Build and deploy logs of a deployment

Without follow returns the persisted lines as {items:[{id,stream,line,createdAt}]} (at most 10,000 lines). With follow=true streams data: {stream,line,ts} until the deployment finishes, then event: end. The debug stream (the agent's verbose trace: docker calls, health probe attempts, route changes, timings; at most 500 lines) is left out unless streams asks for it.

ParameterInTypeDescription
deploymentIdrequiredpathstring
followquerybooleanStream lines as server-sent events until the deployment finishes
streamsquerystringWhich streams to return: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
object
Errors
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

GET/deployments/{deploymentId}/logs/download

Download a deployment's build and deploy log as a file

The persisted lines of the deployment (at most 10,000, plus 500 debug lines when asked for) as format=txt (default; <time> [<stream>] <line>, runtime lines without the tag) or format=ndjson ({ts, stream, line} per line), in the order they were recorded, optionally limited to a from/to time range. Secret values are redacted. Audited as deployment.logs.download.

ParameterInTypeDescription
deploymentIdrequiredpathstring
formatqueryenum: txt | ndjsontxt (default) or ndjson.
streamsquerystringWhich streams to include: empty for build, deploy and runtime; all to include the debug stream; or a comma-separated list of build, deploy, runtime and debug
fromquerystring (date-time)Only lines at or after this time (RFC 3339).
toquerystring (date-time)Only lines before this time (RFC 3339).
Response 200 · The log as a file (`Content-Disposition: attachment`): plain text, one line per log line, or NDJSON (`{ts, stream, line, …}` per line). Secret values are masked. A range longer than the cap ends with a truncation note. · application/x-ndjson
string
Errors
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 422Unprocessable Entity
  • 500Internal Server Errordebug

Errors are RFC 9457 application/problem+json with a stable code field.

GET/environments/{environmentId}/logs

Merged runtime logs of every service of an environment

Same shape as the service log endpoint; entries also carry serviceId and serviceName.

ParameterInTypeDescription
environmentIdrequiredpathstring
tailqueryinteger (int64)
followquerybooleanStream new lines as server-sent events
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
object
Errors
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 409Conflict
  • 422Unprocessable Entity
  • 500Internal Server Error
  • 503Service Unavailable

Errors are RFC 9457 application/problem+json with a stable code field.

GET/environments/{environmentId}/logs/history

Stored runtime logs of an environment

The same as the service endpoint for every service of the environment, merged by time. Entries carry serviceId and serviceName. Services whose server is offline are listed in unavailable instead of failing the request.

ParameterInTypeDescription
environmentIdrequiredpathstring
fromquerystring (date-time)Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.
toquerystring (date-time)Only lines before this time (RFC 3339). Default: now.
qquerystringA log search query (the same language as the log views): free text, "phrases", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log.
limitqueryinteger (int64)Page size (default 500, max 2000).
cursorquerystringOpaque cursor from a previous page's nextCursor.
orderqueryenum: desc | ascdesc (default): newest first. asc: oldest first.
Response 200 · OK · application/json
LogHistoryPage
  • capturingbooleanrequired
  • LogHistoryEntry[] | nullrequired
  • neweststring (date-time)
  • nextCursorstring
  • oldeststring (date-time)
    The oldest line the server still has.
  • partialboolean
  • queryErrorsstring[] | null
    The parts of the query that were ignored.
  • LogHistoryUnavailable[] | null
    Services whose history could not be read (their server is offline, for example).
Errors
  • 400Bad Request
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 422Unprocessable Entity
  • 500Internal Server Error
  • 502Bad Gateway
  • 504Gateway Timeout

Errors are RFC 9457 application/problem+json with a stable code field.

GET/log-drains

List log drains

Destinations the servers ship runtime logs to. Credentials are never returned; servers carries the drain's health as each server's agent reports it. Requires the admin scope.

Response 200 · OK · application/json
DrainListOutputBody
  • LogDrainView[] | nullrequired
Errors
  • 401Unauthorized
  • 403Forbidden
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

POST/log-drains

Add a log drain

Kinds: loki (push URL, tenant, labels; basic auth or bearer token), otlp (OTLP/HTTP logs URL; bearer token and/or headers), syslog (RFC 5424 over UDP, TCP or TCP+TLS) and http (JSON batches to any intake: Datadog, Better Stack, Axiom; credentials as headers, bearer or basic). Every connected server ships its lines from its own host, starting from the moment the drain is saved. Requires the admin scope.

Request body · application/json · required
CreateDrainInputBody
  • allProjectsboolean
    Default true: every project of the team. false: only projectIds.
  • bufferMbinteger (int64)
    Undelivered backlog kept on disk per server (default 256, min 8).
  • DrainConfigBodyrequired
  • enabledboolean
    Default true.
  • kindenum: loki | otlp | syslog | httprequired
  • namestringrequired
  • projectIdsstring[] | null
  • querystring
    Only ship lines matching this log search query.
  • LogDrainSecretsInput
  • serviceIdsstring[] | null
    Narrow the scope to these services.
Response 201 · Created · application/json
LogDrainView
  • allProjectsbooleanrequired
  • bufferMbinteger (int64)required
    Undelivered backlog a drain keeps on each server's disk.
  • createdAtstring (date-time)required
  • enabledbooleanrequired
  • headerNamesstring[] | nullrequired
    Names of the stored extra headers; their values are secret.
  • HTTPDrainConfig
  • idstringrequired
  • kindenum: loki | otlp | syslog | httprequired
  • LokiDrainConfig
  • namestringrequired
  • OTLPDrainConfig
  • projectIdsstring[] | nullrequired
  • querystringrequired
    Only lines matching this log search query are shipped (empty: every line).
  • map of stringrequired
    A mask for each credential that is set (token, username, password); never its value.
  • LogDrainServerStatus[] | nullrequired
    The drain's health on each server that reported it.
  • serviceIdsstring[] | nullrequired
  • SyslogDrainConfig
  • LogDrainTestStaterequired
  • updatedAtstring (date-time)required
Errors
  • 401Unauthorized
  • 403Forbidden
  • 409Conflict
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

GET/log-drains/{drainId}

Get a log drain

ParameterInTypeDescription
drainIdrequiredpathstring
Response 200 · OK · application/json
LogDrainView
  • allProjectsbooleanrequired
  • bufferMbinteger (int64)required
    Undelivered backlog a drain keeps on each server's disk.
  • createdAtstring (date-time)required
  • enabledbooleanrequired
  • headerNamesstring[] | nullrequired
    Names of the stored extra headers; their values are secret.
  • HTTPDrainConfig
  • idstringrequired
  • kindenum: loki | otlp | syslog | httprequired
  • LokiDrainConfig
  • namestringrequired
  • OTLPDrainConfig
  • projectIdsstring[] | nullrequired
  • querystringrequired
    Only lines matching this log search query are shipped (empty: every line).
  • map of stringrequired
    A mask for each credential that is set (token, username, password); never its value.
  • LogDrainServerStatus[] | nullrequired
    The drain's health on each server that reported it.
  • serviceIdsstring[] | nullrequired
  • SyslogDrainConfig
  • LogDrainTestStaterequired
  • updatedAtstring (date-time)required
Errors
  • 401Unauthorized
  • 403Forbidden
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

PATCH/log-drains/{drainId}

Update a log drain

Omitted fields stay as they are; empty credentials keep the stored ones (secrets.clear removes some). The kind cannot change.

ParameterInTypeDescription
drainIdrequiredpathstring
Request body · application/json · required
PatchDrainInputBody
  • allProjectsboolean
  • bufferMbinteger (int64)
  • DrainConfigBody
  • enabledboolean
  • namestring
  • projectIdsstring[]
  • querystring
  • LogDrainSecretsInput
  • serviceIdsstring[]
Response 200 · OK · application/json
LogDrainView
  • allProjectsbooleanrequired
  • bufferMbinteger (int64)required
    Undelivered backlog a drain keeps on each server's disk.
  • createdAtstring (date-time)required
  • enabledbooleanrequired
  • headerNamesstring[] | nullrequired
    Names of the stored extra headers; their values are secret.
  • HTTPDrainConfig
  • idstringrequired
  • kindenum: loki | otlp | syslog | httprequired
  • LokiDrainConfig
  • namestringrequired
  • OTLPDrainConfig
  • projectIdsstring[] | nullrequired
  • querystringrequired
    Only lines matching this log search query are shipped (empty: every line).
  • map of stringrequired
    A mask for each credential that is set (token, username, password); never its value.
  • LogDrainServerStatus[] | nullrequired
    The drain's health on each server that reported it.
  • serviceIdsstring[] | nullrequired
  • SyslogDrainConfig
  • LogDrainTestStaterequired
  • updatedAtstring (date-time)required
Errors
  • 401Unauthorized
  • 403Forbidden
  • 409Conflict
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

DELETE/log-drains/{drainId}

Delete a log drain

Servers stop shipping and forget the drain's position.

ParameterInTypeDescription
drainIdrequiredpathstring
Response 204 · No Content

No body.

Errors
  • 401Unauthorized
  • 403Forbidden
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

POST/log-drains/{drainId}/test

Send a test line through a drain

Sends one test line from a connected server's agent, which is where reachability and credentials count, and returns the outcome (ok, a message, the HTTP status). The result is also kept on the drain's test state. Works on a disabled drain.

ParameterInTypeDescription
drainIdrequiredpathstring
Request body · application/json · required
TestDrainInputBody
  • serverIdstring
    Send from this server. Default: the first connected one.
Response 200 · OK · application/json
LogDrainTestResult
  • messagestringrequired
  • okbooleanrequired
  • serverIdstringrequired
  • serverNamestringrequired
  • statusCodeinteger (int64)
Errors
  • 401Unauthorized
  • 403Forbidden
  • 409Conflict
  • 422Unprocessable Entity
  • 500Internal Server Error
  • 503Service Unavailable
  • 504Gateway Timeout

Errors are RFC 9457 application/problem+json with a stable code field.

GET/servers/{serverId}/log-settings

A server's log history settings

Capture on or off, retention days and size caps, with the usage the agent last reported.

ParameterInTypeDescription
serverIdrequiredpathstring
Response 200 · OK · application/json
LogSettingsView
  • capturebooleanrequired
    Capture the runtime output of this server's services. Off: nothing new is stored; what is stored stays until it expires.
  • maxServerBytesinteger (int64)required
    Cap for the whole server; the oldest lines of any service go first.
  • maxServiceBytesinteger (int64)required
    Cap per service; the oldest lines go first.
  • onlinebooleanrequired
  • retentionDaysinteger (int64)required
  • LogServerUsage
Errors
  • 401Unauthorized
  • 403Forbidden
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

PUT/servers/{serverId}/log-settings

Change a server's log history settings

Retention 1-90 days (default 7); size caps of at least 32 MB (defaults 500 MB per service, 5 GB per server; the oldest lines go first). The agent applies them at once.

ParameterInTypeDescription
serverIdrequiredpathstring
Request body · application/json · required
PutSettingsInputBody
  • capturebooleanrequired
  • maxServerBytesinteger (int64)required
  • maxServiceBytesinteger (int64)required
  • retentionDaysinteger (int64)required
Response 200 · OK · application/json
LogSettingsView
  • capturebooleanrequired
    Capture the runtime output of this server's services. Off: nothing new is stored; what is stored stays until it expires.
  • maxServerBytesinteger (int64)required
    Cap for the whole server; the oldest lines of any service go first.
  • maxServiceBytesinteger (int64)required
    Cap per service; the oldest lines go first.
  • onlinebooleanrequired
  • retentionDaysinteger (int64)required
  • LogServerUsage
Errors
  • 401Unauthorized
  • 403Forbidden
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.

GET/services/{serviceId}/logs

Runtime logs of a service

Without follow returns {items:[{ts,line}]}. With follow=true streams server-sent events data: {ts,line,serviceId}. Secret values are redacted. 503 server_offline when the server is not connected.

ParameterInTypeDescription
serviceIdrequiredpathstring
tailqueryinteger (int64)
followquerybooleanStream new lines as server-sent events
componentquerystringCompose stacks only: show one component's lines (without it, every component, each line prefixed '<component> | ')
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
object
Errors
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 409Conflict
  • 422Unprocessable Entity
  • 500Internal Server Error
  • 503Service Unavailableserver_offline

Errors are RFC 9457 application/problem+json with a stable code field.

GET/services/{serviceId}/logs/download

Download a service's stored runtime logs as a file

The service's runtime log from the server's own history (7 days by default) as format=txt (default; one <time> <line> per line) or format=ndjson ({ts, stream, replica, deploymentId, line} per line), oldest first, within an optional from/to range and q filter. Secret values are redacted exactly as in the log view. At most 200,000 lines: a longer range ends with a truncation note, so narrow it. The history comes from the server's agent: 503 server_offline while it is offline, 409 history_disabled when capture is off. Audited as service.logs.download.

ParameterInTypeDescription
serviceIdrequiredpathstring
componentquerystringCompose stacks only: only the lines of this component.
fromquerystring (date-time)Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.
toquerystring (date-time)Only lines before this time (RFC 3339). Default: now.
qquerystringA log search query (the same language as the log views).
formatqueryenum: txt | ndjsontxt (default) or ndjson.
Response 200 · The log as a file (`Content-Disposition: attachment`): plain text, one line per log line, or NDJSON (`{ts, stream, line, …}` per line). Secret values are masked. A range longer than the cap ends with a truncation note. · application/x-ndjson
string
Errors
  • 400Bad Request
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 409Conflicthistory_disabled
  • 422Unprocessable Entity
  • 500Internal Server Error
  • 502Bad Gateway
  • 503Service Unavailableserver_offline
  • 504Gateway Timeout

Errors are RFC 9457 application/problem+json with a stable code field.

GET/services/{serviceId}/logs/history

Stored runtime logs of a service

A page of the service's runtime log from the server's own history (7 days by default), within an optional time range, filtered by the log search language. The server's agent answers, so history is unavailable (503 server_offline) while the server is offline. Secret values are redacted. Page with nextCursor; partial: true means the scan stopped early and the cursor continues it.

ParameterInTypeDescription
serviceIdrequiredpathstring
componentquerystringCompose stacks only: only the lines of this component (stored lines keep the '<component> | ' prefix the agent adds).
fromquerystring (date-time)Only lines at or after this time (RFC 3339). Default: the oldest line the server keeps.
toquerystring (date-time)Only lines before this time (RFC 3339). Default: now.
qquerystringA log search query (the same language as the log views): free text, "phrases", level:error, -service:web, @status:[400 TO 499]. Evaluated on the server that stores the log.
limitqueryinteger (int64)Page size (default 500, max 2000).
cursorquerystringOpaque cursor from a previous page's nextCursor.
orderqueryenum: desc | ascdesc (default): newest first. asc: oldest first.
Response 200 · OK · application/json
LogHistoryPage
  • capturingbooleanrequired
  • LogHistoryEntry[] | nullrequired
  • neweststring (date-time)
  • nextCursorstring
  • oldeststring (date-time)
    The oldest line the server still has.
  • partialboolean
  • queryErrorsstring[] | null
    The parts of the query that were ignored.
  • LogHistoryUnavailable[] | null
    Services whose history could not be read (their server is offline, for example).
Errors
  • 400Bad Request
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 409Conflict
  • 422Unprocessable Entity
  • 500Internal Server Error
  • 502Bad Gateway
  • 503Service Unavailableserver_offline
  • 504Gateway Timeout

Errors are RFC 9457 application/problem+json with a stable code field.

GET/task-runs/{runId}/logs

Output of a task run

Without follow returns the stored lines as {items:[{id,stream,line,createdAt}]} (redacted, at most 10,000 lines). With follow=true streams data: {stream,line,ts} until the run finishes, then event: end with {status,exitCode}.

ParameterInTypeDescription
runIdrequiredpathstring
followquerybooleanStream lines as server-sent events until the run finishes
Response 200 · JSON `{items}` without `follow`; a `text/event-stream` with `follow=true` · application/json
object
Errors
  • 401Unauthorized
  • 403Forbidden
  • 404Not Found
  • 422Unprocessable Entity
  • 500Internal Server Error

Errors are RFC 9457 application/problem+json with a stable code field.