Logs

Download schema

Endpoints for discovering and querying FlowGuard request logs.

List log fields

GET

https://flowguard.network/api/v1

/logs/fields

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

List the fields that can be used in log filters, including each field's value type, supported operators, and fixed options. Use this endpoint before constructing a log query instead of relying on hard-coded field names.

List log fields › Responses

object[] · required

Retrieve a log by stream ID

GET

https://flowguard.network/api/v1

/logs/by-stream/{streamId}

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

Return the newest retained request log with an exact, case-sensitive stream ID match.

Retrieve a log by stream ID › path Parameters

streamId

string · required

Retrieve a log by stream ID › Responses

The matching request log.

object · required

Query request logs

POST

https://flowguard.network/api/v1

/logs/query

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

Query request logs for the authenticated team within a time range. Results use cursor pagination and are ordered by timestamp and a stable event identifier. When continuing a query, send the returned cursor unchanged and keep the same time range, filters, and direction.

Query request logs › Request Body

QueryLogsRequest

from

string · date-time · required

Inclusive beginning of the query range. Defaults to 24 hours before to.

Example: 2026-09-02T12:00:00Z

to

string · date-time · required

Exclusive end of the query range. Defaults to the current time.

Example: 2026-09-03T12:00:00Z

direction

string · enum · required

Sort order for matching events.

Enum values:

asc

desc

Example: desc

Default: desc

limit

integer · min: 1 · max: 200 · required

Maximum number of events to return.

Default: 100

object · required

cursor

string | null · maxLength: 2048

Opaque cursor returned as meta.next_cursor by the previous page. Keep the time range, filters, and direction unchanged when continuing a query.

Example: eyJ0aW1lc3RhbXAiOjE3NzczNzQwMDAwMDAsImlkIjoic3ludGhldGljLWV2ZW50In0=

Query request logs › Responses

Matching request log events and cursor pagination metadata.

object[] · required

object · required

POST/logs/query

curl https://flowguard.network/api/v1/logs/query \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <token>' \
  --data '{
  "from": "2026-09-02T12:00:00Z",
  "to": "2026-09-03T12:00:00Z",
  "direction": "desc",
  "limit": 100,
  "cursor": "eyJ0aW1lc3RhbXAiOjE3NzczNzQwMDAwMDAsImlkIjoic3ludGhldGljLWV2ZW50In0=",
  "filters": {
    "operator": "AND",
    "groups": [
      {
        "operator": "AND",
        "conditions": [
          {
            "column": "stream_id",
            "operator": "equals",
            "value": "value",
            "case_sensitive": true
          }
        ]
      }
    ]
  }
}'

Example Request Body

{
  "from": "2026-09-02T12:00:00Z",
  "to": "2026-09-03T12:00:00Z",
  "direction": "desc",
  "limit": 100,
  "cursor": "eyJ0aW1lc3RhbXAiOjE3NzczNzQwMDAwMDAsImlkIjoic3ludGhldGljLWV2ZW50In0=",
  "filters": {
    "operator": "AND",
    "groups": [
      {
        "operator": "AND",
        "conditions": [
          {
            "column": "stream_id",
            "operator": "equals",
            "value": "value",
            "case_sensitive": true
          }
        ]
      }
    ]
  }
}

json

Example Responses

{
  "data": [
    {
      "cursor": "eyJ0aW1lc3RhbXAiOjE3NzczNzQwMDAwMDAsImlkIjoic3ludGhldGljLWV2ZW50In0=",
      "timestamp": "2026-09-03T11:58:00Z",
      "fields": {
        "request.method": "GET",
        "request.url.domain": "service.example.test",
        "client.ip": "192.0.2.44",
        "response.status": 403
      }
    }
  ],
  "meta": {
    "next_cursor": null,
    "has_more": false,
    "from": "2026-09-02T12:00:00Z",
    "to": "2026-09-03T12:00:00Z",
    "direction": "desc",
    "limit": 100
  }
}

json

application/json

Retrieve a log window

POST

https://flowguard.network/api/v1

/logs/window

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

Return chronological context around a timestamp, stream ID, or opaque log cursor. Stream ID and cursor anchors are included even when they do not match the supplied filters; filters apply to surrounding events.

Retrieve a log window › Request Body

LogWindowRequest

object · required

Anchor used to center the returned log window.

before

integer · min: 0 · max: 200 · required

Number of matching events to retrieve before the anchor.

after

integer · min: 0 · max: 200 · required

Number of matching events to retrieve after the anchor.

object · required

Retrieve a log window › Responses

A chronological window of request logs and bidirectional cursor metadata.

object[] · required

object · required

POST/logs/window

curl https://flowguard.network/api/v1/logs/window \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <token>' \
  --data '{
  "anchor": {
    "type": "timestamp",
    "value": "value"
  },
  "before": 0,
  "after": 0,
  "filters": {
    "operator": "AND",
    "groups": [
      {
        "operator": "AND",
        "conditions": [
          {
            "column": "stream_id",
            "operator": "equals",
            "value": "value",
            "case_sensitive": true
          }
        ]
      }
    ]
  }
}'

Example Request Body

{
  "anchor": {
    "type": "timestamp",
    "value": "value"
  },
  "before": 0,
  "after": 0,
  "filters": {
    "operator": "AND",
    "groups": [
      {
        "operator": "AND",
        "conditions": [
          {
            "column": "stream_id",
            "operator": "equals",
            "value": "value",
            "case_sensitive": true
          }
        ]
      }
    ]
  }
}

json

Example Responses

{
  "data": [
    {
      "cursor": "eyJ0aW1lc3RhbXAiOjE3NzczNzQwMDAwMDAsImlkIjoic3ludGhldGljLWV2ZW50In0=",
      "timestamp": "2026-09-03T11:58:00Z",
      "fields": {
        "stream_id": "synthetic-stream-7f2a",
        "request.url.domain": "service.example.test",
        "client.ip": "192.0.2.44"
      }
    }
  ],
  "meta": {
    "anchor": {
      "type": "timestamp",
      "cursor": "eyJ0aW1lc3RhbXAiOjE3NzczNzQwMDAwMDAsImlkIjoic3ludGhldGljLWV2ZW50In0=",
      "timestamp": "2026-09-03T11:58:00Z"
    },
    "from": "2026-08-04T12:00:00Z",
    "to": "2026-09-03T12:00:00Z",
    "older_cursor": null,
    "newer_cursor": null,
    "has_older": false,
    "has_newer": false,
    "before": 50,
    "after": 50
  }
}

json

application/json

Summarize an incident interval

POST

https://flowguard.network/api/v1

/logs/summary

OpenID Connect

Bearer (ctp_*)

Bearer (ctt_*)

Returns aggregate request volume, approximate cardinalities, latency percentiles, top dimensions, correlated JA4 fingerprints, and requested baselines for an interval of at most 24 hours.

Summarize an incident interval › Request Body

SummarizeTrafficRequest

from

string · date-time · required

to

string · date-time · required

baselines

TrafficBaseline[] · maxItems: 2 · unique · required

Enum values:

previous_period

previous_day

object · required

Summarize an incident interval › Responses

Aggregate incident summary.

No data returned

POST/logs/summary

curl https://flowguard.network/api/v1/logs/summary \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <token>' \
  --data '{
  "from": "2024-08-25T15:00:00Z",
  "to": "2024-08-25T15:00:00Z",
  "baselines": [
    "previous_period"
  ],
  "server_scope": {
    "mode": "all",
    "server_ids": [
      "string"
    ]
  },
  "filters": {
    "operator": "AND",
    "groups": [
      {
        "operator": "AND",
        "conditions": [
          {
            "column": "stream_id",
            "operator": "equals",
            "value": "value",
            "case_sensitive": true
          }
        ]
      }
    ]
  }
}'

Example Request Body

{
  "from": "2024-08-25T15:00:00Z",
  "to": "2024-08-25T15:00:00Z",
  "baselines": [
    "previous_period"
  ],
  "server_scope": {
    "mode": "all",
    "server_ids": [
      "string"
    ]
  },
  "filters": {
    "operator": "AND",
    "groups": [
      {
        "operator": "AND",
        "conditions": [
          {
            "column": "stream_id",
            "operator": "equals",
            "value": "value",
            "case_sensitive": true
          }
        ]
      }
    ]
  }
}

json

Example Responses

{
  "key": {}
}

json

application/json

Rules