list_events

GET

/api/v1/events

curl --request GET \
  --url https://example.com/api/v1/events \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Parameters

Query Parameters

before

string

start

string

Time-range lower bound (inclusive, RFC 3339). Distinct from before (the paging cursor).

end

string

Time-range upper bound (inclusive, RFC 3339).

limit

integer format: int64

kind

string

Event kinds to include, comma-separated (syslog,trap). A single value is the long-standing spelling and still works; an empty value or an absent parameter means every kind.

node_id

string format: uuid

matched

boolean

Only rule-matched events (or only unmatched ones). Superseded by action, which says what the rule did; kept because it is a narrower question some clients still ask.

action

string

Rule outcomes to include, comma-separated (fired,cleared); empty or absent means all.

severity

string

Syslog severities (0–7) to include, comma-separated; empty or absent means all. An event with no syslog severity — a trap, a webhook — matches no severity filter.

q

string

Free-text matched against source (node name / IP) or message, case-insensitively. Whether it also matches inside a word depends on the store this deployment searches: PostgreSQL matches any substring, a log store matches whole words. With regex, it is instead a regular expression matched against the message only, which reaches inside words on either.

regex

boolean

Interpret q as a regular expression (message-only) rather than a plain term.

msg

string

Message-only condition, matched with the same store-dependent word rules as q.

msg_regex

boolean

Interpret msg as a regular expression, which reaches inside words on either store.

msg_not

boolean

Keep the events whose message does not match msg.

src

string

Condition on the event’s source: its IP, or the name of the node it is attributed to. There is no regex form — the node-name half is resolved against PostgreSQL and has no counterpart in a log store, so a pattern would mean two different things on the two backends.

src_not

boolean

Keep the events whose source does not match src.

Responses

200

Matching events, newest first, from whichever store is the source of record

Media typeapplication/json

Array<object>

One received event, as served by GET /api/v1/events.

object

action

required

What the pipeline did with an event. When several rules match one event, the row records the strongest outcome.

string

Allowed values: none info suppressed cleared refreshed fired

app_name

string | null

at_unix_ms

required

integer format: int64

facility

integer | null format: int32

hostname

string | null

id

required

string format: uuid

kind

required

What kind of passive event a poller (or core, for webhooks) received.

string

Allowed values: syslog trap webhook

matched_rule_id

string | null format: uuid

message

required

string

node_id

string | null format: uuid

pool

string | null

recorded_at

required

string format: date-time

source_id

string | null format: uuid

source_ip

string | null

syslog_severity

integer | null format: int32

trap_name

Well-known MIB name for trap_oid (e.g. linkDown), derived at read time; None for syslog/webhook events or an OID outside the curated set.

string | null

trap_oid

string | null

varbinds

Example

[
  {
    "action": "none",
    "kind": "syslog"
  }
]

400

before is not RFC 3339, a range bound is malformed, the kind is unknown, or the regex does not compile

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks the read permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

This deployment has no write side to resolve node names against

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}