list_events

GET

/api/v1/events

curl --request GET \
  --url https://example.com/api/v1/events \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Parameters

Query Parameters

before

string

start

string

Time-range lower bound (inclusive, RFC 3339). Distinct from before (the paging cursor).

end

string

Time-range upper bound (inclusive, RFC 3339).

limit

integer format: int64

kind

string

node_id

string format: uuid

matched

boolean

q

string

Free-text matched against source (node name / IP) or message. With regex, it is instead a regular expression matched against the message only.

regex

boolean

Interpret q as a regular expression (message-only) rather than a plain term.

Responses

200

Matching events, newest first, from whichever store is the source of record

Media typeapplication/json

Array<object>

One received event, as served by GET /api/v1/events.

object

action

required

What the pipeline did with an event. When several rules match one event, the row records the strongest outcome.

string

Allowed values: none info suppressed cleared refreshed fired

app_name

string | null

at_unix_ms

required

integer format: int64

facility

integer | null format: int32

hostname

string | null

id

required

string format: uuid

kind

required

What kind of passive event a poller (or core, for webhooks) received.

string

Allowed values: syslog trap webhook

matched_rule_id

string | null format: uuid

message

required

string

node_id

string | null format: uuid

pool

string | null

recorded_at

required

string format: date-time

source_id

string | null format: uuid

source_ip

string | null

syslog_severity

integer | null format: int32

trap_name

Well-known MIB name for trap_oid (e.g. linkDown), derived at read time; None for syslog/webhook events or an OID outside the curated set.

string | null

trap_oid

string | null

varbinds

Example

[
  {
    "action": "none",
    "kind": "syslog"
  }
]

400

before is not RFC 3339, a range bound is malformed, the kind is unknown, or the regex does not compile

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks the read permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

This deployment has no write side to resolve node names against

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}