Search log records
Records for the window, newest first by default, keyset-paged with next_cursor. Bodies are cut to body_max_bytes and flagged body_truncated. A page is bounded to about 4 MB; meta.truncated says it was cut and next_cursor continues after the last record returned.
curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/logs?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&limit=100&order=desc&cursor=example_string&body_max_bytes=2048" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/logs?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&limit=100&order=desc&cursor=example_string&body_max_bytes=2048"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.get(url, headers=headers)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/logs?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&limit=100&order=desc&cursor=example_string&body_max_bytes=2048", {
method: "GET",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("GET", "https://mythic-analytics.gulp.workers.dev/client/v1/logs?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&limit=100&order=desc&cursor=example_string&body_max_bytes=2048", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/logs?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&limit=100&order=desc&cursor=example_string&body_max_bytes=2048')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"records": [
{
"uuid": "example_string",
"timestamp": "2024-12-25T10:00:00Z",
"observed_at": "2024-12-25T10:00:00Z",
"received_at": "2024-12-25T10:00:00Z",
"level": "trace",
"severity_number": 42,
"severity_text": "example_string",
"service": "checkout",
"scope_name": "John Doe",
"scope_version": "example_string",
"event_name": "John Doe",
"body": "example_string",
"body_bytes": 42,
"body_truncated": true,
"attributes": {},
"resource_attributes": {},
"trace_id": "example_string",
"span_id": "example_string",
"distinct_id": "example_string",
"session_id": "example_string",
"pattern_id": "example_string"
}
],
"next_cursor": "example_string",
"meta": {
"from": "2024-12-25T10:00:00Z",
"to": "2024-12-25T10:00:00Z",
"order": "example_string",
"limit": 42,
"truncated": true
}
}
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Error",
"message": "`feature_not_in_plan` — the plan does not include logs.",
"code": 402
}
{
"error": "Forbidden",
"message": "You don't have permission to access this resource",
"code": 403
}
{
"error": "Too Many Requests",
"message": "Rate limit exceeded. Please try again later",
"code": 429,
"retryAfter": 3600
}
{
"error": "Error",
"message": "`query_failed` — the log store did not answer.",
"code": 502
}
{
"error": "Service Unavailable",
"message": "The service is temporarily unavailable. Please try again later",
"code": 503
}
/client/v1/logs
Target server for requests. Edit to use your own host.
Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
Window end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
Comma list of levels.
Comma list of service names, at most 20.
Case-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
Records linked to this distinct_id (from mythic.distinct_id, distinct_id, user.id or enduser.id).
Records linked to ANY of these distinct_ids: a comma list, or the param repeated. At most 50 values of at most 256 bytes. A value cannot contain a comma. To read one person's logs across all their identities, use GET /client/v1/data/people/{personId}/logs, which fills this in from the identity graph.
Only records Mythic accepted strictly before this instant (ISO 8601 or epoch milliseconds). Pins a read so that records arriving late cannot change it.
32 hex characters. A filter only.
next_cursor from the previous page.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
Query Parameters
Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
2026-10-18T10:00:00ZWindow end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
15m1h6h24h7d30dCase-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
timeout "connection reset"Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
["http.status_code=500"]Records linked to this distinct_id (from mythic.distinct_id, distinct_id, user.id or enduser.id).
Records linked to ANY of these distinct_ids: a comma list, or the param repeated. At most 50 values of at most 256 bytes. A value cannot contain a comma. To read one person's logs across all their identities, use GET /client/v1/data/people/{personId}/logs, which fills this in from the identity graph.
user_42,jane@example.comOnly records Mythic accepted strictly before this instant (ISO 8601 or epoch milliseconds). Pins a read so that records arriving late cannot change it.
2026-10-18T11:00:00Z32 hex characters. A filter only.
v1:892ea82429dfa0bf975caecb03a9e5eadescascnext_cursor from the previous page.