People & IdentityList a person's logs

List a person's logs

Server log records (sent over OTLP to POST /i/v1/logs) for one person, across ALL of their identities. The person is resolved through the identity graph (a merged-away id resolves to the surviving person, and resolved_from says so), then the records whose distinct_id is any of the person's identity values are returned: every distinct_id, user_id, email and other identity the graph links to them, plus the canonical person id, at most 50. Device ids are never queried. meta.identities_queried, identities_total and identities_omitted say how many were used; values over the cap, or containing a comma or longer than 256 bytes, are omitted and counted.

Logs are read through the graph at query time and never create or change identity links. A record appears here only when its producer sent one of the person's identity values (see Link logs to people and sessions); records carrying only a session id do not appear on the person in this version, use GET /replays/{sessionId}/logs.

Newest first by default, keyset-paged: pass next_cursor back as cursor, and keep the first page's meta.from/meta.to as from/to so later pages read the same window. Default window 7 days, at most 30 (the retention).

Needs the Logs feature in the plan (402 feature_not_in_plan) and, for a scoped mcp_ key, BOTH people:read and logs:read (403 insufficient_scope names the missing one). HIPAA locations are refused (403 hipaa_restricted); a location whose configuration cannot be read answers 503 privacy_unknown, retryable. Shares the logs read budget (120 requests per minute per location) with /client/v1/logs.

curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/data/people/8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6f/logs?location_id=acme-retail&from=example_string&to=example_string&range=7d&levels=warn%2Cerror%2Cfatal&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&received_before=example_string&limit=100&order=desc&cursor=example_string&body_max_bytes=2048" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Authorization: Bearer YOUR_API_TOKEN"
{
  "success": true,
  "data": {
    "person_id": "example_string",
    "resolved_from": "example_string",
    "records": [
      {
        "uuid": "example_string",
        "timestamp": "2024-12-25T10:00:00Z",
        "observed_at": "2024-12-25T10:00:00Z",
        "received_at": "2024-12-25T10:00:00Z",
        "level": "trace",
        "severity_number": 42,
        "severity_text": "example_string",
        "service": "hc-api",
        "scope_name": "John Doe",
        "scope_version": "example_string",
        "event_name": "John Doe",
        "body": "example_string",
        "body_bytes": 42,
        "body_truncated": true,
        "attributes": {},
        "resource_attributes": {},
        "trace_id": "example_string",
        "span_id": "example_string",
        "distinct_id": "example_string",
        "session_id": "example_string",
        "pattern_id": "example_string"
      }
    ],
    "next_cursor": "example_string",
    "meta": {
      "from": "2024-12-25T10:00:00Z",
      "to": "2024-12-25T10:00:00Z",
      "order": "desc",
      "limit": 42,
      "truncated": true,
      "identities_queried": 123,
      "identities_total": 123,
      "identities_omitted": 123
    }
  }
}
GET
/people/{personId}/logs
GET
Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token
Bearer Tokenstring
Required

Agency key as bearer token. Format: Bearer ak_.... Must name a location via the location_id query parameter or X-Location-Id header. Scoped keys (mcp_) are accepted too and need people:read. See Using an mcp_ key over HTTP.

Agency key as bearer token. Format: Bearer ak_.... Must name a location via the location_id query parameter or X-Location-Id header. Scoped keys (mcp_) are accepted too and need people:read. See Using an mcp_ key over HTTP.
Bearer Token
Bearer Tokenstring
Required

Location secret key as bearer token. Format: Bearer sk_.... Resolves its own location — no location_id needed.

Location secret key as bearer token. Format: Bearer sk_.... Resolves its own location — no location_id needed.
path
personIdstring
Required

Canonical person id, or any raw identity value linked to the person (anonymous id, device id, email, or user id).

query
location_idstring

Required for agency (ak_) keys. Ignored for secret (sk_) keys, which resolve their own location. May also be supplied via the X-Location-Id header.

query
fromstring

Window start, ISO 8601 or epoch milliseconds. Default range (7 days) before to.

query
tostring

Window end, exclusive. Default now.

query
rangestring

Preset window ending at to. Ignored when from is set. Default 7d.

Options: 15m, 1h, 6h, 24h, 7d, 30d
query
levelsstring

Comma list of levels: trace, debug, info, warn, error, fatal. Use warn,error,fatal for warnings and worse.

query
servicesstring

Comma list of service names, at most 20.

query
qstring

Case-insensitive body search, at most 5 terms (all must match).

query
attrarray

Repeatable attribute filter, key=value or a bare key. At most 5.

query
trace_idstring

32 hex characters.

query
received_beforestring

Only records Mythic accepted strictly before this instant.

query
limitinteger
Min: 1 • Max: 500
query
orderstring
Options: desc, asc
query
cursorstring

next_cursor from the previous page.

query
body_max_bytesinteger
Min: 64 • Max: 32768
Request Preview
Response

Response will appear here after sending the request

Authentication

header
Authorizationstring
Required

Bearer token. Agency key as bearer token. Format: Bearer ak_.... Must name a location via the location_id query parameter or X-Location-Id header. Scoped keys (mcp_) are accepted too and need people:read. See Using an mcp_ key over HTTP.

header
Authorizationstring
Required

Bearer token. Location secret key as bearer token. Format: Bearer sk_.... Resolves its own location — no location_id needed.

Path Parameters

personIdstring
Required

Canonical person id, or any raw identity value linked to the person (anonymous id, device id, email, or user id).

Example:
8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6f

Query Parameters

location_idstring

Required for agency (ak_) keys. Ignored for secret (sk_) keys, which resolve their own location. May also be supplied via the X-Location-Id header.

Example:
acme-retail
fromstring

Window start, ISO 8601 or epoch milliseconds. Default range (7 days) before to.

tostring

Window end, exclusive. Default now.

rangestring

Preset window ending at to. Ignored when from is set. Default 7d.

Allowed values:15m1h6h24h7d30d
levelsstring

Comma list of levels: trace, debug, info, warn, error, fatal. Use warn,error,fatal for warnings and worse.

Example:
warn,error,fatal
servicesstring

Comma list of service names, at most 20.

qstring

Case-insensitive body search, at most 5 terms (all must match).

attrarray

Repeatable attribute filter, key=value or a bare key. At most 5.

trace_idstring

32 hex characters.

received_beforestring

Only records Mythic accepted strictly before this instant.

orderstring
Allowed values:descasc
cursorstring

next_cursor from the previous page.

Responses

successboolean
dataobject