List a person's logs
Server log records (sent over OTLP to POST /i/v1/logs) for one person, across ALL of their identities. The person is resolved through the identity graph (a merged-away id resolves to the surviving person, and resolved_from says so), then the records whose distinct_id is any of the person's identity values are returned: every distinct_id, user_id, email and other identity the graph links to them, plus the canonical person id, at most 50. Device ids are never queried. meta.identities_queried, identities_total and identities_omitted say how many were used; values over the cap, or containing a comma or longer than 256 bytes, are omitted and counted.
Logs are read through the graph at query time and never create or change identity links. A record appears here only when its producer sent one of the person's identity values (see Link logs to people and sessions); records carrying only a session id do not appear on the person in this version, use GET /replays/{sessionId}/logs.
Newest first by default, keyset-paged: pass next_cursor back as cursor, and keep the first page's meta.from/meta.to as from/to so later pages read the same window. Default window 7 days, at most 30 (the retention).
Needs the Logs feature in the plan (402 feature_not_in_plan) and, for a scoped mcp_ key, BOTH people:read and logs:read (403 insufficient_scope names the missing one). HIPAA locations are refused (403 hipaa_restricted); a location whose configuration cannot be read answers 503 privacy_unknown, retryable. Shares the logs read budget (120 requests per minute per location) with /client/v1/logs.
curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/data/people/8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6f/logs?location_id=acme-retail&from=example_string&to=example_string&range=7d&levels=warn%2Cerror%2Cfatal&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&received_before=example_string&limit=100&order=desc&cursor=example_string&body_max_bytes=2048" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/data/people/8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6f/logs?location_id=acme-retail&from=example_string&to=example_string&range=7d&levels=warn%2Cerror%2Cfatal&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&received_before=example_string&limit=100&order=desc&cursor=example_string&body_max_bytes=2048"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.get(url, headers=headers)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/data/people/8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6f/logs?location_id=acme-retail&from=example_string&to=example_string&range=7d&levels=warn%2Cerror%2Cfatal&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&received_before=example_string&limit=100&order=desc&cursor=example_string&body_max_bytes=2048", {
method: "GET",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("GET", "https://mythic-analytics.gulp.workers.dev/client/v1/data/people/8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6f/logs?location_id=acme-retail&from=example_string&to=example_string&range=7d&levels=warn%2Cerror%2Cfatal&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&received_before=example_string&limit=100&order=desc&cursor=example_string&body_max_bytes=2048", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/data/people/8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6f/logs?location_id=acme-retail&from=example_string&to=example_string&range=7d&levels=warn%2Cerror%2Cfatal&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&received_before=example_string&limit=100&order=desc&cursor=example_string&body_max_bytes=2048')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"person_id": "example_string",
"resolved_from": "example_string",
"records": [
{
"uuid": "example_string",
"timestamp": "2024-12-25T10:00:00Z",
"observed_at": "2024-12-25T10:00:00Z",
"received_at": "2024-12-25T10:00:00Z",
"level": "trace",
"severity_number": 42,
"severity_text": "example_string",
"service": "hc-api",
"scope_name": "John Doe",
"scope_version": "example_string",
"event_name": "John Doe",
"body": "example_string",
"body_bytes": 42,
"body_truncated": true,
"attributes": {},
"resource_attributes": {},
"trace_id": "example_string",
"span_id": "example_string",
"distinct_id": "example_string",
"session_id": "example_string",
"pattern_id": "example_string"
}
],
"next_cursor": "example_string",
"meta": {
"from": "2024-12-25T10:00:00Z",
"to": "2024-12-25T10:00:00Z",
"order": "desc",
"limit": 42,
"truncated": true,
"identities_queried": 123,
"identities_total": 123,
"identities_omitted": 123
}
}
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Error",
"message": "`feature_not_in_plan`: the plan does not include Logs.",
"code": 402
}
{
"error": "Forbidden",
"message": "You don't have permission to access this resource",
"code": 403
}
{
"error": "Not Found",
"message": "The requested resource was not found",
"code": 404
}
{
"error": "Too Many Requests",
"message": "Rate limit exceeded. Please try again later",
"code": 429,
"retryAfter": 3600
}
{
"error": "Error",
"message": "`query_failed` or `upstream_error`: the log or person store did not answer.",
"code": 502
}
{
"error": "Service Unavailable",
"message": "The service is temporarily unavailable. Please try again later",
"code": 503
}
/people/{personId}/logsTarget server for requests. Edit to use your own host.
Agency key as bearer token. Format: Bearer ak_.... Must name a location via the location_id query parameter or X-Location-Id header. Scoped keys (mcp_) are accepted too and need people:read. See Using an mcp_ key over HTTP.
Bearer ak_.... Must name a location via the location_id query parameter or X-Location-Id header. Scoped keys (mcp_) are accepted too and need people:read. See Using an mcp_ key over HTTP.
Location secret key as bearer token. Format: Bearer sk_.... Resolves its own location — no location_id needed.
Bearer sk_.... Resolves its own location — no location_id needed.
Canonical person id, or any raw identity value linked to the person (anonymous id, device id, email, or user id).
Required for agency (ak_) keys. Ignored for secret (sk_) keys, which resolve their own location. May also be supplied via the X-Location-Id header.
Window start, ISO 8601 or epoch milliseconds. Default range (7 days) before to.
Window end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. Default 7d.
Comma list of levels: trace, debug, info, warn, error, fatal. Use warn,error,fatal for warnings and worse.
Comma list of service names, at most 20.
Case-insensitive body search, at most 5 terms (all must match).
Repeatable attribute filter, key=value or a bare key. At most 5.
32 hex characters.
Only records Mythic accepted strictly before this instant.
next_cursor from the previous page.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Agency key as bearer token. Format: Bearer ak_.... Must name a location via the location_id query parameter or X-Location-Id header. Scoped keys (mcp_) are accepted too and need people:read. See Using an mcp_ key over HTTP.
Bearer token. Location secret key as bearer token. Format: Bearer sk_.... Resolves its own location — no location_id needed.
Path Parameters
Canonical person id, or any raw identity value linked to the person (anonymous id, device id, email, or user id).
8f3c1e00-4a2b-4c9d-9e11-1a2b3c4d5e6fQuery Parameters
Required for agency (ak_) keys. Ignored for secret (sk_) keys, which resolve their own location. May also be supplied via the X-Location-Id header.
acme-retailWindow start, ISO 8601 or epoch milliseconds. Default range (7 days) before to.
Window end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. Default 7d.
15m1h6h24h7d30dComma list of levels: trace, debug, info, warn, error, fatal. Use warn,error,fatal for warnings and worse.
warn,error,fatalComma list of service names, at most 20.
Case-insensitive body search, at most 5 terms (all must match).
Repeatable attribute filter, key=value or a bare key. At most 5.
32 hex characters.
Only records Mythic accepted strictly before this instant.
descascnext_cursor from the previous page.