List a session's logs
Server log records (sent over OTLP to POST /i/v1/logs) whose session_id is this session: what your backend logged for the visitor's requests, when it forwards the browser's Mythic session id (see Link logs to people and sessions). Works for any session id, recorded or not. Oldest first by default, keyset-paged with next_cursor.
The search window is the session id's embedded time minus 24 hours to plus 48 hours (meta.from/meta.to). The id is minted from the visitor's clock, so this is where to look, not the session's start.
Needs the Logs feature in the plan (402 feature_not_in_plan) and, for a scoped mcp_ key, BOTH replays:read and logs:read. HIPAA locations are refused (403 hipaa_restricted); a location whose configuration cannot be read answers 503 privacy_unknown, retryable. Shares the logs read budget (120 requests per minute per location) with /client/v1/logs.
curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/data/replays/example_string/logs?location_id=example_string&levels=example_string&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&limit=200&order=asc&cursor=example_string&body_max_bytes=2048" \
-H "Content-Type: application/json" \
-H "X-Location-Id: example_string" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/data/replays/example_string/logs?location_id=example_string&levels=example_string&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&limit=200&order=asc&cursor=example_string&body_max_bytes=2048"
headers = {
"Content-Type": "application/json",
"X-Location-Id": "example_string",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.get(url, headers=headers)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/data/replays/example_string/logs?location_id=example_string&levels=example_string&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&limit=200&order=asc&cursor=example_string&body_max_bytes=2048", {
method: "GET",
headers: {
"Content-Type": "application/json",
"X-Location-Id": "example_string",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("GET", "https://mythic-analytics.gulp.workers.dev/client/v1/data/replays/example_string/logs?location_id=example_string&levels=example_string&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&limit=200&order=asc&cursor=example_string&body_max_bytes=2048", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-Location-Id", "example_string")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/data/replays/example_string/logs?location_id=example_string&levels=example_string&services=example_string&q=example_string&attr=%5B%22example_string%22%5D&trace_id=example_string&limit=200&order=asc&cursor=example_string&body_max_bytes=2048')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['X-Location-Id'] = 'example_string'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"session_id": "example_string",
"records": [
{
"uuid": "example_string",
"timestamp": "2024-12-25T10:00:00Z",
"received_at": "2024-12-25T10:00:00Z",
"level": "trace",
"service": "example_string",
"body": "example_string",
"body_truncated": true,
"attributes": {},
"resource_attributes": {},
"trace_id": "example_string",
"distinct_id": "example_string",
"session_id": "example_string",
"pattern_id": "example_string"
}
],
"next_cursor": "example_string",
"meta": {
"from": "2024-12-25T10:00:00Z",
"to": "2024-12-25T10:00:00Z",
"order": "example_string",
"limit": 42,
"truncated": true
}
}
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Unauthorized",
"message": "Authentication required. Please provide a valid API token",
"code": 401
}
{
"error": "Error",
"message": "`feature_not_in_plan`: the plan does not include Logs.",
"code": 402
}
{
"error": "Forbidden",
"message": "You don't have permission to access this resource",
"code": 403
}
{
"error": "Too Many Requests",
"message": "Rate limit exceeded. Please try again later",
"code": 429,
"retryAfter": 3600
}
{
"error": "Error",
"message": "`query_failed`: the log store did not answer.",
"code": 502
}
{
"error": "Service Unavailable",
"message": "The service is temporarily unavailable. Please try again later",
"code": 503
}
/replays/{sessionId}/logsTarget server for requests. Edit to use your own host.
Agency key (ak_) or location secret key (sk_) as a bearer token. Format: Bearer ak_... or Bearer sk_.... Scoped keys (mcp_) are accepted too and need replays:read; the session logs route, and include=logs on the timeline, also need logs:read. See Using an mcp_ key over HTTP.
ak_) or location secret key (sk_) as a bearer token. Format: Bearer ak_... or Bearer sk_.... Scoped keys (mcp_) are accepted too and need replays:read; the session logs route, and include=logs on the timeline, also need logs:read. See Using an mcp_ key over HTTP.
The session id (UUIDv7).
Alternative to the X-Location-Id header for agency (ak_) keys. Ignored for secret (sk_) keys.
Comma list of levels, e.g. warn,error,fatal.
Comma list of service names, at most 20.
Case-insensitive body search, at most 5 terms (all must match).
Repeatable attribute filter, key=value or a bare key. At most 5.
next_cursor from the previous page.
Location to scope the request to. Required for agency (ak_) keys. Ignored for secret (sk_) keys, which resolve their own location.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Agency key (ak_) or location secret key (sk_) as a bearer token. Format: Bearer ak_... or Bearer sk_.... Scoped keys (mcp_) are accepted too and need replays:read; the session logs route, and include=logs on the timeline, also need logs:read. See Using an mcp_ key over HTTP.
Path Parameters
The session id (UUIDv7).
Query Parameters
Alternative to the X-Location-Id header for agency (ak_) keys. Ignored for secret (sk_) keys.
Comma list of levels, e.g. warn,error,fatal.
Comma list of service names, at most 20.
Case-insensitive body search, at most 5 terms (all must match).
Repeatable attribute filter, key=value or a bare key. At most 5.
ascdescnext_cursor from the previous page.
Headers
Location to scope the request to. Required for agency (ak_) keys. Ignored for secret (sk_) keys, which resolve their own location.