> ## Documentation Index > Fetch the complete documentation index at: https://docs.rootly.com/llms.txt > Use this file to discover all available pages before exploring further. # List Observability logs > Search Rootly Observability logs with the Logs explorer query syntax (`service:`, `severity:`, `index:`, `trace_id:`, `@attribute:value`, `OR` inside field groups, `-` negation, `*` prefix, free text). Rows are newest first, clipped and redacted. `meta.query` and `meta.window` echo the effective query and window. Requires a personal or Global API key (Team API Keys are group-scoped and get 403 `unsupported_api_key`) or an OAuth token with the `obs.logs:read` (or `all`) scope, and the Observability logs read permission. A Global API key uses its service user's Observability role, which starts as the team's default Observability role. Limited to 60 requests per minute per token; on this endpoint the X-RateLimit-* headers report that per-minute budget, not the default API limit. Every 429 returns the errors envelope with code rate_limited and a Retry-After header. ## OpenAPI ````yaml https://rootly-heroku.s3.amazonaws.com/swagger/v1/swagger.json get /v1/observability/logs openapi: 3.0.1 info: title: Rootly API v1 version: v1 license: name: Rootly url: https://rootly.com description: >+ # How to generate an API Key? - **Organization dropdown** > **Organization Settings** > **API Keys** # JSON:API Specification Rootly is using **JSON:API** (https://jsonapi.org) specification: - JSON:API is a specification for how a client should request that resources be fetched or modified, and how a server should respond to those requests. - JSON:API is designed to minimize both the number of requests and the amount of data transmitted between clients and servers. This efficiency is achieved without compromising readability, flexibility, or discoverability. - JSON:API requires use of the JSON:API media type (**application/vnd.api+json**) for exchanging data. # Authentication and Requests We use standard HTTP Authentication over HTTPS to authorize your requests. ``` curl --request GET \ --header 'Content-Type: application/vnd.api+json' \ --header 'Authorization: Bearer YOUR-TOKEN' \ --url https://api.rootly.com/v1/incidents ```
# Rate limiting - There is a default limit of **5** **GET**, **HEAD**, and **OPTIONS** calls **per API key** every **60 seconds** (0 hours). The limit is calculated over a **0-hour sliding window** looking back from the current time. While the limit can be configured to support higher thresholds, you must first contact your **Rootly Customer Success Manager** to make any adjustments. - There is a default limit of **3** **POST**, **PUT**, **PATCH** or **DELETE** calls **per API key** every **60 seconds** (0 hours). The limit is calculated over a **0-hour sliding window** looking back from the current time. While the limit can be configured to support higher thresholds, you must first contact your **Rootly Customer Success Manager** to make any adjustments. - When rate limits are exceeded, the API will return a **429 Too Many Requests** HTTP status code with the response: `{"error": "Rate limit exceeded. Try again later."}` - **X-RateLimit headers** are included in every API response, providing real-time rate limit information: - **X-RateLimit-Limit** - The maximum number of requests permitted and the time window (e.g., "1000, 1000;window=3600" for 1000 requests per hour) - **X-RateLimit-Remaining** - The number of requests remaining in the current rate limit window - **X-RateLimit-Used** - The number of requests already made in the current window - **X-RateLimit-Reset** - The time at which the current rate limit window resets, in UTC epoch seconds # Pagination - Pagination is supported for all endpoints that return a collection of items. - Pagination is controlled by the **page** query parameter ## Example ``` curl --request GET \ --header 'Content-Type: application/vnd.api+json' \ --header 'Authorization: Bearer YOUR-TOKEN' \ --url https://api.rootly.com/v1/incidents?page[number]=1&page[size]=10 ``` x-logo: url: https://rootly-heroku.s3.us-east-1.amazonaws.com/swagger/v1/logo.png servers: - url: https://api.rootly.com security: [] paths: /v1/observability/logs: get: tags: - Observability summary: List Observability logs description: >- Search Rootly Observability logs with the Logs explorer query syntax (`service:`, `severity:`, `index:`, `trace_id:`, `@attribute:value`, `OR` inside field groups, `-` negation, `*` prefix, free text). Rows are newest first, clipped and redacted. `meta.query` and `meta.window` echo the effective query and window. Requires a personal or Global API key (Team API Keys are group-scoped and get 403 `unsupported_api_key`) or an OAuth token with the `obs.logs:read` (or `all`) scope, and the Observability logs read permission. A Global API key uses its service user's Observability role, which starts as the team's default Observability role. Limited to 60 requests per minute per token; on this endpoint the X-RateLimit-* headers report that per-minute budget, not the default API limit. Every 429 returns the errors envelope with code rate_limited and a Retry-After header. operationId: listObservabilityLogs parameters: - name: filter[query] in: query required: false schema: type: string description: >- Logs explorer query, e.g. `service:checkout severity:error index:main`. - name: filter[from] in: query required: false schema: type: string description: >- Window start: ISO8601 or relative like `now-6h`, `now-30m`, `now-2d`. Defaults to `now-1h`. Windows are at most 7 days, and 24 hours without an indexable term. - name: filter[to] in: query required: false schema: type: string description: 'Window end: ISO8601 or relative like `now`. Defaults to `now`.' - name: page[size] in: query required: false schema: type: integer minimum: 1 maximum: 50 default: 25 description: >- Maximum rows per page (1-50, default 25). A page can hold fewer rows when the response size budget is reached; keep paging while meta.page.next_cursor is present. - name: page[cursor] in: query required: false schema: type: string description: >- `meta.page.next_cursor` from the previous page. Keeps that page's window; send the same `filter[query]`. responses: '200': description: Log rows with the effective query and window content: application/json: schema: type: object required: - data - meta - links properties: data: type: array items: type: object required: - id - type - attributes properties: id: type: string type: type: string enum: - observability_logs attributes: type: object properties: timestamp: type: string format: date-time service: type: string index: type: string severity: type: string body: type: string trace_id: type: string span_id: type: string pattern_hash: type: string attributes: type: object additionalProperties: type: string resource_attributes: type: object additionalProperties: type: string meta: type: object required: - query - window - returned - truncated - warnings - page properties: query: type: string window: $ref: '#/components/schemas/observability_window' returned: type: integer truncated: type: boolean warnings: type: array items: $ref: '#/components/schemas/observability_warning' page: type: object properties: size: type: integer next_cursor: type: string nullable: true links: type: object properties: next: type: string nullable: true '400': description: Invalid query, window or cursor content: application/json: schema: $ref: '#/components/schemas/observability_errors' '403': description: Observability is not available for the team content: application/json: schema: $ref: '#/components/schemas/observability_errors' '404': description: The role cannot read logs content: application/json: schema: $ref: '#/components/schemas/observability_errors' '429': description: Rate limit exceeded headers: Retry-After: schema: type: integer description: Seconds to wait before retrying content: application/json: schema: $ref: '#/components/schemas/observability_errors' '503': description: ClickHouse is unavailable content: application/json: schema: $ref: '#/components/schemas/observability_errors' security: - bearer_auth: [] components: schemas: observability_window: type: object required: - from - to properties: from: type: string format: date-time description: Resolved window start (UTC, inclusive) to: type: string format: date-time description: >- Resolved window end (UTC). Inclusive for logs; exclusive for patterns, whose counts cover whole minutes in [from, to) observability_warning: type: object required: - code - detail properties: code: type: string enum: - no_data - attribute_missing detail: type: string observability_errors: type: object required: - errors properties: errors: type: array items: type: object required: - status - code - title properties: status: type: string code: type: string description: >- Stable machine-readable error code, e.g. invalid_range, outside_retention, search_requires_narrower_range, invalid_cursor, invalid_query, too_expensive, invalid_parameter, observability_unavailable, insufficient_scope, unsupported_api_key, not_found, unavailable, rate_limited title: type: string source: type: object properties: parameter: type: string securitySchemes: bearer_auth: type: http scheme: bearer ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.