Logs, audit activity, alerts, and platform events

Access/firewall logs, audit records, alerts, login events, platform activity, and log-delivery status. Required resource or feature: Resource logging and access to the relevant namespace or tenant.

Metric families and dimensions

Select the resource, namespace or tenant scope, time window, and query expression supported by the endpoint. Named aggregations summarize matching records; paginated records require the documented cursor or scroll contract. See HTTP access logs and Security events for measured queries.

Use Query concepts for shared request guidance and table conventions.

Statistics and analytics queries

Method and exact path	Information returned	Scope and principal filters	Specification reference
GET /api/data/namespaces/system/all_ns_alerts	Alerts; returns data	Tenant; system only; inactive, silenced, inhibited, unprocessed, filter	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/access_logs	Access Log Query V2; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; aggs, end_time, limit, query, scroll, search_after, sort, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/access_logs/aggregation	Access Log Aggregation Query; returns aggs, total_hits	Selected namespace; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/access_logs/scroll	Access Log Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/access_logs/scroll	Access Log Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/alerts	Alerts; returns data	Selected namespace; inactive, silenced, inhibited, unprocessed, filter	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/alerts/history	Alerts History; returns alerts, scroll_id, total_hits	Selected namespace; filter, start_time, end_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/alerts/history/aggregation	Alerts History Aggregation; returns aggs, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, filter, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/alerts/history/scroll	Alerts History Scroll; returns alerts, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/alerts/history/scroll	Alerts History Scroll; returns alerts, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/audit_logs	Audit Log Query V2; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, limit, query, scroll, search_after, sort, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/audit_logs/aggregation	Audit Log Aggregation Query; returns aggs, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/audit_logs/scroll	Audit Log Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/audit_logs/scroll	Audit Log Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/firewall_logs	Firewall Logs Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; aggs, end_time, limit, query, scroll, search_after, sort, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/firewall_logs/aggregation	Firewall Logs Aggregation Query; returns aggs, total_hits	Selected namespace; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/firewall_logs/scroll	Firewall Logs Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/firewall_logs/scroll	Firewall Logs Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/global_log_receiver/status	Global Log Receiver Status; returns glr_status, step	Selected namespace; end_time, group_by, label_filter, start_time, step	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/platform_events	Platform event Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, include_config_changes, limit, query, scroll, search_after, sort, sort_values, start_time	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/platform_events/aggregation	Platform event Aggregation Query; returns aggs, total_hits	Selected namespace; system can query across namespaces; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/data/namespaces/{namespace}/platform_events/scroll	Platform event Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/data/namespaces/{namespace}/platform_events/scroll	Platform event Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
GET /api/operate/namespaces/{namespace}/sites/{site}/vpm/debug/{node}/exec-log	Exec Log; returns exec_log	Selected namespace; site, node, line_count	Operation · Request schema · Response schema
GET /api/operate/namespaces/{namespace}/sites/{site}/vpm/debug/{node}/{service}/log	Log; returns log	Selected namespace; site, node, service, last_lines	Operation · Request schema · Response schema
POST /api/secret_management/namespaces/{namespace}/voltshare/access_count	VoltShare Access Count Query; returns data, step	Selected namespace; end_time, group_by, label_filter, start_time, step	Operation · Request schema · Response schema
POST /api/secret_management/namespaces/{namespace}/voltshare/audit_logs	Audit Log Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; aggs, end_time, limit, query, scroll, search_after, sort, sort_values, start_time	Operation · Request schema · Response schema
POST /api/secret_management/namespaces/{namespace}/voltshare/audit_logs/aggregation	Audit Log Aggregation Query; returns aggs, total_hits	Selected namespace; aggs, end_time, query, start_time	Operation · Request schema · Response schema
GET /api/secret_management/namespaces/{namespace}/voltshare/audit_logs/scroll	Audit Log Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
POST /api/secret_management/namespaces/{namespace}/voltshare/audit_logs/scroll	Audit Log Scroll Query; returns aggs, last_sort_values, logs, scroll_id, total_hits	Selected namespace; scroll_id	Operation · Request schema · Response schema
GET /api/web/namespaces/system/tenant/idm/events/last_login	GetLastLoginMap; returns last_login_map	Tenant; system only; No additional selector	Operation · Request schema · Response schema
GET /api/web/namespaces/system/tenant/idm/events/login	GetLoginEvents; returns login_events_map	Tenant; system only; first, max	Operation · Request schema · Response schema
POST /api/web/namespaces/system/tenant/idm/events/login_in_time	GetLoginEventsInTimeFrame; returns login_events_map	Tenant; system only; end, first, max, start	Operation · Request schema · Response schema
GET /api/web/namespaces/system/tenant/idm/users/inactive	ListInactiveUsers; returns users	Tenant; system only; No additional selector	Operation · Request schema · Response schema

Related discovery and status

Method and exact path	Information returned	Scope and principal filters	Specification reference
POST /api/alert/namespaces/{namespace}/alert_policy/match	Alert Policy Match; returns alert_match	Selected namespace; labels	Operation · Request schema · Response schema

Existing reports and artifacts

Method and exact path	Information returned	Scope and principal filters	Specification reference
POST /api/report/namespaces/{namespace}/report_configs/list-reports-history	Reports History; returns items, reports, reports_list	Selected namespace; include_all, report_config_names	Operation · Request schema · Response schema
GET /api/report/namespaces/{namespace}/reports/{name}	Report; returns deleted_referred_objects, disabled_referred_objects, metadata, referring_objects, spec	Selected namespace; name, response_format	Operation · Request schema · Response schema
GET /api/report/namespaces/{namespace}/reports/{name}/download	Download Report; returns Attachments, css_data, html_data	Selected namespace; name	Operation · Request schema · Response schema