API reference

Base URL, authentication, conventions, and every endpoint Logstreem exposes.

One REST API over HTTPS. JSON in, JSON out, bearer tokens. Everything the console and the CLI do goes through these endpoints — there is no privileged internal API.

Base URL

https://api.logstreem.com/v1

Authentication

Every request carries a token in the Authorization header. Tokens are created in the dashboard or via POST /v1/tokens, and are scoped to actions and datasets — see tokens.

cURL

curl https://api.logstreem.com/v1/datasets \
  -H "Authorization: Bearer lstrm_live_9f2c…"

Prefix	Reaches	Billed
`lstrm_test_`	The documentation sandbox	No
`lstrm_live_`	Your organisation's data	Yes

Resources

Datasets

Create, inspect, trim and delete.

Ingest

Send events as JSON, NDJSON or OTLP.

Query

Run LSQL and stream results.

Tokens

Issue, scope and revoke.

Monitors

Alerting rules and their history.

Notifiers

Where alerts go.

Annotations

Mark deploys and incidents on charts.

Dashboards

Read and write dashboards as data.

Conventions

Ids are prefixed and opaque: ds_, mon_, ntf_, tok_, dsh_, ann_. Never parse them.
List endpoints return { object: "list", data, has_more, next_cursor } — see pagination.
Timestamps are RFC 3339 in UTC, always with a Z.
Unknown request fields are rejected with 400, not ignored — a typo fails loudly.
Every response carries X-Request-Id, and every error repeats it in the body.

Try it calls a sandbox

The panels on these pages hit simulated endpoints on this site. The query endpoint genuinely evaluates LSQL; the rest return fixtures. See Sandbox.

PreviousEmail NextIngest events