Skip to main content
Everything you can do in the dashboard, you can do through the API. It is the same API the dashboard uses, so there is no second-class surface and nothing that only the interface can reach.
The endpoint pages beneath this one are generated from the route table, so the paths, methods and response shapes on them are the ones the service registers.Two rules are enforced by middleware rather than declared per operation, so they do not appear in those parameter tables. Both are on this page, and both will otherwise look like an unexplained error: tenantId is required, and APM endpoints need a project scope.

​
Authenticate

Two credentials, and using the wrong one is the most common first error.
A license key does not work on the API. It authenticates ingest only. A request to /api/logs carrying X-License-Key is unauthenticated and returns 401.The reverse is also true — a session token will not ingest telemetry. See Authentication.
Browser clients use an HttpOnly cookie set at sign-in; programmatic clients use a bearer token. Both resolve to the same session.

​
Two URL grammars

The same handlers answer under two prefixes, and both are current:
There is no bare /accounts/… API. /accounts/{accountId}/… is the dashboard’s address bar, not an API path. The API equivalent always carries the /v1 prefix.

​
Your organization is a parameter, and it must agree with your session

Most endpoints require a tenantId — in the query string, in the path, or in the body. It is never authoritative: the value that scopes the query is the one on your session, and the one you send is only checked for contradiction.
Omitting it returns 401 Missing tenantId. It is not optional on the tenant-scoped routes, which is nearly all of them. The exception is the Prometheus-compatible surface under /api/v1/…, which Grafana drives and which cannot send one — those routes accept its absence.
Naming an organization other than your own returns 403, not your own data. The failure is visible rather than silently corrected — so a bug in your client surfaces immediately instead of producing plausible results from the wrong place. The contradiction is looked for in the query string, the path and the body, so echoing a whole object back does not slip past it.

​
APM endpoints are project-scoped

Services, endpoints, traces, dependencies and the service map answer for one project, and the scope has to be stated:
  • ?projectId=<id> — that project only.
  • ?scope=account — the whole account.
Neither one returns 400 PROJECT_SCOPE_REQUIRED. An account-wide read is legitimate and has to be asked for by name, because the alternative — treating a missing scope as “everything” — renders one project’s page with the whole account’s numbers on it and reports no error. An unknown or foreign projectId returns 404.The scope is a query parameter. There is no :projectId path segment on the API.

​
Errors

Every non-2xx response uses one shape:
Branch on error, never on message. The error code is stable and is part of the contract. The message is written for a human and may be reworded at any time.
The ones you will meet:
A 403 for a role and a 403 for a plan are different problems with different fixes. One is answered by an Admin in your organization; the other by your account contact. The error code distinguishes them.

​
Roles

Read endpoints need Viewer. Creating and editing product configuration needs Editor. Users, license keys and billing need Admin. The audit log needs Auditor, Admin or Owner. The full model, including why Auditor is not a rung on the ladder, is on Roles and permissions.

​
Working with the API

Logs, metrics, traces and services are all queryable, with the same time ranges and filters the product uses. Results are cached briefly, so two identical requests in quick succession may return the same response — see Platform architecture.
Alert rules, dashboards, SLOs, synthetic checks and notification channels can all be created and updated programmatically — which is what makes it practical to keep them in version control and apply them per environment.Synthetic checks additionally import and export as YAML.
A subset of the Prometheus HTTP API, so Grafana can read aiAxonIQ as a datasource with no adapter. Read the limits before relying on it — rate functions parse and return an average. See Grafana and Prometheus clients.
Ingest volume against plan allowances, for your own dashboards or a monthly report. Cached for five minutes.

​
One endpoint in this reference is not reachable yet

GET /search/logs — the fuzzy full-text log search — is served outside the /api/ prefix, and the reverse proxy in front of every deployment does not route that prefix. A request to it reaches the dashboard and returns HTML with a 200, which is the most confusing possible failure. It is listed under Endpoints because it is registered in the service; treat it as not available until the path is routed, and use GET /api/logs with a search= expression instead. See Searching logs.

​
Live tail is a WebSocket, and is not in the endpoint list

GET /ws/live-tail streams telemetry as it arrives. It is a WebSocket upgrade, so an OpenAPI document cannot describe it without describing it wrongly — as a GET that returns a JSON body, which is a handshake no client should perform. It is deliberately absent from the Endpoints pages and documented on Live tail instead. It carries the same session and the same tenantId rule as every other tenant-scoped route.

​
What the Endpoints pages leave out

The reference is generated from the route table of the service that answers, so an endpoint’s presence means it is served. Four things are withheld on purpose:
  • The staff console and the sandbox control plane. Internal surfaces, not part of the product you are integrating with.
  • The SSO endpoints. SAML is not served — three of the five routes answer 501 — so publishing them would document a door with no handle.
  • The impersonation redemption and the billing webhook. Both are real and neither is called by a customer: one is reached only from a staff-issued link, the other only by the payment provider.
  • Billing checkout, portal and invoice endpoints. Not enabled on this deployment. They are not listed because a listed endpoint that returns 404 is worse than an absent one.

​
Sending telemetry

Ingest is a different surface with different rules — a license key rather than a session, its own status codes and its own limits. It is documented under Ingest endpoints rather than here.

​
Next

Authentication

The two credentials and which to use where.

Roles and permissions

What each role can reach.

Ingest endpoints

The other half of the surface.