Query customer logs
Query persisted customer logs with filtering, pagination, and search. When data.live is present the page came from the span store: one entry is one execution seam, so sub-seam rows (step skips, sources, context notices, artifacts, state snapshots, custom events) are not listed, a start/complete pair is one row carrying a duration, runs still in progress appear once they finish, and search matches a span’s message, name, operation, tool name or error class. Otherwise each entry is one event. Requests naming audit or schedule, and an audit-entitled unfiltered read, are always served from the event tier.
Authentication
Query parameters
Start timestamp (ISO 8601). Defaults to 24 hours ago.
End timestamp (ISO 8601). Defaults to now.
Comma-separated log levels (debug,info,warn,error). An unknown value is rejected with 400.
Comma-separated categories (execution,agent,tool,model,system,error,schedule,batch,audit). An unknown value is rejected with 400.
Filter by runtime execution_id / executionSessionId (for example exec_… or otel-…), not the aex_… agent-execution row ID
Case-insensitive substring search over a span’s message, name, operation, tool name or error class; a live-tier row matches on its message.
Comma-separated statuses (running,completed,failed,queued,cancelled,unknown). An unknown value is rejected with 400. A row is unknown while its activity has not finished, else failed at level error and completed otherwise; running, queued and cancelled match no row today.
Comma-separated entry types (flow,step,tool,batch,system,agent,model,schedule,audit). An unknown value is rejected with 400. Matches the type each row is rendered with, so step selects step spans only and flow selects flow runs without their steps. Combined with category by AND.
Max results per page (default 500, max 1000)
Sort order: asc or desc
Response
The time window the query resolved to, after defaults and from/to aliases.