API Endpoint Overview

Download PDF

Map of common LogZilla API endpoints for auth, users, dashboards, widgets, triggers, and queries, sourced from lib/logzilla/api/urls.py

API Endpoint Overview

A practical map of commonly used API endpoints, sourced from lib/logzilla/api/urls.py. For full request/response schemas, filters, and examples, use the interactive docs at /api/docs.

  • Auth and session

    • GET/POST/DELETE /api/auth --- session info, login, logout
    • POST /api/reset-password
    • GET /api/ping

  • Users and access control

    • GET/POST /api/users (and /{id})
    • GET /api/groups
    • POST /api/groups
    • GET /api/groups/{id}
    • PUT /api/groups/{id}
    • PATCH /api/groups/{id}
    • DELETE /api/groups/{id}
    • GET /api/permissions

  • Dashboards and widgets

    • GET /api/dashboards
    • POST /api/dashboards
    • GET /api/dashboards/{id}
    • PUT /api/dashboards/{id}
    • PATCH /api/dashboards/{id}
    • DELETE /api/dashboards/{id}
    • POST /api/dashboards/{id}/{report|templates|widgets}
    • DELETE /api/dashboards/{id}/widgets/
    • GET /api/widgets
    • POST /api/widgets
    • GET /api/widgets/{id}
    • PUT /api/widgets/{id}
    • PATCH /api/widgets/{id}
    • DELETE /api/widgets/{id}
    • POST /api/widgets/{id}/report
    • GET /api/widget-types
    • GET /api/widget-presets

  • Events

    • GET /api/events/{ev_id}
    • GET /api/events/{ev_id}/timestamps
    • GET /api/events/{ev_id}/triggers
    • GET /api/events/{ev_id}/ai
    • POST /api/events/{ev_id}/forward

  • Triggers

    • GET /api/triggers
    • POST /api/triggers
    • GET /api/triggers/{id}
    • PUT /api/triggers/{id}
    • PATCH /api/triggers/{id}
    • DELETE /api/triggers/{id}
    • GET /api/triggers/{id}/history
    • POST /api/triggers-validator --- validate filters

  • Notifications

    • GET /api/notification-groups

  • Queries (generic)

    • POST /api/query --- create
    • GET /api/query/{qid} --- results (with paging for Search)
    • GET /api/query/{qid}/{export|recalculate|remove|stop}
    • POST /api/query/{qid}/stop
    • GET /api/query-types --- available query types
    • WebSocket: /ws/live-updates (see Making Queries)

  • Queries (typed)

    • POST /api/queries/search
    • GET /api/queries/search/{qid}
    • GET /api/queries/search/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/search/{qid}/stop
    • POST /api/queries/lastn
    • GET /api/queries/lastn/{qid}
    • GET /api/queries/lastn/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/lastn/{qid}/stop
    • POST /api/queries/topn
    • GET /api/queries/topn/{qid}
    • GET /api/queries/topn/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/topn/{qid}/stop
    • POST /api/queries/eventrate
    • GET /api/queries/eventrate/{qid}
    • GET /api/queries/eventrate/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/eventrate/{qid}/stop
    • POST /api/queries/processingstats
    • GET /api/queries/processingstats/{qid}
    • GET /api/queries/processingstats/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/processingstats/{qid}/stop
    • POST /api/queries/storagestats
    • GET /api/queries/storagestats/{qid}
    • GET /api/queries/storagestats/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/storagestats/{qid}/stop
    • POST /api/queries/system_cpu
    • GET /api/queries/system_cpu/{qid}
    • GET /api/queries/system_cpu/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/system_cpu/{qid}/stop
    • POST /api/queries/system_df
    • GET /api/queries/system_df/{qid}
    • GET /api/queries/system_df/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/system_df/{qid}/stop
    • POST /api/queries/system_iops
    • GET /api/queries/system_iops/{qid}
    • GET /api/queries/system_iops/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/system_iops/{qid}/stop
    • POST /api/queries/system_memory
    • GET /api/queries/system_memory/{qid}
    • GET /api/queries/system_memory/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/system_memory/{qid}/stop
    • POST /api/queries/system_network
    • GET /api/queries/system_network/{qid}
    • GET /api/queries/system_network/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/system_network/{qid}/stop
    • POST /api/queries/system_networkerrors
    • GET /api/queries/system_networkerrors/{qid}
    • GET /api/queries/system_networkerrors/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/system_networkerrors/{qid}/stop
    • POST /api/queries/systemstatus
    • GET /api/queries/systemstatus/{qid}
    • GET /api/queries/systemstatus/{qid}/{export|recalculate|remove|stop}
    • POST /api/queries/systemstatus/{qid}/stop

  • Reports

    • GET /api/report-presets
    • GET /api/reports
    • GET /api/reports/{id} (report metadata)
    • DELETE /api/reports/{id}
    • GET /api/reports/{id}/export
    • GET /api/reports-templates
    • POST /api/reports-templates
    • GET /api/reports-templates/{id}
    • PUT /api/reports-templates/{id}
    • PATCH /api/reports-templates/{id}
    • DELETE /api/reports-templates/{id}
    • POST /api/reports-templates/{id}/generate
    • GET /api/reports-schedules
    • POST /api/reports-schedules
    • GET /api/reports-schedules/{id}
    • PUT /api/reports-schedules/{id}
    • PATCH /api/reports-schedules/{id}
    • DELETE /api/reports-schedules/{id}
    • GET /api/reports-schedules/{id}/reports

  • Settings and system

    • GET /api/license/info (GET /api/license-info is a deprecated alias)
    • GET/POST /api/settings (and extra configs)
    • PATCH /api/settings/{group} --- save a group's values as {"values": {...}}. The watcher applies the change for most groups; the module groups listed under Server Settings take effect only after a container restart. Enabling Event Correlation is PATCH /api/settings/sec with {"values": {"SEC_ENABLED": true}}; enabling the forwarder is PATCH /api/settings/forwarder with {"values": {"FORWARDER_ENABLED": true}}. The watcher starts or stops the SEC and forwarder module containers from those two flags. The forwarder group is addressed by name; it is not in the GET /api/settings list
    • GET/POST /api/settings/ai/models (models offered by the AI provider; POST lists for unsaved provider, key, and base URL values)
    • POST /api/settings-update-publish
    • GET/POST /api/customer-info
    • GET /api/monitor

  • Archives

    • GET /api/archives
    • POST /api/archives
    • GET /api/archives/{chunk_ts}
    • POST /api/archives/migrate
    • DELETE /api/archives/range
    • POST /api/archives/remove (range)
    • GET /api/archive-restore-logs

  • Forwarder

    • GET /api/forwarder-counters
    • POST /api/forwarder/reload --- reload the forwarder configuration and wait for the module's reply (timeout query parameter, 1 to 30 s, default 10); 200 reports the number of enabled forwarders, and 500 means the new configuration was refused, with the reason in detail (the file name when a file could not be loaded or a forwarder failed validation) and the previous configuration still active

  • Script Server (trigger scripts)

    • POST /api/scripts/reload --- make the Script Server pick up new, changed, and removed scripts; workers are replaced one at a time
    • POST /api/scripts/run --- run one installed script with a supplied event and return its stdout, stderr, and return code (timeout query parameter, 1 to 30 s, default 30); a non-zero return code is a failing script, not a failing request
    • GET /api/dictionaries/script --- the scripts the Script Server currently serves

  • Event Correlation (SEC instances; Manage Settings permission)

    • GET /api/sec --- the instances the Simple Event Correlator (SEC) server runs, each with its process state: pid, running, and returncode (pattern substring filter)
    • POST /api/sec/reload --- reload every instance from /etc/logzilla/sec and return the resulting list (force_reload and timeout query parameters): a directory added since the SEC server started is started, an instance whose files changed is restarted, an instance whose process has ended is restarted even when its files are unchanged, and an instance whose directory is gone is dropped, so to remove an instance, delete its directory and reload; an instance whose config.yaml is invalid is reported with 422 and nothing is reloaded
    • GET /api/sec/{name} --- one instance with its process state and, unless debug_dump=false or memory_info=false, its rule statistics dump and memory use; the dump is requested only once the SEC process has installed its signal handler, so a fresh instance is never terminated by the read, and it is null when the instance is not running or did not write it within 5 s
    • POST /api/sec/{name}/events --- write test lines to one instance as {"lines": [...]}; matching rules run their actions
    • All four answer 423 while Event Correlation is disabled or not licensed (PATCH /api/settings/sec enables it)

  • Artifacts (orchestration files)

    • GET /api/artifacts --- the three roots: sec, forwarder, scripts
    • GET /api/artifacts/{path} --- list a directory (pattern glob on names) or read a file with its sha256; a path is a root, a directory (sec/<instance>, scripts/<group>), or a file (sec/<instance>/<rule>.sec, forwarder/<name>.yaml or .json, scripts/<group>/<name>)
    • PUT /api/artifacts/{path} --- create or overwrite one file from {"content": "..."} (at most 1 MiB of text); the content is validated first (forwarder YAML through the forwarder's rule models, scripts need a #! line) and a rejected write leaves the previous file untouched; scripts are written mode 0700, other files 0600; no reload is triggered (use POST /api/scripts/reload, POST /api/forwarder/reload, and POST /api/sec/reload above)
    • DELETE /api/artifacts/{path} --- remove a file, or a whole SEC instance directory (sec/<instance>)
    • All four require the Manage Artifacts permission or an admin account; a trigger script runs as root inside the Script Server container, so grant the permission to the orchestration account only

  • Lookup tools

    • GET /api/lookup/{dns|whois|mac|cisco-mnemonic|geoip|mswin-eventid|mitre-id}/{pk}

  • Terminals (test utilities)

    • POST /api/terminals --- create ephemeral shell session

  • Mailer and LDAP tester

    • POST /api/mailer
    • POST /api/ldap-tester

  • App store

    • GET /api/apps --- available apps
    • GET /api/installed-apps

  • Misc

    • GET /api/async-results
    • GET /api/docs, GET /api/schema

Notes:

  • All endpoints require a valid user token in Authorization: token <TOKEN> unless explicitly marked public. See Getting Started for token usage.
  • The HTTP Receiver (ingestion) is separate and documented under Receiving Data; its interactive docs are typically at /incoming/docs.
API Endpoint Overview | LogZilla Documentation