GET Find incidents overlapping a log window

/api/v1/logs/incidents

Returns up to 100 overlapping incidents for authorized workspace sources. limited indicates truncation. source_ids is a JSON array of at most 100 UUIDs. Marker overlap does not establish causation.

On this page

Access and permissions

Returns up to 100 overlapping incidents for authorized workspace sources. limited indicates truncation. source_ids is a JSON array of at most 100 UUIDs. Marker overlap does not establish causation.

Browser session: __Host-mb_session cookie.

Machine management credentials in Authorization: Bearer. Check the permissions (scopes) required by the operation.

Parameters and headers

Field	Location	Type and limits	Required	Meaning
workspace_id	URL query	string	Yes	Validated operation parameters
from	URL query	string; {"format":"date-time"}	Yes	Validated operation parameters
to	URL query	string; {"format":"date-time"}	Yes	Validated operation parameters
source_ids	URL query	string	No	Validated operation parameters

Request body

No request body.

Responses

Stable error codes
invalid_credential
unauthorized

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Stable error codes
csrf
insufficient_scope
invalid_origin
operator_required
forbidden

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Stable error codes
invalid_workspace
not_found

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Stable error codes
invalid_workspace
stale_check
result_conflict

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Stable error codes
invalid_config
invalid_monitor

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Stable error codes
invalid_workspace
check_capacity

Header	Type and limits	Meaning
Retry-After	string; {"pattern":"^[0-9]+$"}	Temporary server error; retry unchanged with Retry-After and the same idempotency identifier

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Stable error codes
check_location_unavailable
feature_unavailable
log_admission_busy
log_queue_full
log_storage_unavailable
unavailable
account_busy
database_lock_timeout
database_timeout
database_unavailable
database_error
request_cancelled

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Stable error codes
log_limit
request_too_large

Header	Type and limits	Meaning
Cache-Control	string; {"pattern":"(?:^\|,\\s*)no-store(?:,\|$)"}	Private API responses prohibit storage. Public OAuth metadata is cached for 300 seconds; live streams additionally prohibit transformation.
Content-Language	string; {"enum":["en","de"]}	Language of human-readable response text, resolved from Accept-Language or the documented browser preference. Technical codes and identifiers remain stable.
X-Request-ID	string	Server-generated request identifier. Include this when reporting an error; inbound values are not trusted.

application/problem+json

Field	Type and limits	Required	Meaning
$	Problem	Yes	—
$.code	string	Yes	Stable machine-readable error code
$.detail	string	Yes	Short localized explanation without internal error details
$.instance	string	Yes	Unique relative identifier /api/v1/requests/{request_id}; not a retrievable resource
$.message	string	Yes	Temporarily identical to detail for existing clients
$.message_key	string	Yes	Stable translation key for changing the displayed language without another request
$.message_params	object; {"additionalProperties":true}	Yes	Named, safely rendered message parameters; never arbitrary HTML
$.request_id	string; {"pattern":"^[0-9a-f]{32}$"}	Yes	Server-generated diagnostic identifier. It contains no login token or credential.
$.status	integer; {"maximum":599,"minimum":400}	Yes	—
$.title	string	Yes	Localized HTTP status title
$.type	string; {"const":"about:blank"}	Yes	—

Header	Type and limits	Meaning
Cache-Control	JSON; {"const":"no-store"}	—

application/json

Field	Type and limits	Required	Meaning
$	object; {"additionalProperties":false}	Yes	—
$.incidents	array<object; {"additionalProperties":false}>; {"maxItems":100}	Yes	—
$.incidents[]	object; {"additionalProperties":false}	Yes	—
$.incidents[].id	string; {"format":"uuid"}	Yes	—
$.incidents[].name	string	Yes	—
$.incidents[].opened_at	string; {"format":"date-time"}	Yes	—
$.incidents[].resolved_at	string \| null; {"format":"date-time"}	Yes	—
$.incidents[].severity	string	Yes	—
$.incidents[].historical	boolean	Yes	—
$.limited	boolean	Yes	—

Retries and asynchronous work

This operation reads or validates without applying a resource mutation. Respect rate limits and credential lifetime.

Request examples

Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.

Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.

curl --fail --silent --show-error --request GET "https://metribeacon.com/api/v1/logs/incidents?workspace_id=00000000-0000-4000-8000-000000000001&from=2026-10-20T10:00:00Z&to=2026-10-20T10:15:00Z" --header 'Cookie: __Host-mb_session=YOUR_SESSION_TOKEN; __Host-mb_csrf=YOUR_CSRF_TOKEN'

import urllib.request
request = urllib.request.Request('https://metribeacon.com/api/v1/logs/incidents?workspace_id=00000000-0000-4000-8000-000000000001&from=2026-10-20T10:00:00Z&to=2026-10-20T10:15:00Z', method='GET', headers={'Cookie': '__Host-mb_session=YOUR_SESSION_TOKEN; __Host-mb_csrf=YOUR_CSRF_TOKEN'})
with urllib.request.urlopen(request) as response:
    print(response.status)

const response = await fetch("https://metribeacon.com/api/v1/logs/incidents?workspace_id=00000000-0000-4000-8000-000000000001&from=2026-10-20T10:00:00Z&to=2026-10-20T10:15:00Z", {method:"GET", credentials:"same-origin", headers:{}});
console.log(response.status);

package main
import("fmt";"net/http")
func main(){ request,_:=http.NewRequest("GET","https://metribeacon.com/api/v1/logs/incidents?workspace_id=00000000-0000-4000-8000-000000000001&from=2026-10-20T10:00:00Z&to=2026-10-20T10:15:00Z",nil);
request.Header.Set("Cookie","__Host-mb_session=YOUR_SESSION_TOKEN; __Host-mb_csrf=YOUR_CSRF_TOKEN");
response,err:=http.DefaultClient.Do(request);if err!=nil{panic(err)};defer response.Body.Close();fmt.Println(response.StatusCode) }

HTTP API, OAuth and MCP
Find the user API endpoints, their permissions, fields, examples and response formats.
GET Read approved log policy
A source write key reads only its own enabled state and masking policy. It cannot approve new local files or commands.
POST Report log collection coverage
Report a selected log stream’s collection or delivery state. A ready status alone does not prove complete delivery; cursor checkpoints are acknowledged together with their log batches. Buffered interruptions remain pending until continuity is confirmed.
GET List log alerts
Read log rule definitions, delivery configuration and current evaluation coverage for the authorized workspace.

Access and permissions

Parameters and headers

Request body

Responses

Retries and asynchronous work

Request examples

Related guides