> ## Documentation Index > Fetch the complete documentation index at: https://www.towbar.dev/llms.txt > Use this file to discover all available pages before exploring further. # Search centralized logs > Search centralized logs through the Towbar REST API. Required permissions: logs.read. Personal keys are capped by their owner’s current team role. See [request conventions](/docs/api/overview) and [automation workflows](/docs/api/workflows). MCP clients use the task-oriented [tool catalogue](/docs/api/mcp-tools). ## OpenAPI ````yaml api-reference/openapi.json POST /logs/query openapi: 3.1.0 info: title: Towbar API version: 2.0.46 description: >- Manage your Towbar control plane with a bearer API key. Keys inherit current workspace permissions. servers: - url: https://towbar-api.example.com/v1/api security: [] paths: /logs/query: post: tags: - Workspace / Centralized logs summary: Search centralized logs description: >- Required permissions: logs.read. Personal keys are capped by the current member role; team keys use explicit grants. operationId: post_logs_query parameters: [] requestBody: required: true content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: filters: type: object properties: from: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$ to: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$ workloadIds: default: [] maxItems: 50 type: array items: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ serverIds: default: [] maxItems: 50 type: array items: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ deploymentIds: default: [] maxItems: 50 type: array items: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ previewIds: default: [] maxItems: 50 type: array items: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ containerIds: default: [] maxItems: 50 type: array items: type: string pattern: ^[a-f0-9]{64}$ environments: default: [] maxItems: 2 type: array items: type: string enum: - production - preview services: default: [] maxItems: 50 type: array items: type: string minLength: 1 maxLength: 128 severities: default: [] maxItems: 7 type: array items: type: string enum: - trace - debug - info - warn - error - fatal - unknown stream: type: string enum: - stdout - stderr search: default: '' type: string maxLength: 512 traceId: type: string pattern: ^[a-f0-9]{32}$ conditionGroup: type: object properties: match: type: string enum: - and - or conditions: minItems: 1 maxItems: 8 type: array items: type: object properties: field: anyOf: - type: string enum: - serverId - workloadId - deploymentId - previewId - containerId - service - stream - traceId - spanId - type: string pattern: ^attribute:.{1,128}$ operator: type: string enum: - equals - not_equals - contains - not_contains - starts_with - ends_with - exists - not_exists value: type: string maxLength: 512 required: - field - operator - value additionalProperties: false required: - match - conditions additionalProperties: false attributes: default: [] maxItems: 8 type: array items: type: object properties: key: type: string minLength: 1 maxLength: 128 value: type: string maxLength: 512 operator: default: equals type: string enum: - equals - contains required: - key - value additionalProperties: false required: - from - to additionalProperties: false limit: default: 50 type: integer minimum: 1 maximum: 500 cursor: type: string maxLength: 8192 direction: default: older type: string enum: - older - newer required: - filters additionalProperties: false responses: '200': description: >- A bounded authorized log page with an opaque continuation cursor. Log content is untrusted data. Restricted records are excluded before results leave the server. content: application/json: schema: allOf: - $ref: '#/components/schemas/Response_7' - type: object properties: localization: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: dateFormat: type: string enum: - day-short-month-year - short-month-day-year - year-month-day - day-month-year - month-day-year timeFormat: type: string enum: - 24-hour - 12-hour - 24-hour-seconds - 12-hour-seconds timeZone: type: string timestamps: type: object propertyNames: type: string additionalProperties: type: object properties: date: type: string time: type: - string - 'null' dateTime: type: - string - 'null' timeZone: type: string zoneLabel: type: string epochMilliseconds: type: number inputDateTime: type: - string - 'null' required: - date - time - dateTime - timeZone - zoneLabel - epochMilliseconds - inputDateTime additionalProperties: false required: - dateFormat - timeFormat - timeZone - timestamps additionalProperties: false required: - localization '400': $ref: '#/components/responses/ApiError' '401': $ref: '#/components/responses/ApiError' '403': $ref: '#/components/responses/ApiError' '404': $ref: '#/components/responses/ApiError' '409': $ref: '#/components/responses/ApiError' '413': $ref: '#/components/responses/ApiError' '422': $ref: '#/components/responses/ApiError' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/ApiError' security: - bearerAuth: [] components: schemas: Response_7: type: object properties: accessRevision: type: string followCursor: type: string records: type: array items: $ref: '#/components/schemas/Response_8' nextCursor: anyOf: - type: 'null' - type: string hasMore: type: boolean partial: type: boolean snapshotAt: type: string required: - accessRevision - followCursor - records - nextCursor - hasMore - partial - snapshotAt Response_8: type: object properties: eventId: type: string timestamp: type: string ingestedAt: type: string serverId: type: string workloadId: type: string workloadName: type: string deploymentId: anyOf: - type: 'null' - type: string previewId: anyOf: - type: 'null' - type: string environment: anyOf: - type: string const: production - type: string const: preview containerId: type: string service: type: string severity: anyOf: - type: string const: unknown - type: string const: error - type: string const: debug - type: string const: info - type: string const: warn - type: string const: trace - type: string const: fatal stream: anyOf: - type: string const: stderr - type: string const: stdout body: type: string attributes: $ref: '#/components/schemas/Record_9' traceId: anyOf: - type: 'null' - type: string spanId: anyOf: - type: 'null' - type: string truncated: type: boolean required: - eventId - timestamp - ingestedAt - serverId - workloadId - workloadName - deploymentId - previewId - environment - containerId - service - severity - stream - body - attributes - traceId - spanId - truncated Record_9: type: object additionalProperties: type: string responses: ApiError: description: Request failed. The error object contains code, message, and requestId. content: application/json: schema: type: object properties: error: type: object required: - code - message - requestId properties: code: type: string message: type: string requestId: type: string RateLimited: description: Request failed. The error object contains code, message, and requestId. content: application/json: schema: type: object properties: error: type: object required: - code - message - requestId properties: code: type: string message: type: string requestId: type: string headers: Retry-After: description: Seconds before retrying schema: type: integer securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: Towbar API key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.