List Request Logs

Beta
GET/v1/core/request-logs

This endpoint is idempotent. Learn more

Returns a paginated list of API request logs, newest first.

Results cover every request where your account is either the acting account or the account that was acted upon, so requests a customer or supplier made against your data appear alongside your own. The q parameter matches a log ID exactly and otherwise searches the request path, the normalized route, and the error message.

Requests to a number of high-traffic endpoints — including these logging endpoints themselves — are recorded but withheld from this listing so they do not drown out the rest of your traffic. They can still be fetched individually by ID.

Permissions requiredValues:request_logs:read
The role behind your API key or agent must grant every one of these permissions.
cursoroptional string

Opaque cursor token identifying where the page of results starts.

Use the cursor value embedded in a previous response's next_page_url or previous_page_url to fetch the adjacent page. Omit to start from the first page.

limitoptional integer

Maximum number of results to return in a single page.

qoptional string

Free-text search term used to filter results.

Which fields are matched against the term varies by endpoint.

starts_atoptional string (date-time)

Restricts results to request logs on or after this timestamp.

ends_atoptional string (date-time)

Restricts results to request logs on or before this timestamp.

methods[]optional arrayenumValues:GETPOSTPUT

Filter by the HTTP method.

status_codes[]optional array

Filter by the HTTP status code.

status_code_classes[]optional array

Filter by the HTTP status class, expressed as the leading digit: 1–5 for 1xx–5xx.

Combined with status_codes using OR — e.g. status_codes=401 and status_code_classes=5 matches 401 responses and any 5xx response.

error_codes[]optional arrayenumValues:expired_tokenapi_key_expiredapi_key_revoked

Filter by API error code.

exclude_error_codes[]optional arrayenumValues:expired_tokenapi_key_expiredapi_key_revoked

Exclude request logs whose API error code is in this set.

Applied as a negative filter after all other filters. Successful requests (which have no error code) are always kept. The OpenMRP dashboard uses this to hide routine expired_token 401s — the noise from short-lived access tokens expiring and clients silently refreshing — while still surfacing genuine auth failures like invalid_credentials.

actor_account_ids[]optional array

Filter by the acting account: the account the actor belongs to (the log's account.id).

Results are always scoped to logs where your account is either the acting account or the target account; this narrows that set to specific acting accounts. For example, pass a customer's account ID to see only requests that customer's actors made against your account.

target_account_ids[]optional array

Filter by the target account: the account the request acted upon (the log's target account).

Results are always scoped to logs where your account is either the acting account or the target account; this narrows that set to specific target accounts. For example, pass a supplier's account ID to see only requests your account made against that supplier.

actor_ids[]optional array

Filter by the actor identifier.

Matches the log's actor.id: a user ID for user actors, an API key ID for api_key actors, or an agent ID for agent actors.

actor_types[]optional arrayenumValues:userapi_keyagent

Filter by the actor type.

Requests are recorded for actors of type user, api_key, and agent — the last covering calls an OpenMRP agent made on your account's behalf.

normalized_routes[]optional array

Filter by the normalized route template.

For example /v1/sales/customers/{id} matches every request to that route regardless of the specific customer ID. Parameter names inside {} are ignored when matching, so {customer_id} and {id} are equivalent.

hosts[]optional array

Filter by the request host.

Typically api.openmrp.ai.

min_latency_usoptional integer

Restricts results to requests that took at least this many microseconds.

idempotency_keyoptional string

Filter by the user-provided idempotency key.

include[]optional arrayenumValues:accountactoractor.role

Sub-objects to expand in the response. When omitted, sub-objects are returned as null.

objectstringenumValues:list

Resource type identifier.

page_infoobject

Pagination metadata.

next_page_urlstringnullable

Relative URL that fetches the next page of results.

previous_page_urlstringnullable

Relative URL that fetches the previous page of results.

has_next_pageboolean

Whether more results exist after this page.

has_prev_pageboolean

Whether results exist before this page.

dataarray of request_log

Resources in this page.

idstring

Request log ID.

objectstringenumValues:request_log

Resource type identifier.

methodstringenumValues:GETPOSTPUT

HTTP method.

hoststring

Request host.

Usually api.openmrp.ai.

pathstring

The exact path the request was made to, including path parameter values.

normalized_routestring

The route template the request matched, with path parameters left as placeholders.

For example /v1/sales/customers/{id} is the normalized route for the request path /v1/sales/customers/ac_.... Falls back to the raw path when the request did not match a registered route.

query_paramsobjectnullable

Query-string parameters the request was made with, as a JSON object.

Encoded as a JSON value (object, array, string, number, boolean, or null), not a JSON-encoded string.

status_codeinteger

HTTP response status code (e.g. 200, 404).

latency_usinteger

Request latency in microseconds.

Measured at the API edge, from the moment the request was received until the response was written, so it excludes network time between your client and OpenMRP.

api_versionstringnullable

The API version the request was served with.

Taken from the OpenMRP-Version header the caller sent; requests rejected for omitting that header record no version.

client_ipstringnullable

Client IP address the request came from.

Not recorded for requests an OpenMRP agent made on your behalf, since those originate inside OpenMRP's own network.

user_agentstringnullable

User agent.

referrerstringnullable

Referrer header.

error_codestringnullableenumValues:expired_tokenapi_key_expiredapi_key_revoked

Machine-readable API error code.

Matches the code of the error response the caller received. Populated only for failed requests.

error_messagestringnullable

Human-readable error message.

The same message the caller received. Populated only for failed requests.

occurred_atstring (date-time)

When the request was received.

Request logs are ordered and date-filtered by this timestamp rather than by created_at.

created_atstring (date-time)

When the log entry was written.

accountaccountExpandablenullable

Account targeted by the request: the account the request acted upon.

Results are scoped to logs where your account is either the acting account or the target account. Use the target_account_ids query parameter to filter by which account was acted upon, and actor_account_ids to filter by who acted.

idstring

Account ID.

objectstringenumValues:account

Resource type identifier.

namestring

The account's display name.

default_billing_addressaddressnullable

The address billed by default on orders for this account.

Always returned as null in this endpoint.
default_shipping_addressaddressnullable

The address shipped to by default on orders for this account.

Always returned as null in this endpoint.
brandingaccount_brandingnullable

Customer-facing branding for the account, such as the logo, support contacts, and social links.

Always returned as null in this endpoint.
portalaccount_portalnullable

The account's customer portal settings, including the portal URL slug.

Always returned as null in this endpoint.
created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

actoractorExpandablenullable

Actor who made the request.

idstring

Unique identifier of the actor.

objectstringenumValues:actor

Resource type identifier.

typestringenumValues:userapi_keyagent

Actor type.

  • user: a human user account.
  • api_key: a programmatic caller authenticating with an API key.
  • agent: an automated agent acting on the account's behalf.
  • group: a shared group identity, such as a "Customer Service" persona, rather than a single individual.
namestringnullable

The actor's display name.

handlestringnullable

Human-readable handle identifying the actor.

  • For user actors: the user's email address.
  • For api_key actors: the redacted key value.

Other actor types carry no handle.

avatar_urlstringnullable

URL of the actor's profile photo, if one is set.

Only populated for user actors.

roleroleExpandablenullable

The role the actor holds in the account, which determines what it is permitted to do.

idstring

Role ID.

objectstringenumValues:role

Resource type identifier.

namestring

Display name of the role.

Unique within the account.

typestringenumValues:adminuserscanner

The kind of role.

The type gates behavior that individual permissions do not cover, and some actions are reserved for a single role type.

  • admin: full administrative access. Sensitive areas such as API keys, billing, and third-party integrations are restricted to admins no matter what permissions another role holds.
  • user: a custom role tailored to a specific need, with its permissions defined explicitly. Roles created through the API always have this type.
  • scanner: the role used by shop-floor scanning stations, assigned automatically when a scanning-station user is created.
  • sales_rep: a role for sales representatives. Order analytics are scoped to the rep's own orders.
  • agent: a role assigned to an automated agent rather than a person.
ownerownernullable

Provenance of this role.

System-owned roles are platform-provided defaults shared across all accounts and cannot be updated or deleted; account-owned roles are custom to your account.

Always returned as null in this endpoint.
permissionsarray of stringnullable

Permissions granted by this role, in {permission}:{action} format, such as customers:read.

created_atstring (date-time)

Creation timestamp.

updated_atstring (date-time)

Last updated timestamp.

idempotency_keystringnullable

User-provided idempotency key.

request_bodyobjectnullable

The JSON body the request was sent with.

Sensitive values such as passwords, tokens, and secrets are redacted before the body is stored. Bodies larger than 256 KB are not stored in full; a small marker object with _truncated set to true is stored in their place.

Encoded as a JSON value (object, array, string, number, boolean, or null), not a JSON-encoded string.

response_bodyobjectnullable

The JSON body OpenMRP responded with.

Sensitive values such as generated API key secrets are redacted before the body is stored. Bodies larger than 256 KB are not stored in full; a small marker object with _truncated set to true is stored in their place.

Encoded as a JSON value (object, array, string, number, boolean, or null), not a JSON-encoded string.

Responses

200

Successful response for List Request Logs