> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Search logs

> Paginates through `paginatedResponse`, so responses use 206 with
`Content-Range` when the page is a subset and 200 when it is not.

How far that contract holds depends on the configured log provider.
The local provider slices the full result set, so `offset` and the
total in `Content-Range` behave as expected. The CloudWatch provider
cannot express offset in an Insights query: it ignores `offset` and
reports the length of the returned page as the total. Paging past
the first page there repeats results, so treat this endpoint as
single-page unless the deployment uses the local provider.




## OpenAPI

````yaml https://raw.githubusercontent.com/InsForge/InsForge/main/openapi/logs.yaml get /api/logs/search
openapi: 3.0.3
info:
  title: Insforge Logs API
  version: 1.0.0
servers: []
security: []
paths:
  /api/logs/search:
    get:
      tags:
        - Admin
      summary: Search logs
      description: |
        Paginates through `paginatedResponse`, so responses use 206 with
        `Content-Range` when the page is a subset and 200 when it is not.

        How far that contract holds depends on the configured log provider.
        The local provider slices the full result set, so `offset` and the
        total in `Content-Range` behave as expected. The CloudWatch provider
        cannot express offset in an Insights query: it ignores `offset` and
        reports the length of the returned page as the total. Paging past
        the first page there repeats results, so treat this endpoint as
        single-page unless the deployment uses the local provider.
      parameters:
        - name: q
          in: query
          required: true
          schema:
            type: string
          description: Search query
        - name: source
          in: query
          schema:
            type: string
          description: Restrict the search to one source
        - name: limit
          in: query
          schema:
            type: integer
            default: 100
        - name: offset
          in: query
          schema:
            type: integer
            default: 0
          description: Ignored by the CloudWatch provider; see the description above
      responses:
        '200':
          description: All matching log entries were returned
          headers:
            Content-Range:
              required: true
              schema:
                type: string
            Preference-Applied:
              required: true
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/LogEntry'
        '206':
          description: A page of matching log entries, with more available
          headers:
            Content-Range:
              required: true
              schema:
                type: string
            Preference-Applied:
              required: true
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/LogEntry'
        '400':
          description: The q parameter is missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                error: INVALID_INPUT
                message: Search query parameter (q) is required
                statusCode: 400
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
      security:
        - bearerAuth: []
        - apiKey: []
components:
  schemas:
    LogEntry:
      type: object
      required:
        - id
        - eventMessage
        - timestamp
        - body
      properties:
        id:
          type: string
        eventMessage:
          type: string
        timestamp:
          type: string
        body:
          type: object
          additionalProperties: true
        source:
          type: string
    ErrorResponse:
      type: object
      required:
        - error
        - message
        - statusCode
      properties:
        error:
          type: string
          description: Error code for programmatic handling
        message:
          type: string
          description: Human-readable error message
        statusCode:
          type: integer
          description: HTTP status code
        nextActions:
          type: string
          description: Suggested action to resolve the error
  responses:
    Unauthorized:
      description: Missing or invalid admin credentials
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            error: AUTH_INVALID_CREDENTIALS
            message: Unauthorized
            statusCode: 401
    Forbidden:
      description: Authenticated, but the token is not a project_admin
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            error: AUTH_UNAUTHORIZED
            message: Admin access required
            statusCode: 403
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
    apiKey:
      type: apiKey
      in: header
      name: x-api-key

````