# Seq Server API — Complete Endpoint Reference

This file lists every API endpoint provided by the Seq server, organized by resource group.

## Table of Contents

1. [api (root)](#api-root)
2. [alerts](#alerts)
3. [alertstate](#alertstate)
4. [apikeys](#apikeys)
5. [appinstances](#appinstances)
6. [apps](#apps)
7. [backups](#backups)
8. [cluster](#cluster)
9. [dashboards](#dashboards)
10. [data (queries)](#data-queries)
11. [deferred](#deferred)
12. [diagnostics](#diagnostics)
13. [events](#events)
14. [expressionindexes](#expressionindexes)
15. [expressions](#expressions)
16. [feeds](#feeds)
17. [indexes](#indexes)
18. [licenses](#licenses)
19. [permalinks](#permalinks)
20. [retentionpolicies](#retentionpolicies)
21. [roles](#roles)
22. [runningtasks](#runningtasks)
23. [settings](#settings)
24. [signals](#signals)
25. [sqlqueries](#sqlqueries)
26. [updates](#updates)
27. [users](#users)
28. [workspaces](#workspaces)
29. [health](#health)
30. [ingestion](#ingestion)
31. [other](#other)

---

## api (root)

| Path | Method | Permission |
|------|--------|------------|
| `api` | GET | Public |

Returns the root resource with links to all API resource groups.

---

## alerts

Manage alert definitions. Users can only access shared alerts and their own. Protected alerts require `Project` permission.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/alerts` | GET | Read | Shared + own only |
| `api/alerts` | POST | Write | Project for protected |
| `api/alerts/{id}` | GET | Read | Shared + own only |
| `api/alerts/{id}` | PUT | Write | Project for protected |
| `api/alerts/{id}` | DELETE | Write | Project for protected |
| `api/alerts/resources` | GET | Public | |
| `api/alerts/template` | GET | Write | |

---

## alertstate

| Path | Method | Permission |
|------|--------|------------|
| `api/alertstate` | GET | Project |
| `api/alertstate/{id}` | GET | Project |
| `api/alertstate/{id}` | DELETE | Project |
| `api/alertstate/resources` | GET | Public |

---

## apikeys

Manage API keys. Non-Project principals can only view/manage their own keys.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/apikeys` | GET | Read | Project sees all; others own only |
| `api/apikeys` | POST | Write | Can only delegate own permissions |
| `api/apikeys/{id}` | GET | Read | Project sees all; others own only |
| `api/apikeys/{id}` | PUT | Write | Can only delegate own permissions |
| `api/apikeys/{id}` | DELETE | Write | Project removes any; others own only |
| `api/apikeys/{id}/metrics/{measurement}` | GET | Read | Own or Project |
| `api/apikeys/metrics/{measurement}` | GET | Project | |
| `api/apikeys/resources` | GET | Public | |
| `api/apikeys/template` | GET | Read | |

---

## appinstances

Manage installed Seq app instances. Non-Project principals see basic details only.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/appinstances` | GET | Read | Basic details without Project |
| `api/appinstances` | POST | System | |
| `api/appinstances/{id}` | GET | Read | Basic details without Project |
| `api/appinstances/{id}` | PUT | System | |
| `api/appinstances/{id}` | DELETE | System | |
| `api/appinstances/{id}/icon` | GET | Read | |
| `api/appinstances/{id}/invoke` | POST | Write | Must be an output app; System for non-direct-invocation |
| `api/appinstances/{id}/metrics/{measurement}` | GET | Project | |
| `api/appinstances/resources` | GET | Public | |
| `api/appinstances/template` | GET | System | |

---

## apps

Manage app packages (install, update, remove). All require System permission.

| Path | Method | Permission |
|------|--------|------------|
| `api/apps` | GET | System |
| `api/apps/{id}` | GET | System |
| `api/apps/{id}` | DELETE | System |
| `api/apps/{id}/icon` | GET | System |
| `api/apps/{id}/update` | POST | System |
| `api/apps/install` | POST | System |
| `api/apps/resources` | GET | Public |
| `api/apps/template` | GET | System |

---

## backups

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/backups` | GET | System | |
| `api/backups/{id}` | GET | System | |
| `api/backups/files/{filename}` | GET | System | Download backup file |
| `api/backups/immediate` | POST | System | Allows cross-site POSTs |
| `api/backups/resources` | GET | Public | |

---

## cluster

| Path | Method | Permission |
|------|--------|------------|
| `api/cluster` | GET | System |
| `api/cluster/{id}` | GET | System |
| `api/cluster/{id}/drain` | POST | System |
| `api/cluster/resources` | GET | Public |

---

## dashboards

Manage dashboards. Users can only access shared dashboards and their own. Protected dashboards require `Project` permission.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/dashboards` | GET | Read | Shared + own only |
| `api/dashboards` | POST | Write | Project for protected |
| `api/dashboards/{id}` | GET | Read | Shared + own only |
| `api/dashboards/{id}` | PUT | Write | Project for protected |
| `api/dashboards/{id}` | DELETE | Write | Project for protected |
| `api/dashboards/query/template` | GET | Write | |
| `api/dashboards/resources` | GET | Public | |
| `api/dashboards/template` | GET | Write | |

---

## data (queries)

Execute SQL-style queries against the event stream.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/data` | GET | Read | Query via query params |
| `api/data` | POST | Read | Query via JSON body |
| `api/data/{signalId}` | GET | Read | **Obsolete** |
| `api/data/resources` | GET | Public | |

---

## deferred

Retrieve results of long-running/deferred operations.

| Path | Method | Permission |
|------|--------|------------|
| `api/deferred/{deferredId}` | GET | Read |

---

## diagnostics

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/diagnostics/status` | GET | Read | Basic server status |
| `api/diagnostics/metrics` | GET | Project | |
| `api/diagnostics/metrics/{measurement}` | GET | Project | |
| `api/diagnostics/ingestion` | GET | System | |
| `api/diagnostics/storage` | GET | Project | |
| `api/diagnostics/report` | GET | System | Full diagnostic report |
| `api/diagnostics/cluster/metrics` | GET | System | |
| `api/diagnostics/usage-telemetry` | POST | Read | |
| `api/diagnostics/resources` | GET | Public | |

---

## events

Core event operations — retrieve, search, stream, delete by signal, and raw ingestion.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/events` | GET | Read | List/search events |
| `api/events/{id}` | GET | Read | Get single event |
| `api/events/raw` | POST | Public* | Raw event ingestion; cross-site allowed. *Ingest required if RequireApiKeyForWritingEvents is on |
| `api/events/scan` | GET | Read | |
| `api/events/scan` | POST | Read | |
| `api/events/signal` | GET | Read | |
| `api/events/signal` | POST | Read | |
| `api/events/signal` | DELETE | Project | Delete events matching signal |
| `api/events/signal/{signalId}` | GET | Read | **Obsolete** |
| `api/events/stream` | GET | Read | Live event stream (Server-Sent Events) |
| `api/events/tabulate` | POST | Read | |
| `api/events/tabulate/{signalId}` | GET | Read | |
| `api/events/resources` | GET | Public | |

---

## expressionindexes

| Path | Method | Permission |
|------|--------|------------|
| `api/expressionindexes` | GET | Read |
| `api/expressionindexes` | POST | Write |
| `api/expressionindexes/{id}` | GET | Read |
| `api/expressionindexes/{id}` | DELETE | Write |
| `api/expressionindexes/resources` | GET | Public |
| `api/expressionindexes/template` | GET | Write |

---

## expressions

| Path | Method | Permission |
|------|--------|------------|
| `api/expressions/sql` | GET | Read |
| `api/expressions/strict` | GET | Read |
| `api/expressions/resources` | GET | Public |

---

## feeds

App package feeds. All require System permission.

| Path | Method | Permission |
|------|--------|------------|
| `api/feeds` | GET | System |
| `api/feeds` | POST | System |
| `api/feeds/{id}` | GET | System |
| `api/feeds/{id}` | PUT | System |
| `api/feeds/{id}` | DELETE | System |
| `api/feeds/resources` | GET | Public |
| `api/feeds/template` | GET | System |

---

## indexes

Signal indexes. Require Project permission.

| Path | Method | Permission |
|------|--------|------------|
| `api/indexes` | GET | Project |
| `api/indexes/{id}` | GET | Project |
| `api/indexes/{id}` | DELETE | Project |
| `api/indexes/resources` | GET | Public |

---

## licenses

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/licenses` | GET | System | |
| `api/licenses/{id}` | GET | Read | Read sees status; System sees certificate details |
| `api/licenses/{id}` | PUT | System | |
| `api/licenses/downgrade` | POST | System | |
| `api/licenses/resources` | GET | Public | |

---

## permalinks

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/permalinks` | GET | Read | Non-Project: own only |
| `api/permalinks` | POST | Write | Non-Project: own only |
| `api/permalinks/{id}` | GET | Read | Non-Project: own only |
| `api/permalinks/{id}` | DELETE | Write | Non-Project: own only |
| `api/permalinks/resources` | GET | Public | |
| `api/permalinks/template` | GET | Write | |

---

## retentionpolicies

All require Project permission.

| Path | Method | Permission |
|------|--------|------------|
| `api/retentionpolicies` | GET | Project |
| `api/retentionpolicies` | POST | Project |
| `api/retentionpolicies/{id}` | GET | Project |
| `api/retentionpolicies/{id}` | PUT | Project |
| `api/retentionpolicies/{id}` | DELETE | Project |
| `api/retentionpolicies/resources` | GET | Public |
| `api/retentionpolicies/template` | GET | Project |

---

## roles

| Path | Method | Permission |
|------|--------|------------|
| `api/roles` | GET | Read |
| `api/roles/{id}` | GET | Read |
| `api/roles/resources` | GET | Public |

---

## runningtasks

| Path | Method | Permission |
|------|--------|------------|
| `api/runningtasks` | GET | System |
| `api/runningtasks/{id}` | GET | System |
| `api/runningtasks/{id}` | DELETE | System |
| `api/runningtasks/resources` | GET | Public |

---

## settings

Server settings. Most require System permission. Notable publicly accessible settings:

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/settings/{id}` | GET | System | Generic setting |
| `api/settings/{id}` | PUT | System | |
| `api/settings/setting-authenticationprovider` | GET | Public | |
| `api/settings/setting-instancetitle` | GET | Public | |
| `api/settings/setting-isauthenticationenabled` | GET | Public | |
| `api/settings/setting-isactivedirectoryauthentication` | GET | Public | |
| `api/settings/setting-isusagetelemetryenabled` | GET | Read | |
| `api/settings/setting-searchdurationseconds` | GET | Read | |
| `api/settings/setting-searchdurationseconds` | PUT | System | |
| `api/settings/setting-servicenameexpression` | GET | Read | |
| `api/settings/setting-servicenameexpression` | PUT | Project | |
| `api/settings/setting-requireapikeyforwritingevents` | GET | Project | |
| `api/settings/setting-requireapikeyforwritingevents` | PUT | Project | |
| `api/settings/setting-newusershowdashboardids` | GET/PUT | Organization | |
| `api/settings/setting-newusershowqueryids` | GET/PUT | Organization | |
| `api/settings/setting-newusershowsignalids` | GET/PUT | Organization | |
| `api/settings/setting-checkforupdates` | GET/PUT | System | |
| `api/settings/setting-minimumfreestoragespace` | GET/PUT | System | |
| `api/settings/setting-raweventmaximumcontentlength` | GET/PUT | System | |
| `api/settings/setting-rawpayloadmaximumcontentlength` | GET/PUT | System | |
| `api/settings/setting-themestyles` | GET/PUT | System | |
| `api/settings/internal-error-reporting` | GET/PUT | System | |
| `api/settings/resources` | GET | Public | |

---

## signals

Saved signals. Users can only access shared signals and their own. Protected signals require `Project` permission.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/signals` | GET | Read | Shared + own only |
| `api/signals` | POST | Write | Project for protected |
| `api/signals/{id}` | GET | Read | Shared + own only |
| `api/signals/{id}` | PUT | Write | Project for protected |
| `api/signals/{id}` | DELETE | Write | Project for protected |
| `api/signals/resources` | GET | Public | |
| `api/signals/template` | GET | Write | |

---

## sqlqueries

Saved SQL queries. Same ownership/sharing rules as signals.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/sqlqueries` | GET | Read | Shared + own only |
| `api/sqlqueries` | POST | Write | Project for protected |
| `api/sqlqueries/{id}` | GET | Read | Shared + own only |
| `api/sqlqueries/{id}` | PUT | Write | Project for protected |
| `api/sqlqueries/{id}` | DELETE | Write | Project for protected |
| `api/sqlqueries/resources` | GET | Public | |
| `api/sqlqueries/template` | GET | Write | |

---

## updates

| Path | Method | Permission |
|------|--------|------------|
| `api/updates` | GET | System |
| `api/updates/{id}` | GET | System |
| `api/updates/resources` | GET | Public |

---

## users

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/users` | GET | Project | System for auth provider info |
| `api/users` | POST | Organization | Cannot grant permissions you don't have |
| `api/users/{id}` | GET | Public | Own record; Project for others |
| `api/users/{id}` | PUT | Public | Own limited fields; Organization for others |
| `api/users/{id}` | DELETE | Organization | |
| `api/users/{id}/searches` | GET | Read | Own search history only |
| `api/users/{id}/searches` | DELETE | Write | Own search history only |
| `api/users/{id}/searches/update` | POST | Write | Own search history only |
| `api/users/{id}/unlinkauthenticationprovider` | POST | System | |
| `api/users/current` | GET | Public | Logged-in user only |
| `api/users/login` | POST | Public | |
| `api/users/logout` | POST | Public | Allows cross-site POSTs |
| `api/users/providers` | GET | Public | |
| `api/users/resources` | GET | Public | |
| `api/users/template` | GET | Organization | |

---

## workspaces

Same ownership/sharing rules as signals, dashboards, etc.

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `api/workspaces` | GET | Read | Shared + own only |
| `api/workspaces` | POST | Write | Project for protected |
| `api/workspaces/{id}` | GET | Read | Shared + own only |
| `api/workspaces/{id}` | PUT | Write | Project for protected |
| `api/workspaces/{id}` | DELETE | Write | Project for protected |
| `api/workspaces/resources` | GET | Public | |
| `api/workspaces/template` | GET | Write | |

---

## health

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `health` | GET | Public | Returns 200 or 503 |
| `health/cluster` | GET | Public | Cluster health |

---

## ingestion

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `ingest/clef` | POST | Public* | CLEF format; cross-site allowed |
| `ingest/otlp/v1/logs` | POST | Public* | OpenTelemetry logs |
| `ingest/otlp/v1/traces` | POST | Public* | OpenTelemetry traces |
| `ingest/otlp/v1/metrics` | POST | Public* | OpenTelemetry metrics |

*If `RequireApiKeyForWritingEvents` is enabled, Ingest permission is required.

---

## other

| Path | Method | Permission | Notes |
|------|--------|------------|-------|
| `integrated` | GET | Public | Windows integrated auth |
| `oidc/challenge` | GET | Public | OpenID Connect |
| `oidc/challenge` | POST | Public | OpenID Connect |
| `theme/styles.css` | GET | Public | Custom theme CSS |