Seq Server API — Complete Endpoint Reference
This file lists every API endpoint provided by the Seq server, organized by resource group.
Table of Contents
- api (root)
- alerts
- alertstate
- apikeys
- appinstances
- apps
- backups
- cluster
- dashboards
- data (queries)
- deferred
- diagnostics
- events
- expressionindexes
- expressions
- feeds
- indexes
- licenses
- permalinks
- retentionpolicies
- roles
- runningtasks
- settings
- signals
- sqlqueries
- updates
- users
- workspaces
- health
- ingestion
- other
api (root)
| Path |
Method |
Permission |
api |
GET |
Public |
Returns the root resource with links to all API resource groups.
alerts
Manage alert definitions. Users can only access shared alerts and their own. Protected alerts require Project permission.
| Path |
Method |
Permission |
Notes |
api/alerts |
GET |
Read |
Shared + own only |
api/alerts |
POST |
Write |
Project for protected |
api/alerts/{id} |
GET |
Read |
Shared + own only |
api/alerts/{id} |
PUT |
Write |
Project for protected |
api/alerts/{id} |
DELETE |
Write |
Project for protected |
api/alerts/resources |
GET |
Public |
|
api/alerts/template |
GET |
Write |
|
alertstate
| Path |
Method |
Permission |
api/alertstate |
GET |
Project |
api/alertstate/{id} |
GET |
Project |
api/alertstate/{id} |
DELETE |
Project |
api/alertstate/resources |
GET |
Public |
apikeys
Manage API keys. Non-Project principals can only view/manage their own keys.
| Path |
Method |
Permission |
Notes |
api/apikeys |
GET |
Read |
Project sees all; others own only |
api/apikeys |
POST |
Write |
Can only delegate own permissions |
api/apikeys/{id} |
GET |
Read |
Project sees all; others own only |
api/apikeys/{id} |
PUT |
Write |
Can only delegate own permissions |
api/apikeys/{id} |
DELETE |
Write |
Project removes any; others own only |
api/apikeys/{id}/metrics/{measurement} |
GET |
Read |
Own or Project |
api/apikeys/metrics/{measurement} |
GET |
Project |
|
api/apikeys/resources |
GET |
Public |
|
api/apikeys/template |
GET |
Read |
|
appinstances
Manage installed Seq app instances. Non-Project principals see basic details only.
| Path |
Method |
Permission |
Notes |
api/appinstances |
GET |
Read |
Basic details without Project |
api/appinstances |
POST |
System |
|
api/appinstances/{id} |
GET |
Read |
Basic details without Project |
api/appinstances/{id} |
PUT |
System |
|
api/appinstances/{id} |
DELETE |
System |
|
api/appinstances/{id}/icon |
GET |
Read |
|
api/appinstances/{id}/invoke |
POST |
Write |
Must be an output app; System for non-direct-invocation |
api/appinstances/{id}/metrics/{measurement} |
GET |
Project |
|
api/appinstances/resources |
GET |
Public |
|
api/appinstances/template |
GET |
System |
|
apps
Manage app packages (install, update, remove). All require System permission.
| Path |
Method |
Permission |
api/apps |
GET |
System |
api/apps/{id} |
GET |
System |
api/apps/{id} |
DELETE |
System |
api/apps/{id}/icon |
GET |
System |
api/apps/{id}/update |
POST |
System |
api/apps/install |
POST |
System |
api/apps/resources |
GET |
Public |
api/apps/template |
GET |
System |
backups
| Path |
Method |
Permission |
Notes |
api/backups |
GET |
System |
|
api/backups/{id} |
GET |
System |
|
api/backups/files/{filename} |
GET |
System |
Download backup file |
api/backups/immediate |
POST |
System |
Allows cross-site POSTs |
api/backups/resources |
GET |
Public |
|
cluster
| Path |
Method |
Permission |
api/cluster |
GET |
System |
api/cluster/{id} |
GET |
System |
api/cluster/{id}/drain |
POST |
System |
api/cluster/resources |
GET |
Public |
dashboards
Manage dashboards. Users can only access shared dashboards and their own. Protected dashboards require Project permission.
| Path |
Method |
Permission |
Notes |
api/dashboards |
GET |
Read |
Shared + own only |
api/dashboards |
POST |
Write |
Project for protected |
api/dashboards/{id} |
GET |
Read |
Shared + own only |
api/dashboards/{id} |
PUT |
Write |
Project for protected |
api/dashboards/{id} |
DELETE |
Write |
Project for protected |
api/dashboards/query/template |
GET |
Write |
|
api/dashboards/resources |
GET |
Public |
|
api/dashboards/template |
GET |
Write |
|
data (queries)
Execute SQL-style queries against the event stream.
| Path |
Method |
Permission |
Notes |
api/data |
GET |
Read |
Query via query params |
api/data |
POST |
Read |
Query via JSON body |
api/data/{signalId} |
GET |
Read |
Obsolete |
api/data/resources |
GET |
Public |
|
deferred
Retrieve results of long-running/deferred operations.
| Path |
Method |
Permission |
api/deferred/{deferredId} |
GET |
Read |
diagnostics
| Path |
Method |
Permission |
Notes |
api/diagnostics/status |
GET |
Read |
Basic server status |
api/diagnostics/metrics |
GET |
Project |
|
api/diagnostics/metrics/{measurement} |
GET |
Project |
|
api/diagnostics/ingestion |
GET |
System |
|
api/diagnostics/storage |
GET |
Project |
|
api/diagnostics/report |
GET |
System |
Full diagnostic report |
api/diagnostics/cluster/metrics |
GET |
System |
|
api/diagnostics/usage-telemetry |
POST |
Read |
|
api/diagnostics/resources |
GET |
Public |
|
events
Core event operations — retrieve, search, stream, delete by signal, and raw ingestion.
| Path |
Method |
Permission |
Notes |
api/events |
GET |
Read |
List/search events |
api/events/{id} |
GET |
Read |
Get single event |
api/events/raw |
POST |
Public* |
Raw event ingestion; cross-site allowed. *Ingest required if RequireApiKeyForWritingEvents is on |
api/events/scan |
GET |
Read |
|
api/events/scan |
POST |
Read |
|
api/events/signal |
GET |
Read |
|
api/events/signal |
POST |
Read |
|
api/events/signal |
DELETE |
Project |
Delete events matching signal |
api/events/signal/{signalId} |
GET |
Read |
Obsolete |
api/events/stream |
GET |
Read |
Live event stream (Server-Sent Events) |
api/events/tabulate |
POST |
Read |
|
api/events/tabulate/{signalId} |
GET |
Read |
|
api/events/resources |
GET |
Public |
|
expressionindexes
| Path |
Method |
Permission |
api/expressionindexes |
GET |
Read |
api/expressionindexes |
POST |
Write |
api/expressionindexes/{id} |
GET |
Read |
api/expressionindexes/{id} |
DELETE |
Write |
api/expressionindexes/resources |
GET |
Public |
api/expressionindexes/template |
GET |
Write |
expressions
| Path |
Method |
Permission |
api/expressions/sql |
GET |
Read |
api/expressions/strict |
GET |
Read |
api/expressions/resources |
GET |
Public |
feeds
App package feeds. All require System permission.
| Path |
Method |
Permission |
api/feeds |
GET |
System |
api/feeds |
POST |
System |
api/feeds/{id} |
GET |
System |
api/feeds/{id} |
PUT |
System |
api/feeds/{id} |
DELETE |
System |
api/feeds/resources |
GET |
Public |
api/feeds/template |
GET |
System |
indexes
Signal indexes. Require Project permission.
| Path |
Method |
Permission |
api/indexes |
GET |
Project |
api/indexes/{id} |
GET |
Project |
api/indexes/{id} |
DELETE |
Project |
api/indexes/resources |
GET |
Public |
licenses
| Path |
Method |
Permission |
Notes |
api/licenses |
GET |
System |
|
api/licenses/{id} |
GET |
Read |
Read sees status; System sees certificate details |
api/licenses/{id} |
PUT |
System |
|
api/licenses/downgrade |
POST |
System |
|
api/licenses/resources |
GET |
Public |
|
permalinks
| Path |
Method |
Permission |
Notes |
api/permalinks |
GET |
Read |
Non-Project: own only |
api/permalinks |
POST |
Write |
Non-Project: own only |
api/permalinks/{id} |
GET |
Read |
Non-Project: own only |
api/permalinks/{id} |
DELETE |
Write |
Non-Project: own only |
api/permalinks/resources |
GET |
Public |
|
api/permalinks/template |
GET |
Write |
|
retentionpolicies
All require Project permission.
| Path |
Method |
Permission |
api/retentionpolicies |
GET |
Project |
api/retentionpolicies |
POST |
Project |
api/retentionpolicies/{id} |
GET |
Project |
api/retentionpolicies/{id} |
PUT |
Project |
api/retentionpolicies/{id} |
DELETE |
Project |
api/retentionpolicies/resources |
GET |
Public |
api/retentionpolicies/template |
GET |
Project |
roles
| Path |
Method |
Permission |
api/roles |
GET |
Read |
api/roles/{id} |
GET |
Read |
api/roles/resources |
GET |
Public |
runningtasks
| Path |
Method |
Permission |
api/runningtasks |
GET |
System |
api/runningtasks/{id} |
GET |
System |
api/runningtasks/{id} |
DELETE |
System |
api/runningtasks/resources |
GET |
Public |
settings
Server settings. Most require System permission. Notable publicly accessible settings:
| Path |
Method |
Permission |
Notes |
api/settings/{id} |
GET |
System |
Generic setting |
api/settings/{id} |
PUT |
System |
|
api/settings/setting-authenticationprovider |
GET |
Public |
|
api/settings/setting-instancetitle |
GET |
Public |
|
api/settings/setting-isauthenticationenabled |
GET |
Public |
|
api/settings/setting-isactivedirectoryauthentication |
GET |
Public |
|
api/settings/setting-isusagetelemetryenabled |
GET |
Read |
|
api/settings/setting-searchdurationseconds |
GET |
Read |
|
api/settings/setting-searchdurationseconds |
PUT |
System |
|
api/settings/setting-servicenameexpression |
GET |
Read |
|
api/settings/setting-servicenameexpression |
PUT |
Project |
|
api/settings/setting-requireapikeyforwritingevents |
GET |
Project |
|
api/settings/setting-requireapikeyforwritingevents |
PUT |
Project |
|
api/settings/setting-newusershowdashboardids |
GET/PUT |
Organization |
|
api/settings/setting-newusershowqueryids |
GET/PUT |
Organization |
|
api/settings/setting-newusershowsignalids |
GET/PUT |
Organization |
|
api/settings/setting-checkforupdates |
GET/PUT |
System |
|
api/settings/setting-minimumfreestoragespace |
GET/PUT |
System |
|
api/settings/setting-raweventmaximumcontentlength |
GET/PUT |
System |
|
api/settings/setting-rawpayloadmaximumcontentlength |
GET/PUT |
System |
|
api/settings/setting-themestyles |
GET/PUT |
System |
|
api/settings/internal-error-reporting |
GET/PUT |
System |
|
api/settings/resources |
GET |
Public |
|
signals
Saved signals. Users can only access shared signals and their own. Protected signals require Project permission.
| Path |
Method |
Permission |
Notes |
api/signals |
GET |
Read |
Shared + own only |
api/signals |
POST |
Write |
Project for protected |
api/signals/{id} |
GET |
Read |
Shared + own only |
api/signals/{id} |
PUT |
Write |
Project for protected |
api/signals/{id} |
DELETE |
Write |
Project for protected |
api/signals/resources |
GET |
Public |
|
api/signals/template |
GET |
Write |
|
sqlqueries
Saved SQL queries. Same ownership/sharing rules as signals.
| Path |
Method |
Permission |
Notes |
api/sqlqueries |
GET |
Read |
Shared + own only |
api/sqlqueries |
POST |
Write |
Project for protected |
api/sqlqueries/{id} |
GET |
Read |
Shared + own only |
api/sqlqueries/{id} |
PUT |
Write |
Project for protected |
api/sqlqueries/{id} |
DELETE |
Write |
Project for protected |
api/sqlqueries/resources |
GET |
Public |
|
api/sqlqueries/template |
GET |
Write |
|
updates
| Path |
Method |
Permission |
api/updates |
GET |
System |
api/updates/{id} |
GET |
System |
api/updates/resources |
GET |
Public |
users
| Path |
Method |
Permission |
Notes |
api/users |
GET |
Project |
System for auth provider info |
api/users |
POST |
Organization |
Cannot grant permissions you don't have |
api/users/{id} |
GET |
Public |
Own record; Project for others |
api/users/{id} |
PUT |
Public |
Own limited fields; Organization for others |
api/users/{id} |
DELETE |
Organization |
|
api/users/{id}/searches |
GET |
Read |
Own search history only |
api/users/{id}/searches |
DELETE |
Write |
Own search history only |
api/users/{id}/searches/update |
POST |
Write |
Own search history only |
api/users/{id}/unlinkauthenticationprovider |
POST |
System |
|
api/users/current |
GET |
Public |
Logged-in user only |
api/users/login |
POST |
Public |
|
api/users/logout |
POST |
Public |
Allows cross-site POSTs |
api/users/providers |
GET |
Public |
|
api/users/resources |
GET |
Public |
|
api/users/template |
GET |
Organization |
|
workspaces
Same ownership/sharing rules as signals, dashboards, etc.
| Path |
Method |
Permission |
Notes |
api/workspaces |
GET |
Read |
Shared + own only |
api/workspaces |
POST |
Write |
Project for protected |
api/workspaces/{id} |
GET |
Read |
Shared + own only |
api/workspaces/{id} |
PUT |
Write |
Project for protected |
api/workspaces/{id} |
DELETE |
Write |
Project for protected |
api/workspaces/resources |
GET |
Public |
|
api/workspaces/template |
GET |
Write |
|
health
| Path |
Method |
Permission |
Notes |
health |
GET |
Public |
Returns 200 or 503 |
health/cluster |
GET |
Public |
Cluster health |
ingestion
| Path |
Method |
Permission |
Notes |
ingest/clef |
POST |
Public* |
CLEF format; cross-site allowed |
ingest/otlp/v1/logs |
POST |
Public* |
OpenTelemetry logs |
ingest/otlp/v1/traces |
POST |
Public* |
OpenTelemetry traces |
ingest/otlp/v1/metrics |
POST |
Public* |
OpenTelemetry metrics |
*If RequireApiKeyForWritingEvents is enabled, Ingest permission is required.
other
| Path |
Method |
Permission |
Notes |
integrated |
GET |
Public |
Windows integrated auth |
oidc/challenge |
GET |
Public |
OpenID Connect |
oidc/challenge |
POST |
Public |
OpenID Connect |
theme/styles.css |
GET |
Public |
Custom theme CSS |