Get Log Entry
Fetch the full traffic-log record for one request. Includes everything the platform observed: request and response headers, body samples (truncated to retention limits), latency breakdown, hit traffic policies, hit firewall rules, OAuth/RBAC client identity (if authenticated), and the agent that handled the request.
Body samples are truncated at the platform's body-capture limit (typically first 64 KB) and stored encrypted at rest. PII filters can mask known credential-shaped fields before storage; check your account settings.
Path parameters
id string Req
Log entry ID. Get from /traffic/logs.
Response (200 OK)
id, endpoint_id, tunnel_id int64
Identification fields.
timestamp (datetime) is the request time; connection_id (string) groups multiplexed requests.method, path, host, request_url string
Request line components. There is no separate
query field — the query string is part of request_url.status_code, edge_status, origin_status int?
Status returned to the client (
status_code = edge_status) and the status your origin returned (origin_status).request_headers, response_headers object
Header maps. Hop-by-hop headers stripped.
request_body, response_body string?
Body samples (truncated).
null when capture was disabled or PII filter scrubbed everything.client_ip, user_agent string
Caller fingerprint.
bytes_in, bytes_out int64
Bandwidth used by this request.
duration_ms int
Full request time in ms — from when the edge received the request to when the client got the complete response. Equals
edge_ms + origin_ttfb_ms + transfer_ms.edge_ms, origin_ttfb_ms, transfer_ms int?
The three sequential timing phases (ms) that sum to
duration_ms. edge_ms: edge pipeline (firewall / rate-limit / auth + framing) before your origin is contacted. origin_ttfb_ms: wait for the origin's first response byte (= TTFB / latency_ms). transfer_ms: response-body streaming after the first byte. A field is null when the phase doesn't apply (an edge-blocked request has no origin/transfer; TCP/UDP sessions have none).latency_ms int?
Time-to-first-byte (TTFB) in ms — identical to
origin_ttfb_ms.firewall_action, firewall_policy, firewall_rule string?
The firewall decision (e.g.
blocked) plus the policy id and matched rule name, when a firewall rule fired.rate_limit_action, rate_limit_rule_id string? / int64?
The rate-limit decision + matched rule id, when a rate-limit rule fired.
request_cookies, response_cookies object
Cookie maps (sensitive values masked).
is_replay, original_request_id, analysis bool / int64? / string?
Replay provenance (
is_replay + the source log id) and any stored AI analysis text.Errors
401 Unauthorized
Missing auth.
404 Not Found
Log doesn't exist (expired beyond retention) or doesn't belong to the calling user's endpoints.
Request
curl "https://api.ngris.com/v1/traffic/logs/log-abc-123" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
log = client.traffic.get_log("log-abc-123")
print(log["status_code"], log["duration_ms"])
if log.get("firewall_action"):
print("Firewall:", log["firewall_action"], log.get("firewall_rule"))
Response — 200 OK (excerpt)
{
"id": 1234,
"timestamp": "2026-04-29T13:01:23.456Z",
"endpoint_id": 87,
"tunnel_id": 12,
"connection_id": "c-9f3a...",
"method": "GET",
"path": "/api/users",
"host": "api.example.com",
"request_url": "https://api.example.com/api/users?limit=10",
"status_code": 500,
"edge_status": 500,
"origin_status": 500,
"duration_ms": 1247,
"request_headers": {"User-Agent": "curl/8.0", "Accept": "*/*"},
"response_headers": {"Content-Type": "text/plain"},
"response_body": "Internal Server Error\n",
"client_ip": "203.0.113.42",
"user_agent": "curl/8.0",
"bytes_in": 0,
"bytes_out": 22,
"latency_ms": 1243,
"edge_ms": 2,
"origin_ttfb_ms": 1243,
"transfer_ms": 2,
"firewall_action": null,
"firewall_policy": null,
"firewall_rule": null,
"rate_limit_action": null,
"rate_limit_rule_id": null,
"is_replay": false
}