Skip to content
StratumStratum Docs

List support log bundles.

GET
/v1/observability/admin/log-bundles
Code sample: Shell / cURL
curl --request GET \
  --url https://stratum.example.com/v1/observability/admin/log-bundles \
  --header 'Authorization: Bearer <token>'

Cedar action observability:ManageLogBundle.. Inventory of every log bundle the operator (or another platform-admin) has captured. Returned newest-first. Includes the open/closed status, the assemble-job status, the createdBy / createdAt / expiresAt window, and the on-disk archive size. Selection criteria + per-group event counts live in the archive’s manifest.json; this list endpoint is metadata-only.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Bundle list.

Media typeapplication/json

. Response envelope for GET /v1/observability/admin/log-bundles. Always sorted newest-first by createdAt.

object
items
required
Array<object>

. Persisted shape of a support log bundle. Selection criteria + lifecycle + job status + (when ready) on-disk archive size. The bundle ARCHIVE itself is fetched separately via the /download endpoint.

object
id
required
string
/^lb-[a-z0-9]{16}$/
caseRef

Optional operator-supplied case/incident reference.

string
note
string
status
required

Operator-mutable lifecycle bit. open is the default; flipping to closed is what the UI uses to dim resolved- case bundles in the inventory.

string
Allowed values: open closed
jobStatus
required
string
Allowed values: pending running ready failed
jobError

Populated when jobStatus=failed. Operator-readable message from the assemble worker.

string
start
required

Inclusive lower bound of the captured log window.

string format: date-time
end
required

Exclusive upper bound of the captured log window.

string format: date-time
logGroupIds
required

Pack-owned log groups the operator selected. The tenant include is via the separate projectId field, NOT this list — keeps cross-tenant gating clean.

Array<string>
projectId

Set when the bundle additionally captures this tenant’s customer log groups. Cross-tenant include requires the observability:ReadAllProjects Cedar action at both create AND download time.

string
severityFloor

Drop events below this severity. Composed with the optional LogsQL filter (both must match).

string
Allowed values: DEBUG INFO WARN ERROR FATAL
filter

Optional LogsQL fragment AND-ed with the stream-key + severity floor.

string
createdBy
required
string
createdAt
required
string format: date-time
startedAt

When the assemble worker picked up the job.

string format: date-time
completedAt

When the assemble worker finished (success or fail).

string format: date-time
expiresAt
required

When the retention sweeper will delete the bundle + its on-disk archive. Default ~30d post-create; configurable.

string format: date-time
sizeBytes
required

On-disk archive size in bytes. 0 until jobStatus=ready.

integer format: int64

Example 

{
  "items": [
    {
      "status": "open",
      "jobStatus": "pending",
      "severityFloor": "DEBUG"
    }
  ]
}

503

Section titled “503”

Upstream temporarily unavailable (driver / scheduler / dependency).

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}