> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.lakera.ai/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lakera.ai/_mcp/server.

# Get guard logs

POST https://platform.lakera.ai/api/v1-beta/logs
Content-Type: application/json

Retrieve individual Guard request logs for your organization.

Returns up to `limit` logs (default 100, max 1000) ordered by timestamp ascending (oldest first). Only flagged results and message-level results are included in each log entry — unflagged detections are omitted.

**Pagination.** Use `offset` to page through results. When `has_more` is `true` in the response, increment `offset` by `limit` to fetch the next page. For example, to iterate over all logs in a time range with pages of 500: fetch with `offset=0`, then `offset=500`, then `offset=1000`, and so on until `has_more` is `false`.

**Filtering.** Narrow results using any combination of these filters:
- `flagged_only` — only requests where the policy action flagged the request.
- `detected_only` — only requests where at least one detector fired (includes
  monitor-mode hits where the policy does not flag).

- `detector_types` — only requests that triggered one or more of the listed
  detector types. See the `GetLogsRequest` schema for the list of accepted
values
  and their corresponding display names in the AI Guardrails Dashboard.


**Authentication.** Use a Platform API key from the AI Guardrails Dashboard — not the Guard API key used for inference requests at `api.lakera.ai`.

**Access.** This endpoint is available to select organizations. Contact your Check Point representative to request access. Community users may also reach out to [support@lakera.ai](mailto:support@lakera.ai).


Reference: https://docs.lakera.ai/api-reference/platform-api/logs/get-logs

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication using API key. Generate an API key from the AI Guardrails Dashboard. Example: Bearer sk_123... Keys carry one of two access scopes, chosen when the key is created: - **Read and write** — may call every endpoint. This is the default, and the scope of every key created before scopes were introduced. - **Read only** — may call read endpoints such as `/v1-beta/logs`, `/v1-beta/analytics` and the `GET` endpoints. Write endpoints return `403`. Issue a read-only key to anything that only needs to retrieve data, such as a log-shipping job or a dashboard, so that it cannot modify your policies or projects.

## Request

### Body (application/json)

This endpoint expects a GetLogsRequest.

- `start_time` (string, required) — Start of the time range (inclusive)
- `end_time` (string, required) — End of the time range (exclusive). Must be after `start_time`.
- `project_id` (string, optional, nullable) — Filter to a single project by ID. Omit to return logs across all projects in your organization.
- `limit` (integer, optional, default: 100) — Maximum number of logs to return. Logs are ordered by timestamp ascending (oldest first).
- `offset` (integer, optional, default: 0) — Number of logs to skip before returning results. Use with `has_more` in the response to page through large result sets: increment `offset` by `limit` until `has_more` is `false`.
- `flagged_only` (boolean, optional, default: false) — When `true`, only return requests where the policy action flagged the request. Independent of `detected_only`.
- `detected_only` (boolean, optional, default: false) — When `true`, only return requests where at least one detector fired. This includes monitor-mode requests where a detector fired but the policy did not flag. Independent of `flagged_only`.
- `detector_types` (list of string, optional, default: []) — Filter to requests that triggered one or more of the listed detector types. An empty list (the default) returns all requests regardless of detector. Accepted values and their corresponding display names in the AI Guardrails Dashboard: | API value | Dashboard display name | |---|---| | `prompt_attack` | Prompt attack | | `data_leakage` | Data leakage (matches all sub-detectors) | | `content_violation` | Content violation (matches all sub-detectors) | | `unknown_links` | Unknown links | | `deny_listed` | Deny-listed | | `tool_access_control` | Tool access control (requires agentic policy feature — contact your Check Point representative to request access) | | `dangerous_deviation` | Dangerous Deviation | | `custom_guardrail` | Custom guardrail | | `audio_prompt_attack` | Audio prompt attack | | `no_detections` | No detections (requests where no detectors fired) |

## Response

### 200

Guard logs for the requested time range

- `logs` (list of GuardLog, required)
- `has_more` (boolean, required) — `true` when there are more logs beyond this page. Increment `offset` by `limit` and repeat the request to fetch the next page.

## Errors

### 400 Bad Request Error

Bad request

- `status` (enum, optional) — Response status
  - Allowed values: `error`
- `error` (string, optional) — Short machine-readable error identifier
- `message` (string, optional) — Human-readable error message
- `code` (integer, optional) — HTTP status code
- `request_id` (string, optional) — Unique identifier for the request

### 403 Forbidden Error

Access denied. Either the feature is not enabled for your organization, or the query exceeded ClickHouse resource limits — try narrowing the time range.

- `status` (enum, optional) — Response status
  - Allowed values: `error`
- `error` (string, optional) — Short machine-readable error identifier
- `message` (string, optional) — Human-readable error message
- `code` (integer, optional) — HTTP status code
- `request_id` (string, optional) — Unique identifier for the request

### 404 Not Found Error

A requested project ID does not belong to your organization. Requests sent without a project are logged under `project-lakera-default` (or `project-lakera-audio-default` for audio), which are always accepted. Archived projects count as found.

- `status` (enum, optional) — Response status
  - Allowed values: `error`
- `error` (string, optional) — Short machine-readable error identifier
- `message` (string, optional) — Human-readable error message
- `code` (integer, optional) — HTTP status code
- `request_id` (string, optional) — Unique identifier for the request

### 421 Misdirected Request Error

Your organization's data is stored in a different region than the one that received the request. `https://platform.lakera.ai` serves organizations stored in `eu-west-1`. Send the request to the regional host named in the message, for example `https://us-east-1.platform.lakera.ai`.

- `status` (enum, optional) — Response status
  - Allowed values: `error`
- `error` (string, optional) — Short machine-readable error identifier
- `message` (string, optional) — Human-readable error message
- `code` (integer, optional) — HTTP status code
- `request_id` (string, optional) — Unique identifier for the request

### 422 Unprocessable Entity Error

Bad request

- `status` (enum, optional) — Response status
  - Allowed values: `error`
- `error` (string, optional) — Short machine-readable error identifier
- `message` (string, optional) — Human-readable error message
- `code` (integer, optional) — HTTP status code
- `request_id` (string, optional) — Unique identifier for the request

## Types

### GuardLog

A single Guard request log entry

- `request_uuid` (string, required) — Unique identifier for the Guard request (UUIDv7)
- `timestamp` (string, required) — When the Guard request was processed
- `project_id` (string, required) — The project this request was screened under. Requests made without an explicit project use the organization's default project ID.
- `policy_id` (string, required) — The policy applied to this request.
- `flagged` (boolean, required) — Whether any detector flagged this request
- `messages` (list of GuardMessage, required) — The conversation messages that were screened
- `results` (list of RequestResult, required) — Request-level detection results. Only includes detectors that flagged the request — unflagged detections are omitted.
- `msg_results` (list of MsgResult, required) — Message-level detection results. Only includes detectors that flagged an individual message — unflagged detections are omitted.
- `event_metadata` (string, required) — Custom metadata attached to the request at call time, serialized as a JSON string. Empty object (`{}`) if no metadata was provided.

### GuardMessage

A single message in a screened conversation

- `role` (string, required) — The message role (e.g. `user`, `assistant`, `tool`)
- `content` (string, required) — The text content of the message
- `content_parts_json` (string, required) — Structured content parts serialized as JSON, for multi-part messages
- `size` (string, required) — Size of the message content
- `index` (integer, required) — Position of the message in the conversation
- `name` (string, required) — Name field, present on tool and function messages
- `tool_calls` (list of any, required) — Tool calls made in this message, serialized as a JSON array
- `refusal` (string, required) — Model refusal content, if present
- `tool_call_id` (string, required) — ID linking a tool result back to its tool call

### RequestResult

A request-level detection result from a single detector

- `detector_type` (string, required) — The detector that produced this result
- `result` (string, required) — The detector's verdict

### MsgResult

A message-level detection result from a single detector

- `detector_type` (string, required) — The detector that produced this result
- `result` (string, required) — The detector's verdict
- `message_id` (integer, required, nullable) — Index of the message this result applies to
- `tool_id` (integer, required, nullable) — Index of the tool call this result applies to, if applicable

## Examples

**Request**

```json
{
  "start_time": "2025-01-01T00:00:00Z",
  "end_time": "2025-01-02T00:00:00Z",
  "limit": 100,
  "offset": 0,
  "flagged_only": false,
  "detected_only": false,
  "detector_types": []
}
```

**Response**

```json
{
  "logs": [
    {
      "request_uuid": "0196e8c7-3a12-7b6d-8f4a-2d8c9b1e3a5f",
      "timestamp": "2024-01-15T09:30:00Z",
      "project_id": "string",
      "policy_id": "string",
      "flagged": true,
      "messages": [
        {
          "role": "user",
          "content": "string",
          "content_parts_json": "string",
          "size": "string",
          "index": 1,
          "name": "string",
          "tool_calls": [
            null
          ],
          "refusal": "string",
          "tool_call_id": "string"
        }
      ],
      "results": [
        {
          "detector_type": "prompt_attack",
          "result": "detected"
        }
      ],
      "msg_results": [
        {
          "detector_type": "pii/email",
          "result": "detected",
          "message_id": 1,
          "tool_id": 1
        }
      ],
      "event_metadata": "string"
    }
  ],
  "has_more": true
}
```

**SDK Code**

```python Logs_getLogs_example
import requests

url = "https://platform.lakera.ai/api/v1-beta/logs"

payload = {
    "start_time": "2025-01-01T00:00:00Z",
    "end_time": "2025-01-02T00:00:00Z",
    "limit": 100,
    "offset": 0,
    "flagged_only": False,
    "detected_only": False,
    "detector_types": []
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript Logs_getLogs_example
const url = 'https://platform.lakera.ai/api/v1-beta/logs';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"start_time":"2025-01-01T00:00:00Z","end_time":"2025-01-02T00:00:00Z","limit":100,"offset":0,"flagged_only":false,"detected_only":false,"detector_types":[]}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Logs_getLogs_example
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.lakera.ai/api/v1-beta/logs"

	payload := strings.NewReader("{\n  \"start_time\": \"2025-01-01T00:00:00Z\",\n  \"end_time\": \"2025-01-02T00:00:00Z\",\n  \"limit\": 100,\n  \"offset\": 0,\n  \"flagged_only\": false,\n  \"detected_only\": false,\n  \"detector_types\": []\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Logs_getLogs_example
require 'uri'
require 'net/http'

url = URI("https://platform.lakera.ai/api/v1-beta/logs")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"start_time\": \"2025-01-01T00:00:00Z\",\n  \"end_time\": \"2025-01-02T00:00:00Z\",\n  \"limit\": 100,\n  \"offset\": 0,\n  \"flagged_only\": false,\n  \"detected_only\": false,\n  \"detector_types\": []\n}"

response = http.request(request)
puts response.read_body
```

```java Logs_getLogs_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://platform.lakera.ai/api/v1-beta/logs")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"start_time\": \"2025-01-01T00:00:00Z\",\n  \"end_time\": \"2025-01-02T00:00:00Z\",\n  \"limit\": 100,\n  \"offset\": 0,\n  \"flagged_only\": false,\n  \"detected_only\": false,\n  \"detector_types\": []\n}")
  .asString();
```

```php Logs_getLogs_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://platform.lakera.ai/api/v1-beta/logs', [
  'body' => '{
  "start_time": "2025-01-01T00:00:00Z",
  "end_time": "2025-01-02T00:00:00Z",
  "limit": 100,
  "offset": 0,
  "flagged_only": false,
  "detected_only": false,
  "detector_types": []
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Logs_getLogs_example
using RestSharp;

var client = new RestClient("https://platform.lakera.ai/api/v1-beta/logs");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"start_time\": \"2025-01-01T00:00:00Z\",\n  \"end_time\": \"2025-01-02T00:00:00Z\",\n  \"limit\": 100,\n  \"offset\": 0,\n  \"flagged_only\": false,\n  \"detected_only\": false,\n  \"detector_types\": []\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Logs_getLogs_example
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = [
  "start_time": "2025-01-01T00:00:00Z",
  "end_time": "2025-01-02T00:00:00Z",
  "limit": 100,
  "offset": 0,
  "flagged_only": false,
  "detected_only": false,
  "detector_types": []
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://platform.lakera.ai/api/v1-beta/logs")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```