---
title: "Query your own org's diagnostic log lines (self-serve)"
method: POST
path: "/me/logs/query"
tags: ["Auth"]
---

# Query your own org's diagnostic log lines (self-serve)

`POST /me/logs/query`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/me/logs/query`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`
  - API key in cookie `mnemom_session`

MNE-382 (O8 supportability). Returns a STRUCTURED, ALLOWLISTED PROJECTION of the authenticated caller's OWN org's diagnostic log lines from the Tier-3 Loki mirror — operational metadata only (timestamp, level, event type, request_id, agent_id, status, duration_ms, http method, route template). The raw log body and any free-text `error` / `stack` / `message` / prompt / request-body content are never returned (GDPR data minimization). The org is resolved SERVER-SIDE from the authenticated identity and force-injected as the query scope; a caller can never name the org or supply a raw query (`org_id` / `query` / `selector` in the body → 400). Restricted to owner/admin/auditor. Fails closed: no resolvable org → 403; Loki creds unconfigured → 503.

## Request body

- object: All fields optional. The query is always scoped to your org server-side; `org_id` / `query` / `selector` / `stream` are rejected (400).
  - `level` 'debug' | 'info' | 'warn' | 'error': Filter to a single severity level.
  - `request_id` string: Filter to a single request_id.
  - `agent_id` string: Filter to a single agent_id.
  - `contains` string: Bounded substring line-filter term (max 128 chars).
  - `start` union: Window start (ISO-8601 or epoch-ms). Clamped to at most 7 days before `end`.
    - string
    - number
  - `end` union: Window end (ISO-8601 or epoch-ms). Clamped to now.
    - string
    - number
  - `limit` integer: Max entries to return (default 100, capped at 500).

## Response `200`

Allowlisted operational-metadata projection of the org's matching log lines.

- object
  - `org_id` string, required: The server-resolved org the query was scoped to.
  - `query` string, required: The server-built LogQL query.
  - `count` integer, required
  - `entries` object[], required
    - `ts` string, required: Loki nanosecond timestamp.
    - `timestamp` string
    - `level` string
    - `event` string: Structured event TYPE token.
    - `request_id` string
    - `agent_id` string
    - `status` integer
    - `duration_ms` number
    - `method` string
    - `route` string: Route template (never a raw path).

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.
- `502`: The log backend query failed or was unreachable.
- `503`: Self-serve log query is not available in this environment.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)