---
title: "List application logs"
method: GET
path: "/clusters/{cluster_id}/logs"
tags: ["Cluster Logs"]
---

# List application logs

`GET /clusters/{cluster_id}/logs`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/logs`
- Auth: API key in header `API-Key`

Returns Keycloak application logs for the cluster, sorted by `created_at` (newest first by default).

When neither `start_time` nor `end_time` is provided the query covers the last hour.
The maximum date range is 90 days. Requests outside the log retention window return an empty result set.

Required scope: `clusters:logs:read`

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `limit` integer
- `offset` integer
- `level` 'info' | 'warn' | 'error' | 'debug'
- `start_time` string, date-time
- `end_time` string, date-time
- `search` string
- `category` string
- `thread_name` string
- `order` 'asc' | 'desc': Sort direction.

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- ClusterLog[]
  - `timestamp` string, date-time, required
  - `level` 'info' | 'warn' | 'error' | 'debug', required
  - `message` string, required
  - `source` string, required: Keycloak logger or component that produced this entry.
  - `category` string, required: Fully-qualified Java package or class name.
  - `thread_name` string, required: Normalized Keycloak thread name.

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `402`: Client error
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)