---
title: "Read a space's edge logs"
method: GET
path: "/v1/spaces/{spaceId}/logs/edge"
tags: ["Activity"]
---

# Read a space's edge logs

`GET /v1/spaces/{spaceId}/logs/edge`

## Request

- Base URL: `https://api.spacefast.com`
- URL: `https://api.spacefast.com/v1/spaces/{spaceId}/logs/edge`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Returns edge requests for one hostname assigned to this space, newest first. Defaults to the primary hostname and the past hour. Use a window of at most one hour within the past 24 hours. Plan retention can shorten the window. Filters within one field use OR; different fields use AND. Results include cache, timing, client, and security details. Access credentials in URLs are redacted. Cursors page a fixed snapshot and expire after five minutes. When using a cursor, the original window and filters apply. A truncated window requires a smaller time range or more filters. This is not a live stream.

## Path parameters

- `spaceId` string, required

## Query parameters

- `limit` integer: Page size.
- `cursor` string: Opaque cursor from the previous page's `nextCursor`.
- `since` union: Start of the log window.
  - string, date-time
  - string
- `until` union: End of the log window.
  - string, date-time
  - string
- `hostname` string: Domain assigned to this space. Defaults to its primary hostname.
- `remoteAddr` union[]: Include these client IP addresses. Repeat the query parameter for multiple values.
  - union
    - string, ipv4
    - string, ipv6
- `ja3Hash` string[]: Include these JA3 TLS fingerprints. Repeat the query parameter for multiple values.
- `method` string[]: Include these HTTP methods. Repeat the query parameter for multiple values.
- `status` integer[]: Include these HTTP status codes. Repeat the query parameter for multiple values.
- `userAgent` string[]: Include these exact User-Agent values. Repeat the query parameter for multiple values.
- `asn` integer[]: Include these autonomous system numbers. Repeat the query parameter for multiple values.

## Response `200`

Response for status 200

- object
  - `$schema` string, uri: Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.
  - `data` object[], required
    - `timestamp` string, date-time, required
    - `hostname` string, required
    - `method` string, required
    - `path` string, required: Request path and query string. Access credentials are redacted.
    - `status` integer, required
    - `remoteAddr` string, nullable, required
    - `remoteUser` string, nullable, required
    - `ja3Hash` string, nullable, required
    - `protocol` string, nullable, required
    - `referer` string, nullable, required
    - `userAgent` string, nullable, required
    - `durationMs` number, nullable, required
    - `countryCode` string, nullable, required
    - `contentType` string, nullable, required
    - `proxyType` string, nullable, required
    - `cacheStatus` string, nullable, required
    - `rateLimited` boolean, nullable, required
    - `rateLimitReason` string, nullable, required
    - `asn` number, nullable, required
    - `defensiveMode` object, required
      - `cookieStatus` string, nullable, required
      - `challengeReason` string, nullable, required
      - `challengeResult` string, nullable, required
  - `pagination` object, required
    - `nextCursor` string, nullable, required: Opaque cursor for the next page; null when there are no more results.
    - `hasMore` boolean, required: Whether another page exists after this one.
  - `warnings` object[]: List diagnostics. edge_logs_truncated includes the query window and result limit; use a smaller window or more filters.
    - `code` string, required: Stable snake_case diagnostic code naming the public contract that produced it.
    - `severity` 'info' | 'warning' | 'error', required: How actionable the diagnostic is.
    - `message` string, required: Human-readable explanation with enough detail to act on.
    - `path` string, nullable: Artifact path the diagnostic points at, for example "_headers:12", when one exists.
    - `provider` 'infra' | 'dns' | 'registrar' | 'runtime', nullable: Upstream system the diagnostic originated from, when not Spacefast itself.
    - `details` object, nullable: Machine-readable context for the diagnostic code.
    - `fix` string, nullable: Concrete, agent-actionable remediation hint, when one can be derived.
    - `retryable` boolean, nullable: Whether retrying the same operation can resolve this diagnostic without the caller changing anything.

## Other responses

- `default`: Problem details (RFC 9457). Any 4xx/5xx response is one `application/problem+json` document.

---

[API](https://skmtc.dev/spacefast/apis/spacefast-api.md) · [All operations](https://skmtc.dev/spacefast/apis/spacefast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/spacefast/apis/spacefast-api/revisions/bd165bc7c983?raw)