Access events (paginated)

Opaque keyset cursor from the previous page's next_cursor. Omit for the first page.

Target page size (1–1000). Defaults to the endpoint's page size when omitted.

A page may exceed this. req_id is not unique here either, so a page that would end mid-request is extended with that request's remaining rows (up to 512). Ending mid-request is what would make the keyset cursor skip rows. Size a viewport on the rows actually returned.

Relative look-back window. Ignored when from/to are supplied.

Inclusive window start, ISO-8601. Use together with to for an explicit range instead of time_range.

Exclusive window end, ISO-8601. Defaults to now when only from is given.

Free-text substring match against the request URI. Matched with lower(uri) LIKE '%needle%', so separators (/, -, _, ., :) are fine. Control bytes are rejected; min 3 chars, max 128.

On an aggregate endpoint a search is answered from the raw table, whose read is bounded: past ACCESS_RAW_ROW_CAP rows scanned the response is capped: true. The floor is not cosmetic: access_logs_v1 has no index on uri, so a 1–2 char needle scans the owner's slice for a match that would hit nearly every row.

Include rows where status_code (HTTP response status code) is one of the given values. Repeat the parameter to pass multiple values.

Exclude rows where status_code (HTTP response status code) is none of the given values. Repeat the parameter to pass multiple values.

Include rows where status_code (HTTP response status code) falls within an inclusive numeric range (SQL BETWEEN lo AND hi). Pass the parameter exactly twice: first the lower bound, then the upper bound.

Include rows where network (blockchain network (chain-qualified)) is one of the given values. Repeat the parameter to pass multiple values. Pass (empty) to match rows with no network (unattributed traffic).

Exclude rows where network (blockchain network (chain-qualified)) is none of the given values. Repeat the parameter to pass multiple values. Pass (empty) to match rows with no network (unattributed traffic).

Include rows where chain (blockchain — the parent of network) is one of the given values. Repeat the parameter to pass multiple values. Pass (empty) to match rows with no chain (unattributed traffic).

Exclude rows where chain (blockchain — the parent of network) is none of the given values. Repeat the parameter to pass multiple values. Pass (empty) to match rows with no chain (unattributed traffic).

Include rows where method (HTTP / RPC method) is one of the given values. Repeat the parameter to pass multiple values.

Exclude rows where method (HTTP / RPC method) is none of the given values. Repeat the parameter to pass multiple values.

Include rows where method (HTTP / RPC method) contains this substring (SQL LIKE '%value%').

Include rows where remote_ip (client IP address, IPv4 or IPv6 (IPv6 matched in canonical form)) is one of the given values. Repeat the parameter to pass multiple values.

Exclude rows where remote_ip (client IP address, IPv4 or IPv6 (IPv6 matched in canonical form)) is none of the given values. Repeat the parameter to pass multiple values.

Include rows where source (traffic source / attribution channel) is one of the given values. Repeat the parameter to pass multiple values. Pass (empty) to match rows with no source (unattributed traffic).

Exclude rows where source (traffic source / attribution channel) is none of the given values. Repeat the parameter to pass multiple values. Pass (empty) to match rows with no source (unattributed traffic).

Include rows where req_id (request id — NOT unique, may match unrelated requests) is one of the given values. Repeat the parameter to pass multiple values.

Include rows where event_id (opaque per-event id from the events list (exact single-event lookup)) is one of the given values. Repeat the parameter to pass multiple values.