API Reference - ProvenLog

All API endpoints are served under the /v1/ prefix when running plog serve.

Base URL

http://localhost:7600/v1

When the server is started with --api-keys, all endpoints require a Bearer token:

curl -H "Authorization: Bearer your-api-key" http://localhost:7600/v1/events

Method	Path	Description
`POST`	`/v1/events`	Ingest a single event
`POST`	`/v1/batch`	Ingest multiple events (207 on partial failure)

Method	Path	Description
`GET`	`/v1/events`	List events with filters
`GET`	`/v1/events/:id`	Get a single event by ID
`GET`	`/v1/search`	Full-text search
`GET`	`/v1/agents`	List agents with event counts
`GET`	`/v1/stats`	Aggregate statistics

Method	Path	Description
`POST`	`/v1/policy/check`	Run policy checks against the audit trail

Method	Path	Description
`GET`	`/v1/stream`	WebSocket live event stream

Method	Path	Description
`GET`	`/v1/dashboard/config`	Dashboard feature configuration
`POST`	`/v1/traces`	OTLP trace receiver (when `--otlp` is enabled)

The API uses standard HTTP status codes:

Status	Description
`200`	Success
`201`	Created (single event or full batch success)
`207`	Multi-status (batch endpoint — partial failure)
`400`	Bad request (validation error)
`401`	Unauthorized (missing or invalid API key)
`404`	Not found
`500`	Internal server error