Logs
API: logs, log-monitor, parsers
Security-log list/create: Security (limit default 100, offset 0).
GET /api/v1/logs
DELETE /api/v1/logs/:id
POST /api/v1/logs/cleanup
GET /api/v1/logs/audit
Purpose. Admin log list (same ListSecurityLogs as /security/logs for GET), delete one, cleanup, audit list.
Authentication. Admin except POST /api/v1/logs/batch (Agent).
Parameters. GET uses security-log query params when served by ListSecurityLogs.
Response. List: {logs,total,limit,offset}. Delete/cleanup: success gin.H. Audit: API_SCHEMA_DOCUMENTATION_BLOCKED if distinct from /auth/audit-logs.
Errors. 400 invalid id; 500 cleanup/list failures.
Edition. SHARED.
POST /api/v1/logs/batch
Purpose. Agent batch security-log ingest (CreateBatchSecurityLogs).
Authentication. Agent JWT + CapabilitySecurityLogIngest.
Audience. Agent-facing — not a browser cookbook.
Request/response. See Security batch section.
POST /api/v1/frontend-logs/batch
Purpose. Console frontend log ingest (FrontendLogsHandler).
Authentication. Inventory: admin JWT unless noted.
Request. API_SCHEMA_DOCUMENTATION_BLOCKED — CreateBatchFrontendLogs binds a slice/gin.H.
Edition. SHARED. Agent-facing ingest is not a browser cookbook.
Log monitor
GET /api/v1/log-monitor/events
GET /api/v1/log-monitor/events/:ip
GET /api/v1/log-monitor/stats
POST /api/v1/log-monitor/events
POST /api/v1/log-monitor/events/batch
POST /api/v1/log-monitor/custom-events/batch
POST /api/v1/log-monitor/success-events/batch
Purpose. Login-failure / custom / success event ingest and list (LogMonitorHandler).
Authentication. Admin for GET; batch POSTs may be Agent-facing in live middleware — treat ingest as Agent-facing if Agent JWT is required. Router: log-monitor group is mixed; document GET as admin.
Request (create). Domain login-failure / custom event request structs (PrivilegeEscalationEventRequest, CustomPatternRequest family). Batch: API_SCHEMA_DOCUMENTATION_BLOCKED for wrapper key.
Edition. SHARED.
Custom parsers
GET /api/v1/log-parsers/custom
GET /api/v1/log-parsers/custom/:id
PUT /api/v1/log-parsers/custom/:id
DELETE /api/v1/log-parsers/custom/:id
PATCH /api/v1/log-parsers/custom/:id/enabled
POST /api/v1/log-parsers/custom/test
Purpose. Custom regex parsers (CustomParserHandler).
Authentication. Admin.
Request (CustomPatternRequest): name, service, regex, log_file_path required; severity oneof low/medium/high/critical; enabled; description.
Response. CustomPattern JSON: id, name, service, regex, log_file_path, severity, enabled, description, created_by, version, timestamps.
Test. API_SCHEMA_DOCUMENTATION_BLOCKED for sample-line payload.
Edition. SHARED.
Security. Regex is operator-controlled; do not log matched secrets.