Skip to main content

API - hosts, metrics, events, logs and security

All paths are relative to https://api.wakora.io/v1/ and need Authorization: Bearer <token>; see the overview for scopes and errors.

Hosts and inventory​

MethodEndpointScopeWhat it does
GET/hostsreadThe fleet: every host with status, meters, agent version.
GET/hosts/overview?server=<uuid>readOne host's overview block: meters, services, sites, open incidents.
GET/hosts/{uuid}readHost detail.
PATCH/hosts/{uuid}adminEdit the host's identity: label, tags (comma-separated), comment.
GET/hosts/{uuid}/inventory?kind=readDiscovery inventory; kind filters: process, port, package, unit, vhost, service, cronjob, docker, guest, device, net.
GET/hosts/{uuid}/checksreadLatest result of every check on the host.
GET/hosts/{uuid}/uptimereadHeartbeat-minute uptime ratio over a window.
GET/hosts/{uuid}/uptime-dailyreadPer-day uptime.
GET/hosts/{uuid}/rulesreadAlert rules as they effectively apply to this host, per-host overrides included.

Metrics​

Metric names and tags are in the metrics reference. Series are returned at the resolution the window allows: raw points for short windows, one-minute, one-hour or one-day rollups for longer ones, each point carrying min, max, average and the last value.

MethodEndpointScopeWhat it does
GET/metrics?server=&name=&from=&to=readOne metric's series on one host. name is an exact metric name.
GET/metrics/names?server=readDistinct metric names seen in the last 24 hours; omit server for the whole workspace. Use it to discover what a host produces before querying.
GET/metrics/latest?server=&name=readLatest value per series.
GET/metrics/latest-by-tag?server=&name=&tag=readLatest value per tag value: per mount, per site, per pool.
GET/metrics/batch?server=&names=readSeveral series in one call; names is a comma-separated list of exact names.
GET/metrics/sum-by-tag?server=&name=&tag=&from=&to=readWindow sums per tag value, for counters that must be summed rather than averaged.

Gauges (a certificate's days left, a queue depth) are read as the last value of a bucket; rates are averaged. A series that stopped is simply absent past its last point; the API never fills zeros.

Events, checks, insights​

MethodEndpointScopeWhat it does
GET/events?server=&kind=&from=&to=&limit=readThe event feed: up and down, agent updates, deploys, discovery changes, integrity changes, anomalies, insights, staged-change notices. One kind per call.
GET/events/daily?tz=readPer-day event counts by category, days sliced in the given IANA time zone.
GET/checks?server=readLatest check results fleet-wide or for one host.
GET/insightsreadInsights: N+1 query findings, disk-full forecasts, pool sizing hints, deployment audits.

Ask for one kind per call rather than pulling everything and filtering: the feed is newest-first with a limit, and on a busy workspace a wide pull returns hours, not days.

Logs​

MethodEndpointScopeWhat it does
GET/logs?q2=&server=&service=&level=&from=&to=readFull-text search; q2 is the needle (whole tokens match through the index, a phrase or a token containing _ falls back to a substring match).
GET/logs/tail?since=&server=&service=&level=readLive tail: lines after the cursor; the answer carries the next since.
GET/logs/stats?server=&service=&level=&q2=readVolume and level counters over the same filters.
GET/logs/daily?tz=readPer-day line counts by level.

Log windows are clamped to the log search depth of your plan. Lines arrive already redacted by the agent; what the API returns is what the console shows.

Security​

MethodEndpointScopeWhat it does
GET/security/overview?server=readPending updates, SSH doors, integrity changes, hardening score and CVE counters for the workspace or one host.
GET/security/daily?tz=readPer-day security signals: authentication failures, root logins, integrity changes, brute-force alerts, OOM kills.
GET/security/cvereadKnown vulnerabilities matched against installed packages: identifier, severity and who assigned it, fixed version where one exists in the host's release, exploited-in-the-wild flag, affected hosts.