> ## Documentation Index > Fetch the complete documentation index at: https://docs.mezmo.com/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve a list of AI investigations for the account > Retrieve a list of AI investigations for the account. ## OpenAPI ````yaml /apis/combined-mezmo-api.yaml get /v3/ai-history/investigation openapi: 3.1.0 info: title: Mezmo API description: >- *REST API for the Mezmo platform: send and export log data, build and manage telemetry pipelines, and administer enterprise accounts.* To use the inline testing functionality here, go into your Mezmo account and add the following address to your CORS Origins page: `https://docs.mezmo.com`. version: 3.0.0 contact: name: Mezmo email: support@mezmo.com url: https://mezmo.com/support servers: - url: https://api.mezmo.com security: - AccessToken: [] tags: - name: Account description: Perform account level actions - name: Alerting description: API to control alerts on pipelines - name: Archiving description: > >*Authentication*: You can find instructions on authentication [here](/log-analysis-api/ref#authentication). The LogDNA Archiving API enables you to programmatically configure your archiving instances via code. Specifically you can set up cold storage buckets to send your logs for long term storage. - name: Board description: > >*Authentication*: You can find instructions on authentication [here](/log-analysis-api/ref#authentication). The LogDNA's API's Board endpoints are used to create, get, list, and delete boards. - name: Configuration description: > >*Authentication*: You can find instructions on authentication [here](/log-analysis-api/ref#authentication). The LogDNA API's Configuration endpoints are used to create, update, and delete views, alerts, and categories. - name: Data Classification & Profiling description: API for classifying and profiling data - name: Edge - Local Deploy description: User routes that are available to use with local Edge instances - name: Enterprise description: Routes for management enterprise level resources - name: Enterprise v1 description: Legacy enterprise management endpoints, superseded by the Enterprise API. - name: Exclusions description: > >*Authentication*: You can find instructions on authentication [here](/log-analysis-api/ref#authentication). Control what you store by creating exclusion rules. New lines that match an exclusion rule will not be stored and will not count toward your storage quota. - name: Export description: > LogDNA provides two endpoints for exporting your log lines. Read the sections below to learn about each, and determine which is appropriate for your use case. ## Export API v1 The Export API v1 is used to export log lines in [JSONL](https://jsonlines.org/) format. Based on your specific plan, the maximum number of logs returned is limited to 10,000 / 20,000. There are two distinct functionalities: 1. Streaming desired log lines directly from the response as raw text data 2. Specifying an email to receive a link that can be used to the download the desired log lines > Note > When an email address is specified, the desired log lines will not be streamed to the response body. > The response will instead send a notification indicating that the request was successful and that the results > will be sent to the email address provided in the request. This entails archiving and uploading the desired logs > to a storage provider. The email includes a URI to download the logs. Be aware that access to this URI will expire > after 24-48 hours. ## Export API v2 The Export API v2 provides an enhancement over v1, allowing you to export any number of log lines using pagination and by-passing the plan-specific limit imposed in v1. By making (multiple) subsequent requests using the `pagination_id` parameter, you can retrieve logs in batches of JSON until all matching log lines have been returned. Each Export API v2 request is limited to 10,000 lines. ### Pagination Functionality Pagination is only necessary when the desired set of log lines is larger than 10,000, since this is the maximum number of results that can be returned in a given page. If an export does not exceed this size, the behavior is similar to v1 -- all of the logs will be returned in a single "page" and no further requests are needed. When an export does exceed this size, refer to the steps outlined below. This is the expected workflow to export a set (cardinality > 10,000) of log lines that requires pagination: 1. Send an initial request with valid query parameters to retrieve logs. Pass a `null` value for the `pagination_id` in the first request. 2. The JSON response contains 2 fields: `lines` and `pagination_id`. The former is an array containing the corresponding batch (the first batch in this case) of logs and the latter is a token used to retrieve the next page of results. 3. Send a subsequent request using the same initial query parameters and also passing in the token received in the response to the `pagination_id` parameter. This will retrieve the next page of results. 4. Repeat this request-response cycle, updating the `pagination_id` parameter with the token returned in every new response, until the response eventually returns a `null` value for the token. This indicates that the corresponding batch of logs is the last and that you have reached the final page. > Important Considerations > In subsequent requests to paginate through results, make sure none of the query parameters & values are modified from the initial request > (excluding `pagination_id`) > The tokens used in the `pagination_id` parameter are tied to a specific export and page so they can be used repeatedly in requests to return > deterministic results > "0" can be passed in to the `from` and `to` parameters which will be resolved to timestamps for a plan's retention boundary and the current > time respectively. This behavior is independent so the value can be passed interchangeably to the parameters -- resulting in 4 possible scenarios: > - [`from`: \, `to`: \] > - [`from`: 0 (retention boundary), `to`: \] > - [`from`: \, `to`: 0 (current time)] > - [`from`: 0 (retention boundary), `to`: 0 (current time)] - name: Groups description: >- Manage log groups that scope which data is accessible to members in that group. - name: Incident Mode description: Change or read state of pipeline (incident mode on/off) - name: Index Rate Alert description: Configure alerts that fire when the log index rate crosses a threshold. - name: Ingestion description: Ingestion API - name: investigation description: Routes related to AI investigations - name: Keys description: Create and manage ingestion and service keys for an account. - name: Log Volume Reduction description: CRUD operations for log volume reduction - name: Members description: Manage organization members, their roles, and RBAC group assignments. - name: Metrics description: Usage metrics for pipelines - name: Parsing Template description: Manage custom log parsing templates. - name: Pipeline Export description: Export pipeline to terraform - name: Pipeline Management description: CRUD Operations for pipeline - name: Pipeline Nodes description: CRUD operations for sources, processors, and destinations - name: Processor Groups description: CRUD operations for Processor Groups - name: Sampling and Simulation description: >- Create samples of data and run them through a simulated pipeline without affecting your published pipeline - name: Screens description: Create and manage custom UI layouts for display on large format screens. - name: Shared Sources description: Create and manage sources for use across multiple pipelines - name: Suspensions description: > >*Authentication*: You can find instructions on authentication [here](/log-analysis-api/ref#authentication). The LogDNA Start/Stop Ingestion API allows users to programmatically manage their data ingestion status. Users can get the current status of their ingestion, suspend their ingestion, and resume their ingestion. To prevent an accidental API call, the suspension of ingestion requires two subsequent API calls. > You can find instructions on authentication [here](/log-analysis-api/ref#authentication). - name: Usage v1 description: > >*Authentication*: You can find instructions on authentication [here](/log-analysis-api/ref#authentication). The Usage API provides endpoints for retrieving aggregated usage information for applications, hosts and tags during a time period. While the `to` and `from` times are unix timestamps, the report is granular by day. Therefore only the day portion is used to establish a date range. ### How is **Usage** defined? This API defines usage as a percentage of the total number of lines ingested by the account within the defined period of time. For example, an app called `myapp` that returns a percentage of `15` in the response object has 15 percent of their logs coming from `myapp`. - name: Usage v2 description: > >*Authentication*: You can find instructions on authentication [here](/log-analysis-api/ref#authentication). The Usage API provides endpoints for retrieving aggregated usage information for applications, hosts and tags during a time period. While the `to` and `from` times are unix timestamps, the report is granular by day. Therefore only the day portion is used to establish a date range. ### How is **Usage** defined? This API defines usage as the number of bytes used by the log lines stored on disk by the account within the defined period of time. For example, an app called `myapp` that returns `150,000` total bytes in the response object indicates that `myapp` is consuming `150,000` bytes of disk storage over the time range. externalDocs: url: https://docs.mezmo.com paths: /v3/ai-history/investigation: get: tags: - investigation summary: Retrieve a list of AI investigations for the account description: Retrieve a list of AI investigations for the account. operationId: listAiInvestigations parameters: - schema: type: string enum: - triggered - investigating - completed in: query name: state required: false description: The state of the investigation. - schema: type: string maxLength: 24 pattern: ^[a-f0-9]{24}$ example: 69a5fa238212825f582445da in: query name: last_id required: false description: |- The identifier of the last record returned. Used to retrieve the next sequence of paginated records. - schema: type: string maxLength: 30 format: date-time in: query name: updated_since required: false description: Filter investigations updated since the specified date and time. - schema: type: number minimum: 1 maximum: 1000 default: 1000 examples: '100': value: 100 '500': value: 500 '1000': value: 1000 in: query name: limit required: false description: The maximum number of records to return. responses: '200': description: Response schema for listing AI investigations. content: application/json: schema: additionalProperties: false type: object title: ListAiInvestigationResponse description: Response schema for listing AI investigations. properties: meta: type: object description: >- Contains additional contextual information about the api response. properties: type: type: string description: >- A human readible identifier denoting the resource type. minLength: 1 maxLength: 50 page: type: object properties: next: type: string nullable: true maxLength: 256 previous: type: string nullable: true maxLength: 256 pk: type: string description: >- Indicates the data property which holds the resource identifier. nullable: true maxLength: 50 links: type: object description: >- An object containing uri templates to this, and related resources. properties: self: type: object related: type: object description: >- Additional URI templates for interacting with resources which are tightly related. required: - self required: - type - page - pk - links data: type: array maxItems: 1000 items: $ref: '#/components/schemas/ai-investigation' required: - meta - data '400': description: >- A normalized representation of an error that is returned from an http request in response to failed input validation content: application/json: schema: $ref: '#/components/schemas/validation-error' '401': description: >- A normalized representation of an error that is returned from an http request content: application/json: schema: $ref: '#/components/schemas/http-error' '429': description: >- A normalized representation of an error that is returned from an http request content: application/json: schema: $ref: '#/components/schemas/http-error' '500': description: >- A normalized representation of an error that is returned from an http request content: application/json: schema: $ref: '#/components/schemas/http-error' 5XX: description: >- A normalized representation of an error that is returned from an http request content: application/json: schema: $ref: '#/components/schemas/http-error' 4XX: description: >- A normalized representation of an error that is returned from an http request content: application/json: schema: $ref: '#/components/schemas/http-error' security: - AccessToken: [] components: schemas: ai-investigation: type: object title: AI Investigation description: Represents an AI investigation. properties: id: type: string minLength: 24 maxLength: 24 description: Identifier of an investigation. example: 699dc0224d832d309c9bb92a account: type: string maxLength: 10 description: A shorthand identifier for the associated account. example: f02c19e195 trigger_source: type: string minLength: 1 maxLength: 254 description: Identifier of the source that triggered the investigation. example: 'Pipeline Alert: disk errors' linked_alert_id: type: string maxLength: 36 description: The ID of the linked alert that triggered the investigation. example: 123e4567-e89b-12d3-a456-426614174000 evidence_refs: type: string maxLength: 100000 description: |- Information about the conditional evidence that was used to create the investigation example: It appears a service named XXXX has been returning many 400 errors confidence_score: type: number minimum: 0 maximum: 1 description: |- A score between 0 and 1 indicating the confidence level of the investigation. suggested_resolution: type: string maxLength: 100000 description: >- Research finding and suggested resolution information for the investigation. This is a mixed-use field generally containing a serialized JSON string representing the structure: { summary: string, timeline: [{ datetime: string, value: string }], root_cause: string, remediation_steps: string[], linked_investigations: string[] } NOTE 1: String fields within this structure may or may not contain markdown. NOTE 2: The timeline date is ISO 8601, e.g. 2024-06-19T12:00:00Z. NOTE 3: The linked_investigations field contains investigation IDs. resolution_status: type: string maxLength: 100 description: The status of the investigation resolution. state: type: string enum: - triggered - investigating - completed description: The state of the investigation. created_at: type: string maxLength: 30 format: date-time description: The date and time when the investigation was created. updated_at: type: string maxLength: 30 format: date-time description: The date and time when the investigation was last updated. validation-error: type: object title: Validation Error description: >- A normalized representation of an error that is returned from an http request in response to failed input validation properties: status: type: integer minimum: 300 maximum: 599 format: int32 description: The HTTP status code the error is associated with context: type: string description: >- The portion of the inbound request which triggered the validation failure enum: - body - querystring - params - headers code: type: string maxLength: 35 description: A textual classifier of the error or failure message: type: string maxLength: 200 description: A message describing the nature of the error or failure errors: type: array maxItems: 200 description: >- List of metadata objects describing validation failures or contextual information items: $ref: '#/components/schemas/http-error-item' required: - status - code - message http-error: type: object title: HTTP Error description: >- A normalized representation of an error that is returned from an http request properties: status: type: integer minimum: 300 maximum: 599 format: int32 description: The HTTP status code the error is associated with context: type: string description: >- The portion of the inbound request which triggered the validation failure enum: - body - querystring - params - headers code: type: string maxLength: 35 description: A textual classifier of the error or failure message: type: string maxLength: 200 description: A message describing the nature of the error or failure errors: type: array maxItems: 200 description: >- List of metadata objects describing validation failures or contextual information items: $ref: '#/components/schemas/http-error-item' required: - status - code - message http-error-item: type: object title: HTTP Error Item additionalProperties: true properties: keyword: type: string maxLength: 30 description: >- An indication of the type of rule or error that caused the request to fail instance_path: type: string maxLength: 200 nullable: true default: null description: JSON Pointer to the location in the data instance schema_path: type: string maxLength: 200 nullable: true default: null description: JSON Pointer to the location of the failing keyword in the schema params: type: object additionalProperties: true description: >- Additional information about the error that can be used to generate error messages property_name: type: string maxLength: 100 nullable: true default: null description: Set for errors in `propertyNames` keyword schema message: type: string maxLength: 200 description: A message describing the nature of the error or failure required: - keyword - params - message securitySchemes: AccessToken: type: apiKey in: header name: Authorization description: >- The primary authentication method for the Mezmo API. Pass the key in the `Authorization` header in the format `Token `. For example: ``` curl -H 'Authorization: Token ' ``` This key is used for all APIs with the exception of ingest. ````