GET /v1/config/log-sources

Returns the log sources configured on the current project. Credentials are never returned — only metadata, the sources array, and the most recent test result.

Authentication

API key with config:read permission. Project-scoped or tenant-scoped (with X-Project-Id).

Endpoint

GET /v1/config/log-sources

Response

200 OK

{
  "success": true,
  "data": [
    {
      "id": "ls_a1b2c3d4-...",
      "tenantId": "tnt_x1y2...",
      "type": "cloudwatch",
      "name": "prod-cloudwatch",
      "sources": [
        "/aws/lambda/checkout-api",
        "/aws/lambda/billing-worker"
      ],
      "isActive": true,
      "lastTestedAt": "2026-04-25T12:00:00Z",
      "lastTestResult": {
        "success": true,
        "message": "Connected successfully"
      },
      "createdAt": "2026-04-12T09:14:00Z"
    }
  ]
}

Field	Type	Notes
`id`	UUID	The log source id
`type`	string	One of `cloudwatch`, `datadog`, `loki`, `splunk`, `elastic`, `gcp_logging`
`name`	string	Human-readable label
`sources`	`string[]`	The log groups, indexes, or selectors this source queries
`isActive`	boolean	When `false`, the source is skipped during analyses
`lastTestedAt`	ISO 8601 \| null	When the source was last tested
`lastTestResult`	object \| null	`{ success, message }` from the most recent test
`createdAt`	ISO 8601	When the source was created

The list is not paginated — log sources per project are bounded by your plan's logSourcesPerProject quota.

Error responses

Status	`error.code`	When
401	`UNAUTHORIZED`	Missing or invalid API key
403	`FORBIDDEN`	Key lacks `config:read`

Example

curl https://api.sigsentry.com/v1/config/log-sources \
  -H "Authorization: Bearer ss_secret_..."