errors

GET /v1/orgs/{orgSlug}/projects/{projectName}/error-releases

Viewer and errors:read. Counts completed front-proxy HTTP attempts, including assets, proxy failures and closed upgrades, not native invocations, cron, DOs or in-flight work. Rates are observed-only; crash-free native request/user fields are null. Unknown, dropped or unjoined observations suppress rates. Verified organization-access subjects alone can enter the known-user subset; no event/header user claims. Receipts retain 24 hours; anonymous minute counters retain 32 days. Last 50 deployments, 24-hour view. Fifteen complete minutes after an observed switch compare with the actual predecessor at the same UTC time a day earlier. At least 200 requests/window and complete observed source coverage are required. Insight is not causal proof and never triggers rollback.

operationId getReleaseHealth

GET /v1/orgs/{orgSlug}/projects/{projectName}/error-releases/{version}/issues

Viewer and errors:read. One row per recorded issue and kind, choosing its earliest transition in the closed window (event ID breaks timestamp ties), ordered by that timestamp then issue ID descending. Pass the release summary's windowStart/windowEnd to investigate its distinct-issue counts. Current status is not a historical filter: an issue resolved later remains in its recorded release. Browser events are excluded. Pages contain at most 50 issues. Cursor is bound to project, version, kind and window. A fixed window is not a frozen database snapshot: late delivery, erasure and the existing 32-day transition retention can change membership between reads. Refresh to reconcile. Retained transitions survive missing issue/event bodies. Labels describe only surviving current issues; issueAvailable=false omits them. eventAvailable requires a surviving issue and the exact event still belonging to that issue with a stored body. Missing, moved or bodyless events never fall back to latest, another issue or release. This read does not capture events, change settings or extend retention.

operationId listReleaseIssues

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors

Issues group error events by fingerprint (docs/customer-error-tracking.md §6). Events come from three origins: platform (out of memory, crashes, boot and build failures, failed cron runs, requests the platform answered because the app could not), app (what the project's code threw or reported), and browser.

Event bodies are kept for keepDays; issues and their counts outlive them.

operationId listErrorIssues

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors-erasure

The user ID is exact and project-scoped, in the body so it stays out of URL logs. Removes their event bodies and linked replays, and conservatively clears all AI outputs in this project because their user attribution can outlive an event. Anonymous occurrence, trend and billing counters remain; affected summaries are cleared. Queued old reports cannot restore the data. Future occurrences after the erasure cut-off can be captured. Does not rewrite repository history or recall data already sent to an explicitly requested AI provider. A token needs org:admin.

operationId eraseErrorUser

Request body: application/json · object

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}

One issue with its latest event, tag distribution and history

operationId getErrorIssue

PATCH /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}

resolved with resolveIn: next_release resolves the issue when the next deployment goes live; an event from an older release does not reopen it. archived with archiveUntil: escalating (the default) brings the issue back when its hourly count rises well above its baseline; a duration such as 24h brings it back after that. Needs the member role.

operationId updateErrorIssue

Request body: application/json · ErrorIssueUpdate

DELETE /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}

Deletes the issue, events, linked replay blobs and derived AI outputs. Requires admin; a token needs org:admin. Unmerge the issue and its merged sources first (409 unmerge_required); no merged source is silently cascaded. Anonymous monthly usage remains. Retries are idempotent; old queued occurrences cannot restore erased data, while a new occurrence after deletion may create a new issue.

operationId deleteErrorIssue

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/insights

Source lines, suspect commits and CODEOWNERS read at the stored event's deployment commit (docs/customer-error-tracking.md §8–§9). Without eventId, selects the newest stored event body for backward compatibility. An explicit eventId selects only a currently matching project/issue row with a stored body; missing, foreign, erased, bodyless or moved events return 404, never latest. Release, commit and repository come from stored platform records, not query hints. A readable event without usable Git returns 200 with available=false and a reason. The response eventId echoes the actual row even for unavailable Git answers; clients using explicit selection must verify it matches, including on older CPs. Commit authors are unverified claims; email is returned only for one verified org member. CODEOWNERS handles grant nothing. Viewer/errors:read is unchanged.

operationId getErrorInsights

PUT /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/assignee

Member. userId must be a member of the project's org (422 not_a_member otherwise); null clears. An assignment is a label for triage and grants nothing. A merged source is 409 issue_merged.

operationId assignErrorIssue

Request body: application/json · object

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/comments

Viewer.

operationId listErrorComments

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/comments

Member. Plain text, at most 4000 characters, scrubbed of secrets (tokens, keys, card numbers, email addresses) before it is stored. The author is the session's user; a body field naming another is refused.

operationId addErrorComment

Request body: application/json · object

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/merge

Member. Sources must be unmerged issues of this project with the same origin as the target (409 origin_mismatch / issue_merged). Their events move to the target with their own fingerprint and weight, their future events route to the target, and the target's counts, trend, user count and newest event are recomputed. Each source keeps its row, state, comments and activity with mergedInto set, and leaves the default stream. Monthly usage is not touched.

operationId mergeErrorIssues

Request body: application/json · object

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/unmerge

Member. The issue in the path must be a merged source. Its fingerprints (and those of issues merged into it earlier) route to it again; their events, including ones that arrived after the merge, move back; both issues are recomputed. The source's own state was never changed by the merge.

operationId unmergeErrorIssue

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/similar

Viewer. Issues among the project's 200 most recently seen whose newest stored stack shares in-app frames with this one's (Jaccard over module|function, a small bonus for the same type). A hint for a person deciding whether to merge: nothing is merged, no model is called, and the score is not a claim that the issues share a cause.

operationId similarErrorIssues

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors-fingerprint-rules

The project's fingerprint rules

operationId getErrorFingerprintRules

PUT /v1/orgs/{orgSlug}/projects/{projectName}/errors-fingerprint-rules

Member. At most 100 rules; matchers are RE2 patterns of at most 1000 bytes. The first rule whose matchers all match an app or browser event sets its fingerprint (and optionally the issue's title, shown as titleCustom). Platform events are never matched and an event's origin never changes. Applies to events received from now on.

operationId putErrorFingerprintRules

Request body: application/json · ErrorFingerprintRules

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/events

An issue's stored events, newest first

operationId listErrorEvents

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/events/{eventId}

One stored event in full: stack with source, breadcrumbs, request, user

operationId getErrorEvent

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/events/{eventId}/related

The browser agent puts a W3C traceparent on same-origin fetch/XHR and records the trace ID on that call's breadcrumb; the server event of the request that carried it is tagged trace_id. Front's request ID joins a browser event to the server request that rendered its page. Both are correlation keys only: issues are never merged and no identity moves between events. At most 50, within 24 hours of the event.

operationId getRelatedErrorEvents

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/history

Read from the ClickHouse event history (docs/customer-error-tracking.md §18). Where no history store is configured (on-prem without ClickHouse) the answer is available: false with no points; the issue's 24-hour trend still comes from the issue.

operationId getErrorHistory

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/diagnoses

The issue's diagnoses, newest first (at most 20)

operationId listErrorDiagnoses

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/diagnoses

Runs one diagnosis of the issue on the model you name: the newest stored event, its stack with source lines, the same request's breadcrumbs and the release it came from are given to the model as data, and the answer lists likely causes, each with the frames or breadcrumbs it rests on, a suggested fix and a confidence. You cannot add your own prompt.

It runs only when you ask — nothing diagnoses an issue on its own. It is charged to the organization's AI credit like a call from runlot dev and appears in the AI ledger under the development lane. Request headers and the user are not sent to the model.

idempotencyKey (or the Idempotency-Key header) is required: sending the same key again returns the stored answer and is not charged again. A key whose first request is still running answers 409 diagnosis_in_progress. Requires member or higher; a token needs org:admin.

operationId diagnoseErrorIssue

Request body: application/json · object

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/fix-proposals

Requires member or higher; a token needs org:admin — a proposal is repository content.

operationId listErrorFixProposals

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/fix-proposals

One model call that reads the source files the issue's newest stored event actually ran through — its symbolicated in-app frames, at most three existing source files — at the commit of the deployment it came from, and returns whole new contents for some of them. Nothing is written: the proposal is stored and can be applied separately.

You choose only the model. The repository (the one the deployment was built from, or the project's only one), the base commit and the files are chosen by Runlot, and the model may only rewrite those files — a proposal that names any other path, a configuration file or a new file fails. The deployment must be the one serving now and come from a clean, full commit. A file that looks like it contains a credential or personal data is refused rather than sent to the model (422 source_has_secrets). Request headers and the user are not sent.

A truncated or malformed answer is a failed proposal whose usage and charge are still shown. idempotencyKey (or the Idempotency-Key header) is required; the same key returns the stored proposal and is not charged again. Requires member or higher; a token needs org:admin.

operationId proposeErrorFix

Request body: application/json · object

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/fix-proposals/{proposalId}

Requires member or higher; a token needs org:admin.

operationId getErrorFixProposal

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/fix-proposals/{proposalId}/apply

Writes the proposal's exact change as one commit on runlot/autofix/<proposal>, parented on its base commit. It does not build, preview, deploy, merge, push anywhere or touch the default branch; the branch is for you to review. proposalSha must be the proposal's exactly and acknowledgeUnreviewedCode true. The deployment serving now must still be the base commit and every file must still have the bytes the proposal was made from, or it is 409 stale_source — propose again. A proposal can be applied for 7 days. Sending it again returns the same branch and commit. Requires member or higher; a token needs org:admin.

operationId applyErrorFix

Request body: application/json · object

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors-ownership

Project admin and org:admin only, private/no-store. No emails or provider calls. Labels are not identity evidence. At most 200 linked identities, 50 clean exact snapshots and 500 pins; explicit truncation flags indicate incomplete lists. This is manual policy, not verified current GitHub handle discovery.

operationId getErrorOwnership

POST /v1/orgs/{orgSlug}/projects/{projectName}/errors-ownership/pins

Project admin and org:admin only. 8 KiB body. Explicit manual acknowledgement required. Never creates or links identities. One immutable pin per deployment and normalized individual selector; team selectors unsupported. Identical active pins are idempotent, conflicts and revoked pins return 409. Technical limit: 500 pin slots/project including revoked or removed mappings, not a plan quota. No access, membership, quota or delivery rights are granted; automatic assignment stays off.

operationId createErrorOwnershipPin

Request body: application/json · ErrorOwnershipPinInput

DELETE /v1/orgs/{orgSlug}/projects/{projectName}/errors-ownership/pins/{deploymentId}/{selector}

Project admin and org:admin only. Cannot restore or retarget it. Does not reroute existing issues or alerts.

operationId revokeErrorOwnershipPin

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors-capture-policy

Admin/org:admin only. Filtered attempts contain no event content, count retries, and do not consume event quotas.

operationId getErrorCapturePolicy

PUT /v1/orgs/{orgSlug}/projects/{projectName}/errors-capture-policy

Admin/org:admin only. This replaces the entire policy; omitted retainFeedbackEmail defaults to false. RE2 patterns are bounded to 20 per kind, 512 bytes each. Route globs are absolute paths, with only * special (50 max, 256 bytes each). Changes reach collectors without app wake or redeployment. Platform events bypass inbound filters, regardless of exception names. retainUserEmail and retainFeedbackEmail are independent, default-off retention options. Either enabled option requires acknowledgePII true. retainUserEmail stores structured event user.email only; retainFeedbackEmail stores the optional unverified email explicitly supplied with browser feedback, not an account identity. Ordinary reads omit feedback email and redact event email. Explicit sensitive reads need admin plus errors:pii. Disabling either option deletes that kind of retained email. Emails are not used for authentication, AI prompts, ownership, metrics or health; Runlot does not send mail to feedback addresses.

operationId putErrorCapturePolicy

Request body: application/json · object

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors-settings

The project's error-tracking cap and settings

operationId getErrorSettings

PUT /v1/orgs/{orgSlug}/projects/{projectName}/errors-settings

Omitted fields preserve existing settings. autoAssign defaults to false and only assigns newly created, unassigned issues from the exact clean Git snapshot. It never overwrites manual assignment or grants membership or alert privileges. monthlyCap null returns to the plan's included amount; a number sets a cap; -1 removes it. browserEnabled is optional: absent leaves the browser switch as it is, false turns the browser agent off on any plan, true needs Pro. Raising the cap above the included amount or removing it needs Pro (403 plan_required). Lowering it is allowed on every plan. Platform events (out of memory, crashes, boot and build failures) are never capped. Needs the admin role.

operationId putErrorSettings

Request body: application/json · ErrorSettingsUpdate

GET /v1/orgs/{orgSlug}/projects/{projectName}/browser-telemetry

Viewer/errors:read. Browser values are untrusted claims, not platform measurements, request counts, session health or billing. Four fixed histograms/hour, no URLs or DOM attribution. Percentiles are bucket ranges only. Technical limits are not a commercial allowance; nothing is charged. droppedAttempts counts CP refusals and may include retries; front queue/rate refusals are separate operator metrics. At most one vital report/page token.

operationId getBrowserTelemetry

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/feedback

Viewer/errors:read for ordinary replies, which omit email. Feedback messages are scrubbed and never an org-member comment. includePII=true additionally requires admin plus errors:pii; only then may email appear when retainFeedbackEmail is enabled and an email was explicitly supplied. The optional feedback email is unverified, not an account identity, and Runlot sends no mail to it. verified remains false. Only the same project, rendering request and release may attach feedback to a browser error. Pending anchors are invisible, expire after ten minutes and have a 64/project fuse. Event erasure cascades attached feedback; erasure clears all pending messages for the project.

operationId listBrowserFeedback

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors-replay-settings

Session replay here is a masked structural replay, not a pixel recording: on a Pro project's pages the browser agent keeps the last 20 seconds of the page's structure — element boxes, a few layout and colour numbers, and the constant [masked] in place of every text and form value — and sends it only when a browser error is captured. Nothing is recorded on pages without an error, under Global Privacy Control, or after the site denies consent.

effective is whether the recorder is offered now: the plan supports it, the browser agent (errors-settings browserEnabled) and replay are on, and the cap is not 0. usedMonth counts complete replays this month; billableMonth counts those past the included amount. No price is set (pricing: open) and nothing is charged. Requires viewer or higher.

operationId getErrorReplaySettings

PUT /v1/orgs/{orgSlug}/projects/{projectName}/errors-replay-settings

Both fields are required. monthlyCap null is the plan's included amount (Pro: 5,000 a month), 0 stops collection, a lower number is allowed on every plan, and -1 (no cap) or a number above the included amount needs Pro (403 plan_required). enabled: true needs Pro. Turning the browser agent off in errors-settings turns replay off as well. A change reaches pages at the next routing-map refresh, with no deploy. Needs the admin role.

operationId putErrorReplaySettings

Request body: application/json · object

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/replays

Only complete replays are listed: every batch stored and re-validated, and anchored on a stored browser error event of this issue from the same page view and release. A replay is kept for the plan's event retention (Pro: 90 days). Needs the admin role until a granular personal-data scope exists; a token needs org:admin.

operationId listErrorReplays

GET /v1/orgs/{orgSlug}/projects/{projectName}/errors/{issueId}/replays/{replayId}

The batches are re-read from storage and re-validated on every request; a replay that does not pass is answered 404 replay_unavailable rather than shown. Each batch is data for the replay player (tags from a fixed list, rectangles, style numbers, [masked] text) and never markup. Needs the admin role; a token needs org:admin.

operationId getErrorReplay

GET /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId getErrorAlerts

PUT /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts/rules/{ruleId}

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId putErrorAlertRule

Request body: application/json · ErrorAlertRule

DELETE /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts/rules/{ruleId}

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId deleteErrorAlertRule

PUT /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts/destinations/{destinationId}

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId putErrorAlertDestination

Request body: application/json · ErrorAlertDestinationInput

DELETE /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts/destinations/{destinationId}

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId deleteErrorAlertDestination

GET /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts/mail

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId getErrorAlertMail

PUT /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts/mail

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId putErrorAlertMail

Request body: application/json · ErrorAlertMailPreference

GET /v1/orgs/{orgSlug}/projects/{projectName}/error-alerts/deliveries

Viewer reads; admin configuration writes. External destinations are disabled until explicitly enabled with disclosure acknowledgement. Secret values are write-only. Enabling custom rules replaces this project's default issue mail routing; no enabled rules preserves the default. Counts are prospective received-time minute buckets; deliveries are at-least-once externally.

operationId listErrorAlertDeliveries

GET /v1/orgs/{orgSlug}/projects/{projectName}/uptime-checks

The project's synthetic HTTP checks with their current state and last run. Each check calls one of the project's own addresses from the control plane every 1, 5 or 15 minutes and wakes the app. Two failures in a row open one CheckFailed issue; the next success resolves it. Viewer.

operationId listUptimeChecks

PUT /v1/orgs/{orgSlug}/projects/{projectName}/uptime-checks/{checkId}

The URL must be https on port 443 and its host one of this project's active addresses. Free allows 1 check per project, Pro 20 (402 uptime_check_limit past it). Admin.

operationId putUptimeCheck

Request body: application/json · UptimeCheckInput

DELETE /v1/orgs/{orgSlug}/projects/{projectName}/uptime-checks/{checkId}

Removes the check and its run history. An open CheckFailed issue stays as it is. Admin.

operationId deleteUptimeCheck

GET /v1/orgs/{orgSlug}/projects/{projectName}/uptime-checks/{checkId}/runs

Newest first, the last seven days. Viewer.

operationId listUptimeRuns