AVAILABLE

Observability

Log Event Normalize & Policy Guard

Inspect and normalize caller-supplied log records, parse strict RFC 5424 VERSION 1, batch-normalize, summarize, and apply explicit timestamp, severity, service, trace, body, age, and attribute policy.

Start free workspaceOpenAPI →

CONTRACT

Predictable for agents. Legible for reviewers.

REST
POST /v1/log-events/policy-check
MCP tool
check_log_event_policy
Inputs
One bounded JSON object, JSON line, strict documented logfmt record, or RFC 5424 VERSION 1 record; batches accept up to 1,000 records with bounded output.
Returns
CLEAR, REVIEW_REQUIRED, or BLOCKED with an OpenTelemetry-aligned canonical event, fixed severity mapping, exact findings, policy evidence, and an agent-readable next action.
Latency
Synchronous
Usage unit
Log-event operation

The suite also exposes /v1/log-events/inspect, /normalize, /parse-rfc5424, /batch-normalize, and /summarize plus /mcp/log-events. Its canonical shape aligns with the OpenTelemetry Logs data model but is not an OTLP ingestion or export endpoint. It accesses no source or backend, executes no query, creates no alert, diagnoses no incident, does not exhaustively detect sensitive data, and stores no payload. Use Sensitive Data Inspect & Redact separately before sending production logs where appropriate. Its RapidAPI release is queued for final external publication.

AGENT-READABLE EXCEPTIONS

LOG_JSON_INVALIDLOG_JSON_DUPLICATE_KEYLOG_LOGFMT_INVALIDLOG_RFC5424_INVALIDLOG_TIMESTAMP_INVALIDLOG_SEVERITY_UNMAPPEDLOG_SPAN_WITHOUT_TRACELOG_FORMAT_NOT_ALLOWEDLOG_SEVERITY_BELOW_MINIMUMLOG_SERVICE_NOT_ALLOWEDLOG_TRACE_CONTEXT_REQUIREDLOG_EVENT_TOO_OLDLOG_EVENT_IN_FUTURELOG_ATTRIBUTE_BLOCKEDLOG_OUTPUT_TOO_LARGE
HTTP request
POST /v1/log-events/policy-check
Authorization: Bearer apc_...
Content-Type: application/json

{
  "input": {
    "format": "JSON_OBJECT",
    "record": {
      "timestamp": "2026-08-11T12:00:00Z",
      "level": "error",
      "message": "request failed",
      "service": "api",
      "trace_id": "11111111111111111111111111111111",
      "span_id": "2222222222222222",
      "deployment": "blue"
    }
  },
  "policy_name": "production-ingest",
  "allowed_formats": [
    "JSON_OBJECT"
  ],
  "require_timestamp": true,
  "require_severity": true,
  "reject_unmapped_severity": true,
  "minimum_severity_number": 13,
  "require_body": true,
  "require_service": true,
  "allowed_services": [
    "api"
  ],
  "require_trace_context": true,
  "maximum_attribute_count": 20,
  "blocked_attribute_keys": [
    "password"
  ]
}
cURL (bash)
curl --request POST \
  --url 'https://api-production-9502.up.railway.app/v1/log-events/policy-check' \
  --header 'Authorization: Bearer ${AP_CONTROL_API_KEY}' \
  --header 'Content-Type: application/json' \
  --data '{
  "input": {
    "format": "JSON_OBJECT",
    "record": {
      "timestamp": "2026-08-11T12:00:00Z",
      "level": "error",
      "message": "request failed",
      "service": "api",
      "trace_id": "11111111111111111111111111111111",
      "span_id": "2222222222222222",
      "deployment": "blue"
    }
  },
  "policy_name": "production-ingest",
  "allowed_formats": [
    "JSON_OBJECT"
  ],
  "require_timestamp": true,
  "require_severity": true,
  "reject_unmapped_severity": true,
  "minimum_severity_number": 13,
  "require_body": true,
  "require_service": true,
  "allowed_services": [
    "api"
  ],
  "require_trace_context": true,
  "maximum_attribute_count": 20,
  "blocked_attribute_keys": [
    "password"
  ]
}'
Representative response
{
  "status": "COMPLETED",
  "decision": "CLEAR",
  "allowed_by_policy": true,
  "policy_name": "production-ingest",
  "event": {
    "timestamp": "2026-08-11T12:00:00Z",
    "severity_text": "error",
    "severity_number": 17,
    "severity_range": "ERROR",
    "body": "request failed",
    "resource": {
      "service.name": "api"
    },
    "attributes": {
      "deployment": "blue"
    },
    "trace_id": "11111111111111111111111111111111",
    "span_id": "2222222222222222",
    "event_name": null,
    "source_format": "JSON_OBJECT",
    "source_sha256": "d6f4...",
    "normalization_changes": []
  },
  "evaluated_policy": {
    "allowed_formats": [
      "JSON_OBJECT"
    ],
    "require_timestamp": true,
    "require_severity": true,
    "reject_unmapped_severity": true,
    "minimum_severity_number": 13,
    "require_body": true,
    "require_service": true,
    "allowed_services": [
      "api"
    ],
    "require_trace_context": true,
    "maximum_attribute_count": 20,
    "blocked_attribute_keys": [
      "password"
    ]
  },
  "findings": [],
  "ruleset_version": "LOG_EVENT_PREFLIGHT_2026_08",
  "scope": "CALLER_SUPPLIED_LOG_RECORDS_ONLY",
  "network_accessed": false,
  "log_source_accessed": false,
  "log_backend_accessed": false,
  "query_executed": false,
  "alert_created": false,
  "incident_diagnosed": false,
  "sensitive_data_exhaustively_detected": false,
  "compliance_verified": false,
  "payload_stored": false,
  "next_action": "Use the normalized event only within the caller's authorized ingestion, retention, access-control, and incident workflow."
}
OpenTelemetry-aligned, not OTLPThe canonical record follows the Logs data-model field concepts and pinned severity ranges; it is not an OTLP receiver, exporter, collector, or backend.
Explicit formats and hard boundsJSON objects, JSON lines, a documented strict logfmt subset, and RFC 5424 VERSION 1 are parsed with byte, depth, value, attribute, batch, and output limits.
No source, query, alert, or diagnosisThe API never tails or fetches logs, accesses a backend, executes a query, creates an alert, diagnoses an incident, exhaustively finds sensitive data, or stores payloads.

Try Log Event Normalize & Policy Guard with your own workflow.

Start with the workspace, inspect the typed result, then integrate with REST or the focused MCP server.

Start free workspaceRead the integration guide →