Skip to main content
You need a root key with the permissions listed on this page. Create one in the dashboard under Settings > Root Keys. See Permission reference for every permission.
Run a SQL query against the logs your deployments wrote. Query the runtime_logs_v1 table. CTEs, subqueries, UNION, and EXCEPT all work. You only see data from the root key’s workspace. To narrow it to one project, , , or deployment, filter on project_id, app_id, environment_id, or deployment_id. Your plan’s log query range limits how far back a query can reach, and analytics query quotas apply. See Limits.

​
Usage

​
Flags

​
string
required
SQL query to run against runtime_logs_v1.

​
Shared flags

Every unkey api command accepts these; CLI output and shared flags describes them in full.
​
string
A JSON document sent as the request body instead of building it from the flags above. It is mutually exclusive with the request-building flags, and unknown fields are rejected locally. See Send a raw body.
​
string
Root key for the request. Falls back to UNKEY_ROOT_KEY, then to the config file written by unkey auth login. See CLI authentication.
​
string
default:"https://api.unkey.com"
Base URL of the API. Falls back to UNKEY_API_BASE_URL. You don’t normally need to set it.
​
string
default:"~/.unkey/config.toml"
Path of the TOML file that unkey auth login writes. Falls back to UNKEY_CONFIG.
​
string
Output format. Falls back to UNKEY_OUTPUT. Set json to print the full response envelope (meta and data) for piping; any other value prints the request ID followed by data.

​
Required permissions

Your root key needs project.*.read_runtime_logs. A grant for one project, such as project.<project_id>.read_runtime_logs, doesn’t work here. Without a matching permission the API answers 403 and the CLI prints Permission denied: followed by the detail. See Root key permissions for the full catalog.

​
Examples

Latest log lines of one deployment:
Count lines by severity:
Send the request body as JSON:

​
API endpoint

The command calls POST /v2/analytics.getRuntimeLogs and prints its response. The request fields carry the same names as the flags in camelCase, which is the shape --body expects.

Analytics tables

Column reference for gateway request and runtime log analytics.
Last modified on September 29, 2026