API Reference

Look up the catalog and insert samples into a saved destination.

Not available yet

API access isn't available yet. Inserts from the app still count toward your monthly insert quota.

Authentication

Send the key as a Bearer token. Keys start with lc_ and are shown only once when you create them.

Authorization header

Authorization: Bearer lc_your_key

Base URL: https://api.logcannon.com

Catalog

Filter by log type, source repository, tactic, technique, or event ID — the same concepts as the catalog in the app.

List catalog entries

curl -H "Authorization: Bearer lc_your_key" \
  "https://api.logcannon.com/api/v1/catalog?technique=T1059.001&limit=20"

Get one catalog entry

curl -H "Authorization: Bearer lc_your_key" \
  "https://api.logcannon.com/api/v1/catalog/CATALOG_ID"

Query parameters: log_type, source_repository, tactic, technique, event_id, search, limit, offset.

Destinations

List saved destinations (id, name, type). Configure destinations in the app first — the API does not create them.

List destinations

curl -H "Authorization: Bearer lc_your_key" \
  "https://api.logcannon.com/api/v1/destinations"

Insert

Insert one catalog sample into a saved destination. Returns a job id and a search URL you can open in that destination.

Insert a catalog sample

curl -X POST "https://api.logcannon.com/api/v1/insert" \
  -H "Authorization: Bearer lc_your_key" \
  -H "Content-Type: application/json" \
  -d '{"catalog_id":"CATALOG_ID","destination_id":"DESTINATION_ID"}'

The response includes job_id and search_url (a Splunk or Kibana query for this insert). search_url is null if the destination has no web URL configured.

Optional config: timestamp_mode (preserve, live, or relative) and add_metadata.

Jobs

Poll insert status. Status values match History in the app: pending, processing, inserting, completed, failed. The same search_url is included here.

Get a job

curl -H "Authorization: Bearer lc_your_key" \
  "https://api.logcannon.com/api/v1/jobs/JOB_ID"