Metrics, Health & Logging API

Auth: Metrics and Health endpoints are unauthenticated (no sensitive data). Log endpoints require a Bearer token or API key — see Authentication. Rate limited: Log endpoints yes; Metrics/Health no.

The observability surface — Prometheus metrics, health probes, and authenticated governance-log retrieval. See the Observability guide and the Operations section.

Metrics

`GET /metrics`

Prometheus text exposition. Standard metric families:

Family	Example labels	What it measures
`http_request_duration_seconds`	`method`, `route`, `status`	Latency histogram.
`governance_verdicts_total`	`verdict`, `guardian`	Verdict counter.
`inference_tokens_total`	`model`, `kind`	Token usage.
`rag_policy_retrieval_seconds`	`store`	Retrieval latency.
`rate_limit_hits_total`	`route`	Throttled requests.

Scrape with your existing Prometheus; the platform's own dashboards consume the same series.

Health

`GET /health`

System health — aggregate status plus per-subsystem health (DB, inference, KMS, anchors):

{
  "status": "ok",
  "subsystems": {
    "database": "ok",
    "inference": "ok",
    "kms": "ok",
    "anchors": "ok"
  },
  "version": "1.42.0"
}

GET /health/liveness — 200 if the process is alive (kubernetes liveness probe).
GET /health/readiness — 200 only when the service can serve traffic (DB reachable, inference warm).

Logs

`GET /v1/logs` — `logs:read`

List governance logs, cursor-paginated, filterable by verdict, guardian, severity, time window. Each GovernanceLog carries the full per-request context: core identifiers, Guardian context, the verdict decision, corrections/violations, token usage & cost, the cryptographic hash chain link, and RAG-governance policy context.

`GET /v1/logs/:log_id` — `logs:read`

Single log detail. The chain_hash field links each entry into the tamper-evident ledger — break one, the chain breaks.

SIEM export

Governance logs ship to your SIEM in real time (Splunk, Datadog, Elastic, Sumo Logic, generic HTTP/JSON, S3). See the SIEM export cookbook and the Observability guide for the pipeline and backend-specific optimizations.

Errors

HTTP	`error.code`	When
`401`	`authentication_error`	Missing/invalid token on a log endpoint.
`403`	`forbidden`	Missing `logs:read`.
`429`	`rate_limited`	Log query rate exceeded.

→ Observability — the metrics & logging guide. → Operations — runbooks & alert catalog. → Errors, rate limits & conventions — shared contract.

Metrics​

GET /metrics​

Health​

GET /health​

Logs​

GET /v1/logs — logs:read​

GET /v1/logs/:log_id — logs:read​

SIEM export​

Errors​