API queries

Run DataPrime or Lucene queries directly from your code—no need to open the Coralogix UI.

Choose the API architecture that best fits your workflow:

JSON over HTTP
gRPC

For large or recurring analytics jobs (like monthly or quarterly reports), use background queries that run asynchronously. These are available via both JSON-over-HTTP and gRPC.

Quick comparison

Feature	JSON over HTTP	gRPC
Transport Security	HTTPS	HTTPS
Request Format	JSON (POST body)	Protobuf message
Response Format	NDJSON for streaming JSON for non-streaming	Protobuf stream
Status Codes	Standard HTTP	gRPC status codes

Setup & authentication

All requests must be sent over HTTPS, regardless of whether you're using HTTP or gRPC.

To get started:

Use the appropriate DataPrime endpoint for your Coralogix domain. Refer to the list of supported endpoints here.
Create a personal or team API key.
Include your API key in the Authorization header of your request:

Authorization: Bearer <YOUR_API_KEY>

Note

Select the DataQuerying permission preset to keep your key automatically aligned with future permission updates.

Required permissions

Action	Purpose
`LEGACY-ARCHIVE-QUERIES:EXECUTE`	Query archived data
`LOGS.DATA-API#HIGH:READDATA`	Query frequent‑search logs
`LOGS.DATA-API#LOW:READDATA`	Query monitoring & compliance logs
`METRICS.DATA-API#HIGH:READDATA`	Query metrics
`SPANS.DATA-API#HIGH:READDATA`	Query frequent‑search spans
`SPANS.DATA-API#LOW:READDATA`	Query monitoring & compliance spans

Next steps

Choose your guide and jump straight into examples:

JSON over HTTP reference – request/response schema, examples, and error handling.
gRPC reference – proto definitions and streaming examples.

Calculate Lambda function invocation duration

Next HTTP API queries