Run SQL over your telemetry

Accepts exactly one SELECT statement as the raw request body. Allowed tables: sigiro_spans, sigiro_logs, sigiro_log_templates, sigiro_metrics_gauge, sigiro_metrics_sum, sigiro_metrics_histogram, sigiro_metrics_exp_histogram, sigiro_profiles, sigiro_anomalies (optionally qualified as lake.* or main.*). WITH/CTE clauses are not supported — rewrite as derived-table subqueries. Scalar functions are allowlisted (aggregates, json extraction, date/time, string, math, conditional helpers); file/network readers are blocked. Every drill_down_sql returned by /v1/investigate can be pasted here verbatim.

Request

POST /v1/query

curl -X POST "https://api.sigiro.com/v1/query" \
  -H "Content-Type: text/plain" \
  -d 'SELECT service_name, count(*) AS errors FROM sigiro_spans GROUP BY 1'

Auth: None. Self-hosted default; the hosted service requires a tenant key.
Body: text/plain — string

Responses

200Query results — one object per row, keyed by your SELECT's column namesapplication/json

example

[
  {
    "errors": 128,
    "service_name": "checkout"
  },
  {
    "errors": 4,
    "service_name": "cart"
  }
]

Every field and constraint is in /openapi.json, which is the document this page is generated from.

Diagnose a service: ranked findings with runnable SQL

Root-cause an incident for one or more services over a time window. Returns a triage summary — NOT raw telemetry: a ranked findings array (read this first), per-operation anomaly flags, and bounded samples of spans/logs. Every lead carries a ready-to-run SQL string (drill_down_sql on findings, operations, spans, and log patterns; drill_all_sql on the spans/logs sections) that you paste VERBATIM into POST /v1/query to fetch the underlying rows and go deeper. Typical agent loop: GET /v1/services → POST /v1/investigate → for any finding or anomalous operation, run its drill_down_sql via /v1/query. Timestamps are microseconds since the Unix epoch. The response is a map {results: {service: block}, errors: {service: message}} — partial results survive a single failing service.

Fetch one whole trace

Every span of one trace, parent links included, so a caller can rebuild the tree. Trace IDs come from the sampled spans in an investigation, or from any SQL query over sigiro_spans.