# sigiro > Send OpenTelemetry to sigiro. When a service fails, you get the cause and the query that proves it. ## Run it ``` docker run -p 4317:4317 -p 4318:4318 -p 9999:9999 ghcr.io/sigiroai/sigiro ``` Ports: 4317 OTLP/gRPC, 4318 OTLP/HTTP, 9999 query + investigate API. ## API The full machine-readable surface is at https://sigiro.com/openapi.json — no key required. - GET /v1/anomalies — ranked shifts against each service's own baseline - POST /v1/investigate — one structured evidence block per service - POST /v1/query — SQL over your telemetry - GET /v1/services, /v1/traces/{trace_id}, /v1/health ## Docs - [Fetch one whole trace](https://sigiro.com/docs/api/get-trace): Every span of one trace, parent links included, so a caller can rebuild the tree. Trace IDs come from the sampled spans in an investigation, or from any SQL query over sigiro_spans. - [API reference](https://sigiro.com/docs/api): Every endpoint sigiro answers on, generated from the spec an agent reads. - [Diagnose a service: ranked findings with runnable SQL](https://sigiro.com/docs/api/investigate-services): Root-cause an incident for one or more services over a time window. Returns a triage summary — NOT raw telemetry: a ranked findings array (read this first), per-operation anomaly flags, and bounded samples of spans/logs. Every lead carries a ready-to-run SQL string (drill_down_sql on findings, operations, spans, and log patterns; drill_all_sql on the spans/logs sections) that you paste VERBATIM into POST /v1/query to fetch the underlying rows and go deeper. Typical agent loop: GET /v1/services → POST /v1/investigate → for any finding or anomalous operation, run its drill_down_sql via /v1/query. Timestamps are microseconds since the Unix epoch. The response is a map {results: {service: block}, errors: {service: message}} — partial results survive a single failing service. - [Ranked shifts against each service's own baseline](https://sigiro.com/docs/api/list-anomalies): Precomputed anomalies: worsening regime shifts (BOCPD changepoints, threshold-free) detected continuously over persisted 5-minute series of every signal — error_rate and latency_p95 per operation, log_volume, error_log_rate and profile_cost (the service's total profiled cost) per service (the operation field holds the entity) — and persisted to the sigiro_anomalies table. Ordered by the unit-free shift magnitude (after - before) / (after + before) descending (1.0 = appeared from a zero baseline, 1/3 = doubled), so the most significant shifts lead regardless of the signal's units — nothing is filtered out; judge significance from before/after (raw signal units: %, µs, logs, profile cost). Optionally filter by service and a from_ts/to_ts window (microseconds since the Unix epoch) over the shift time. Each row carries a ready-to-run drill_down_sql for POST /v1/query. Rows whose shifts fall in the same or adjacent 5-minute detection bucket on the same service share an incident_id — one incident across signals, not N independent anomalies (the correlation window is the detection pass's own bucket resolution, never a tuned threshold); incident_id is null for uncorrelated rows. - [List services seen, with time bounds](https://sigiro.com/docs/api/list-services): Every service that has reported telemetry, with the first and last timestamp seen for each (microseconds since the Unix epoch). The entry point of an agent loop: pick a service here, then investigate it. - [Run SQL over your telemetry](https://sigiro.com/docs/api/run-query): Accepts exactly one SELECT statement as the raw request body. Allowed tables: sigiro_spans, sigiro_logs, sigiro_log_templates, sigiro_metrics_gauge, sigiro_metrics_sum, sigiro_metrics_histogram, sigiro_metrics_exp_histogram, sigiro_profiles, sigiro_anomalies (optionally qualified as lake.* or main.*). WITH/CTE clauses are not supported — rewrite as derived-table subqueries. Scalar functions are allowlisted (aggregates, json extraction, date/time, string, math, conditional helpers); file/network readers are blocked. Every drill_down_sql returned by /v1/investigate can be pasted here verbatim. - [Hosted beta](https://sigiro.com/docs/hosted-onboarding): Send OpenTelemetry to hosted sigiro with a tenant key, then query it back with SQL. You run no infrastructure. We set up each tenant by hand during the invited beta. - [sigiro docs](https://sigiro.com/docs): sigiro is the detect and diagnose layer for software that repairs itself. OpenTelemetry goes in. Ranked results and runnable SQL come out, for agents and not for dashboards. - [Instrument your code with an AI agent](https://sigiro.com/docs/install-with-ai): Give one prompt to an agent. The agent adds OpenTelemetry auto-instrumentation to your service and points it at sigiro. This works with Claude Code, OpenCode, and Codex. - [Quickstart](https://sigiro.com/docs/quickstart): Run sigiro with one docker command. Point OpenTelemetry at it. Then ask it what changed and why. This takes five minutes. You need no collector and no configuration file. - [Full text of every page](https://sigiro.com/llms-full.txt): all docs as markdown, one file ## FAQ ### What is sigiro? sigiro is an observability backend for agents. You send OpenTelemetry to sigiro. You ask a question in SQL or with one investigate call. sigiro gives you a diagnosis, not a dashboard. ### Does sigiro replace Datadog or Grafana? sigiro replaces them when a machine reads the data. If a person must look at a chart, keep the dashboard. sigiro is for the steps after that. ### Must I change my code? No. sigiro uses standard OTLP on ports 4317 and 4318. Your OpenTelemetry SDK or collector sends to sigiro without a change. ### Where does my data go? You install sigiro on your servers. sigiro writes to your storage and sends no data to us. You do not make an account. The hosted service is different: it keeps your telemetry for you. ### Does sigiro page me? No. A page interrupts a person who cannot watch continuously. sigiro gives a table that a program reads in a loop. ### How does sigiro know what to report without thresholds? sigiro compares each service with its own recent history. A service that is always slow but steady reports nothing, because nothing changed. A service that becomes two times slower reports, because no rule was necessary. ### Does sigiro sample the data? No. sigiro keeps each request. Sample rates were necessary when no one could read all of the data. A machine can read all of the data. ### Which query language must I learn? None. You ask in SQL. Your agent writes SQL correctly. Each answer gives you the query that made it. ### Can my agent use sigiro without me? Yes. The agent reads the API description at /openapi.json. It needs no key and no tool definition. Then it asks in SQL. ### What does sigiro cost? sigiro is free when you install it, and the storage is yours. There are no fees for hosts, seats or data. The hosted service costs approximately $14 each month. Access is by invitation. ### What does sigiro not do? sigiro does not write your patches, run your pipeline, or evaluate alert rules. sigiro has no dashboard builder and no full-text log index. Questions are structured, because that is how an agent asks.