List all users in the account.

Returns user names, emails, role IDs, active status, and last login timestamps. Supports pagination via token.

List all roles in the account (v2 API).

Returns role names, capabilities, assigned users, and data access filters (log analytics, audit, security).

List all fields (built-in and custom).

Returns field names, data types, and states. Useful for understanding what fields are available for searching and building field extraction rules.

List field extraction rules (FERs).

Returns rule names, scopes, parse expressions, enabled status, and extracted field names. FERs automatically parse fields from log messages at ingest time.

List all index partitions.

Returns partition names, routing expressions, analytics tiers, retention periods, and whether they're included in default searches. Partitions control how data is indexed and retained.

List all lookup tables.

Returns table names, descriptions, field schemas, primary keys, TTL settings, and size limit actions. Lookup tables are used for enrichment in search queries via the 'lookup' operator.

Get a lookup table's configuration and schema.

Returns the table's field definitions, primary keys, TTL, size limit action, and parent folder ID.

List all ingest budgets (v2).

Returns budget names, scopes, capacity in bytes, timezone, reset time, and actions taken when capacity is exceeded. Ingest budgets control data volume limits per scope.

Get all currently active/firing alerts.

Returns monitors in a triggered state. Filter by severity using the status parameter: Critical, Warning, MissingData, or AllTriggered for all.

Get detailed information about an active alert.

Returns the monitor's status, trigger conditions, queries, notification config, and playbook.

Resolve an active alert by disabling its monitor.

Sumo Logic auto-resolves alerts when trigger conditions are no longer met. For manual resolution, this disables the monitor to stop the alert. Use enable_monitor to reactivate afterward.

List all collectors with their IDs, names, types, and status.

Get a collector's full configuration and status.

Create a new Hosted collector.

Hosted collectors are cloud-managed and used for HTTP sources, cloud-to-cloud integrations, and AWS polling sources. Installed collectors cannot be created via API.

Update a collector's configuration (read-modify-write).

Fetches current config with ETag, merges your changes, and saves with optimistic locking.

Delete a collector and all its sources.

WARNING: This action is irreversible. All sources on this collector will also be deleted.

List all sources configured on a collector.

Get a source's full configuration.

Create an HTTP source on a Hosted collector.

Returns the source config including the unique HTTP endpoint URL where data can be sent via POST.

Get the current user's personal content folder.

Returns the root of your personal library including child items (saved searches, dashboards, folders). Use the returned ID as a starting point to navigate the content library.

Get a content folder and its children.

Returns the folder metadata and a list of child items (searches, dashboards, sub-folders) with their IDs and types.

Look up a content item by its library path.

Returns the item's ID, name, type, and parent info. Paths start with /Library/.

List dashboards with pagination.

Returns dashboard titles, IDs, and descriptions. Use the 'next' token from the response to fetch subsequent pages.

Get a dashboard's full configuration.

Returns the complete definition including panels, layout, variables, time range, and visual settings.

Create a new dashboard with panels, layout, and variables.

Panels use a 24-column grid layout. Each panel needs a unique 'key' that maps to a layoutStructures entry defining its grid position (x, y, width, height).

Panel types: TextPanel (markdown text), SumoSearchPanel (log/ metric queries with charts), ServiceMapPanel, TracesListPanel.

Update a dashboard's configuration (read-modify-write).

Fetches the current config, merges your changes, and saves. Pass a JSON object with only the fields you want to change. For panels/layout, pass the complete arrays.

Delete a dashboard.

WARNING: This action is irreversible.

Execute a metrics query and return time-series data.

Uses the same query syntax as the Sumo Logic UI. Supports operators like avg, sum, min, max, rate, delta, topk, outlier, predict, and grouping with 'by'.

List available metric names.

Discovers metrics by running a short-range query and extracting unique metric names from the results. Use filter_query to narrow by source category, content type, or other dimensions.

Get metadata (dimensions and their values) for a metric.

Runs a short query for the named metric and extracts all dimension keys and sample values from the results.

List metric namespaces (content types).

Discovers available metric sources by querying for unique _contentType values (e.g. HostMetrics, AwsCloudWatch, MetricFromLog). These serve as logical namespaces.

List all monitors with their names, IDs, types, and statuses.

Search monitors by name, description, or status filter.

Filter examples: monitorStatus:Critical, monitorStatus:Warning, monitorStatus:AllTriggered, type:MonitorsLibraryMonitor.

Get a monitor's full configuration and current status.

Create a new Sumo Logic monitor.

For simple threshold monitors, use threshold/trigger_type params. For complex monitors (anomaly, outlier, multiple triggers, webhook notifications), pass triggers_json and/or notifications_json with the full JSON arrays.

Update a monitor's configuration (read-modify-write).

Fetches the current config, merges your changes, and saves. Pass a JSON object with only the fields you want to change.

Delete a monitor and all its associated alerts.

WARNING: This action is irreversible.

Enable a disabled monitor so it resumes evaluating.

Disable a monitor to stop evaluation and alerting.

Get the current health and triggering state of a monitor.

Returns whether the monitor is Normal, Critical, Warning, MissingData, or Disabled.

Get alert/trigger history for a monitor.

Returns events within the time range. Falls back to current status if the history endpoint is unavailable.

Execute a Sumo Logic log search and return results.

Handles the full search lifecycle: creates a job, polls until done, fetches results, and cleans up. For aggregation queries (containing count, sum, avg, group by, etc.) returns aggregated records. For raw queries returns log messages.

Check the status of a running or completed search job.

Returns the current state, message count, record count, and any pending warnings or errors since the last status check.

Fetch results from a search job.

Use 'messages' for raw log lines. Use 'records' for aggregated results (queries with count, sum, avg, group by, etc.). Supports pagination via offset and limit.

Cancel a running search job and free server-side resources.

Verify that the Sumo Logic API connection is working.

Tests authentication and endpoint reachability. Use this to confirm credentials are configured correctly.

Get account status and data ingestion information.

Check if a Sumo Logic query is syntactically valid.

Creates a minimal search job (1-second range) and immediately cancels it. Returns valid=true if the query was accepted, or the specific error message if it was rejected.