Authentication
All OTLP endpoints require anAuthorization header carrying a project ingest key:
sl_public_ (legacy keys use the superlog_live_ prefix) and have no expiry by default; you can revoke them at any time.
Do not use a Personal Access Token (PAT) on ingest endpoints. PATs are for the MCP server only. Sending a
superlog_cli_* or superlog_pat_* token to an ingest endpoint returns 401.Base URL
Endpoints
POST /v1/traces
Ingest OpenTelemetry trace spans. Headers
Body
Standard OTLP
ExportTraceServiceRequest — either JSON or serialized protobuf, matching the Content-Type you declare.
Responses
POST /v1/logs
Ingest OpenTelemetry log records. Headers
Body
Standard OTLP
ExportLogsServiceRequest.
Responses — same status codes as /v1/traces.
POST /v1/metrics
Ingest OpenTelemetry metric data points (gauge, sum, histogram, and summary). Headers
Body
Standard OTLP
ExportMetricsServiceRequest.
Responses — same status codes as /v1/traces.
POST /aws/firehose/metrics
Ingest CloudWatch Metric Streams data delivered by an Amazon Kinesis Data Firehose HTTP endpoint. Superlog’s collector decodes OTLP v1 encoding (the format CloudWatch Metric Streams emits when configured withoutput-format: opentelemetry1.0).
Authentication
Firehose delivers the ingest key in the X-Amz-Firehose-Access-Key header rather than Authorization. Set this header to your project ingest key when you configure the Firehose delivery stream’s HTTP endpoint in the AWS console.
Responses
Firehose treats only 200 as a successful delivery. Any other status causes Firehose to retry with backoff. After the configured retry window, batches are written to your configured error S3 bucket.
POST /aws/firehose/logs
Ingest CloudWatch Logs data delivered by a Kinesis Data Firehose subscription filter. Authentication is the same as/aws/firehose/metrics.
GET /health
Health check endpoint. Returns{"ok": true} when the proxy is running. No authentication required. Suitable for load-balancer health probes.
Code Examples
Node.js — @opentelemetry/exporter-trace-otlp-http
/v1/logs and /v1/metrics respectively, using the same Authorization header.
curl
Error Handling
Non-2xx responses carry a JSON body with a singleerror field: