Skip to main content
A query API key lets a tool, script, dashboard, or AI agent call Rootprint’s read-only log endpoints without a browser session. Use a personal API key, also called a personal access token (PAT), when the client should act as you. Use a service account key when a shared integration needs its own non-human identity. To connect an AI agent over MCP instead of calling these endpoints yourself, see Connect an AI agent.

​
How query keys work

  • Prefix rpk_. Personal keys and service account keys use the same prefix. Rootprint shows the full value once, at creation, so store it like a password.
  • Read-only. A query key grants logs: read. Management endpoints for indexes, sources, users, settings, and API key administration reject it with 403.
  • Not index-scoped. A query key reads every index, and can open any trace by ID.
  • No expiry. Query keys do not expire. Revoke a key to cut off access.

​
Create a personal key

Create, list, and revoke your own personal keys from Profile, in the user menu. In the API keys section, click Create key, give the key a name, and copy the value before you close the dialog.

​
Create a service account key

Admins create service account keys from Settings → Service accounts. Create a service account first, then click Create key, choose the account, name the key, and copy the one-time value. See Service accounts for the full workflow.

​
Authenticate

Send either key type as a bearer token.

​
Read logs

List indexes to find the index IDs:
Then search one:
numHits in the response is an exact count only when you add countAll=true. Without it, numHits can be lower than the real number of matches. The span search, GET /api/traces/explore/spans, returns total on the first page and null when offset is above 0.

​
Endpoints that accept a query key

See Query language for the q syntax, and the endpoint reference in the sidebar for every query parameter.