Observability Insights Public API
The Observability Insights Public API lets you pull your own observability data — request overviews, service catalogs, traces, and metrics — directly into your own tools, scripts, and dashboards.
- API Base URL (API_BASE_URL):
https://insights.adobecqms.net/ - Format: JSON over HTTPS
- Authentication: API key (Bearer token)
Replace
{{API_BASE_URL}}throughout this document with your Observability Insights instance’s API host, e.g.https://insights.adobecqms.net/.
1. Getting an API key
API keys are personal credentials tied to your account and scoped to a single organization. A key can only read data for tenants that belong to the organization it was created for — it can never see another organization’s data.
Generate a key
-
Sign in to the Observability Insights dashboard.
-
Open your profile menu (top right) → API Keys.
-
In the API Keys tab, click Generate key.
-
Give it a descriptive name (e.g.
CI pipeline,Grafana datasource), choose the organization it should be scoped to, and optionally set an expiration date. -
Click Generate key. Your key is shown once, in the format:
code language-none synx_9pQ2v6f1WYbLZk3n0aRtEo4jXcHsVmDgUiPq7B8l1ycCopy it immediately and store it somewhere safe (a secrets manager, CI secret store, etc.) — the dashboard cannot show it to you again. If you lose it, revoke it and generate a new one.
Manage existing keys
The API Keys section lists every key you’ve created, including its organization, creation date, expiration, and last-used timestamp. Click the trash icon next to a key to revoke it — revocation is immediate and cannot be undone.
Key security
- Treat an API key exactly like a password. Anyone with the key can read all observability data for every tenant in the organization it’s scoped to, until it’s revoked or expires.
- Never commit a key to source control or share it in plaintext (chat, email, tickets).
- Rotate keys periodically and revoke any key that’s no longer in use.
- If a key is compromised, revoke it immediately from Org Settings → API Keys and generate a replacement.
2. Authenticating requests
Every request to the Public API must include your key in the Authorization header:
Authorization: Bearer synx_9pQ2v6f1WYbLZk3n0aRtEo4jXcHsVmDgUiPq7B8l1yc
Requests without a valid key, or with an expired/revoked key, receive 401 Unauthorized. Session logins (browser cookies/tokens) are not accepted on this API .
3. Base concepts
Tenants
Every endpoint requires a tenant_id query parameter identifying which tenant’s data to read. A key can only query tenants that belong to the organization it was created for; requesting a tenant outside that organization returns 403 Forbidden. There is no “all tenants” mode on this API — always pass a specific tenant_id.
Not sure which tenant_id values your key can use? Call GET /public/v1/tenants — it lists exactly the tenants your key is authorized to query.
Time ranges
Endpoints that accept from / to parameters take Unix timestamps (seconds), millisecond timestamps, or ISO 8601 datetime strings, e.g.:
from=1735689600
from=2025-01-01T00:00:00Z
If omitted, most endpoints default to a recent rolling window (see each endpoint below).
Rate limits
Requests are rate-limited per API key. If you exceed the limit, you’ll receive:
HTTP/1.1 429 Too Many Requests
Retry-After: 60
{ "error": "Too Many Requests", "message": "Rate limit of 300 requests/60s exceeded" }
Back off and retry after the number of seconds in the Retry-After header. Contact support if your use case needs a higher limit.
Errors
Errors are returned as JSON with an error field and, usually, a human-readable message:
{ "error": "Bad Request", "message": "tenant_id is required" }
400 Bad Requesttenant_id, bad time range)401 Unauthorized403 Forbidden429 Too Many RequestsRetry-After502 Bad Gateway503 Service Unavailable4. Endpoints
GET /public/v1/tenants
Lists the tenant IDs your key is authorized to query. Call this first — every other endpoint requires one of these values as tenant_id.
curl -s "{{API_BASE_URL}}/public/v1/tenants" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
{ "tenants": ["tenant1", "tenant2"] }
GET /public/v1/overview
High-level health KPIs for a tenant over a time window: request volume, error rate, and latency percentiles.
tenant_idminutesfrom/to aren’t given (default 15)curl -s "{{API_BASE_URL}}/public/v1/overview?tenant_id=<tenant_id>&minutes=30" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
{
"tenant_id": "<tenant_id>",
"from": 1735689000,
"to": 1735690800,
"total_spans": 48213,
"errors": 112,
"error_rate_pct": 0.23,
"p50_ms": 34,
"p95_ms": 210,
"p99_ms": 480,
"service_count": 12,
"trace_count": 9021
}
GET /public/v1/services
Lists distinct service names reporting for a tenant.
tenant_idfrom, tocurl -s "{{API_BASE_URL}}/public/v1/services?tenant_id=<tenant_id>" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
{
"tenant_id": "<tenant_id>",
"services": ["checkout-api", "payments-worker", "web-frontend"]
}
GET /public/v1/traces
Searches recent traces for a tenant, with optional filters.
tenant_idfrom, tolimitoffsetserviceapp_namestatusok, error, or unsetsearchmin_duration_mscurl -s "{{API_BASE_URL}}/public/v1/traces?tenant_id=<tenant_id>&status=error&limit=25" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
{
"data": [
{
"TraceId": "4bf92f3577b34da6a3ce929d0e0e4736",
"ServiceName": "checkout-api",
"DurationMs": 812,
"StatusCode": "Error",
"Timestamp": "2026-08-30T09:12:44Z"
}
],
"rows": 137,
"limit": 25,
"offset": 0
}
Use rows (the total matching count) alongside limit/offset to page through results.
GET /public/v1/traces/:traceId
Returns the full span waterfall for a single trace.
tenant_idlimitoffsetcurl -s "{{API_BASE_URL}}/public/v1/traces/4bf92f3577b34da6a3ce929d0e0e4736?tenant_id=<tenant_id>" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
{
"spans": [
{
"SpanId": "00f067aa0ba902b7",
"Name": "POST /checkout",
"DurationMs": 812,
"children": []
}
],
"totalDurationMs": 812,
"spanCount": 14,
"limit": 500,
"offset": 0
}
GET /public/v1/metrics
Returns raw metric data points for a tenant.
tenant_idmetricmetric/likelikemetric/likeLIKE pattern to match multiple metric namestypegauge (default) or sumfrom, toservicehostattribute_key, attribute_valuecurl -s "{{API_BASE_URL}}/public/v1/metrics?tenant_id=<tenant_id>&metric=jvm.memory.used&type=gauge" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
{
"data": [
{
"TimeUnix": "2026-08-30T09:00:00Z",
"MetricName": "jvm.memory.used",
"Value": 512482816,
"ServiceName": "checkout-api",
"host": ""
}
],
"rows": 1
}
Infrastructure host metrics
The same endpoint also serves the host-level metrics shown on the Infrastructure dashboard (CPU, memory, load average, disk I/O, network I/O). Use these exact metric / attribute_key / attribute_value combinations, always with a host:
metricattribute_keyattribute_valuesystem.cpu.utilizationstateidle (subtract from 1 for “in use”), or query user/system/iowait separately and sumsystem.memory.utilizationstateusedsystem.cpu.load_average.1msystem.disk.io (type=sum)directionreadsystem.disk.io (type=sum)directionwritesystem.disk.operations (type=sum)directionreadsystem.disk.operations (type=sum)directionwritesystem.network.io (type=sum)directionreceivesystem.network.io (type=sum)directiontransmitcurl -s "{{API_BASE_URL}}/public/v1/metrics?tenant_id=<tenant_id>&metric=system.cpu.utilization&type=gauge&attribute_key=state&attribute_value=idle&host=<host_name>" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
Important — disk and network values are raw, ever-increasing counters, not rates. The dashboard’s “bytes/sec” and “operations/sec” charts are computed by taking two consecutive counter readings and dividing by the elapsed time:
rate = (value_at_t2 - value_at_t1) / (t2 - t1_in_seconds)
GET /public/v1/pages
Top requested content pages (.html) per dispatcher instance, ranked by request count. Backed by the dispatcher.httpd.requests metric — this endpoint is specific to AEM Dispatcher/CDN-style access logs, not a general page-analytics tool.
tenant_idfrom, tolimitcurl -s "{{API_BASE_URL}}/public/v1/pages?tenant_id=<tenant_id>&limit=50" \
-H "Authorization: Bearer $Observability_Insights_API_KEY"
{
"tenant_id": "<tenant_id>",
"from": 1735689000,
"to": 1735690800,
"data": [
{
"instance": "<instance_name>",
"domain": "www.abc.com",
"path": "/join-us/insights.html",
"full_url": "https://www.abc.com/join-us/insights.html",
"requests": 7
}
],
"rows": 1
}
5. What this API does not do
- No raw SQL access. All endpoints return curated, purpose-built data shapes — you cannot query the underlying data store directly.
- No cross-tenant queries. Every request is scoped to exactly one
tenant_id. - No write access. The Public API is read-only.
6. Support
If you run into unexpected errors, or have a use case not covered by these endpoints, contact your Customer Success / Enablement Engineer for further help.