Ingest

logor does not invent ingest APIs — it adopts the ones with ecosystems.

Errors: the Sentry envelope protocol

POST /api/{project-id}/envelope/

Authentication is the DSN key, either as ?sentry_key= or in the X-Sentry-Auth header — exactly where Sentry SDKs put it. v1 accepts error events (exception, message, tags, release, environment, breadcrumbs); other envelope item types are acknowledged and dropped honestly, so SDKs never retry what the node will not keep.

The legacy /api/{project-id}/store/ endpoint is answered too, for older SDKs.

Grouping is deliberately simple and documented: the SDK-sent fingerprint wins; otherwise the exception type plus the top in-app frames; otherwise the message. Each group is an issue with first/last seen, a count, and open / resolved / ignored states.

Logs: batched JSON

POST /ingest/logs

A JSON batch of {level, message, fields, ts} rows, DSN-key authenticated the same way. The recent view and the SSE live tail in the console read straight from the same tables.

Rate limits

Per-key rate limits guard the door. Over the limit the answer is 429 with Retry-After — which Sentry SDKs honour by backing off, so a noisy service degrades politely instead of dropping silently.

Retention

Events and logs live in xcon-db timeseries tables partitioned by time. Retention is a partition drop — old data leaves in whole days, an O(1) operation that never rewrites what stays.