Monitoring API

Server health, system logs, access logs, license status and alerts. Every request sends a token in the Authorization: Bearer header; see Get started with the API.

List system log entries

GET /api/admin/system-logs

Returns the warnings and errors the server logged, newest first, one page at a time. An error reference a user quotes (REF-a3f8b2c1) can be pasted into search.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`search`	query	string	Matches words in the message. An error reference such as `REF-a3f8b2c1` (at least 4 characters after `REF-`) finds the entries of that request instead.
`level`	query	string: `warn`, `error`	Only entries at this level.
`component`	query	string	Only entries from this component. The components with recent entries are listed by `GET /api/admin/system-logs/stats`.
`error_code`	query	string	Comma-separated error codes; matches any of them.
`acknowledged`	query	string: `true`, `false`	`true` for entries an admin marked as handled, `false` for the rest. Leave out for both.
`from`	query	string (date-time)	Only entries at or after this time (RFC 3339).
`to`	query	string (date-time)	Only entries at or before this time (RFC 3339).
`cursor`	query	string	The `next_cursor` of the previous page. Leave out for the newest entries.
`limit`	query	integer	Most entries per page. Larger values return 200. Default `50`. Minimum 1. Maximum 200.

Response 200

Success.

data is SystemLogPage.

{
  "success": true,
  "data": {
    "entries": [
      {
        "id": 90211,
        "timestamp": "2026-10-02T09:12:44.381Z",
        "level": "error",
        "message": "file write failed",
        "component": "storage",
        "error_code": "FILE_WRITE",
        "request_id": "a3f8b2c1d4e5f60718293a4b5c6d7e8f",
        "attributes": {
          "provider": "S3 primary"
        }
      }
    ],
    "next_cursor": "",
    "has_more": false
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.” “Invalid ‘from’ date: must be RFC3339 (e.g. 2026-07-12T00:00:00Z)” “Invalid ‘to’ date: must be RFC3339 (e.g. 2026-07-12T23:59:59Z)”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Export system log entries

GET /api/admin/system-logs/export

Downloads the newest 10,000 system log entries matching the filters as NDJSON, newest first. Each export is recorded in the audit log as log.exported.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`search`	query	string	Matches words in the message. An error reference such as `REF-a3f8b2c1` (at least 4 characters after `REF-`) finds the entries of that request instead.
`level`	query	string: `warn`, `error`	Only entries at this level.
`component`	query	string	Only entries from this component. The components with recent entries are listed by `GET /api/admin/system-logs/stats`.
`error_code`	query	string	Comma-separated error codes; matches any of them.
`acknowledged`	query	string: `true`, `false`	`true` for entries an admin marked as handled, `false` for the rest. Leave out for both.
`from`	query	string (date-time)	Only entries at or after this time (RFC 3339).
`to`	query	string (date-time)	Only entries at or before this time (RFC 3339).

Response 200

The entries, as a download named system-logs-YYYY-MM-DD.ndjson. One JSON record per line. If the export fails after it started, the last line is {"error":"export_incomplete","message":"This export is incomplete. Try exporting again."}.

data is SystemLogEntry.

"{\"id\":90211,\"timestamp\":\"2026-10-02T09:12:44.381Z\",\"level\":\"error\",\"message\":\"file write failed\",\"component\":\"storage\",\"error_code\":\"FILE_WRITE\",\"request_id\":\"a3f8b2c1d4e5f60718293a4b5c6d7e8f\",\"attributes\":{\"provider\":\"S3 primary\"}}\n"

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.” “Invalid ‘from’ date: must be RFC3339 (e.g. 2026-07-12T00:00:00Z)” “Invalid ‘to’ date: must be RFC3339 (e.g. 2026-07-12T23:59:59Z)”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Count system log entries by component

GET /api/admin/system-logs/stats

Returns how many warnings and errors each component logged in the last 24 hours, most first.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data is array of SystemLogComponentCount.

{
  "success": true,
  "data": [
    {
      "component": "storage",
      "count": 14
    },
    {
      "component": "email",
      "count": 3
    }
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

List error codes

GET /api/admin/system-logs/error-codes

Returns every error code a system log entry can carry, sorted, for the error_code filter.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data is array of string.

{
  "success": true,
  "data": [
    "ACCESS_LOG_READ",
    "ACME_CERT_UNAVAILABLE",
    "ACME_DOMAIN_LIST"
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Get server diagnostics

GET /api/admin/system/diagnostics

Returns the server’s version, uptime, database version, counts of users, files and domains, active storage providers and network setup.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data is Diagnostics.

{
  "success": true,
  "data": {
    "server_version": "1.4.0",
    "os": "linux/amd64",
    "uptime_seconds": 432180,
    "postgres_version": "18.0",
    "total_users": 42,
    "total_files": 1830,
    "total_domains": 2,
    "storage_providers": [
      {
        "id": "0b7c1a2f-3e45-4d6e-8f90-1a2b3c4d5e6f",
        "name": "S3 primary",
        "provider_type": "s3",
        "is_active": true
      }
    ],
    "saml_sp_cert": {
      "fingerprint": "4F:2A:9C:…:7B",
      "expires_at": "2036-09-01T00:00:00Z"
    },
    "sso_enabled": true,
    "log_level": "info",
    "https_port": "443",
    "public_https_port": "443",
    "reverse_proxy": "none",
    "trusted_proxies": [],
    "trusted_proxies_from_env": false
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Download a diagnostic report

POST /api/admin/system/diagnostics

Downloads a zip for support with system-info.txt (diagnostics, license, domains and certificates, email setup, disk space), logs.jsonl (the newest 10,000 warnings and errors) and, when access logging is on, access.log (today’s access log). Email addresses and phone numbers are masked, and link IDs and other secrets are tagged. The download is recorded in the audit log as support_bundle.downloaded.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

The diagnostic report, as a download named dew-diagnostics-YYYY-MM-DD.zip.

Content type application/zip.

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Get system health

GET /api/admin/system/overview

Returns one check each for storage, email, certificates, the license and errors in the last 24 hours, worked out when you call it, plus the server’s address, the size of stored files and whether a newer server version is available.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data is SystemOverview.

{
  "success": true,
  "data": {
    "hostname": "files.example.com",
    "checks": [
      {
        "area": "storage",
        "status": "ok",
        "summary": "Reachable"
      },
      {
        "area": "email",
        "status": "warn",
        "summary": "Microsoft 365 secret expires in 9 days",
        "link": "/admin/email"
      },
      {
        "area": "certificates",
        "status": "ok",
        "summary": "Valid until Jan 12"
      },
      {
        "area": "license",
        "status": "ok",
        "summary": "Pro · 12 of 25 users"
      },
      {
        "area": "errors",
        "status": "ok",
        "summary": "No errors in the last 24 hours"
      }
    ],
    "stored_bytes": 51758612480,
    "available_version": "2026.11.1400",
    "update_check_enabled": true,
    "update_checked": true
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Read an access log

GET /api/admin/access-logs

Returns lines of an access log file as plain text, one request per line in Apache Combined format with the signed-in user’s ID (or -) in the user field, ending in the duration and the request ID. By default it returns the last 500 lines of today’s file. Reading a whole file (tail=0) is recorded in the audit log as log.exported.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`file`	query	string	The file to read: `access.log` for today, or a name from `GET /api/admin/access-logs/files`, such as `access-2026-10-01.log.gz`. Default `"access.log"`.
`tail`	query	integer	How many lines from the end to return. `0` returns the whole file; larger values return 5000. Default `500`. Minimum 0. Maximum 5000.

Response 200

The log lines.

Content type text/plain.

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.” “Invalid log filename”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
404	Access logging is turned off, or the file doesn’t exist.	“Access logging is not enabled” “Log file not found”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

List access log files

GET /api/admin/access-logs/files

Returns the access log files kept on the server: today’s access.log and one file per earlier day, compressed (.gz) after a day. The list is empty when access logging is turned off.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data is array of AccessLogFile.

{
  "success": true,
  "data": [
    {
      "name": "access.log",
      "date": "today",
      "size": 184320
    },
    {
      "name": "access-2026-10-01.log.gz",
      "date": "2026-10-01",
      "size": 40211
    }
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Get license status

GET /api/admin/license

Returns the license plan, whether it is valid, its seats and how many are used, and any grace period with what will change when it ends.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data is LicenseStatus.

{
  "success": true,
  "data": {
    "tier": "Enterprise",
    "valid": true,
    "license_key": "A1B2…9Z8Y",
    "max_users": 50,
    "machine_id": "7d2e9c41-5a3b-4f6e-8c1d-2b4a6e8f0c13",
    "fingerprint": "e4b1c9a2-7f3d-4a8e-9b6c-1d2f3a4b5c6d",
    "activated": true,
    "trial": false,
    "validation_error": "",
    "needs_activation": false,
    "active_users": 42,
    "pending_invites": 3,
    "effective_users": 45,
    "domain_count": 2,
    "max_domains": 0,
    "last_validated": "2026-10-02T06:00:00Z",
    "expires_at": "2027-09-30T00:00:00Z"
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

List admin alerts

GET /api/admin/notifications

Returns the alerts admins see under the bell that nobody has dismissed yet, newest first: certificates and license expiring, storage running out or unreachable, email delivery problems, API tokens expiring and new versions.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`limit`	query	integer	Most alerts to return. Values outside 1 to 200 return 50. Default `50`. Minimum 1. Maximum 200.

Response 200

Success.

data is array of AdminNotification.

{
  "success": true,
  "data": [
    {
      "id": "5e8a1c3d-9b2f-4e7a-8c6d-0f1e2d3c4b5a",
      "category": "cert_expiry",
      "severity": "warn",
      "title": "Certificate expires soon",
      "message": "The certificate for files.example.com expires in 7 days.",
      "dismissed": false,
      "created_at": "2026-10-02T06:00:04Z"
    }
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Count admin alerts

GET /api/admin/notifications/count

Returns how many alerts nobody has dismissed yet, and the most severe of them.

Permission: Monitoring: Server status (system:read)
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data fields:

Field	Type	Description
`count` (required)	integer
`severity` (required)	string: `error`, `warn`, ``	The most severe undismissed alert: `error`, `warn`, or empty when there is none.

{
  "success": true,
  "data": {
    "count": 2,
    "severity": "warn"
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.