Observability & Log Sync

const auth = Buffer.from(`${process.env.STACKONE_API_KEY}:`).toString("base64");

const response = await fetch("https://api.stackone.com/logs", {
  method: "POST",
  headers: {
    Authorization: `Basic ${auth}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    page: 1,
    page_size: 100,
    filters: {
      log_type: ["action"],
      order_by: "event_time",
      order_direction: "desc",
    },
  }),
});

const { data: logs, total } = await response.json();

import base64
import os
import requests

api_key = os.environ["STACKONE_API_KEY"]
headers = {
    "Authorization": f"Basic {base64.b64encode(f'{api_key}:'.encode()).decode()}",
    "Content-Type": "application/json",
}

response = requests.post(
    "https://api.stackone.com/logs",
    json={
        "page": 1,
        "page_size": 100,
        "filters": {
            "log_type": ["action"],
            "order_by": "event_time",
            "order_direction": "desc",
        },
    },
    headers=headers,
)

body = response.json()
logs = body["data"]
total = body["total"]

const auth = Buffer.from(`${process.env.STACKONE_API_KEY}:`).toString("base64");

const response = await fetch("https://api.stackone.com/logs", {
  method: "POST",
  headers: {
    Authorization: `Basic ${auth}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    page: 1,
    page_size: 100,
    filters: {
      log_type: ["action"],
      start_time: "2026-01-15T09:00:00.000Z",
      end_time: "2026-01-15T17:00:00.000Z",
      status_code: ["400", "401", "500", "502", "503"],
      connector_key: ["bamboohr", "workday"],
      account_secure_id: ["45355976281015164504"],
      order_by: "event_time",
      order_direction: "desc",
    },
  }),
});

import base64
import os
from datetime import datetime, timezone

import requests

PAGE_SIZE = 100


def fetch_logs_between(start_time: str, end_time: str) -> list[dict]:
    api_key = os.environ["STACKONE_API_KEY"]
    headers = {
        "Authorization": f"Basic {base64.b64encode(f'{api_key}:'.encode()).decode()}",
        "Content-Type": "application/json",
    }

    collected, page = [], 1
    while True:
        response = requests.post(
            "https://api.stackone.com/logs",
            json={
                "page": page,
                "page_size": PAGE_SIZE,
                "filters": {
                    "log_type": ["action"],
                    "start_time": start_time,
                    "end_time": end_time,
                    "order_by": "event_time",
                    "order_direction": "asc",
                },
            },
            headers=headers,
        )
        response.raise_for_status()

        body = response.json()
        rows = body["data"]
        collected.extend(rows)

        # Stop on total, not on a short page. The endpoint can return fewer
        # rows than you asked for while still echoing back the page_size sent.
        if not rows or len(collected) >= body["total"]:
            return collected
        page += 1


# Usage: sweep a closed window, forward to your platform, then store run_end
# as the next run's start
run_end = datetime.now(timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
logs = fetch_logs_between(last_sync_time, run_end)
for log in logs:
    forward_to_observability_platform(log)  # Your implementation

async function sendToDatadog(log: DatadogLog) {
  await fetch('https://http-intake.logs.datadoghq.com/api/v2/logs', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'DD-API-KEY': process.env.DATADOG_API_KEY!
    },
    body: JSON.stringify([log])
  });
}

import { logs } from '@opentelemetry/api-logs';

function sendToOtel(log: ActionLog) {
  const logger = logs.getLogger('stackone');

  logger.emit({
    // success is independent of status_code, which is null when the run failed
    // before it got a response. Check both or those failures log as INFO.
    severityNumber: log.success === false || (log.status_code ?? 0) >= 400 ? 17 : 9,
    body: `${log.connector_key} ${log.action_id}`,
    // Only action_run_id is guaranteed. Everything else is nullable, and
    // OpenTelemetry rejects null attribute values, so drop them first.
    attributes: defined({
      'http.status_code': log.status_code,
      'stackone.action_id': log.action_id,
      'stackone.action_run_id': log.action_run_id,
      'stackone.action_type': log.action_type,
      'stackone.category': log.category,
      'stackone.connector_key': log.connector_key,
      'stackone.account_id': log.account_id,
      'stackone.risk_level': log.risk_level, // Defender projects only
      'duration_ms': log.duration_ms
    })
  });
}

function defined(attributes: Record<string, unknown>) {
  return Object.fromEntries(
    Object.entries(attributes).filter(([, value]) => value !== null && value !== undefined)
  );
}