Events
Search telemetry events across conversations by type, tool, agent and time.
GET /telemetry/eventsEvents across every conversation, newest first. This is the endpoint for questions that are not about one conversation: how often a tool ran, what a particular agent has been doing, what happened in the last hour.
Parameters
| Parameter | Type | Description |
|---|---|---|
coreSlug | string | Confine to one agent. Omit to span every agent the key may read |
eventType | string | Exact match, e.g. tool.called, session.ended |
toolId | string | Exact match on the tool that produced the event |
agentId | string | Exact match on the agent that produced it |
from | ISO 8601 | Lower bound on the event time, inclusive |
to | ISO 8601 | Upper bound on the event time, inclusive |
cursor | string | nextCursor from the previous page |
limit | integer | Page size. Default 25, maximum 100 |
Filters combine with AND. All of them are exact matches; there is no prefix, wildcard or full-text search on this endpoint.
from and to here bound the event's own timestamp, which is the plain
meaning. Note that this is different from
GET /telemetry/sessions, where the same
two parameters select sessions that were active in the window.
The event shape
The same shape is returned by this endpoint, by
GET /telemetry/sessions/{sid} and by
GET /telemetry/runs/{runId}.
| Field | Type | Description |
|---|---|---|
id | uuid | The event's own id |
sid | string | The session this event belongs to |
trace_id | string | null | Trace id, when the emitter set one |
core_id | uuid | The agent's id |
core_slug | string | The agent's slug — the name you filter by |
event_type | string | e.g. tool.called, session.ended |
event | object | The full event payload as the deployment emitted it |
environment | string | null | The emitting environment |
run_type | string | null | production, test or eval |
run_id | string | null | The evaluation run, when this event belongs to one |
channel | string | null | voice, sms, chat, email, … |
agent_id | string | null | The agent within the deployment |
tool_id | string | null | The tool, on tool events |
created_at | string | When the event happened |
The organization id is not returned. It is the same for every row you can see, because the key already fixed it.
event is the emitter's own payload, so its inner shape depends on the event
type and on the kit version that produced it. Treat the columns above as the
stable contract and read event defensively.
Examples
Every tool call in the last hour:
curl -H "Authorization: Bearer $SUBCORE_API_KEY" \
"https://api.subcore.ai/telemetry/events?eventType=tool.called&from=2026-09-04T12:00:00Z"One tool on one agent:
curl -H "Authorization: Bearer $SUBCORE_API_KEY" \
"https://api.subcore.ai/telemetry/events?coreSlug=support-agent&toolId=lookup_order&limit=100"An empty query value means "not filtered", not "equal to the empty string".
?channel= and omitting channel do the same thing.