For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/api/latest/spans/search-spans.md. A documentation index is available at /llms.txt.
Language
Datadog site

Search spans

POSThttps://api.datadoghq.com/api/v2/spans/events/searchhttps://api.us3.datadoghq.com/api/v2/spans/events/searchhttps://api.us5.datadoghq.com/api/v2/spans/events/searchhttps://api.datadoghq.eu/api/v2/spans/events/searchhttps://api.ap1.datadoghq.com/api/v2/spans/events/searchhttps://api.ap2.datadoghq.com/api/v2/spans/events/searchhttps://api.uk1.datadoghq.com/api/v2/spans/events/searchhttps://api.ddog-gov.com/api/v2/spans/events/searchhttps://api.us2.ddog-gov.com/api/v2/spans/events/search

Overview

List endpoint returns spans that match a span search query. Results are paginated.

Use this endpoint to build complex spans filtering and search. This endpoint is rate limited to 300 requests per hour.

OAuth apps require the apm_read authorization scope to access this endpoint.

Request

Body Data (required)

Field
Type
Description
data
object

The object containing the query content.

Response

OK

Response object with all spans matching the request and pagination information.

Field
Type
Description
data
[object]

Array of spans matching the request.

links
object

Links attributes.

meta
object

The metadata associated with a request.

Code Example

Search spans returns "OK" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 25
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
Search spans returns "OK" response with pagination
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X POST "https://api.${DD_SITE}/api/v2/spans/events/search" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "filter": {
        "from": "now-15m",
        "query": "service:python*",
        "to": "now"
      },
      "options": {
        "timezone": "GMT"
      },
      "page": {
        "limit": 2
      },
      "sort": "timestamp"
    },
    "type": "search_request"
  }
}
EOF