Search raw call trace events - NetSapiens API v2

Searches the raw event rows that call traces are built from. Where the other trace endpoints render one call, this one returns matching rows as they were logged: by call ID, by text inside the event (a SIP header, a number, an IP address), by event type, or by time alone.

Each core server keeps only its own events. By default every core server is searched at the same time and the rows are merged into one list, newest first. Set hostname to search one core server. Each row's server says which server it came from.

Requires Super User or Super User Read Only scope. The rows are raw SIP messages from every domain.

The search is limited so it cannot overload the event database:

Window: at most 6 hours. With no datetime-start or datetime-end, it covers the 30 minutes before the request. A longer window returns 400; it is never shortened for you.

Query time: each server stops its search after 10 seconds.

Request time: the whole request, including collecting rows from every server, stops after 15 seconds. A server that has not connected within 2 seconds, or answered within 15, is left out.

Rows: limit, 1000 by default and 10000 at most, across all servers. When there are more matches, X-NS-Result-Truncated is true.

When some servers do not answer, you still get 200 with the rows from the ones that did, and X-NS-Fanout-Missing names the ones left out. When none answer, you get 504 if they all ran out of time, otherwise 502.

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Responses

🟢200OK

application/json

Matching rows, possibly none. The headers state the window searched, which servers answered, and whether rows were left out.

Headers

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

🔴500Server Error

🔴502Bad Gateway

🔴504Gateway Timeout

curl --location 'https://awqacore01.crexendocloud.com/ns-api/v2/sipflow/events?datetime-start=2026-10-11T08%3A00%3A00-04%3A00&datetime-end=2026-10-11T08%3A30%3A00-04%3A00&hostname=all&callid=0f1e2d3c4b5a69788796a5b4c3d2e1f0%40192.0.2.10&search=sip%3A1001%40example.com&event-type=sip&limit=undefined&sort=undefined' \ --header 'Authorization: Bearer <token>'

[ { "event-index": 918273, "event-time": "2026-10-11T12:04:11+00:00", "event-ts": "1791720251527", "hostname": "core1.example.com", "event-type": "sip", "orig-callid": "0f1e2d3c4b5a69788796a5b4c3d2e1f0@192.0.2.10", "served-callid": "0f1e2d3c4b5a69788796a5b4c3d2e1f0@192.0.2.10", "event-text": "Received 1024 bytes from 192.0.2.10:5060\nINVITE sip:1001@example.com SIP/2.0\nVia: SIP/2.0/UDP 192.0.2.10:5060;branch=z9hG4bK776asdhds\nFrom: <sip:2125550100@192.0.2.10>;tag=1928301774\nTo: <sip:1001@example.com>\nCall-ID: 0f1e2d3c4b5a69788796a5b4c3d2e1f0@192.0.2.10\nCSeq: 1 INVITE", "server": "core1.example.com" } ]