Connection logs

Every connection through your static IPs leaves one log row: when, where to, how many bytes, from which IP, and how it ended. Use the rows to see why an allowlisted API refused you, or which token made a call.

Docs preview: Fixedmark is not live yet. Endpoints are issued at launch, and these pages describe planned launch behavior. Anything marked planned may change. Join early access to get yours first.

What a row holds

Connection log fields
Field	Meaning
`at`	When the connection closed.
`direction`	`egress` for outbound traffic, `ingress` for a partner's connection to an inbound route.
`dest_host`, `dest_port`	The destination your client asked for.
`sni`	The TLS server name, when the client sent one.
`bytes_up`, `bytes_down`	Bytes sent and received.
`duration_ms`	How long the connection was open.
`egress_ip`	The static IP the connection left from.
`result`, `reason`	How it ended. See the results below.
`credential_id`	The id of the proxy credential that opened the connection, never the token.

Rows hold metadata only. No request or response content is stored, and TLS traffic is never decrypted.

Results

Common connection results
Result	Meaning
`ok`	The connection opened and closed normally.
`denied_by_policy`	The credential's allowlist does not name the destination.
`probe`	fm tunnel checked its credentials at startup and closed. No traffic was sent.
`auth_failed`	The app id or token was wrong or revoked.
`upstream_unreachable`, `upstream_timeout`, `upstream_reset`	The destination refused, did not answer, or reset the connection.
`smtp_blocked_by_provider`	The destination port is a mail port that is blocked. See support.

How long rows are kept

Connection log retention by plan
Plan	Kept for
Starter	1 day
Pro	7 days
Business	30 days
Scale	30 days

Retention follows your current plan. Rows older than it are deleted and cannot be read back.

Read the logs

Open the app, then Logs, in the dashboard. Or page through rows with the API, newest first:

Terminal

curl "https://api.fixedmark.com/v1/apps/APP_ID/logs?direction=egress&result=denied_by_policy&limit=100" \
  -H "Authorization: Bearer $FIXEDMARK_API_KEY"

Log query parameters
Parameter	Meaning
`since`, `until`	RFC 3339 times. `since` never reaches past your retention.
`direction`	`egress` or `ingress`. Inbound rows are `ingress` and appear only on IPs with an inbound route.
`peer`	An `ingress` row's partner address, or a CIDR such as `198.51.100.0/24`.
`listener_port`	The inbound port on your IP, such as `20000`.
`route_id`	One inbound route.
`dest`	A host, `host:port`, or `*.suffix`.
`result`	One result, such as `denied_by_policy`.
`egress_ip`	One of your static IPs.
`limit`	1 to 1000 rows per page.
`cursor`	The `next_cursor` of the previous page.

GET /v1/apps/{id}/logs/stream follows new rows as server-sent events with the same filters. Send Last-Event-ID to resume after a disconnect. A resumed stream misses no row but can send one again, so skip a row whose id you already have. An unknown or repeated parameter answers 400 logs.bad_query, and too many open streams answers 503 logs.busy.

Frequently asked questions

Why do I see a probe row each time fm tunnel starts?

fm checks its credentials when it starts, then closes that connection. The row has result probe and carries no traffic.

Can I see inbound connections?

Yes, once you have an inbound route. Each partner connection leaves an ingress row with the partner's address, the inbound port, the route, bytes, and how it ended, such as partner_denied for a source outside the route's partner list. Filter with direction=ingress, peer, listener_port, or route_id.