> ## Documentation Index > Fetch the complete documentation index at: https://docs.zespan.com/llms.txt > Use this file to discover all available pages before exploring further. # What the OTLP endpoint received for this project > For each source that sent data to `POST /v1/traces` in the last 30 days (a gateway such as `litellm` or `kong`, or `otel` for any other exporter): when data last arrived, how (JSON or protobuf, gzip), the spans and model calls received in the last 24 hours, the share of model calls that came with token counts, a span kind and prompt or answer text, and warnings (`no_tokens`, `content_while_capture_off`, `legacy_names`, `test_only`). Counts only: never a payload, header or key. Backs the **Gateway and OTLP data** card in Settings, Instrumentation. Requires `dashboard:read`. ## OpenAPI ````yaml /api-reference/openapi.yaml get /v1/projects/{id}/otlp-status openapi: 3.1.0 info: title: Zespan Public API version: 1.0.0 description: > The Zespan Public API covers the endpoints that customers call directly or through the Zespan SDKs: trace ingestion (native and OpenTelemetry), prompt management, datasets and dataset runs, and the runtime guardrails check. All endpoints authenticate with a project API key sent in the `x-api-key` header. Create and manage API keys from the project settings in the Zespan dashboard. servers: - url: https://api.zespan.com description: Zespan production API security: - ApiKeyAuth: [] tags: - name: Ingestion description: Send traces and events to Zespan. - name: OpenTelemetry description: OTLP-compatible ingestion endpoints. - name: Prompts description: Manage versioned prompts and their labels, tags, and folders. - name: Datasets description: Read datasets and manage dataset runs used for experiments and scoring. - name: Changes description: >- Report deploys, prompt, model, config and flag changes from your CI, and manage the write-only change keys that do it. - name: Prevention description: > Prevention drafts: for a finding Zespan caught, a policy it drafted from your own recorded traffic and tested against it. The written advice on a finding is free; drafting is on the Pro plan and above. Session-authenticated (dashboard cookie), not `x-api-key`. Off by default; a draft is only ever a policy saved at `dryrun` that a person applies. - name: Findings description: > Functional findings: failures Zespan found in your stored traces, with cause, fix and evidence. Session-authenticated (dashboard cookie), not `x-api-key`. - name: Guardrails description: Runtime guardrail evaluation. - name: SDK / CLI support description: > Small support endpoints consumed by the SDKs and @zespan/cli rather than called directly by application code. - name: Blast Radius description: > The prompt/agent/model/policy/evaluator/alert dependency graph backing the pre-release impact check and the evaluator-delete gate in the dashboard. Session-authenticated (dashboard cookie), not `x-api-key`. - name: Outcomes description: > Report business outcomes (a deflected ticket, an avoided refund, an SLA met) attributed to a trace, and read them back summarized by agent or model, joined to real trace cost. Backs the Value dashboard page. The ingest endpoint is `x-api-key`-authenticated like the rest of ingestion; the two read endpoints are session-authenticated (dashboard cookie) like Blast Radius. - name: Compliance description: > Generate audit-ready evidence documents (a per-agent Compliance Card, or SOC 2 control evidence) from recorded platform data, and re-verify a generated document's citations against live data. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `compliance:read` / `compliance:generate` permissions and the Pro plan or above (the framework listing is the one exception — no project scope and no plan gate, since a customer deciding whether to upgrade needs to see what they'd get). - name: Models description: > Per-model usage, cost, latency, and error-rate rollups for a project, including the lifecycle overlay described under the Model Lifecycle tag. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `dashboard:read`. - name: Model Lifecycle description: > Findings from the daily model deprecation scan, which matches models a project actually calls against a curated, bundled catalogue of provider-announced deprecation and retirement dates. Every figure on a finding (call volume, cost, affected agents/prompts, cost comparison against a named successor) is measured from real trace data — there is no quality-delta or regression-comparison endpoint, because nothing in this API invokes a model on the caller's behalf. Session-authenticated (dashboard cookie), not `x-api-key`: reading findings and the catalogue requires `dashboard:read`, dismissing a finding requires `alerts:manage`. - name: Stack layers description: > Where in your stack a failure showed and where it most likely started (Instructions, Agent logic, Tool, MCP connection, Retrieval, Memory, Model, Guardrail, Source data, Infra / platform), how sure Zespan is, and your confirmations. The same `stack` object rides on findings, proven causes, issues, incidents and the trace; only what the caller may see is returned (attribution mode and role decide), and the empty shape is returned when nothing may be shown. See the Stack layers reference page. Session-authenticated (dashboard cookie), not `x-api-key`. - name: Policies description: > The organisation-wide policy rollup backing the top-level **Policies** entry in the org admin sidebar: every policy id across every project, grouped by id, plus the org's recent apply history. These endpoints report what is deployed — they never declare a project non-compliant, because no standard exists yet for a project to be measured against. `orgId` in the path selects the scope: it accepts either the organisation's slug or its id, and both routes 403 if the caller is not a member of it. Session-authenticated (dashboard cookie), not `x-api-key`, gated by `policy:read`, which every role has. - name: Demo description: > Open the shared, read-only demo project as a signed-in user. Session-authenticated (dashboard cookie), not `x-api-key`. paths: /v1/projects/{id}/otlp-status: get: tags: - OpenTelemetry summary: What the OTLP endpoint received for this project description: > For each source that sent data to `POST /v1/traces` in the last 30 days (a gateway such as `litellm` or `kong`, or `otel` for any other exporter): when data last arrived, how (JSON or protobuf, gzip), the spans and model calls received in the last 24 hours, the share of model calls that came with token counts, a span kind and prompt or answer text, and warnings (`no_tokens`, `content_while_capture_off`, `legacy_names`, `test_only`). Counts only: never a payload, header or key. Backs the **Gateway and OTLP data** card in Settings, Instrumentation. Requires `dashboard:read`. operationId: getOtlpStatus parameters: - name: id in: path required: true schema: type: string format: uuid description: Project id. responses: '200': description: The sources, newest first (empty when nothing arrived). content: application/json: schema: type: object properties: endpointPath: type: string example: /v1/traces sources: type: array items: type: object properties: source: type: string lastAt: type: string format: date-time encoding: type: string enum: - json - protobuf gzip: type: boolean spans24h: type: integer modelCalls24h: type: integer coverage: type: object properties: tokens: type: integer description: Percent of model calls with token counts. kind: type: integer description: Percent of model calls with a span kind. content: type: integer description: >- Percent of model calls with prompt or answer text. warnings: type: array items: type: string enum: - no_tokens - content_while_capture_off - legacy_names - test_only '403': description: Lacks `dashboard:read`. content: application/json: schema: $ref: '#/components/schemas/Error' '404': $ref: '#/components/responses/NotFound' security: [] components: schemas: Error: type: object properties: error: type: string description: Human-readable error message. example: Unauthorized code: type: string description: Machine-readable error code, when present. example: rate_limit_exceeded message: type: string description: The same text as `error`. example: Rate limit exceeded requestId: type: string description: >- The request's id, also returned in the `x-request-id` response header. Quote it when you contact support. example: 5f0c9a4e-3b1d-4e7a-9c2f-8d6b1a0e7c34 details: description: Field-level details for validation errors, when present. required: - error responses: NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Project API key. Manage keys in the Zespan dashboard under project settings. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.