Base URL
Authentication
Every request carries your ingest token (tnt_...), in one of two ways:
- As a query parameter:
?tenant=tnt_your_token - As a header (log-drain integrations):
Authorization: Bearer tnt_your_token
Endpoints
Send events (per platform)
{adapter} is your platform’s slug. The integration formats the body in that
platform’s native log shape; Rankly normalizes it.
| Adapter slug | Platform |
|---|---|
cloudflare-worker | Cloudflare Worker |
cloudfront | AWS CloudFront (via Firehose) |
gcp-logsink | Google Cloud (via Pub/Sub) |
fastly | Fastly real-time logs |
akamai | Akamai DataStream 2 |
vercel | Vercel middleware or Log Drain |
netlify | Netlify edge function or Log Drain |
nginx-agent | nginx via Fluent Bit |
custom | Your own code |
Custom events
Batch backfill
{ "events": [ ... ] }, up to 5,000 pre-normalized events per request.
Use this to load historical data without sending one request per event.
Health check
{ "status": "ok" }. Use it to confirm the endpoint is reachable from
your network.
How events are processed
Each event runs through the same pipeline regardless of source:Normalize
The adapter converts the platform’s log shape into Rankly’s
event fields.
Filter by domain
Events for hosts you have not verified are
dropped.
Classify and verify
Rankly names the agent, groups it by purpose, and
verifies its identity.