blob_id. The lookup is limited to the organization of the caller, so an identifier from another organization answers 404. The call requires streams.query, or sys.telemetry.read in the system scope.
404 as well.
Errors
curl http://localhost:5080/api/v1/web/investigation/blob/$BLOB_ID \
-H "authorization: Bearer $MS_JWT"
{
"version": 1,
"stack": [
{ "kind": "trace", "trace_id": "0af7651916cd43dd8448eb211c80319c" },
{ "kind": "log", "query": "level = error" }
]
}
Correlation & Web
Fetch investigation stack
Read a document stored with the investigation blob call.
curl http://localhost:5080/api/v1/web/investigation/blob/$BLOB_ID \
-H "authorization: Bearer $MS_JWT"
{
"version": 1,
"stack": [
{ "kind": "trace", "trace_id": "0af7651916cd43dd8448eb211c80319c" },
{ "kind": "log", "query": "level = error" }
]
}
Last modified on October 9, 2026