OneCLI connects AI agents to Coralogix with an API key. Agents can run DataPrime and PromQL queries over your logs, traces, and metrics, and read alerts, incidents, cases, and dashboards. The gateway injects the key into requests to the Coralogix API, so your agent never sees it.This suits SRE and debugging agents: pulling the errors behind a spike, correlating an alert with the logs around it, or checking a service’s SLO before a deploy.Connecting takes about two minutes.
Every Coralogix account lives in one region, and a key only works there. Read yours from the address you sign in at:
You sign in at
Region
<team>.app.coralogix.us
us1
<team>.app.cx498.coralogix.com
us2
<team>.app.us3.coralogix.com
us3
<team>.coralogix.com
eu1
<team>.app.eu2.coralogix.com
eu2
<team>.app.coralogix.in
ap1
<team>.app.coralogixsg.com
ap2
<team>.app.ap3.coralogix.com
ap3
2
Create an API key in Coralogix
In Coralogix, open Settings > API Keys and create a Personal or Team key. Give it a name such as onecli-key and pick its Role Presets.
Creating a personal key in Coralogix. The role presets decide what the key, and so the agent, can do.
For an agent that investigates, choose the DataQuerying preset. It can query logs, traces, and metrics, and Coralogix keeps the preset up to date as it adds permissions. Add Alerts or Incidents permissions only if the agent should read or manage them too.Copy the key right away.
Prefer a Team key for a shared agent. A Personal key stops working when the person who created it leaves the team.
3
Paste it in OneCLI
In the OneCLI dashboard, open Connections > Coralogix, paste the key into API key, and pick your Region. Each option shows its sign-in address, so match the one in your browser. US2 is selected by default.
The Coralogix connect window in OneCLI.
Select Connect Coralogix. OneCLI checks the key against the API in your region before saving it, and names the connection after your Coralogix team.
The gateway always sends a connection’s requests to its own region. An agent can call the current host (api.us2.coralogix.com) or an older one your scripts already use (api.cx498.coralogix.com, ng-api-http.cx498.coralogix.com), and it works either way. Log ingestion (ingress.*) uses a separate Send-Your-Data key and is not part of this connection.
Run DataPrime or Lucene queries over logs and spans
Metrics
Run PromQL queries and read metric labels and series
Alerts
List alert definitions and their triggered events, and create, change, or delete definitions
Incidents
List, filter, and read incidents, and acknowledge, resolve, close, or assign them
Cases
List, filter, and read cases with their timelines, and acknowledge, assign, resolve, close, or comment on them
Dashboards
List and read dashboards, and create, change, or delete them
SLOs
List SLOs and read their status
Saved views
List and read saved Explore views
What a key can actually do is capped by its Coralogix permissions. A DataQuerying key can query but cannot touch alerts or incidents, whatever OneCLI allows.
Grant the connection to each agent that needs it, and choose per tool what runs freely, what needs approval, and what’s blocked.A good default is to let agents query logs and metrics freely and put anything that changes state behind approval. Deleting an alert definition silences monitoring for good, and resolving an incident or case hides it from the people working it.Organization rules add guardrails on top. A blocked request never reaches Coralogix.To disconnect, remove the connection in Connections > Coralogix, then delete the key in Coralogix under Settings > API Keys.
