API Reference

Open the interactive OpenAPI reference:

GET /collectors

List Data Collectors

Lists the appliances that collect, and therefore hold collector logs.

Only collecting appliances are listed. An All-In-One and a Collector Unit collect; a Database Server does not and is excluded, because a log read queued against one would never run.

The id or the name of an entry here is what the collector log endpoints accept to identify which collector to read from.

Requires the DEV_COLLECTIONS_VIEW access hook.

Status Codes:

200 OK – The collecting appliances, ordered by name.
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
500 Internal Server Error – The Data Collectors could not be listed

Request JSON Object:

collectors[].id (integer) – The appliance id of the collector.
collectors[].ip (string) – The IP address of the collector.
collectors[].name (string) – The appliance name of the collector.

POST /collector_logs/list

Queue or run a Data Collector log file listing

Queues a request to list the log files available on a Data Collector.

Listing a directory is work that happens on the collector, so this endpoint queues the request and returns a receipt rather than the listing. The queued request reaches the collector through a database update, so nothing is available immediately: measured pickup latency is 12 to 27 seconds, and can be minutes on a busy collector.

Read the listing back from GET /collector_logs/list/{request_id}, polling until terminated is true.

With run_local set to true, the listing instead runs on the host this service runs on, an All-In-One or a Database Server, with the same command a queued request would run, run the way the Remote Toolbox runs it. The listing is returned directly with 200, all at once, and there is nothing to poll. collector is not required for a local run and is ignored if given, since a local run always reads this host. A local run that does not finish within 90 seconds is stopped and answered with 504 and what it listed before then. Every response says which happened in mode.

Requires the DEV_TOOLS_RUN and DEV_COLLECTIONS_VIEW access hooks.

Response JSON Object:

collector (string) – The id or name of the collector, as returned by GET /collectors. A numeric value is treated as an appliance id and anything else as an appliance name.
directory (string) – Which log directory to read. The caller supplies a key, never a path, and the service resolves it server side, so a path traversal cannot be expressed. - sl1 resolves to /var/log/sl1, the current service logs written by rsyslog - em7 resolves to /var/log/em7, the logdir recorded in silo.conf The default applies to the request body of the two POST endpoints. The directory query parameter of GET /collector_logs/list/{request_id} is required and has no default, because it labels the entries the listing returns. Note that silo.log is 0 bytes on current releases and is not a useful target.
run_local (boolean) – True to run the tool on the host this service runs on, an All-In-One or a Database Server, and answer with its output directly, rather than queueing it for a collector. Also accepted as 1 or 0; anything else, including the strings “true” and “false”, is rejected with 400. Left out, it is true on an All-In-One and false otherwise.

Status Codes:

200 OK – The listing was run locally, because run_local was true or was left out on an All-In-One, and has finished.
202 Accepted – The listing was queued. The listing itself is not available yet; poll GET /collector_logs/list/{request_id} until terminated is true.
400 Bad Request – A collector was not supplied for a queued listing, run_local is not true, false, 1 or 0, or the directory is not one of sl1 or em7.
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – No collecting appliance matches the supplied collector. No alternatives are suggested, because a collector is looked up by exact id or name and there are no near misses to offer; use GET /collectors to find the right collector. Also returned for a tool_name in the path other than list or fetch.
429 Too Many Requests – A local run was refused because five are already in progress, the most that may run at once. Try again once one has finished.
500 Internal Server Error – The listing could not be queued or run
504 Gateway Timeout – A local listing did not finish within 90 seconds and was stopped. The body carries the error fields together with what the listing produced before then.

Request JSON Object:

directory (any) – The directory key the caller named.
directory_path (string) – The absolute path the key resolves to on this host.
files[].base_name (string) – The log the file belongs to, with any rotation suffix removed.
files[].compressed (boolean) – Whether the file is gzip compressed.
files[].directory (any) – The directory key the file was found in. Send it, with name as the log_name, to POST /collector_logs/fetch to read this file.
files[].directory_path (string) – The absolute path of the directory on the collector.
files[].generation (string) – The rotation suffix, or null for the current log.
files[].modified (string) – The modification time as an ISO 8601 timestamp in UTC.
files[].name (string) – The file name within the directory.
files[].rotated (boolean) – Whether this is a rotated generation rather than the current log.
files[].size_bytes (integer) – The size of the file on the collector. Worth reading before a fetch, because an active collector log reaches tens of megabytes.
last_id (integer) – The id of the run’s last output row.
mode (any) – Always local.
terminated (boolean) – True once the run finished, false only when it ran past its timeout. As for a queued listing, this reports termination only.
toolbox.phase (string) – Where the job is, derived from the spool row and the output together, since the Remote Toolbox can lose either signal. There is no stuck phase: a job the collector never picks up stays queued and one the toolbox abandons stays running, so judge from the two ages when to stop waiting. unknown means neither the spool row nor any output could be read, which in practice is only a job pruned in the middle of a request, since a job with no spool row is reported as not found.
toolbox.returncode (integer) – The return code recorded for the queued command. Null for as long as the command is still running.
toolbox.seconds_since_last_output (integer) – Seconds since the job last wrote output, or null when it has written none.
toolbox.seconds_since_queued (integer) – Seconds since the command was queued, or null when the spool row has been pruned.
toolbox.state (integer) – The spool row’s state as found: 1 scheduled, 2 launched, 3 running, 0 complete, 4 failed, 5 canceled. The updates can land out of order, so a finished job can still read 2; phase accounts for that.
truncated (boolean) – True when the listing was longer than the 32 MiB of output a local run keeps; the entries past the limit were discarded. A local listing is not paged, so it is otherwise false.
collector.id (integer) – The appliance id of the collector.
collector.ip (string) – The IP address of the collector.
collector.name (string) – The appliance name of the collector.
directory – The directory key the caller named. This round-trips: send it straight back as the directory of the next request.
directory_path – The absolute path the key resolves to on the collector.
mode – Always remote.
note (string) – A reminder that the listing is not available yet and where to read it from.
request_id (integer) – The id to read the queued request’s output with. It is not a durable handle. Collector log output ages out of the platform’s log tables after about 31 days, independently of the row describing the request, so a request id can outlive its own description and an old id becomes unreadable.

GET /collector_logs/list/{request_id}

Read a queued Data Collector log file listing

Reads back the log file listing for a queued request. A local listing is answered when it is run, so it has nothing to read back here.

An empty files list with terminated false means the collector has not produced the listing yet, not that the directory is empty. Call again with the returned last_id as after_id until terminated is true.

Termination reports only that the collector has finished. It is reported for a command that worked, one that failed, and one the Remote Toolbox refused before running, so it must not be read as success.

Requires the DEV_TOOLS_RUN access hook. Only the user that queued the request may read it.

Parameters:

request_id (integer) – The request_id returned when the listing was queued.

Query Parameters:

directory (string) –
Which log directory the request was queued for. Required, and with no default here, unlike the two POST endpoints where it defaults to sl1. A missing directory is rejected with 400.

It must match the directory the listing was queued with. The listing does not carry the directory back: the collector reports basenames only, and the service stamps each entry with the key given here. Polling an em7 listing without the parameter would return entries labelled sl1 and /var/log/sl1, and feeding such an entry straight back to POST /collector_logs/fetch would then target a file that does not exist, or, for a basename present in both log trees, silently a different file. The mismatch cannot be detected server side.
after_id (integer) – Read only output produced after this cursor. Pass the previous response’s last_id to continue where it stopped, or omit it to read from the beginning.
page_size (integer) – The maximum number of output rows to read. Values above the maximum are reduced to it. 0 is rejected rather than read as a request for the default.
wait_seconds (number) –
Opt-in server side waiting. Defaults to no wait, which returns whatever the collector has written so far.

The budget is capped at 90 seconds, deliberately below the 120 second reverse proxy read timeout, so a wait can never turn a request that is merely still running into a gateway timeout the caller cannot distinguish from a failure. A larger value is reduced to the cap. A non-finite value, nan or inf, is rejected with 400.

Status Codes:

200 OK – The files found so far, the cursor to resume from, and whether the collector has finished.
400 Bad Request – A missing or invalid directory, or an invalid after_id, page_size or wait_seconds. directory is required on this endpoint. A page_size of 0 is rejected rather than read as a request for the default, and a non-finite nan or inf is rejected for after_id, page_size and wait_seconds alike.
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – The request id is not a collector log listing belonging to this user. Returned identically whether the id was never issued, belongs to another Remote Toolbox tool, belongs to another user, or has aged out of the platform’s retention window. Also returned for a tool_name in the path other than list or fetch.
500 Internal Server Error – The listing could not be read

Request JSON Object:

directory (any) – The directory key the caller named. This round-trips: send it straight back as the directory of the next request.
directory_path (string) – The absolute path the key resolves to on the collector.
files[].base_name (string) – The log the file belongs to, with any rotation suffix removed.
files[].compressed (boolean) – Whether the file is gzip compressed.
files[].directory (any) – The directory key the file was found in. Send it, with name as the log_name, to POST /collector_logs/fetch to read this file.
files[].directory_path (string) – The absolute path of the directory on the collector.
files[].generation (string) – The rotation suffix, or null for the current log.
files[].modified (string) – The modification time as an ISO 8601 timestamp in UTC.
files[].name (string) – The file name within the directory.
files[].rotated (boolean) – Whether this is a rotated generation rather than the current log.
files[].size_bytes (integer) – The size of the file on the collector. Worth reading before a fetch, because an active collector log reaches tens of megabytes.
last_id (integer) – The cursor to resume from. Pass it back as after_id on the next call. Unchanged from the requested cursor when the page held no rows.
mode (any) – Always remote.
request_id (integer) – The request id the listing belongs to.
terminated (boolean) – True when the collector has finished. This reports termination only: the same marker is written for a command that worked, one that failed, and one the Remote Toolbox refused before running, so it must not be read as success. Also true once a finished job’s output has been read to the end, which covers a completed marker the Remote Toolbox failed to write, once it has had no output for 90 seconds.
toolbox.phase (string) – Where the job is, derived from the spool row and the output together, since the Remote Toolbox can lose either signal. There is no stuck phase: a job the collector never picks up stays queued and one the toolbox abandons stays running, so judge from the two ages when to stop waiting. unknown means neither the spool row nor any output could be read, which in practice is only a job pruned in the middle of a request, since a job with no spool row is reported as not found.
toolbox.returncode (integer) – The return code recorded for the queued command. Null for as long as the command is still running.
toolbox.seconds_since_last_output (integer) – Seconds since the job last wrote output, or null when it has written none.
toolbox.seconds_since_queued (integer) – Seconds since the command was queued, or null when the spool row has been pruned.
toolbox.state (integer) – The spool row’s state as found: 1 scheduled, 2 launched, 3 running, 0 complete, 4 failed, 5 canceled. The updates can land out of order, so a finished job can still read 2; phase accounts for that.
truncated (boolean) – True when the page could not carry everything that was waiting: more rows were waiting than the page size allowed, the text returned reached the 1048576 character per response ceiling with rows still left behind, or any combination of the two. Request the next page from last_id rather than assuming the listing ended. Both budgets are cumulative across a wait_seconds poll, which spends one row budget and one character budget over the whole wait rather than one of each per internal read.

POST /collector_logs/fetch

Queue or run a Data Collector log file read

Queues a request to read one log file on a Data Collector.

Reading and filtering happen on the collector, so this endpoint queues the request and returns a receipt rather than the content. The queued request reaches the collector through a database update, so nothing is available immediately: measured pickup latency is 12 to 27 seconds, and can be minutes on a busy collector.

Every filter is applied on the collector rather than in the service, because the output returns through a shared platform log table in chunked rows and an active collector log reaches tens of megabytes.

Every read is capped twice on the collector, whatever filters it carries: a line cap of lines, or 100000 when lines is omitted, and a byte cap of max_bytes, or 5242880 (5 MiB) when max_bytes is omitted. Both caps are applied after pattern and after the timestamp window, so they bound the result of the filters rather than the file. The max_bytes that will be enforced is echoed on the receipt.

Read the content back from GET /collector_logs/fetch/{request_id}, polling until terminated is true.

With run_local set to true, the read instead runs on the host this service runs on, an All-In-One or a Database Server, with the same command a queued request would run, run the way the Remote Toolbox runs it, so both caps still apply. The content is returned directly with 200, all at once rather than paged, though each record is still cut to 4096 characters, and there is nothing to poll. collector is not required for a local run and is ignored if given, since a local run always reads this host. A local run that does not finish within 90 seconds is stopped and answered with 504 and what it read before then. Every response says which happened in mode.

Requires the DEV_TOOLS_RUN and DEV_COLLECTIONS_VIEW access hooks.

Query Parameters:

combine_streams (boolean) – For a local run only: true to return the output as one stream, combined, in the order it was written, the toolbox’s marker rows included, rather than split by stream. Only true, false, 1 and 0 are accepted, in any case; anything else is rejected with 400. Ignored for a queued read.

Response JSON Object:

collector (string) – The id or name of the collector, as returned by GET /collectors. A numeric value is treated as an appliance id and anything else as an appliance name.
directory (string) – Which log directory to read. The caller supplies a key, never a path, and the service resolves it server side, so a path traversal cannot be expressed. - sl1 resolves to /var/log/sl1, the current service logs written by rsyslog - em7 resolves to /var/log/em7, the logdir recorded in silo.conf The default applies to the request body of the two POST endpoints. The directory query parameter of GET /collector_logs/list/{request_id} is required and has no default, because it labels the entries the listing returns. Note that silo.log is 0 bytes on current releases and is not a useful target.
lines (integer) – Return only this many trailing lines. Applied after pattern and after the timestamp window, so it is the last n matching records rather than the last n records in the file. Omitting it does not remove the line cap. Every read is bounded by both a line cap and a byte cap, whatever filters it carries: the line cap is lines when supplied and 100000 otherwise, and the byte cap is max_bytes when supplied and 5242880 (5 MiB) otherwise. Both bound a plain read, a compressed generation, a pattern-only read and a window-only read alike.
log_name (string) – The log file to read, within the chosen directory. Must have the shape the platform produces: a current log such as sl1.log, or a rotated generation such as sl1.log.20260913-1789312001.gz. A compressed generation is read in place rather than decompressed first. (required)
max_bytes (integer) – A ceiling on the bytes the collector will return for this read. It defaults to 5242880 (5 MiB), which is also its maximum: a larger value is reduced to the maximum rather than rejected. 0, a negative number, a boolean and a non-numeric string are rejected with 400. The cap is enforced on the collector, as the final stage of the pipeline, and the value that will be enforced is echoed as max_bytes on the 202 receipt. The byte cap is the one that bounds the work, because 100000 records of an unknown width is not a size. The line cap is applied before the byte cap and both keep the trailing end of what they are given, so a read that the byte cap actually cuts returns the most recent records of the last n lines and drops the oldest of that window. The cut lands at a byte offset rather than on a record boundary, so the first record of such a read can be a partial line and a leading fragment should be expected. That is not the ... [truncated] marker, which is a separate per-record limit applied as the output is read back.
pattern (string) – An extended regular expression (grep -E) to match records against, applied on the collector. A pattern may not contain whitespace, quotes or backslashes. Express whitespace with a POSIX class such as [[:space:]]; for example AID:[[:space:]]*907 matches an application id of 907 written as AID: 907 with any amount of space after the colon.
run_local (boolean) – True to run the tool on the host this service runs on, an All-In-One or a Database Server, and answer with its output directly, rather than queueing it for a collector. Also accepted as 1 or 0; anything else, including the strings “true” and “false”, is rejected with 400. Left out, it is true on an All-In-One and false otherwise.
since (string) – Inclusive lower bound on the record timestamp. Any leading portion of an ISO 8601 timestamp is accepted, so 2026, 2026-09, 2026-09-23 and 2026-09-23T14:05 are all valid. The bound is compared as text against the timestamp that begins each record. Use T between the date and the time. A space is not accepted as the separator and is rejected with 400. Against the em7 directory a window is day granular only, because records there separate the date from the time with a space, so the field a bound is compared against is the date alone. A day bound works there; a bound carrying a time component matches nothing at all, and the 202 receipt says so in its note.
until (string) – Inclusive upper bound on the record timestamp, in the same form as since, and inclusive of everything the bound names rather than of the single instant it names. until=2026-09-24 keeps every record stamped on the 24th, so since=2026-09-23&until=2026-09-24 is the whole of the 23rd together with the whole of the 24th. A longer bound still cuts exactly where it says: until=2026-09-24T09:30 stops at the end of that minute.

Status Codes:

200 OK – The read was run locally, because run_local was true or was left out on an All-In-One, and has finished.
202 Accepted – The read was queued. The content itself is not available yet; poll GET /collector_logs/fetch/{request_id} until terminated is true.
400 Bad Request – A collector was not supplied for a queued read, run_local or combine_streams is invalid, a log name was not supplied, or a filter was rejected. A pattern may not contain whitespace, quotes or backslashes; a since or until must use T rather than a space between the date and the time; and max_bytes must be a positive integer.
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – No collecting appliance matches the supplied collector. No alternatives are suggested, because a collector is looked up by exact id or name and there are no near misses to offer; use GET /collectors to find the right collector. Also returned for a tool_name in the path other than list or fetch.
429 Too Many Requests – A local run was refused because five are already in progress, the most that may run at once. Try again once one has finished.
500 Internal Server Error – The read could not be queued or run
504 Gateway Timeout – A local read did not finish within 90 seconds and was stopped. The body carries the error fields together with what the read produced before then.

Request JSON Object:

directory (any) – The directory key the caller named.
directory_path (string) – The absolute path the key resolves to on this host.
last_id (integer) – The id of the run’s last output row.
line_counts (object) – A count of the run’s rows per stream, including the toolbox’s started and completed marker rows, which are left out of a split output.
log_name (string) – The log file that was read.
max_bytes (integer) – The byte ceiling that was enforced for this read.
mode (any) – Always local.
note (string) – Present only when the read has a limitation worth stating, such as a time-bearing since or until against the em7 directory, where a window is day granular only.
output (object) – The run’s output, one text per stream, with stdout and stderr always present. With combine_streams true, it holds only combined, every row in the order it was written, the marker rows included.
terminated (boolean) – True once the run finished, false only when it ran past its timeout. As for a queued read, this reports termination only.
toolbox.phase (string) – Where the job is, derived from the spool row and the output together, since the Remote Toolbox can lose either signal. There is no stuck phase: a job the collector never picks up stays queued and one the toolbox abandons stays running, so judge from the two ages when to stop waiting. unknown means neither the spool row nor any output could be read, which in practice is only a job pruned in the middle of a request, since a job with no spool row is reported as not found.
toolbox.returncode (integer) – The return code recorded for the queued command. Null for as long as the command is still running.
toolbox.seconds_since_last_output (integer) – Seconds since the job last wrote output, or null when it has written none.
toolbox.seconds_since_queued (integer) – Seconds since the command was queued, or null when the spool row has been pruned.
toolbox.state (integer) – The spool row’s state as found: 1 scheduled, 2 launched, 3 running, 0 complete, 4 failed, 5 canceled. The updates can land out of order, so a finished job can still read 2; phase accounts for that.
truncated (boolean) – True when the read produced more than the 32 MiB of output a local run keeps; the lines past the limit were discarded. A local read is returned whole, so the per response ceiling does not apply, and it is otherwise false. Each record is still cut to 4096 characters, with ... [truncated] appended.
collector.id (integer) – The appliance id of the collector.
collector.ip (string) – The IP address of the collector.
collector.name (string) – The appliance name of the collector.
directory – The directory key the caller named. This round-trips: send it straight back as the directory of the next request.
directory_path – The absolute path the key resolves to on the collector.
log_name – The log file the request will read.
max_bytes – The byte ceiling that will be enforced on the collector for this read, after any reduction to the 5242880 byte (5 MiB) maximum. Present whether or not the caller supplied max_bytes, because the cap always applies.
mode – Always remote.
note – A reminder that the content is not available yet and where to read it from. It also carries a warning when the directory is em7 and since or until carries a time component, because a window there is day granular only.
request_id (integer) – The id to read the queued request’s output with. It is not a durable handle. Collector log output ages out of the platform’s log tables after about 31 days, independently of the row describing the request, so a request id can outlive its own description and an old id becomes unreadable.

GET /collector_logs/fetch/{request_id}

Read a queued Data Collector log file read

Reads back the log content for a queued request. A local read is answered when it is run, so it has nothing to read back here.

The output is returned as text per stream, in output. A read’s standard output is the log content asked for. A page ends on a line, so append each stream’s text from each page to what you already have.

A page is bounded by page_size, by a 1048576 character ceiling on the text returned across the whole response, and by a 4096 character ceiling per record. truncated is true when either of the first two stopped the page with rows still left behind; a record cut by the third arrives with the marker ... [truncated] appended. The response ceiling counts decoded characters rather than encoded bytes, so a page of heavily multibyte text can exceed 1 MiB once encoded.

An empty page with terminated false means the collector has not produced more output yet, not that the log was empty. Call again with the returned last_id as after_id until terminated is true.

Termination reports only that the collector has finished. It is reported for a command that worked, one that failed, and one the Remote Toolbox refused before running, so the outcome has to be judged from the content and the toolbox fields.

Requires the DEV_TOOLS_RUN access hook. Only the user that queued the request may read it.

Parameters:

request_id (integer) – The request_id returned when the read was queued.

Query Parameters:

after_id (integer) – Read only output produced after this cursor. Pass the previous response’s last_id to continue where it stopped, or omit it to read from the beginning.
page_size (integer) – The maximum number of output rows to return. Values above the maximum are reduced to it. 0 is rejected rather than read as a request for the default.
wait_seconds (number) –
Opt-in server side waiting. Defaults to no wait, which returns whatever the collector has written so far.

The budget is capped at 90 seconds, deliberately below the 120 second reverse proxy read timeout, so a wait can never turn a request that is merely still running into a gateway timeout the caller cannot distinguish from a failure. A larger value is reduced to the cap. A non-finite value, nan or inf, is rejected with 400.

Status Codes:

200 OK – The page’s output per stream, in output, a count of rows per stream, the cursor to resume from, whether the collector has finished, whether more output was waiting than the page could hold, and the Remote Toolbox state.
400 Bad Request – An invalid after_id, page_size or wait_seconds. A page_size of 0 is rejected rather than read as a request for the default, and a non-finite nan or inf is rejected for all three.
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – The request id is not a collector log retrieval belonging to this user. Returned identically whether the id was never issued, belongs to another Remote Toolbox tool, belongs to another user, or has aged out of the platform’s retention window. Also returned for a tool_name in the path other than list or fetch.
500 Internal Server Error – The output could not be read

Request JSON Object:

last_id (integer) – The cursor to resume from. Pass it back as after_id on the next call. Unchanged from the requested cursor when the page held no rows.
line_counts (object) – A count of this page’s rows per stream, including the toolbox’s started and completed marker rows, which are left out of output.
mode (any) – Always remote.
output (object) – This page’s output, one text per stream. Always has stdout and stderr; a stream the toolbox does not normally write appears under its own name. Each record is one line ending in a newline; one that had none, such as a record cut to 4096 characters with ... [truncated] appended, is given one. Empty streams with terminated false mean the collector has not produced more output yet.
request_id (integer) – The request id the output belongs to.
terminated (boolean) – True when the collector has finished. This reports termination only: the same marker is written for a command that worked, one that failed, and one the Remote Toolbox refused before running, so it must not be read as success. Judge the outcome from the content and the toolbox fields. Also true once a finished job’s output has been read to the end, which covers a completed marker the Remote Toolbox failed to write, once it has had no output for 90 seconds.
toolbox.phase (string) – Where the job is, derived from the spool row and the output together, since the Remote Toolbox can lose either signal. There is no stuck phase: a job the collector never picks up stays queued and one the toolbox abandons stays running, so judge from the two ages when to stop waiting. unknown means neither the spool row nor any output could be read, which in practice is only a job pruned in the middle of a request, since a job with no spool row is reported as not found.
toolbox.returncode (integer) – The return code recorded for the queued command. Null for as long as the command is still running.
toolbox.seconds_since_last_output (integer) – Seconds since the job last wrote output, or null when it has written none.
toolbox.seconds_since_queued (integer) – Seconds since the command was queued, or null when the spool row has been pruned.
toolbox.state (integer) – The spool row’s state as found: 1 scheduled, 2 launched, 3 running, 0 complete, 4 failed, 5 canceled. The updates can land out of order, so a finished job can still read 2; phase accounts for that.
truncated (boolean) – True when the page could not carry everything that was waiting: more rows were waiting than the page size allowed, the text returned reached the 1048576 character per response ceiling with rows still left behind, or any combination of the two. Request the next page from last_id rather than assuming the output ended. Both budgets are cumulative across a wait_seconds poll, which spends one row budget and one character budget over the whole wait rather than one of each per internal read.