Run your first diagnosis

Create a free account

Go to https://getketl.com/signup and sign up with an email address or Google. No credit card required.

Every account starts on the free tier: 20 diagnoses per calendar month, no time limit, and full access to the reasoning engine. The usage counter resets on the first of each month UTC. When you hit the limit, the API returns HTTP 402 with a "error": "limit" body. Upgrade to Team on the pricing page for higher volume and automated integrations.

Diagnose in the dashboard

After signing in, the dashboard presents four input areas:

• Alert (required): paste the alert text exactly as it fired. At least 8 characters; more context is better.
• Logs (required): paste raw log lines from the affected service. At least 20 characters; a one-to-five minute window around the alert time gives the best signal. The engine handles noisy, unstructured lines.
• Recent deploys (optional): paste deploy records from your CI or deployment tool covering the 30 minutes before the alert. A matching deploy dramatically increases confidence.
• Past incidents (optional): paste notes or post-mortems from prior incidents on the same service. Prior patterns help Ketl recognise a repeat.

Click Run diagnosis. Within a few seconds you get:

• A severity label (critical, warning, or info) and a plain-language summary.
• Ranked root causes, each with an honest confidence score and verbatim evidence quotes lifted directly from the telemetry you pasted.
• One proposed fix or rollback: the exact steps, the command to run (or null if none applies), the blast radius, and how to verify the fix worked.
• An Also consider note pointing at an alternative direction in case the leading cause is wrong.

The engine cites only lines that appear in the input you gave it. It does not invent log lines or quotes.

Call the API

The same engine is available as a JSON endpoint at POST /api/diagnose. The endpoint is same-origin and requires an authenticated session. In a browser context credentials: "include" sends the session cookie automatically. From a server or terminal, copy your session token from browser devtools after signing in.

Dedicated API tokens for server-to-server calls are a Team plan feature.

Request

Send a JSON body with these fields. alert and logs are required; the rest are optional but improve accuracy.

// fetch: browser or same-origin server context
const res = await fetch("/api/diagnose", {
  method: "POST",
  credentials: "include",        // sends the session cookie
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    service:   "checkout-api",   // optional; helps scope the context
    alert:     "P1: checkout-api error rate 14% (threshold 2%)",
    logs:      [
      "2026-07-22T03:14:52Z ERROR checkout-api: sql: Unexpected EOF",
      "2026-07-22T03:14:53Z ERROR checkout-api: sql: Unexpected EOF",
      "2026-07-22T03:15:01Z WARN  checkout-api: retrying query (attempt 2/3)",
    ].join("\n"),
    deploys:   "2026-07-22T02:58:00Z checkout-api v2.9.1 to v2.10.0 by deploy-bot",
    incidents: "2026-05-11: N+1 query on product_variants caused 8% error rate",
  }),
});

// HTTP 402 means the monthly free-tier limit is reached.
if (res.status === 402) {
  const err = await res.json();
  console.error(err.message); // "You have used all 20 free diagnoses..."
}

const { result, usage } = await res.json();
console.log(result.severity);             // "critical"
console.log(result.rootCauses[0].title);  // leading ranked cause
console.log(result.proposedFix.command);  // exact command or null
console.log(usage.used + "/" + usage.limit + " diagnoses used");

The same call with curl, using a copied session token:

# Copy the session token from Application > Cookies in browser devtools.
# Team plan users: use -H "X-Ketl-Token: <token>" instead.
curl -s -X POST "https://getketl.com/api/diagnose" \
  -H "Content-Type: application/json" \
  -H "Cookie: next-auth.session-token=<your-session-token>" \
  -d '{
    "service": "checkout-api",
    "alert": "P1: checkout-api error rate 14% (threshold 2%)",
    "logs": "2026-07-22T03:14:52Z ERROR checkout-api: sql: Unexpected EOF\n2026-07-22T03:14:53Z ERROR checkout-api: sql: Unexpected EOF",
    "deploys": "2026-07-22T02:58:00Z checkout-api v2.9.1 to v2.10.0 by deploy-bot"
  }' | jq '.result.proposedFix.command'

Response shape

A successful 200 response returns { result: DiagnoseResult, usage: UsageSummary }. Below is a realistic example for the N+1 deploy scenario above.

{
  "result": {
    "summary": "A deploy 16 minutes before the alert correlates with a spike in SQL errors. The most likely cause is an N+1 query regression introduced in v2.10.0.",
    "severity": "critical",
    "signalsUsed": ["alert", "logs", "deploys", "incidents"],
    "rootCauses": [
      {
        "rank": 1,
        "title": "N+1 query regression in v2.10.0",
        "category": "deploy regression",
        "confidence": 88,
        "explanation": "checkout-api moved from v2.9.1 to v2.10.0 sixteen minutes before the error rate crossed the threshold. A past incident on 2026-05-11 shows an identical SQL error signature caused by an N+1 query on product_variants.",
        "evidence": [
          {
            "source": "deploys",
            "quote": "2026-07-22T02:58:00Z checkout-api v2.9.1 to v2.10.0 by deploy-bot",
            "note": "Deploy 16 minutes before the alert fired"
          },
          {
            "source": "logs",
            "quote": "2026-07-22T03:14:52Z ERROR checkout-api: sql: Unexpected EOF"
          },
          {
            "source": "incidents",
            "quote": "2026-05-11: N+1 query on product_variants caused 8% error rate",
            "note": "Identical error signature"
          }
        ]
      }
    ],
    "proposedFix": {
      "kind": "rollback",
      "title": "Roll checkout-api back to v2.9.1",
      "steps": [
        "Confirm error rate started rising at 02:58 UTC in your metrics dashboard.",
        "Roll back to the last stable release, v2.9.1.",
        "Watch the error rate for five minutes to confirm recovery.",
        "Open a post-mortem ticket to find and fix the N+1 query before re-deploying."
      ],
      "command": "kubectl rollout undo deployment/checkout-api",
      "risk": "Rollback reverts functional changes in v2.10.0. Confirm no data migration ran with this release before proceeding.",
      "verify": "Error rate drops below 2% within two minutes of rollback completing.",
      "confidence": 88
    },
    "alsoConsider": "If errors predate the deploy, check for a traffic spike to the product-recommendations endpoint.",
    "model": "gpt-4.1-mini",
    "routed": "gpt-4.1-mini · frontier",
    "offline": false
  },
  "usage": {
    "used": 3,
    "limit": 20,
    "plan": "free"
  }
}

Error codes

• 400: validation failure. The body includes an error string describing what is missing (alert too short, logs too short, or total input over 24,000 characters).
• 401: not signed in. Sign in at /signup or /contact to get a Team token.
• 402: monthly free-tier limit reached. The body includes used, limit, and a human-readable message.
• 502: upstream model call failed. Retry after a short pause; the engine falls back automatically if a provider is degraded.

Connect a source

On the free tier, paste telemetry into the dashboard or call the API manually. On Team, you can connect Ketl directly to PagerDuty, Datadog, Grafana, Sentry, and GitHub so a diagnosis fires the moment an alert does, with logs and deploys already attached.

See the integration guide for setup instructions, a webhook handler you can deploy today on any tier, and what each connector reads.

Next steps

• Connect your stack: forward alerts via webhook or set up a native connector on Team.
• How the AI works: the ingest, reasoning, root-cause ranking, and model-routing pipeline explained.