# Epok

> Epok is an incident-intelligence engine that works an incident in all three tenses: it forecasts forming failures where they're genuinely predictable (saturation, exhaustion, capacity — with a live ETA and confidence), recommends the reversible action that restores service (you execute), and drafts the cited root-cause verdict so it doesn't recur. Send logs, metrics, traces, infrastructure, and RUM via OpenTelemetry or common shippers; detectors run automatically — anomaly detection, new-error detection, incident grouping, and root-cause analysis — with no configuration. Epok grades its own confidence against real outcomes and abstains, with next steps, when the evidence is thin rather than guessing. This file is the index for AI/coding agents; the full machine-readable operations guide is at /llms-full.txt.

## Start here (for agents)

- [Full agent guide](https://getepok.dev/llms-full.txt): everything an agent needs to onboard a project — authentication, ingest endpoints for every signal, query API, search syntax, rate limits, verification steps. Read this first.
- [OpenAPI 3.0 spec](https://getepok.dev/openapi.json): request/response schemas for the public API (ingest, search, alerts, live-tail WebSockets).
- [Agents page](https://getepok.dev/docs/agents): the human-facing version of this guide.

## Docs — start here

- [Docs hub](https://getepok.dev/docs): the index — supported protocols, an interactive shipper picker, and links to every guide below.
- [Quickstart](https://getepok.dev/docs/quickstart): send one event with curl, verify it landed, run your first search. Includes the timestamp trap that hides data the ingest plane already accepted.
- [Authentication](https://getepok.dev/docs/authentication): which credential headers the ingest plane and the app plane each accept — they differ — plus step-by-step 401 triage.
- [Limits & error codes](https://getepok.dev/docs/limits): body size caps, ingest rate and burst, daily volume quota, every HTTP status the ingest plane returns.

## Docs — install guides

- [Traces / APM](https://getepok.dev/docs/install/traces): OpenTelemetry auto-instrumentation for Node, Python, Java, Go.
- [Metrics & infrastructure](https://getepok.dev/docs/install/metrics): host, container, Kubernetes and database metrics.
- [Prometheus](https://getepok.dev/docs/install/prometheus): tee an existing fleet across with one remote_write block.
- [Kubernetes](https://getepok.dev/docs/install/kubernetes): container logs plus node/pod metrics via DaemonSet.
- [AWS](https://getepok.dev/docs/install/aws) · [GCP](https://getepok.dev/docs/install/gcp) · [Vercel](https://getepok.dev/docs/install/vercel) · [Railway](https://getepok.dev/docs/install/railway)
- [Heroku & PaaS drains](https://getepok.dev/docs/install/drains): Heroku, any PaaS that can POST to an HTTPS URL, and GELF over HTTP.
- [Browser RUM & replay](https://getepok.dev/docs/install/rum): Core Web Vitals, frontend errors, session replay stitched to the backend trace.
- [Source maps](https://getepok.dev/docs/install/sourcemaps): upload from CI so frontend stacks resolve to original files and lines.

## Docs — reference & configuration

- [Search syntax](https://getepok.dev/docs/search-syntax): field filters, booleans, wildcards, regex, time and stream filters, pipes.
- [Detectors](https://getepok.dev/docs/detectors): every detector, what it looks for, and which are still capped at warning severity while they soak. Per-detector pages at /docs/detectors/{id}.
- [Custom rules](https://getepok.dev/docs/custom-rules): threshold rules and composite rules — full field reference and test endpoints.
- [Detection tuning](https://getepok.dev/docs/detection-tuning): map your severity and identity fields, tune thresholds, understand each reset path's blast radius.
- [Alerting hygiene](https://getepok.dev/docs/alerting): mute schedules, maintenance windows, weekly digest, audit trail, custom actions.
- [API reference (interactive)](https://getepok.dev/docs/api): browsable OpenAPI reference.
- [Migration guides](https://getepok.dev/docs/migrate): moving from other observability tools.
- [Changelog](https://getepok.dev/docs/changelog)
- [What we don't do](https://getepok.dev/docs/what-we-dont-do): honest scope boundaries.

## Key facts

- Ingest base URL: https://ingest.getepok.dev — OTLP logs and traces accept JSON and protobuf. OTLP metrics accept JSON on every build and protobuf on newer ones, so set `encoding: json` in your collector's otlphttp exporter and it is accepted either way. There is no gRPC endpoint (no `:4317`) — use http/json or http/protobuf. Metrics ALSO accept Prometheus remote_write (POST /api/v1/write) and InfluxDB line protocol (POST /write) — no collector required.
- API base URL: https://app.getepok.dev — Bearer API key auth (`Authorization: Bearer <key>`).
- Detectors run automatically on ingested data. There is nothing to configure to get detection.
- Signup is trial-first at https://app.getepok.dev (Google sign-in). API keys: app → Settings → API Keys.