its written:

Systemd unit name (e.g., box, nginx, mysql).

however:

# curl -s "https://my.***.nl/api/v1/system/logs/nginx?access_token=***" | head -5
{
  "status": "Bad Request",
  "message": "No such unit 'nginx'"
}

# curl -s "https://my.***.nl/api/v1/system/logs/box?access_token=***" | head -5
{"realtimeTimestamp":1774683967027000,"message":"apphealthmonitor: setHealth: 3028ad69-1c5f-44c7-ae4c-f61a3f194df3 (***redacted***) waiting for 1186.973 to update health","source":"box"}

# curl -s "https://my.***.nl/api/v1/system/logs/mysql?access_token=***" | head -5
{
  "status": "Bad Request",
  "message": "No such unit 'mysql'"
}

Because of the fact that Cloudron is not logging any 'failed logins' in the box.log (except succeeded) I need to extract them from the NGINX logs but then the API must work.
p.s.: the stream version does work but is not really suitable