{"openapi":"3.1.0","info":{"title":"openobserve","description":"OpenObserve API documents [https://openobserve.ai/docs/](https://openobserve.ai/docs/)","contact":{"name":"OpenObserve","url":"https://openobserve.ai/","email":"hello@zinclabs.io"},"license":{"name":"AGPL-3.0","identifier":"AGPL-3.0"},"version":"0.90.0"},"paths":{"/.well-known/oauth-authorization-server":{"post":{"tags":["MCP"],"summary":"Handler for OAuth 2.0 Authorization Server Metadata (Enterprise)\nRFC 8414: https://datatracker.ietf.org/doc/html/rfc8414\nThis endpoint provides discovery information for OAuth clients\nMust be publicly accessible (no auth) per OAuth spec","operationId":"OAuthServerMetadata","responses":{"200":{"description":"Success","content":{"application/json":{}}}},"x-o2-mcp":{"enabled":false}}},"/api/clusters":{"get":{"tags":["Clusters"],"summary":"List available clusters","description":"Retrieves a list of all available clusters organized by region. Each region contains a list of cluster names that can be used for data processing and storage. This information is useful for understanding your deployment topology and selecting appropriate clusters for workload distribution.","operationId":"ListClusters","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"propertyNames":{"type":"string"}}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Clusters","operation":"get"}}},"/api/organizations":{"get":{"tags":["Organizations"],"summary":"Get user's organizations","description":"Retrieves a list of all organizations that the authenticated user has access to, including organization details, permissions, and subscription information. Root users can see all organizations in the system.","operationId":"GetUserOrganizations","responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/OrgDetails"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Organizations","operation":"list"},"x-o2-mcp":{"description":"Get user organizations","category":"users"}},"post":{"tags":["Organizations"],"summary":"Create new organization","description":"Creates a new organization with the specified configuration and settings. The authenticated user will be automatically added as an owner of the newly created organization and can then invite other users and configure the organization. If the creator is a service account, the response will include the service account's token for the newly created organization, enabling automated workflows to immediately access the new organization without additional token retrieval steps.","operationId":"CreateOrganization","requestBody":{"description":"Organization data","content":{"application/json":{"schema":{"type":"object","required":["name"],"properties":{"identifier":{"type":"string"},"name":{"type":"string","description":"Only alphanumeric characters (A-Z, a-z, 0-9), spaces, and underscores are allowed"},"org_type":{"type":"string"},"service_account":{"type":["string","null"],"description":"Optional service account email to add to the organization\nWhen specified, only this service account will be added (not the API caller)"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Organization"},{"type":"object","properties":{"service_account":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ServiceAccountTokenInfo"}]}}}]}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Organizations","operation":"create"},"x-o2-mcp":{"description":"Create an organization","category":"organizations"}}},"/api/v2/{org_id}/alerts":{"get":{"tags":["Alerts"],"summary":"List organization alerts","description":"Retrieves a list of all alerts in the organization with filtering and pagination options. Shows alert summaries including names, status, folder organization, and basic configuration details for monitoring and management purposes.","operationId":"ListAlerts","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Optional folder ID filter parameter.","required":false,"schema":{"type":"string"},"style":"form"},{"name":"stream_type","in":"query","description":"Optional stream type filter parameter.","required":false,"schema":{"$ref":"#/components/schemas/StreamType"},"style":"form"},{"name":"stream_name","in":"query","description":"Optional stream name filter parameter.\n\nThis parameter is only used if `stream_type` is also provided.","required":false,"schema":{"type":"string"},"style":"form"},{"name":"alert_name_substring","in":"query","description":"Optional case-insensitive name substring filter parameter.","required":false,"schema":{"type":"string"},"style":"form"},{"name":"owner","in":"query","description":"Optional owner user filter parameter.","required":false,"schema":{"type":"string"},"style":"form"},{"name":"enabled","in":"query","description":"Optional enabled filter parameter.","required":false,"schema":{"type":"boolean"},"style":"form"},{"name":"page_size","in":"query","description":"The optional number of alerts to retrieve. If not set then all alerts\nthat match the query parameters will be returned.","required":false,"schema":{"type":"integer","format":"int64","minimum":0},"style":"form"},{"name":"page_idx","in":"query","description":"The optional page index. If not set then defaults to `0`.\n\nThis parameter is only used if `page_size` is also set.","required":false,"schema":{"type":"integer","format":"int64","minimum":0},"style":"form"},{"name":"alert_type","in":"query","description":"Optional alert type filter: `all` (default), `scheduled`, `realtime`,\nor `anomaly_detection`.","required":false,"schema":{"$ref":"#/components/schemas/AlertTypeFilter"},"style":"form"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","description":"HTTP response body for `ListAlerts` endpoint.","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/ListAlertsResponseBodyItem"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"list"},"x-o2-mcp":{"description":"List all alerts","category":"alerts","summary_fields":["name","stream_name","stream_type","enabled","is_real_time","folder_id","folder_name"]}},"post":{"tags":["Alerts"],"summary":"Create new alert","description":"Creates a new alert with specified conditions, triggers, and notifications. Users can define custom queries, thresholds, and notification destinations to monitor their data and receive timely alerts when conditions are met.","operationId":"CreateAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID (Required if alert folder is not the default folder)","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Alert data","content":{"application/json":{"schema":{"allOf":[{"oneOf":[{"type":"object","description":"Alert configuration for monitoring streams and triggering notifications.\n\nAn alert watches a stream (logs, metrics, or traces) using SQL or PromQL queries,\nand sends notifications to configured destinations when trigger conditions are met.","properties":{"context_attributes":{"type":["object","null"],"description":"Optional key-value attributes to include in alert notifications.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"creates_incident":{"type":"boolean","description":"When true, this alert routes notifications through the incident system\ninstead of sending direct alert notifications."},"deduplication":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DeduplicationConfig","description":"Optional deduplication configuration to prevent alert spam."}]},"description":{"type":"string","description":"Human-readable description of what this alert monitors.","example":"Fires when error count exceeds threshold in the specified time window"},"destinations":{"type":"array","items":{"type":"string"},"description":"List of destination names to notify when alert fires.\nDestinations must be pre-configured in the system.\nAccepts either `destinations` or `alert_destinations` as the JSON field name.","example":["slack-alerts","pagerduty"]},"enabled":{"type":"boolean","description":"Whether the alert is active. Disabled alerts are not evaluated."},"id":{"type":["string","null"],"description":"Unique identifier for the alert. Auto-generated on creation.","readOnly":true},"is_real_time":{"type":"boolean","description":"If true, alert evaluates in real-time as data arrives.\nIf false, alert runs on a schedule defined by trigger_condition.frequency."},"last_edited_by":{"type":["string","null"],"description":"Username who last edited the alert.","readOnly":true},"last_satisfied_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert condition was last satisfied.","readOnly":true},"last_triggered_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert was last triggered.","readOnly":true},"name":{"type":"string","description":"Human-readable name for the alert. Must be unique within the organization.","example":"High Error Rate Alert"},"org_id":{"type":"string","description":"Organization ID. Usually set automatically from the request context."},"owner":{"type":["string","null"],"description":"Username of the alert owner."},"query_condition":{"$ref":"#/components/schemas/QueryCondition","description":"Query configuration: SQL query or PromQL expression to evaluate."},"row_template":{"type":"string","description":"Template for formatting individual rows in the alert message."},"row_template_type":{"$ref":"#/components/schemas/RowTemplateType","description":"Format type for the row template."},"stream_name":{"type":"string","description":"Name of the stream to monitor.","example":"default"},"stream_type":{"$ref":"#/components/schemas/StreamType","description":"Type of stream to monitor: logs, metrics, or traces."},"template":{"type":["string","null"],"description":"Optional template name. When specified, this template is used for all\ndestinations instead of destination-level templates. This allows using\ndifferent templates for different alerts while reusing the same destinations."},"trigger_condition":{"$ref":"#/components/schemas/TriggerCondition","description":"Trigger configuration: when and how often to evaluate, thresholds."},"tz_offset":{"type":"integer","format":"int32","description":"Timezone offset in minutes. Negative values for western hemisphere."},"updated_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of last modification.","readOnly":true}}}],"description":"The alert configuration. All fields from Alert are flattened into this request body."},{"type":"object","properties":{"alert_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AlertTypeFilter","description":"Discriminates the alert type. Defaults to scheduled alert when absent.\nSet to `\"anomaly_detection\"` to create an anomaly detection config instead."}]},"anomaly_config":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AnomalyAlertFields","description":"Anomaly-detection-specific fields (nested object)."}]},"folder_id":{"type":["string","null"],"description":"Optional folder ID indicating the folder in which to create the alert.\nIf omitted the alert will be created in the default folder.","example":"default"}}}],"description":"HTTP request body for `CreateAlert` endpoint.\n\nCreates a new alert with the specified configuration. The alert monitors\na stream (logs, metrics, or traces) and triggers notifications when conditions are met.\n\n## Example\n\n```json\n{\n    \"name\": \"High Error Rate Alert\",\n    \"stream_type\": \"logs\",\n    \"stream_name\": \"default\",\n    \"is_real_time\": false,\n    \"query_condition\": {\n        \"type\": \"sql\",\n        \"sql\": \"SELECT count(*) as count FROM \\\"default\\\" WHERE level = 'error'\"\n    },\n    \"trigger_condition\": {\n        \"period\": 15,\n        \"operator\": \">=\",\n        \"threshold\": 100,\n        \"frequency\": 5,\n        \"frequency_type\": \"minutes\",\n        \"silence\": 60\n    },\n    \"destinations\": [\"slack-alerts\"],\n    \"enabled\": true,\n    \"description\": \"Alert when error count exceeds 100 in 15 minutes\"\n}\n```"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create a new alert rule with flexible query options. IMPORTANT: Alert name must use snake_case (no spaces/special chars like :,#,?,&,%,/,quotes), destinations array is required with valid destination names. QueryCondition supports 3 query types: (1) Custom - uses conditions, aggregation, vrl_function, search_event_type, multi_time_range; (2) SQL - uses sql, vrl_function, search_event_type; (3) PromQL - uses promql, promql_condition, multi_time_range","category":"alerts"},"x-o2-ratelimit":{"module":"Alerts","operation":"create"}}},"/api/v2/{org_id}/alerts/bulk/enable":{"post":{"tags":["Alerts"],"summary":"Enable or disable alert in bulk","description":"Toggles the active status of alerts to enable or disable its monitoring and notification functionality in bulk. When disabled, the alert will stop evaluating conditions and sending notifications until re-enabled.","operationId":"EnableAlertBulk","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"value","in":"query","description":"Set to `true` to enable the alert or `false` to disable the alert.","required":true,"schema":{"type":"boolean"},"style":"form"}],"requestBody":{"description":"Alert id list","content":{"application/json":{"schema":{"type":"object","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string"}}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"update"},"x-o2-mcp":{"enabled":false}}},"/api/v2/{org_id}/alerts/generate_sql":{"post":{"tags":["Alerts"],"summary":"Generate SQL from alert query parameters","description":"Generates a SQL query string based on alert query parameters including stream, aggregations, and conditions. This endpoint is useful for testing alert queries and understanding the SQL that will be executed.","operationId":"GenerateSql","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"SQL generation parameters","content":{"application/json":{"schema":{"type":"object","description":"HTTP request body for `GenerateSql` endpoint.","required":["stream_name","stream_type","query_condition"],"properties":{"query_condition":{"$ref":"#/components/schemas/QueryCondition","description":"Query condition containing aggregation and WHERE conditions\nThe conditions field within QueryCondition supports both V1 and V2 formats"},"stream_name":{"type":"string","description":"Stream name to query","example":"default"},"stream_type":{"$ref":"#/components/schemas/StreamType","description":"Type of stream (logs, metrics, traces, etc.)"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","description":"HTTP response body for `GenerateSql` endpoint.","required":["sql"],"properties":{"metadata":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/GenerateSqlMetadata","description":"Optional metadata about the generated query"}]},"sql":{"type":"string","description":"The generated SQL query string","example":"SELECT * FROM \"my_stream\" WHERE field > 100"}}}}}},"400":{"description":"Bad request - invalid parameters","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Generate SQL from natural language","category":"alerts"},"x-o2-ratelimit":{"module":"Alerts","operation":"generate_sql"}}},"/api/v2/{org_id}/alerts/incidents":{"get":{"tags":["Incidents"],"summary":"List alert incidents","description":"Retrieves a list of correlated alert incidents with optional status filtering and pagination.","operationId":"ListIncidents","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"status","in":"query","description":"Filter by status (open, acknowledged, resolved)","required":false,"schema":{"type":["string","null"]}},{"name":"limit","in":"query","description":"Maximum number of results","required":false,"schema":{"type":"integer","format":"int64","minimum":0}},{"name":"offset","in":"query","description":"Offset for pagination","required":false,"schema":{"type":"integer","format":"int64","minimum":0}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListIncidentsResponse"}}}},"500":{"description":"Internal error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"list"},"x-o2-mcp":{"description":"List all incidents","category":"alerts"}}},"/api/v2/{org_id}/alerts/incidents/stats":{"get":{"tags":["Incidents"],"summary":"Get incident statistics","description":"Retrieves statistics about incidents including counts by status and severity.","operationId":"GetIncidentStats","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentStats"}}}},"500":{"description":"Internal error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"get"},"x-o2-mcp":{"description":"Get incident statistics","category":"alerts"}}},"/api/v2/{org_id}/alerts/incidents/{incident_id}":{"get":{"tags":["Incidents"],"summary":"Get incident details","description":"Retrieves detailed information about a specific incident including all correlated alerts.","operationId":"GetIncident","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"incident_id","in":"path","description":"Incident ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentWithAlerts"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"get"},"x-o2-mcp":{"description":"Get an incident's details","category":"alerts","pinned":true}}},"/api/v2/{org_id}/alerts/incidents/{incident_id}/rca":{"post":{"tags":["Incidents"],"summary":"Trigger RCA analysis for an incident","description":"Triggers root cause analysis for an incident. Use stream=true query parameter for streaming response, otherwise returns complete result as JSON.","operationId":"TriggerIncidentRca","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"incident_id","in":"path","description":"Incident ID","required":true,"schema":{"type":"string"}},{"name":"stream","in":"query","description":"Use streaming response (default: false)","required":false,"schema":{"type":"boolean"}},{"name":"reanalysis","in":"query","description":"Treat this as a user-initiated reanalysis — bypasses cooldown (default: false)","required":false,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"RCA analysis completed or SSE stream","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RcaResponse"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}},"503":{"description":"RCA agent unavailable","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"update"},"x-o2-mcp":{"description":"Manually trigger incident RCA","category":"alerts"}}},"/api/v2/{org_id}/alerts/incidents/{incident_id}/update":{"patch":{"tags":["Incidents"],"summary":"Update incident fields","description":"Updates incident title, severity, or status. This endpoint is only available with enterprise features enabled.","operationId":"UpdateIncident","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"incident_id","in":"path","description":"Incident ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Field to update","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdatePayload"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Incident"}}}},"403":{"description":"Enterprise feature","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update an incident's title or severity. Status changes (resolve, acknowledge, reopen) are NOT supported via this tool — they must be performed by a human in the UI.","category":"alerts"},"x-o2-ratelimit":{"module":"Alerts","operation":"update"}}},"/api/v2/{org_id}/alerts/move":{"patch":{"tags":["Alerts"],"summary":"Move alerts between folders","description":"Moves one or more alerts from their current folder to a specified destination folder. Helps organize alerts into logical groups and manage access permissions when using role-based access control.","operationId":"MoveAlerts","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"From Folder ID (Required if RBAC enabled)","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Identifies alerts and the destination folder","content":{"application/json":{"schema":{"type":"object","description":"HTTP request body for `MoveAlerts` endpoint.","required":["alert_ids","dst_folder_id"],"properties":{"alert_ids":{"type":"array","items":{"type":"string"},"description":"IDs of the alerts to move."},"anomaly_config_ids":{"type":"array","items":{"type":"string"},"description":"IDs of anomaly detection configs to move. Defaults to empty when not\nprovided. Callers should always supply this to avoid per-ID DB lookups."},"dst_folder_id":{"type":"string","description":"Indicates the folder to which alerts should be moved."}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Move alerts to another folder","category":"alerts"},"x-o2-ratelimit":{"module":"Alerts","operation":"update"}}},"/api/v2/{org_id}/alerts/{alert_id}":{"get":{"tags":["Alerts"],"summary":"Get alert details","description":"Retrieves detailed information about a specific alert including its configuration, conditions, triggers, notification settings, and current status. Useful for viewing and understanding existing alert setups.","operationId":"GetAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Alert ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID (Required if RBAC enabled)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Alert","description":"HTTP response body for `GetAlert` endpoint."}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get alert details by ID","category":"alerts"},"x-o2-ratelimit":{"module":"Alerts","operation":"get"}},"put":{"tags":["Alerts"],"summary":"Update alert configuration","description":"Updates an existing alert's configuration including conditions, queries, thresholds, notification destinations, and scheduling. Allows users to modify alert behavior and settings as monitoring requirements change.","operationId":"UpdateAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Alert ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID (Required if RBAC enabled)","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Alert data","content":{"application/json":{"schema":{"allOf":[{"oneOf":[{"type":"object","description":"Alert configuration for monitoring streams and triggering notifications.\n\nAn alert watches a stream (logs, metrics, or traces) using SQL or PromQL queries,\nand sends notifications to configured destinations when trigger conditions are met.","properties":{"context_attributes":{"type":["object","null"],"description":"Optional key-value attributes to include in alert notifications.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"creates_incident":{"type":"boolean","description":"When true, this alert routes notifications through the incident system\ninstead of sending direct alert notifications."},"deduplication":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DeduplicationConfig","description":"Optional deduplication configuration to prevent alert spam."}]},"description":{"type":"string","description":"Human-readable description of what this alert monitors.","example":"Fires when error count exceeds threshold in the specified time window"},"destinations":{"type":"array","items":{"type":"string"},"description":"List of destination names to notify when alert fires.\nDestinations must be pre-configured in the system.\nAccepts either `destinations` or `alert_destinations` as the JSON field name.","example":["slack-alerts","pagerduty"]},"enabled":{"type":"boolean","description":"Whether the alert is active. Disabled alerts are not evaluated."},"id":{"type":["string","null"],"description":"Unique identifier for the alert. Auto-generated on creation.","readOnly":true},"is_real_time":{"type":"boolean","description":"If true, alert evaluates in real-time as data arrives.\nIf false, alert runs on a schedule defined by trigger_condition.frequency."},"last_edited_by":{"type":["string","null"],"description":"Username who last edited the alert.","readOnly":true},"last_satisfied_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert condition was last satisfied.","readOnly":true},"last_triggered_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert was last triggered.","readOnly":true},"name":{"type":"string","description":"Human-readable name for the alert. Must be unique within the organization.","example":"High Error Rate Alert"},"org_id":{"type":"string","description":"Organization ID. Usually set automatically from the request context."},"owner":{"type":["string","null"],"description":"Username of the alert owner."},"query_condition":{"$ref":"#/components/schemas/QueryCondition","description":"Query configuration: SQL query or PromQL expression to evaluate."},"row_template":{"type":"string","description":"Template for formatting individual rows in the alert message."},"row_template_type":{"$ref":"#/components/schemas/RowTemplateType","description":"Format type for the row template."},"stream_name":{"type":"string","description":"Name of the stream to monitor.","example":"default"},"stream_type":{"$ref":"#/components/schemas/StreamType","description":"Type of stream to monitor: logs, metrics, or traces."},"template":{"type":["string","null"],"description":"Optional template name. When specified, this template is used for all\ndestinations instead of destination-level templates. This allows using\ndifferent templates for different alerts while reusing the same destinations."},"trigger_condition":{"$ref":"#/components/schemas/TriggerCondition","description":"Trigger configuration: when and how often to evaluate, thresholds."},"tz_offset":{"type":"integer","format":"int32","description":"Timezone offset in minutes. Negative values for western hemisphere."},"updated_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of last modification.","readOnly":true}}}],"description":"Alert configuration fields (used for scheduled/realtime alerts)."},{"type":"object","properties":{"alert_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AlertTypeFilter","description":"Discriminates the alert type. When `\"anomaly_detection\"`, delegates to the\nanomaly config update path."}]},"anomaly_config":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UpdateAnomalyAlertFields","description":"Anomaly-detection-specific fields to update (partial — only supplied fields\nare changed)."}]}}}],"description":"HTTP request body for `UpdateAlert` endpoint.\n\nUpdates an existing alert. Provide the full alert configuration — this replaces\nthe existing alert entirely (not a partial update). The request body is the same\nstructure as Alert.\n\nFor anomaly detection configs, set `alert_type = \"anomaly_detection\"` and supply\nanomaly-specific fields directly at the top level (flat). Only fields present in\nthe request body will be updated (partial update semantics for anomaly fields)."}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update an existing alert","category":"alerts"},"x-o2-ratelimit":{"module":"Alerts","operation":"update"}},"delete":{"tags":["Alerts"],"summary":"Delete alert","description":"Permanently removes an alert and all its configurations including conditions, triggers, and notification settings. This action cannot be undone and will stop all monitoring and notifications for the deleted alert.","operationId":"DeleteAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Alert ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID (Required if RBAC enabled)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"delete"},"x-o2-mcp":{"description":"Delete an alert by ID","category":"alerts","requires_confirmation":true}}},"/api/v2/{org_id}/alerts/{alert_id}/clone":{"post":{"tags":["Alerts"],"summary":"Clone an alert or anomaly detection config","description":"Creates a copy of an existing alert or anomaly detection config. For anomaly configs, the clone starts untrained with counters reset. Provide an optional name and folder_id in the request body.","operationId":"CloneAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Source alert or anomaly config ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Clone options","content":{"application/json":{"schema":{"type":"object","description":"HTTP request body for `CloneAlert` endpoint.","properties":{"folder_id":{"type":["string","null"],"description":"Optional folder ID to place the clone in. Defaults to the source folder."},"name":{"type":["string","null"],"description":"Optional new name for the cloned alert. Defaults to `<source_name>_copy`."}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"create"}}},"/api/v2/{org_id}/alerts/{alert_id}/enable":{"patch":{"tags":["Alerts"],"summary":"Enable or disable alert","description":"Toggles the active status of an alert to enable or disable its monitoring and notification functionality. When disabled, the alert will stop evaluating conditions and sending notifications until re-enabled.","operationId":"EnableAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Alert ID","required":true,"schema":{"type":"string"}},{"name":"value","in":"query","description":"Set to `true` to enable the alert or `false` to disable the alert.","required":true,"schema":{"type":"boolean"},"style":"form"}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"update"},"x-o2-mcp":{"description":"Enable or disable an alert","category":"alerts"}}},"/api/v2/{org_id}/alerts/{alert_id}/export":{"post":{"tags":["Alerts"],"summary":"Export alert configuration","description":"Exports the complete configuration of a specific alert in a format suitable for backup, sharing, or importing into other environments. Includes all alert settings, conditions, and notification configurations.","operationId":"ExportAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Alert ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID (Required if RBAC enabled)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Alert","description":"HTTP response body for `GetAlert` endpoint."}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"get"},"x-o2-mcp":{"description":"Export alert as JSON","category":"alerts"}}},"/api/v2/{org_id}/alerts/{alert_id}/retrain":{"patch":{"tags":["Alerts"],"summary":"Trigger retraining for an anomaly detection alert","description":"Triggers a model retrain for an anomaly detection alert. Returns 400 if called on a non-anomaly alert type.","operationId":"RetrainAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Anomaly detection alert ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Not an anomaly detection alert","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"update"}}},"/api/v2/{org_id}/alerts/{alert_id}/trigger":{"patch":{"tags":["Alerts"],"summary":"Manually trigger alert","description":"Manually triggers an alert to test its functionality and notification delivery. Useful for testing alert configurations, verifying notification channels, and ensuring alerts work as expected before relying on them for monitoring.","operationId":"TriggerAlert","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"path","description":"Alert ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID (Required if RBAC enabled)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Alerts","operation":"update"},"x-o2-mcp":{"description":"Manually trigger an alert","category":"alerts"}}},"/api/v2/{org_id}/folders/{folder_type}":{"get":{"tags":["Folders"],"summary":"List organization folders","description":"Retrieves a list of all folders in the organization for the specified folder type. Users will only see folders they have access to when role-based access control is enabled.","operationId":"ListFolders","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_type","in":"path","description":"Type of data the folder can contain","required":true,"schema":{"$ref":"#/components/schemas/FolderType"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"object","description":"HTTP response body for `ListFolder` endpoint.","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Folder"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Folders","operation":"list"},"x-o2-mcp":{"description":"List all folders","category":"folders","summary_fields":["folderId","name","description"]}},"post":{"tags":["Folders"],"summary":"Create new folder","description":"Creates a new folder for organizing dashboards, alerts, or reports. Folders help users organize their content into logical groups and manage access permissions when using role-based access control.","operationId":"CreateFolder","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_type","in":"path","description":"Type of data the folder can contain","required":true,"schema":{"$ref":"#/components/schemas/FolderType"}}],"requestBody":{"description":"Folder details","content":{"application/json":{"schema":{"type":"object","description":"HTTP request body for `CreateFolder` endpoint.","required":["name","description"],"properties":{"description":{"type":"string"},"name":{"type":"string"}}},"example":{"name":"Infrastructure","description":"Traffic patterns and network performance of the infrastructure"}}},"required":true},"responses":{"200":{"description":"Folder created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `CreateFolder` endpoint."}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Folders","operation":"create"},"x-o2-mcp":{"description":"Create a new folder","category":"folders"}}},"/api/v2/{org_id}/folders/{folder_type}/name/{folder_name}":{"get":{"tags":["Folders"],"summary":"Get folder by name","description":"Retrieves detailed information about a specific folder by its name rather than ID. Useful when you know the folder name but not its unique identifier. Returns folder information for the specified folder type and name.","operationId":"GetFolderByName","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_type","in":"path","description":"Type of data the folder can contain","required":true,"schema":{"$ref":"#/components/schemas/FolderType"}},{"name":"folder_name","in":"path","description":"Folder Name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `GetFolder` endpoint."}}}},"404":{"description":"Folder not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get folder by name","category":"folders"},"x-o2-ratelimit":{"module":"Folders","operation":"get"}}},"/api/v2/{org_id}/folders/{folder_type}/{folder_id}":{"get":{"tags":["Folders"],"summary":"Get folder details","description":"Retrieves detailed information about a specific folder including its name, description, creation details, and metadata. Returns folder information for the specified folder type and ID.","operationId":"GetFolder","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_type","in":"path","description":"Type of data the folder can contain","required":true,"schema":{"$ref":"#/components/schemas/FolderType"}},{"name":"folder_id","in":"path","description":"Folder ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `GetFolder` endpoint."}}}},"404":{"description":"Folder not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get folder details by ID","category":"folders"},"x-o2-ratelimit":{"module":"Folders","operation":"get"}},"put":{"tags":["Folders"],"summary":"Update folder details","description":"Updates an existing folder's name, description, or other properties. Note that the default folder cannot be updated and folders containing content may have restrictions on certain changes.","operationId":"UpdateFolder","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_type","in":"path","description":"Type of data the folder can contain","required":true,"schema":{"$ref":"#/components/schemas/FolderType"}},{"name":"folder_id","in":"path","description":"Folder name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Folder details","content":{"application/json":{"schema":{"type":"object","properties":{"description":{"type":"string","default":""},"folder_id":{"type":"string","default":""},"name":{"type":"string","default":""}}},"example":{"title":"Infra","description":"Traffic patterns and network performance of the infrastructure"}}},"required":true},"responses":{"200":{"description":"Folder updated","content":{"text/plain":{"schema":{"type":"string"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Folders","operation":"update"},"x-o2-mcp":{"description":"Update folder properties","category":"folders"}},"delete":{"tags":["Folders"],"summary":"Delete folder","description":"Permanently deletes a folder and removes it from the organization. The folder must be empty (no dashboards, alerts, or reports) before it can be deleted. The default folder cannot be deleted.","operationId":"DeleteFolder","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_type","in":"path","description":"Type of data the folder can contain","required":true,"schema":{"$ref":"#/components/schemas/FolderType"}},{"name":"folder_id","in":"path","description":"Folder ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"text/plain":{"schema":{"type":"string"}}}},"404":{"description":"NotFound","content":{"text/plain":{"schema":{"type":"string"}}}},"500":{"description":"Error","content":{"text/plain":{"schema":{"type":"string"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Folders","operation":"delete"},"x-o2-mcp":{"description":"Delete a folder by ID","category":"folders","requires_confirmation":true}}},"/api/v2/{org_id}/reports":{"get":{"tags":["Reports"],"summary":"List dashboard reports (v2)","description":"Lists reports for the organization, optionally filtered by folder.","operationId":"ListReportsV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID filter","required":false,"schema":{"type":"string"}},{"name":"dashboard_id","in":"query","description":"Dashboard ID filter","required":false,"schema":{"type":"string"}},{"name":"cache","in":"query","description":"Filter destination-less (cache) reports","required":false,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"list"}},"post":{"tags":["Reports"],"summary":"Create dashboard report (v2)","description":"Creates a new automated dashboard report in the specified folder. Pass `?folder=<folder_id>` to place the report in a non-default folder.","operationId":"CreateReportV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID (defaults to 'default')","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Report details","content":{"application/json":{"schema":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}}}},"required":true},"responses":{"200":{"description":"Report created","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"create"}}},"/api/v2/{org_id}/reports/bulk":{"delete":{"tags":["Reports"],"summary":"Delete multiple dashboard reports by ID (v2)","operationId":"DeleteReportBulkV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Report IDs (KSUIDs)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkDeleteRequest"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BulkDeleteResponse"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"delete"},"x-o2-mcp":{"enabled":false}}},"/api/v2/{org_id}/reports/move":{"patch":{"tags":["Reports"],"summary":"Move reports between folders (v2)","operationId":"MoveReports","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Report IDs and destination folder","content":{"application/json":{"schema":{"type":"object","required":["report_ids","dst_folder_id"],"properties":{"dst_folder_id":{"type":"string"},"report_ids":{"type":"array","items":{"type":"string"}}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"update"}}},"/api/v2/{org_id}/reports/{report_id}":{"get":{"tags":["Reports"],"summary":"Get dashboard report by ID (v2)","operationId":"GetReportV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"report_id","in":"path","description":"Report ID (KSUID)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"get"}},"put":{"tags":["Reports"],"summary":"Update dashboard report by ID (v2)","description":"Updates an existing report. Pass `?folder=<folder_id>` to move the report to a different folder at the same time.","operationId":"UpdateReportV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"report_id","in":"path","description":"Report ID (KSUID)","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Move to this folder ID","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Report details","content":{"application/json":{"schema":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}}}},"required":true},"responses":{"200":{"description":"Updated","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"update"}},"delete":{"tags":["Reports"],"summary":"Delete dashboard report by ID (v2)","operationId":"DeleteReportV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"report_id","in":"path","description":"Report ID (KSUID)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Deleted","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"delete"}}},"/api/v2/{org_id}/reports/{report_id}/enable":{"patch":{"tags":["Reports"],"summary":"Enable or disable a report by ID (v2)","operationId":"EnableReportV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"report_id","in":"path","description":"Report ID (KSUID)","required":true,"schema":{"type":"string"}},{"name":"value","in":"query","description":"true to enable, false to disable","required":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"update"}}},"/api/v2/{org_id}/reports/{report_id}/trigger":{"put":{"tags":["Reports"],"summary":"Manually trigger a report by ID (v2)","operationId":"TriggerReportV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"report_id","in":"path","description":"Report ID (KSUID)","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/_bulk":{"post":{"tags":["Logs"],"summary":"Bulk ingest logs (Elasticsearch compatible)","description":"Ingests multiple log records in bulk using Elasticsearch-compatible NDJSON format. Each line contains either an index/create action followed by the document data. This endpoint provides high-throughput ingestion for applications migrating from or integrating with Elasticsearch.","operationId":"LogsIngestionBulk","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Ingest data (ndjson)","content":{"application/json":{"schema":{"type":"string"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":2,"errors":true,"items":[{"index":{"_index":"olympics","_id":1,"status":200,"error":{"type":"Too old data, only last 5 hours data can be ingested. Data discarded.","reason":"Too old data, only last 5 hours data can be ingested. Data discarded.","index_uuid":"1","shard":"1","index":"olympics"},"original_record":{"athlete":"CHASAPIS, Spiridon","city":"BER","country":"USA","discipline":"Swimming","event":"100M Freestyle For Sailors","gender":"Men","medal":"Silver","onemore":1,"season":"summer","sport":"Aquatics","year":1986}}}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/_search":{"post":{"tags":["Search"],"summary":"Search data with SQL","description":"Executes SQL queries against log streams with support for complex search patterns, time range filtering, aggregations, and histogram generation. Supports advanced features like multi-stream searches, caching, and UI optimizations for dashboard visualizations.","operationId":"SearchSQL","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. one of: logs, metrics, traces. Defaults to logs.","required":false,"schema":{"type":"string"}},{"name":"is_ui_histogram","in":"query","description":"Whether to return histogram data for UI (default: false)","required":false,"schema":{"type":"boolean"}},{"name":"is_multi_stream_search","in":"query","description":"Indicate is search is for multi stream (default: false)","required":false,"schema":{"type":"boolean"}},{"name":"validate","in":"query","description":"Validate query fields against stream schema and User-Defined Schema (UDS). When enabled, returns error if queried fields are not in schema or not allowed by UDS (default: false)","required":false,"schema":{"type":"boolean"}}],"requestBody":{"description":"Search query","content":{"application/json":{"schema":{"type":"object","required":["query"],"properties":{"clear_cache":{"type":"boolean"},"clusters":{"type":"array","items":{"type":"string"}},"encoding":{"$ref":"#/components/schemas/RequestEncoding"},"local_mode":{"type":["boolean","null"]},"query":{"$ref":"#/components/schemas/SearchQuery"},"regions":{"type":"array","items":{"type":"string"}},"search_event_context":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventContext"}]},"search_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventType"}]},"timeout":{"type":"integer","format":"int64"},"use_cache":{"type":"boolean"}}},"example":{"query":{"sql":"select * from k8s","start_time":1675182660872049,"end_time":1675185660872049,"from":0,"size":10}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"hits":[{"_p":"F","_timestamp":1674213225158000,"kubernetes":{"container_hash":"dkr.ecr.us-west-2.amazonaws.com/openobserve@sha256:3dbbb0dc1eab2d5a3b3e4a75fd87d194e8095c92d7b2b62e7cdbd07020f54589","container_image":"dkr.ecr.us-west-2.amazonaws.com/openobserve:v0.0.3","container_name":"openobserve","docker_id":"eb0983bdb9ff9360d227e6a0b268fe3b24a0868c2c2d725a1516c11e88bf5789","host":"ip.us-east-2.compute.internal","namespace_name":"openobserve","pod_id":"35a0421f-9203-4d73-9663-9ff0ce26d409","pod_name":"openobserve-ingester-0"},"log":"[2023-01-20T11:13:45Z INFO  actix_web::middleware::logger] 10.2.80.192 \"POST /api/demo/_bulk HTTP/1.1\" 200 68","stream":"stderr"}],"total":27179431,"from":0,"size":1,"scan_size":28943}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Search data with SQL, you can use `match_all('foo')` to search with full text search, also you can use `str_match(field, 'bar')` to search in a specific field; start_time, end_time can't be zero, need to be a valid micro timestamp. Note: in summary mode, response is capped at 100 hits, request detail='full' if you need more.","category":"search","pinned":true},"x-o2-ratelimit":{"module":"Search","operation":"get"}}},"/api/{org_id}/_search_history":{"post":{"tags":["Search"],"summary":"Search query history","description":"Retrieves historical search queries and their execution details","operationId":"SearchHistory","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Search history request parameters","content":{"application/json":{"schema":{"type":"object","description":"Request parameters for querying search history","required":["start_time","end_time"],"properties":{"end_time":{"type":"integer","format":"int64","description":"end time in micro seconds"},"org_id":{"type":["string","null"],"description":"Organization ID to filter search history by"},"size":{"type":"integer","format":"int64","description":"Maximum number of search history records to return"},"start_time":{"type":"integer","format":"int64","description":"start time in micro seconds"},"stream_name":{"type":["string","null"],"description":"Name of the specific stream to filter by"},"stream_type":{"type":["string","null"],"description":"Type of stream to filter by (e.g., logs, metrics, traces)"},"trace_id":{"type":["string","null"],"description":"Trace ID to filter search history by"},"user_email":{"type":["string","null"],"description":"Email of the user to filter search history by"}}},"example":{"stream_name":"default","stream_type":"logs","min_ts":1632960000,"max_ts":1633046400,"trace_id":"7f7898fd19424c47ba830a6fa9b25e1f","size":100}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":40,"took_detail":{"total":40,"idx_took":0,"wait_in_queue":0},"hits":[{"cached_ratio":0,"end_time":15,"org_id":"default","scan_records":1,"scan_size":7.0,"sql":"SELECT COUNT(*) from \"default\"","start_time":0,"stream_name":"default","stream_type":"logs","took":0.056222333,"trace_id":"7f7898fd19424c47ba830a6fa9b25e1f","function":"."}],"total":3,"from":0,"size":20,"cached_ratio":0,"scan_size":0,"idx_scan_size":0,"scan_records":3,"trace_id":"2lsPBWjwZxUJ5ugvZ4jApESZEpk","is_partial":false,"result_cache_ratio":0}}}},"400":{"description":"Bad Request - Invalid parameters or body","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search","operation":"get"},"x-o2-mcp":{"description":"Get search history","category":"search"}}},"/api/{org_id}/_search_partition":{"post":{"tags":["Search"],"summary":"Search partition data","description":"Executes search queries on partitioned log data with specified parameters","operationId":"SearchPartition","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. Must be one of: logs, metrics, traces. Defaults to logs if not specified.","required":false,"schema":{"type":"string"}},{"name":"enable_align_histogram","in":"query","description":"Enable align histogram","required":true,"schema":{"type":"boolean"}}],"requestBody":{"description":"Search query","content":{"application/json":{"schema":{"type":"object","required":["sql","start_time","end_time"],"properties":{"clusters":{"type":"array","items":{"type":"string"}},"encoding":{"$ref":"#/components/schemas/RequestEncoding"},"end_time":{"type":"integer","format":"int64"},"histogram_interval":{"type":"integer","format":"int64"},"query_fn":{"type":["string","null"]},"regions":{"type":"array","items":{"type":"string"}},"sampling_ratio":{"type":["number","null"],"format":"double"},"sql":{"type":"string"},"start_time":{"type":"integer","format":"int64"},"streaming_output":{"type":"boolean"}}},"example":{"sql":"select * from k8s ","start_time":1675182660872049,"end_time":1675185660872049}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"file_num":10,"original_size":10240,"compressed_size":1024,"partitions":[[1674213225158000,1674213225158000],[1674213225158000,1674213225158000]]}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search","operation":"get"},"x-o2-mcp":{"description":"Get search partitions then you can call _search api by partitions to give the result looks faster","category":"search"}}},"/api/{org_id}/_search_stream":{"post":{"tags":["Search"],"summary":"Stream search results","description":"Executes a search query and streams the results back in real-time using HTTP/2 server-sent events. This is ideal for large result sets or long-running queries where you want to receive data as it becomes available rather than waiting for the complete response. Results are streamed as JSON objects separated by newlines.","operationId":"SearchStreamHttp2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"is_ui_histogram","in":"query","description":"Whether to return histogram data for UI","required":true,"schema":{"type":"boolean"}},{"name":"is_multi_stream_search","in":"query","description":"Indicate is search is for multi stream","required":true,"schema":{"type":"boolean"}}],"requestBody":{"description":"Search query","content":{"application/json":{"schema":{"type":"string"},"example":{"sql":"select * from logs LIMIT 10","start_time":1675182660872049,"end_time":1675185660872049}}},"required":true},"responses":{"200":{"description":"Success","content":{"text/event-stream":{}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search","operation":"get"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/_values_stream":{"post":{"tags":["Search"],"summary":"Get field values with HTTP/2 streaming","description":"Retrieves field values from logs using HTTP/2 streaming for real-time results","operationId":"ValuesStreamHttp2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Values query","content":{"application/json":{"schema":{"type":"string"},"example":{"sql":"select * from logs LIMIT 10","start_time":1675182660872049,"end_time":1675185660872049}}},"required":true},"responses":{"200":{"description":"Success","content":{"text/event-stream":{}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search","operation":"get"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/actions":{"get":{"tags":["Actions"],"summary":"List automated actions","description":"Retrieves a list of all automated actions configured for the organization. Returns action metadata including names, status, execution schedules, and basic configuration details. Helps administrators manage automation workflows, monitor action health, and understand the complete automation landscape across the organization.","operationId":"ListActions","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Actions","operation":"list"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/actions/download/{ksuid}":{"get":{"tags":["Actions"],"summary":"Download action package","description":"Downloads the complete action package as a ZIP file containing all source code, configuration files, dependencies, and metadata for a specific automated action. Useful for backup, version control, sharing actions across environments, or performing offline analysis of action implementations.","operationId":"GetActionZip","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"ksuid","in":"path","description":"Action ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/zip":{"schema":{"type":"string"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Actions","operation":"get"}}},"/api/{org_id}/actions/upload":{"post":{"tags":["Actions"],"summary":"Upload automated action package","description":"Uploads a ZIP file containing an automated action package with source code, configuration, and dependencies. The package is extracted, validated, and deployed to the action execution environment. Supports both new action creation and updates to existing actions. Includes validation of environment variables, execution parameters, and package integrity.","operationId":"UploadZippedAction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Action processed successfully","content":{"application/json":{"schema":{"type":"string"}}}},"400":{"description":"Error processing action","content":{"application/json":{"schema":{"type":"string"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"string"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Actions","operation":"create"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/actions/{action_id}":{"get":{"tags":["Actions"],"summary":"Get automated action details","description":"Retrieves complete configuration and runtime details for a specific automated action. Returns execution parameters, environment variables, scheduling configuration, execution history, and performance metrics. Used for monitoring action behavior, troubleshooting issues, and reviewing automation settings.","operationId":"GetAction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"action_id","in":"path","description":"Action ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Actions","operation":"get"},"x-o2-mcp":{"enabled":false}},"put":{"tags":["Actions"],"summary":"Update automated action","description":"Updates the configuration and parameters of an existing automated action. Allows modification of execution settings, environment variables, scheduling parameters, and other action properties. Changes take effect on the next execution cycle, ensuring continuous operation with updated configuration.","operationId":"UpdateAction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"action_id","in":"path","description":"Action ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Template data","content":{"application/json":{"schema":{"type":"object","properties":{"body":{"type":"string","default":""},"id":{"type":["string","null"],"default":null},"is_default":{"type":"boolean","default":false},"name":{"type":"string","default":""},"org_id":{"type":"string","default":""},"type":{"oneOf":[{"$ref":"#/components/schemas/TemplateType"}],"default":"http"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Actions","operation":"update"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/actions/{ksuid}":{"delete":{"tags":["Actions"],"summary":"Delete automated action","description":"Permanently removes an automated action from the organization. The action must not be in use by active workflows or schedules before deletion. Once deleted, any scheduled executions or trigger-based invocations will stop, and the action configuration cannot be recovered.","operationId":"DeleteAction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"ksuid","in":"path","description":"Action ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Actions","operation":"delete"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/alerts/dedup/summary":{"get":{"tags":["Alerts"],"summary":"Get deduplication summary statistics for an organization","operationId":"GetDedupSummary","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DedupSummaryResponse"}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/alerts/deduplication/config":{"get":{"tags":["Alerts"],"summary":"Get deduplication configuration for an organization","operationId":"GetDeduplicationConfig","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GlobalDeduplicationConfig"}}}},"403":{"description":"Forbidden - Enterprise feature"},"404":{"description":"Not found"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]},"post":{"tags":["Alerts"],"summary":"Set deduplication configuration for an organization","operationId":"SetDeduplicationConfig","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Deduplication configuration","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GlobalDeduplicationConfig"}}},"required":true},"responses":{"200":{"description":"Success"},"400":{"description":"Bad request"},"403":{"description":"Forbidden - Enterprise feature"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}},"delete":{"tags":["Alerts"],"summary":"Delete deduplication configuration for an organization","operationId":"DeleteDeduplicationConfig","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success"},"403":{"description":"Forbidden - Enterprise feature"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}},"/api/{org_id}/alerts/deduplication/semantic-groups":{"get":{"tags":["Alerts"],"summary":"Get semantic field groups for an organization","operationId":"GetSemanticGroups","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/FieldAlias"}}}}},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]},"put":{"tags":["Alerts"],"summary":"Save semantic field groups for an organization","description":"Merges provided groups with existing ones:\n- Groups with matching IDs are updated (replaced)\n- New groups (no matching ID) are added\n- Existing groups not in the request are preserved","operationId":"SaveSemanticGroups","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Semantic groups to save (merged with existing)","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/FieldAlias"}}}},"required":true},"responses":{"200":{"description":"Success"},"400":{"description":"Bad request - Invalid semantic groups"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/alerts/deduplication/semantic-groups/preview-diff":{"post":{"tags":["Alerts"],"summary":"Preview diff between imported semantic groups and current DB state","description":"This endpoint compares the provided semantic groups with what's currently stored\nand returns a diff showing additions, modifications, and unchanged groups.\nThe UI can use this to show users what will change before they commit.","operationId":"PreviewSemanticGroupsDiff","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Semantic groups to compare","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/FieldAlias"}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SemanticGroupDiff"}}}},"400":{"description":"Bad request - Invalid semantic groups"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/alerts/destinations":{"get":{"tags":["Alerts"],"summary":"List alert destinations","description":"Retrieves a list of all alert destinations configured for an organization. Optionally filter by module type (alert or pipeline) to get specific destination categories. Returns destination names, types, and basic configuration details to help administrators manage notification routing and review available delivery options.","operationId":"ListDestinations","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"module","in":"query","description":"Destination module filter, none, alert, or pipeline","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","description":"Alert destination configuration for sending notifications when alerts trigger.\n\nIMPORTANT: The `template` field is REQUIRED to create an alert destination.\nWithout a template, the destination becomes a pipeline destination and cannot be used with\nalerts.\n\n# Example - Creating an HTTP alert destination\n```json\n{\n  \"name\": \"my_alert_webhook\",\n  \"url\": \"https://example.com/webhook\",\n  \"method\": \"post\",\n  \"type\": \"http\",\n  \"template\": \"Default\",\n  \"skip_tls_verify\": false\n}\n```\n\n# Example - Creating an Email alert destination\n```json\n{\n  \"name\": \"my_email_dest\",\n  \"type\": \"email\",\n  \"emails\": [\"alerts@example.com\", \"team@example.com\"],\n  \"template\": \"Default\"\n}\n```","properties":{"action_id":{"type":["string","null"],"description":"Action ID for enterprise Action destinations. Required when `type` is `action`."},"aws_region":{"type":["string","null"],"description":"AWS region for SNS destinations. Required when `type` is `sns`."},"destination_type_name":{"type":["string","null"],"description":"Specific destination type identifier (e.g., \"openobserve\", \"splunk\", \"elasticsearch\")."},"emails":{"type":"array","items":{"type":"string"},"description":"Email recipients for Email destinations. Required when `type` is `email`."},"headers":{"type":["object","null"],"description":"Optional HTTP headers to include with webhook requests.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"metadata":{"type":"object","description":"Optional key-value metadata for the destination.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"method":{"$ref":"#/components/schemas/HTTPType","description":"HTTP method for HTTP destinations. Typically \"post\" for webhooks."},"name":{"type":"string","description":"Unique name for this destination. Must be unique within the organization.","example":"my_alert_webhook"},"output_format":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HTTPOutputFormat","description":"Output format for HTTP destinations (json or text). Default is json."}]},"skip_tls_verify":{"type":"boolean","description":"Whether to skip TLS certificate verification for HTTP destinations."},"sns_topic_arn":{"type":["string","null"],"description":"SNS topic ARN for SNS destinations. Required when `type` is `sns`."},"template":{"type":["string","null"],"description":"REQUIRED for alert destinations. Name of the template to use for formatting alert messages.\nUse \"Default\" for the built-in default template. Without a template, the destination\nbecomes a pipeline destination and cannot be used with alerts.","example":"Default"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Destination type: `http` (webhook), `email`, or `sns`. Default is `http`."},"url":{"type":"string","description":"Webhook URL for HTTP destinations. Required when `type` is `http`.","example":"https://example.com/webhook"}}}}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"List all alert destinations","category":"alerts","summary_fields":["name","type","template"]},"x-o2-ratelimit":{"module":"Destinations","operation":"list"}},"post":{"tags":["Alerts"],"summary":"Create alert or pipeline destination","description":"Creates a new alert destination configuration for an organization. Destinations define where alert notifications are sent when alert conditions are met, including webhooks, email addresses, and SNS topics.\n\nIMPORTANT: The `template` field is REQUIRED to create an alert destination. Use 'Default' for the built-in template. For pipeline destinations, this includes external systems like OpenObserve, Splunk, Elasticsearch, etc. Use the 'module' query parameter to specify destination type: 'alert' (default) or 'pipeline'.\n\nWithout a template, the destination becomes a pipeline destination and cannot be used with alerts.\n\nExample HTTP destination:\n\n```json\n{\"name\": \"my_webhook\", \"url\": \"https://example.com/webhook\", \"method\": \"post\", \"type\": \"http\", \"template\": \"Default\"}\n```\n\nExample Email destination:\n```json\n{\"name\": \"my_email\", \"type\": \"email\", \"emails\": [\"alerts@example.com\"], \"template\": \"Default\"}\n```","operationId":"CreateDestination","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"module","in":"query","description":"Destination module type: 'alert' (default) or 'pipeline'","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Alert destination data. The 'template' field is required (use 'Default' for the built-in template).","content":{"application/json":{"schema":{"type":"object","description":"Alert destination configuration for sending notifications when alerts trigger.\n\nIMPORTANT: The `template` field is REQUIRED to create an alert destination.\nWithout a template, the destination becomes a pipeline destination and cannot be used with\nalerts.\n\n# Example - Creating an HTTP alert destination\n```json\n{\n  \"name\": \"my_alert_webhook\",\n  \"url\": \"https://example.com/webhook\",\n  \"method\": \"post\",\n  \"type\": \"http\",\n  \"template\": \"Default\",\n  \"skip_tls_verify\": false\n}\n```\n\n# Example - Creating an Email alert destination\n```json\n{\n  \"name\": \"my_email_dest\",\n  \"type\": \"email\",\n  \"emails\": [\"alerts@example.com\", \"team@example.com\"],\n  \"template\": \"Default\"\n}\n```","properties":{"action_id":{"type":["string","null"],"description":"Action ID for enterprise Action destinations. Required when `type` is `action`."},"aws_region":{"type":["string","null"],"description":"AWS region for SNS destinations. Required when `type` is `sns`."},"destination_type_name":{"type":["string","null"],"description":"Specific destination type identifier (e.g., \"openobserve\", \"splunk\", \"elasticsearch\")."},"emails":{"type":"array","items":{"type":"string"},"description":"Email recipients for Email destinations. Required when `type` is `email`."},"headers":{"type":["object","null"],"description":"Optional HTTP headers to include with webhook requests.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"metadata":{"type":"object","description":"Optional key-value metadata for the destination.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"method":{"$ref":"#/components/schemas/HTTPType","description":"HTTP method for HTTP destinations. Typically \"post\" for webhooks."},"name":{"type":"string","description":"Unique name for this destination. Must be unique within the organization.","example":"my_alert_webhook"},"output_format":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HTTPOutputFormat","description":"Output format for HTTP destinations (json or text). Default is json."}]},"skip_tls_verify":{"type":"boolean","description":"Whether to skip TLS certificate verification for HTTP destinations."},"sns_topic_arn":{"type":["string","null"],"description":"SNS topic ARN for SNS destinations. Required when `type` is `sns`."},"template":{"type":["string","null"],"description":"REQUIRED for alert destinations. Name of the template to use for formatting alert messages.\nUse \"Default\" for the built-in default template. Without a template, the destination\nbecomes a pipeline destination and cannot be used with alerts.","example":"Default"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Destination type: `http` (webhook), `email`, or `sns`. Default is `http`."},"url":{"type":"string","description":"Webhook URL for HTTP destinations. Required when `type` is `http`.","example":"https://example.com/webhook"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create alert/pipeline destination, alert destination must have a template","category":"alerts"},"x-o2-ratelimit":{"module":"Destinations","operation":"create"}}},"/api/{org_id}/alerts/destinations/{destination_name}":{"get":{"tags":["Alerts"],"summary":"Get alert destination","description":"Retrieves the configuration details for a specific alert destination. Returns the complete destination setup including delivery method, authentication credentials, notification settings, and other configuration parameters. Used for reviewing and managing existing destination configurations.","operationId":"GetDestination","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"destination_name","in":"path","description":"Destination name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","description":"Alert destination configuration for sending notifications when alerts trigger.\n\nIMPORTANT: The `template` field is REQUIRED to create an alert destination.\nWithout a template, the destination becomes a pipeline destination and cannot be used with\nalerts.\n\n# Example - Creating an HTTP alert destination\n```json\n{\n  \"name\": \"my_alert_webhook\",\n  \"url\": \"https://example.com/webhook\",\n  \"method\": \"post\",\n  \"type\": \"http\",\n  \"template\": \"Default\",\n  \"skip_tls_verify\": false\n}\n```\n\n# Example - Creating an Email alert destination\n```json\n{\n  \"name\": \"my_email_dest\",\n  \"type\": \"email\",\n  \"emails\": [\"alerts@example.com\", \"team@example.com\"],\n  \"template\": \"Default\"\n}\n```","properties":{"action_id":{"type":["string","null"],"description":"Action ID for enterprise Action destinations. Required when `type` is `action`."},"aws_region":{"type":["string","null"],"description":"AWS region for SNS destinations. Required when `type` is `sns`."},"destination_type_name":{"type":["string","null"],"description":"Specific destination type identifier (e.g., \"openobserve\", \"splunk\", \"elasticsearch\")."},"emails":{"type":"array","items":{"type":"string"},"description":"Email recipients for Email destinations. Required when `type` is `email`."},"headers":{"type":["object","null"],"description":"Optional HTTP headers to include with webhook requests.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"metadata":{"type":"object","description":"Optional key-value metadata for the destination.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"method":{"$ref":"#/components/schemas/HTTPType","description":"HTTP method for HTTP destinations. Typically \"post\" for webhooks."},"name":{"type":"string","description":"Unique name for this destination. Must be unique within the organization.","example":"my_alert_webhook"},"output_format":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HTTPOutputFormat","description":"Output format for HTTP destinations (json or text). Default is json."}]},"skip_tls_verify":{"type":"boolean","description":"Whether to skip TLS certificate verification for HTTP destinations."},"sns_topic_arn":{"type":["string","null"],"description":"SNS topic ARN for SNS destinations. Required when `type` is `sns`."},"template":{"type":["string","null"],"description":"REQUIRED for alert destinations. Name of the template to use for formatting alert messages.\nUse \"Default\" for the built-in default template. Without a template, the destination\nbecomes a pipeline destination and cannot be used with alerts.","example":"Default"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Destination type: `http` (webhook), `email`, or `sns`. Default is `http`."},"url":{"type":"string","description":"Webhook URL for HTTP destinations. Required when `type` is `http`.","example":"https://example.com/webhook"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Destinations","operation":"get"},"x-o2-mcp":{"description":"Get destination details","category":"alerts"}},"put":{"tags":["Alerts"],"summary":"Update alert or pipeline destination","description":"Updates an existing destination configuration. For alert destinations, allows modification of settings such as webhook URLs, authentication credentials, notification channels, and other delivery parameters. For pipeline destinations, allows updating external system endpoints, output formats, and metadata. Use the 'module' query parameter to specify destination type: 'alert' (default) or 'pipeline'.","operationId":"UpdateDestination","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"destination_name","in":"path","description":"Destination name","required":true,"schema":{"type":"string"}},{"name":"module","in":"query","description":"Destination module type: 'alert' (default) or 'pipeline'","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Destination data","content":{"application/json":{"schema":{"type":"object","description":"Alert destination configuration for sending notifications when alerts trigger.\n\nIMPORTANT: The `template` field is REQUIRED to create an alert destination.\nWithout a template, the destination becomes a pipeline destination and cannot be used with\nalerts.\n\n# Example - Creating an HTTP alert destination\n```json\n{\n  \"name\": \"my_alert_webhook\",\n  \"url\": \"https://example.com/webhook\",\n  \"method\": \"post\",\n  \"type\": \"http\",\n  \"template\": \"Default\",\n  \"skip_tls_verify\": false\n}\n```\n\n# Example - Creating an Email alert destination\n```json\n{\n  \"name\": \"my_email_dest\",\n  \"type\": \"email\",\n  \"emails\": [\"alerts@example.com\", \"team@example.com\"],\n  \"template\": \"Default\"\n}\n```","properties":{"action_id":{"type":["string","null"],"description":"Action ID for enterprise Action destinations. Required when `type` is `action`."},"aws_region":{"type":["string","null"],"description":"AWS region for SNS destinations. Required when `type` is `sns`."},"destination_type_name":{"type":["string","null"],"description":"Specific destination type identifier (e.g., \"openobserve\", \"splunk\", \"elasticsearch\")."},"emails":{"type":"array","items":{"type":"string"},"description":"Email recipients for Email destinations. Required when `type` is `email`."},"headers":{"type":["object","null"],"description":"Optional HTTP headers to include with webhook requests.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"metadata":{"type":"object","description":"Optional key-value metadata for the destination.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"method":{"$ref":"#/components/schemas/HTTPType","description":"HTTP method for HTTP destinations. Typically \"post\" for webhooks."},"name":{"type":"string","description":"Unique name for this destination. Must be unique within the organization.","example":"my_alert_webhook"},"output_format":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HTTPOutputFormat","description":"Output format for HTTP destinations (json or text). Default is json."}]},"skip_tls_verify":{"type":"boolean","description":"Whether to skip TLS certificate verification for HTTP destinations."},"sns_topic_arn":{"type":["string","null"],"description":"SNS topic ARN for SNS destinations. Required when `type` is `sns`."},"template":{"type":["string","null"],"description":"REQUIRED for alert destinations. Name of the template to use for formatting alert messages.\nUse \"Default\" for the built-in default template. Without a template, the destination\nbecomes a pipeline destination and cannot be used with alerts.","example":"Default"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Destination type: `http` (webhook), `email`, or `sns`. Default is `http`."},"url":{"type":"string","description":"Webhook URL for HTTP destinations. Required when `type` is `http`.","example":"https://example.com/webhook"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update alert destination","category":"alerts"},"x-o2-ratelimit":{"module":"Destinations","operation":"update"}},"delete":{"tags":["Alerts"],"summary":"Delete alert destination","description":"Removes an alert destination configuration from the organization. The destination must not be in use by any active alerts or pipelines before deletion. Once deleted, any alerts previously configured to use this destination will need to be updated with alternative notification methods to continue functioning.","operationId":"DeleteAlertDestination","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"destination_name","in":"path","description":"Destination name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"409":{"description":"Conflict","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete alert destination","category":"alerts","requires_confirmation":true},"x-o2-ratelimit":{"module":"Destinations","operation":"delete"}}},"/api/{org_id}/alerts/history":{"get":{"tags":["Alerts"],"summary":"Get alert execution history","description":"Retrieves the execution history of alerts for the organization. This endpoint queries the organization's own triggers stream to provide details about when alerts were triggered, their status, and execution details.","operationId":"GetAlertHistory","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"alert_id","in":"query","description":"Filter by specific alert id","required":false,"schema":{"type":"string"}},{"name":"start_time","in":"query","description":"Start time in Unix timestamp microseconds","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"end_time","in":"query","description":"End time in Unix timestamp microseconds","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"from","in":"query","description":"Pagination offset (default: 0)","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"size","in":"query","description":"Number of results to return (default: 100, max: 1000)","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"sort_by","in":"query","description":"Field to sort by: timestamp, alert_name, status, is_realtime, is_silenced, start_time, end_time, duration, retries, delay_in_secs, evaluation_took_in_secs, source_node, query_took (default: timestamp)","required":false,"schema":{"type":"string"}},{"name":"sort_order","in":"query","description":"Sort order: asc or desc (default: desc)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["total","from","size","hits"],"properties":{"from":{"type":"integer","format":"int64"},"hits":{"type":"array","items":{"$ref":"#/components/schemas/AlertHistoryEntry"}},"size":{"type":"integer","format":"int64"},"total":{"type":"integer","minimum":0}}}}}},"400":{"description":"Bad Request","content":{"application/json":{}}},"403":{"description":"Forbidden","content":{"application/json":{}}},"500":{"description":"Internal Server Error","content":{"application/json":{}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/alerts/templates":{"get":{"tags":["Templates"],"summary":"List alert templates","description":"Retrieves a list of all alert notification templates configured for an organization. Returns template names, types, and basic metadata to help administrators manage notification formatting options. Templates provide reusable formatting configurations that ensure consistent alert notifications across different channels and destinations.","operationId":"ListTemplates","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"isDefault":{"type":["boolean","null"]},"name":{"type":"string"},"title":{"type":"string"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Indicates whether the body is\nhttp or email body"}}}}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Templates","operation":"list"},"x-o2-mcp":{"description":"List all alert templates","category":"alerts","summary_fields":["name","type","isDefault","title"]}},"post":{"tags":["Templates"],"summary":"Create alert template","description":"Creates a new alert notification template for an organization. Templates define the format and content of alert notifications, including message structure, variable substitutions, and styling options. Templates can be reused across multiple alert destinations to maintain consistent notification formatting and branding across different channels.","operationId":"CreateTemplate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Template data","content":{"application/json":{"schema":{"type":"object","properties":{"body":{"type":"string"},"isDefault":{"type":["boolean","null"]},"name":{"type":"string"},"title":{"type":"string"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Indicates whether the body is\nhttp or email body"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create alert template","category":"alerts"},"x-o2-ratelimit":{"module":"Templates","operation":"create"}}},"/api/{org_id}/alerts/templates/system/prebuilt":{"get":{"tags":["Templates"],"summary":"Get system prebuilt templates","description":"Retrieves all system-defined prebuilt templates. These templates are provided by OpenObserve for common notification destinations like Slack, Microsoft Teams, Email, PagerDuty, etc. System templates are read-only and serve as the foundation for prebuilt alert destinations. This endpoint returns the complete template configurations including body, type, and metadata. Requires LIST permission on templates.","operationId":"GetSystemTemplates","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"isDefault":{"type":["boolean","null"]},"name":{"type":"string"},"title":{"type":"string"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Indicates whether the body is\nhttp or email body"}}}}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Templates","operation":"list"},"x-o2-mcp":{"description":"Get system prebuilt templates","category":"alerts"}}},"/api/{org_id}/alerts/templates/{template_name}":{"get":{"tags":["Templates"],"summary":"Get alert template","description":"Retrieves the configuration and content of a specific alert notification template. Returns the template structure including message format, variable definitions, styling options, and other formatting parameters. Used for reviewing existing templates and understanding notification formats before making modifications.","operationId":"GetTemplate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"template_name","in":"path","description":"Template name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"body":{"type":"string"},"isDefault":{"type":["boolean","null"]},"name":{"type":"string"},"title":{"type":"string"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Indicates whether the body is\nhttp or email body"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get template details","category":"alerts"},"x-o2-ratelimit":{"module":"Templates","operation":"get"}},"put":{"tags":["Templates"],"summary":"Update alert template","description":"Updates an existing alert notification template. Allows modification of template content, formatting, variable placeholders, and styling options. Changes to templates will apply to all future alert notifications that use this template, providing a centralized way to update notification formats across multiple alerts and destinations.","operationId":"UpdateTemplate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"template_name","in":"path","description":"Template name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Template data","content":{"application/json":{"schema":{"type":"object","properties":{"body":{"type":"string"},"isDefault":{"type":["boolean","null"]},"name":{"type":"string"},"title":{"type":"string"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Indicates whether the body is\nhttp or email body"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Templates","operation":"update"},"x-o2-mcp":{"description":"Update alert template","category":"alerts"}},"delete":{"tags":["Templates"],"summary":"Delete alert template","description":"Removes an alert notification template from the organization. The template must not be in use by any active destinations before deletion. Once deleted, any destinations previously using this template will need to be updated with alternative templates to continue formatting notifications properly.","operationId":"DeleteAlertTemplate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"template_name","in":"path","description":"Template name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"409":{"description":"Conflict","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete alert template","category":"alerts","requires_confirmation":true},"x-o2-ratelimit":{"module":"Templates","operation":"delete"}}},"/api/{org_id}/cipher_keys":{"get":{"tags":["Key"],"summary":"List encryption keys","description":"Retrieves a list of all encryption keys available within the organization. Returns key names and metadata without exposing sensitive key material. Helps administrators manage encryption keys, audit key usage, and ensure proper key lifecycle management. Only available in enterprise deployments for enhanced security and compliance.","operationId":"ListCipherKeys","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"list all keys in the org","content":{"application/json":{"schema":{"type":"object"}}}}},"x-o2-mcp":{"enabled":false}},"post":{"tags":["Key"],"summary":"Create encryption key","description":"Creates a new encryption key for data encryption and decryption operations. The key is securely stored and validated before being made available for use. Key names cannot contain ':' characters. Only available in enterprise deployments for enhanced data security and compliance requirements.","operationId":"CreateCipherKey","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Key data to add","content":{"application/json":{"schema":{"type":"object","required":["name","key"],"properties":{"key":{"type":"object"},"name":{"type":"string"}}}}},"required":true},"responses":{"200":{"description":"Empty response","content":{"application/json":{"schema":{"default":null}}}},"400":{"description":"Invalid request","content":{"application/json":{}}}},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/cipher_keys/{key_name}":{"get":{"tags":["Key"],"summary":"Get encryption key details","description":"Retrieves the configuration and metadata for a specific encryption key by name. Returns key information without exposing sensitive key material. Used for managing and auditing encryption keys within the organization. Only available in enterprise deployments for enhanced security management.","operationId":"GetCipherKey","parameters":[{"name":"key_name","in":"path","description":"Name of the key to retrieve","required":true,"schema":{"type":"string"},"example":"test_key"},{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Key info","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Key not found","content":{"text/plain":{}}}},"x-o2-mcp":{"enabled":false}},"put":{"tags":["Key"],"summary":"Update encryption key","description":"Updates the configuration and parameters of an existing encryption key. The key is validated after updates to ensure it remains functional for encryption and decryption operations. Changes are applied atomically to maintain data security and consistency. Only available in enterprise deployments for enhanced security management.","operationId":"UpdateCipherKey","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"key_name","in":"path","description":"name of the key to update","required":true,"schema":{"type":"string"},"example":"test_key"}],"requestBody":{"description":"updated key data","content":{"application/json":{"schema":{"type":"object","required":["name","key"],"properties":{"key":{"type":"object"},"name":{"type":"string"}}}}},"required":true},"responses":{"200":{"description":"Empty response","content":{"application/json":{"schema":{"default":null}}}},"400":{"description":"Invalid request","content":{"application/json":{}}}},"x-o2-mcp":{"enabled":false}},"delete":{"tags":["Keys"],"summary":"Delete encryption key","description":"Permanently removes an encryption key from the organization. This action cannot be undone and will prevent any future data decryption operations that depend on this key. Ensure all data encrypted with this key is either migrated or no longer needed before deletion. Only available in enterprise deployments for enhanced security management.","operationId":"DeleteCipherKey","parameters":[{"name":"key_name","in":"path","description":"name of the key to delete","required":true,"schema":{"type":"string"},"example":"test_key"},{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Empty response","content":{"application/json":{"schema":{"default":null}}}}},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/dashboards":{"get":{"tags":["Dashboards"],"summary":"List organization dashboards","description":"Retrieves a list of dashboards within the organization, with optional filtering by folder and pagination support","operationId":"ListDashboards","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Optional folder ID filter parameter\n\nIf neither `folder` nor any other filter parameter are set then this\nwill search for all dashboards in the \"default\" folder.\n\nIf `folder` is not set and another filter parameter, such as `title`, is\nset then this will search for dashboards in all folders.","required":false,"schema":{"type":"string"},"style":"form"},{"name":"title","in":"query","description":"The optional case-insensitive title substring with which to filter\ndashboards.","required":false,"schema":{"type":"string"},"style":"form"},{"name":"pageSize","in":"query","description":"The optional number of dashboards to retrieve. If not set then all\ndashboards that match the query parameters will be returned.\n\nCurrently this parameter is only untilized by the API when the `title`\nparameter is also set.","required":false,"schema":{"type":"integer","format":"int64","minimum":0},"style":"form"}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"object","description":"HTTP response body for `ListDashboards` endpoint.","required":["dashboards"],"properties":{"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ListDashboardsResponseBodyItem"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Dashboards","operation":"list"},"x-o2-mcp":{"description":"List all dashboards in organization","category":"dashboards","summary_fields":["dashboard_id","title","description","owner","folder_name"]}},"post":{"tags":["Dashboards"],"summary":"Create new dashboard","description":"Creates a new dashboard with specified title, description, and visualization panels. The dashboard will be saved in the specified folder","operationId":"CreateDashboard","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID where the dashboard will be created. Used for RBAC checks in enterprise version. Defaults to 'default' if not specified","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Dashboard details","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"}],"description":"HTTP request body for the `CreateDashboard`/`UpdateDashboard` endpoints."},"example":{"title":"Network Traffic Overview","description":"Traffic patterns and network performance of the infrastructure"}}},"required":true},"responses":{"201":{"description":"Dashboard created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Dashboard","description":"HTTP response body for `CreateDashboard`/`UpdateDashboard` endpoints."}}}},"404":{"description":"Folder not found","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create a dashboard with visualization panels. LAYOUT: 192-column grid with {x, y, w, h, i} where x=column(0-191), y=row, w=width, h=height, i=panel_id. Common widths: full=192, half=96, third=64. PANEL QUERIES: Each panel query needs 'fields' with x/y/z arrays populated EVEN when customQuery=true. AXIS RULES: x=dimension/time field, y=metric field(s), z=only for heatmaps(color intensity)/stacked-charts(breakdown field)/geo-maps(value). For most charts (line/area/bar/pie), leave z=[]. Use SELECT aliases as column values. Example: 'SELECT histogram(_timestamp) as ts, COUNT(*) as cnt' needs x=[{label:'ts',alias:'ts',column:'ts',aggregationFunction:null}], y=[{label:'cnt',alias:'cnt',column:'cnt',aggregationFunction:null}], z=[]. FILTER: The 'filter' field in 'fields' MUST be an object (NOT an array). Use: {type:'list',values:[],logicalOperator:'AND',filterType:'list'} for no filters.","category":"dashboards"},"x-o2-ratelimit":{"module":"Dashboards","operation":"create"}}},"/api/{org_id}/dashboards/move":{"patch":{"tags":["Dashboards"],"summary":"Move multiple dashboards","description":"Moves multiple dashboards to a specified destination folder in a single batch operation. Useful for organizing dashboards efficiently","operationId":"MoveDashboards","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Identifies dashboards and the destination folder","content":{"application/json":{"schema":{"type":"object","description":"HTTP request body for `MoveDashboards` endpoint.","required":["dashboard_ids","dst_folder_id"],"properties":{"dashboard_ids":{"type":"array","items":{"type":"string"},"description":"IDs of the dashboards to move."},"dst_folder_id":{"type":"string","description":"Indicates the folder to which dashboard should be moved."}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Dashboards","operation":"update"},"x-o2-mcp":{"description":"Move multiple dashboards to folder","category":"dashboards"}}},"/api/{org_id}/dashboards/{dashboard_id}":{"get":{"tags":["Dashboards"],"summary":"Get dashboard details","description":"Retrieves complete details of a specific dashboard including its panels, queries, and visualization configurations","operationId":"GetDashboard","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","description":"Dashboard ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID where the dashboard is located. Used for RBAC permission checks in enterprise version","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Dashboard","description":"HTTP response body for `CreateDashboard`/`UpdateDashboard` endpoints."}}}},"403":{"description":"Unauthorized Access","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Dashboard not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get dashboard details by ID","category":"dashboards"},"x-o2-ratelimit":{"module":"Dashboards","operation":"get"}},"put":{"tags":["Dashboards"],"summary":"Update existing dashboard","description":"Updates an existing dashboard with new content, panels, or settings. Supports concurrent edit conflict detection using hash values","operationId":"UpdateDashboard","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","description":"Dashboard ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID where the dashboard is located","required":true,"schema":{"type":"string"}},{"name":"hash","in":"query","description":"Hash value for conflict detection. Required when updating an existing dashboard to prevent concurrent edit conflicts","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Dashboard details","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"}],"description":"HTTP request body for the `CreateDashboard`/`UpdateDashboard` endpoints."}}},"required":true},"responses":{"200":{"description":"Dashboard updated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Dashboard","description":"HTTP response body for `CreateDashboard`/`UpdateDashboard` endpoints."}}}},"404":{"description":"Dashboard not found","content":{"application/json":{"schema":{"default":null}}}},"409":{"description":"Conflict: Failed to save due to concurrent changes","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failed to update the dashboard","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update an existing dashboard","category":"dashboards"},"x-o2-ratelimit":{"module":"Dashboards","operation":"update"}},"delete":{"tags":["Dashboards"],"summary":"Delete dashboard","description":"Permanently deletes a dashboard and all its associated panels and configurations. This action cannot be undone","operationId":"DeleteDashboard","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","description":"Dashboard ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID where the dashboard is located. Used for RBAC permission checks in enterprise version","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"403":{"description":"Unauthorized Access","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete a dashboard by ID","category":"dashboards","requires_confirmation":true},"x-o2-ratelimit":{"module":"Dashboards","operation":"delete"}}},"/api/{org_id}/dashboards/{dashboard_id}/annotations":{"get":{"tags":["Dashboards"],"summary":"Get timed annotations for dashboard","description":"Retrieves timed annotations for dashboard panels within a specified time range","operationId":"GetAnnotations","parameters":[{"name":"panels","in":"query","description":"Commas separated list of panels","required":false,"schema":{"type":"string"},"style":"form"},{"name":"start_time","in":"query","description":"Time in microseconds","required":true,"schema":{"type":"integer","format":"int64"},"style":"form"},{"name":"end_time","in":"query","description":"Time in microseconds","required":true,"schema":{"type":"integer","format":"int64"},"style":"form"},{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Timed annotations retrieved successfully","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/TimedAnnotation"}}}}},"400":{"description":"Invalid query parameters","content":{"application/json":{}}},"500":{"description":"Failed to get timed annotations","content":{"application/json":{}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Dashboards","operation":"list"},"x-o2-mcp":{"description":"Get annotations","category":"dashboards"}},"post":{"tags":["Dashboards"],"summary":"Create timed annotations for dashboard","description":"Creates new timed annotations for specific panels within a dashboard","operationId":"CreateAnnotations","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Timed annotation request payload","content":{"application/json":{"schema":{"type":"object","required":["timed_annotations"],"properties":{"timed_annotations":{"type":"array","items":{"$ref":"#/components/schemas/TimedAnnotation"}}}}}},"required":true},"responses":{"200":{"description":"Timed annotations created successfully","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/TimedAnnotation"}}}}},"500":{"description":"Failed to create timed annotations","content":{"application/json":{}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create time annotations","category":"dashboards"},"x-o2-ratelimit":{"module":"Dashboards","operation":"create"}},"delete":{"tags":["Dashboards"],"summary":"Delete timed annotations from dashboard","description":"Removes timed annotations from dashboard panels based on specified criteria","operationId":"DeleteAnnotations","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Timed annotation delete request payload","content":{"application/json":{"schema":{"type":"object","required":["annotation_ids"],"properties":{"annotation_ids":{"type":"array","items":{"type":"string"}}}}}},"required":true},"responses":{"200":{"description":"Timed annotations deleted successfully"},"500":{"description":"Failed to delete timed annotations","content":{"application/json":{}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete annotations","category":"dashboards","requires_confirmation":true},"x-o2-ratelimit":{"module":"Dashboards","operation":"delete"}}},"/api/{org_id}/dashboards/{dashboard_id}/annotations/panels/{timed_annotation_id}":{"delete":{"tags":["Dashboards"],"summary":"Remove timed annotation from panel","description":"Removes a specific timed annotation from a dashboard panel","operationId":"RemoveTimedAnnotationFromPanel","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"timed_annotation_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"IDs of dashboard panels from which to remove the timed annotation","content":{"application/json":{"schema":{"type":"array","items":{"type":"string"}}}},"required":true},"responses":{"200":{"description":"Removed timed annotation from dashboard panels successfully"},"500":{"description":"Failed to remove timed annotation from panels","content":{"application/json":{}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Dashboards","operation":"delete"},"x-o2-mcp":{"description":"Remove annotation from panel","category":"dashboards","requires_confirmation":true}}},"/api/{org_id}/dashboards/{dashboard_id}/annotations/{timed_annotation_id}":{"put":{"tags":["Dashboards"],"summary":"Update timed annotation","description":"Updates an existing timed annotation with new content or metadata","operationId":"UpdateAnnotations","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","required":true,"schema":{"type":"string"}},{"name":"timed_annotation_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Timed annotation update request payload","content":{"application/json":{"schema":{"type":"object","properties":{"annotation_id":{"type":["string","null"],"default":null},"end_time":{"type":["integer","null"],"format":"int64","default":null},"panels":{"type":"array","items":{"type":"string"},"default":[]},"start_time":{"type":"integer","format":"int64","default":0},"tags":{"type":"array","items":{"type":"string"},"default":[]},"text":{"type":["string","null"],"default":null},"title":{"type":"string","default":""}}}}},"required":true},"responses":{"200":{"description":"Timed annotations updated successfully"},"500":{"description":"Failed to update timed annotations","content":{"application/json":{}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Dashboards","operation":"update"},"x-o2-mcp":{"description":"Update annotations","category":"dashboards"}}},"/api/{org_id}/dashboards/{dashboard_id}/panels":{"post":{"tags":["Dashboards"],"summary":"Add a panel to a dashboard","description":"Add a panel to an existing dashboard. Layout auto-computed if not specified. Returns new hash for chaining.","operationId":"AddPanel","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","description":"Dashboard ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID where the dashboard is located","required":false,"schema":{"type":"string"}},{"name":"hash","in":"query","description":"Hash value for conflict detection","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Panel to add","content":{"application/json":{"schema":{"type":"object","description":"Request body for AddPanel and UpdatePanel endpoints.","required":["panel"],"properties":{"panel":{"$ref":"#/components/schemas/Panel"},"tabId":{"type":["string","null"]}}}}},"required":true},"responses":{"200":{"description":"Panel added","content":{"application/json":{"schema":{"type":"object","description":"Response body for AddPanel and UpdatePanel endpoints.","required":["panel","hash","tabId"],"properties":{"hash":{"type":"string"},"panel":{"$ref":"#/components/schemas/Panel"},"tabId":{"type":"string"}}}}}},"400":{"description":"Unsupported dashboard version","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Dashboard or tab not found","content":{"application/json":{"schema":{"default":null}}}},"409":{"description":"Panel ID already exists or hash conflict","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Dashboards","operation":"update"},"x-o2-mcp":{"description":"Add a panel to an existing dashboard. Layout auto-computed. Returns new hash for chaining.","category":"dashboards"}}},"/api/{org_id}/dashboards/{dashboard_id}/panels/{panel_id}":{"put":{"tags":["Dashboards"],"summary":"Update a single panel in a dashboard","description":"Update a single panel in a dashboard by panel ID. Preserves layout if not explicitly set.","operationId":"UpdatePanel","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","description":"Dashboard ID","required":true,"schema":{"type":"string"}},{"name":"panel_id","in":"path","description":"Panel ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID where the dashboard is located","required":false,"schema":{"type":"string"}},{"name":"hash","in":"query","description":"Hash value for conflict detection","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Panel data to update","content":{"application/json":{"schema":{"type":"object","description":"Request body for AddPanel and UpdatePanel endpoints.","required":["panel"],"properties":{"panel":{"$ref":"#/components/schemas/Panel"},"tabId":{"type":["string","null"]}}}}},"required":true},"responses":{"200":{"description":"Panel updated","content":{"application/json":{"schema":{"type":"object","description":"Response body for AddPanel and UpdatePanel endpoints.","required":["panel","hash","tabId"],"properties":{"hash":{"type":"string"},"panel":{"$ref":"#/components/schemas/Panel"},"tabId":{"type":"string"}}}}}},"400":{"description":"Unsupported dashboard version","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Dashboard, tab, or panel not found","content":{"application/json":{"schema":{"default":null}}}},"409":{"description":"Hash conflict","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Dashboards","operation":"update"},"x-o2-mcp":{"description":"Update a single panel in a dashboard by panel ID. Preserves layout if not explicitly set.","category":"dashboards"}},"delete":{"tags":["Dashboards"],"summary":"Delete a single panel from a dashboard","description":"Delete a single panel from a dashboard by panel ID.","operationId":"DeletePanel","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","description":"Dashboard ID","required":true,"schema":{"type":"string"}},{"name":"panel_id","in":"path","description":"Panel ID","required":true,"schema":{"type":"string"}},{"name":"folder","in":"query","description":"Folder ID where the dashboard is located","required":false,"schema":{"type":"string"}},{"name":"hash","in":"query","description":"Hash value for conflict detection","required":true,"schema":{"type":"string"}},{"name":"tabId","in":"query","description":"Tab ID to search for the panel","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Panel deleted","content":{"application/json":{"schema":{"type":"object","description":"Response body for DeletePanel endpoint.","required":["hash","panelId"],"properties":{"hash":{"type":"string"},"panelId":{"type":"string"}}}}}},"400":{"description":"Unsupported dashboard version","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Dashboard, tab, or panel not found","content":{"application/json":{"schema":{"default":null}}}},"409":{"description":"Hash conflict","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete a single panel from a dashboard by panel ID.","category":"dashboards","requires_confirmation":true},"x-o2-ratelimit":{"module":"Dashboards","operation":"update"}}},"/api/{org_id}/enrichment_tables/{table_name}":{"post":{"tags":["Functions"],"summary":"Create or update enrichment table","description":"Creates a new enrichment table or updates existing table data for log enrichment","operationId":"CreateUpdateEnrichmentTable","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"table_name","in":"path","description":"Table name","required":true,"schema":{"type":"string"}}],"responses":{"201":{"description":"Saved enrichment table","content":{"application/json":{"schema":{"default":null}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create/update enrichment table","category":"enrichment"},"x-o2-ratelimit":{"module":"Enrichment Table","operation":"create"}}},"/api/{org_id}/enrichment_tables/{table_name}/url":{"post":{"tags":["Functions"],"summary":"Create enrichment table from URL","description":"Creates a new enrichment table by fetching CSV data from a public URL. The process runs asynchronously in the background.","operationId":"CreateEnrichmentTableFromUrl","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"table_name","in":"path","description":"Table name","required":true,"schema":{"type":"string"}},{"name":"append","in":"query","description":"Whether to append data to existing table (default: false)","required":false,"schema":{"type":"boolean"}}],"requestBody":{"description":"URL for the CSV file","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnrichmentTableUrlRequest"}}},"required":true},"responses":{"202":{"description":"Job created successfully","content":{"text/plain":{"schema":{"type":"string"}}}},"400":{"description":"Bad Request","content":{"text/plain":{"schema":{"type":"string"}}}},"500":{"description":"Internal Server Error","content":{"text/plain":{"schema":{"type":"string"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Enrichment Table","operation":"create"},"x-o2-mcp":{"description":"Create table from URL","category":"enrichment"}}},"/api/{org_id}/folders":{"get":{"tags":["Folders"],"summary":"List all folders (deprecated)","description":"Retrieves all dashboard folders for the organization - this endpoint is deprecated","operationId":"ListFoldersDeprecated","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"object","description":"HTTP response body for `ListFolder` endpoint.","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Folder"}}}}}}}},"deprecated":true,"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Folders","operation":"list"},"x-o2-mcp":{"enabled":false}},"post":{"tags":["Folders"],"summary":"Create a new folder (deprecated)","description":"Creates a new dashboard folder - this endpoint is deprecated","operationId":"CreateFolderDeprecated","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Folder details","content":{"application/json":{"schema":{"type":"object","description":"HTTP request body for `CreateFolder` endpoint.","required":["name","description"],"properties":{"description":{"type":"string"},"name":{"type":"string"}}},"example":{"name":"Infrastructure","description":"Traffic patterns and network performance of the infrastructure"}}},"required":true},"responses":{"200":{"description":"Folder created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `CreateFolder` endpoint."}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"deprecated":true,"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Folders","operation":"create"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/folders/dashboards/{dashboard_id}":{"put":{"tags":["Dashboards"],"summary":"Move dashboard to folder","description":"Moves a dashboard from one folder to another within the organization. The dashboard content remains unchanged","operationId":"MoveDashboard","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"dashboard_id","in":"path","description":"Dashboard ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"MoveDashboard details","content":{"application/json":{"schema":{"type":"object","description":"HTTP request body for `MoveDashboard` endpoint.","required":["from","to"],"properties":{"from":{"type":"string"},"to":{"type":"string"}}},"example":{"from":"Source folder id","to":"Destination folder id"}}},"required":true},"responses":{"200":{"description":"Dashboard Moved","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Dashboard not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Move dashboard to another folder","category":"dashboards"},"x-o2-ratelimit":{"module":"Dashboards","operation":"update"}}},"/api/{org_id}/folders/name/{folder_name}":{"get":{"tags":["Folders"],"summary":"Get folder by name (deprecated)","description":"Retrieves a folder using its name instead of ID - this endpoint is deprecated","operationId":"GetFolderByNameDeprecated","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_name","in":"path","description":"Folder Name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `GetFolder` endpoint."}}}},"404":{"description":"Folder not found","content":{"application/json":{"schema":{"default":null}}}}},"deprecated":true,"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Folders","operation":"get"}}},"/api/{org_id}/folders/{folder_id}":{"get":{"tags":["Folders"],"summary":"Get folder by ID (deprecated)","description":"Retrieves a specific folder by its identifier - this endpoint is deprecated","operationId":"GetFolderDeprecated","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_id","in":"path","description":"Folder ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `GetFolder` endpoint."}}}},"404":{"description":"Folder not found","content":{"application/json":{"schema":{"default":null}}}}},"deprecated":true,"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Folders","operation":"get"}},"put":{"tags":["Folders"],"summary":"Update an existing folder (deprecated)","description":"Updates folder details like name and description - this endpoint is deprecated","operationId":"UpdateFolderDeprecated","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_id","in":"path","description":"Folder name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Folder details","content":{"application/json":{"schema":{"type":"object","properties":{"description":{"type":"string","default":""},"folder_id":{"type":"string","default":""},"name":{"type":"string","default":""}}},"example":{"title":"Infra","description":"Traffic patterns and network performance of the infrastructure"}}},"required":true},"responses":{"200":{"description":"Folder updated","content":{"text/plain":{"schema":{"type":"string"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"deprecated":true,"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Folders","operation":"update"},"x-o2-mcp":{"enabled":false}},"delete":{"tags":["Folders"],"summary":"Delete a folder (deprecated)","description":"Removes a folder and all its contents - this endpoint is deprecated","operationId":"DeleteFolderDeprecated","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"folder_id","in":"path","description":"Folder ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"deprecated":true,"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Folders","operation":"delete"}}},"/api/{org_id}/functions":{"get":{"tags":["Functions"],"summary":"List organization functions","description":"Retrieves all custom transformation functions available in the organization, including their VRL code, configuration parameters, and current usage status. Shows function metadata such as creation date, last modified time, and pipeline dependencies to help administrators manage data transformation logic across the organization.","operationId":"listFunctions","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Transform"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Functions","operation":"list"},"x-o2-mcp":{"description":"List all functions","category":"functions","summary_fields":["name","transType","streams"]}},"post":{"tags":["Functions"],"summary":"Create new function","description":"Creates a new custom transformation function using VRL (Vector Remap Language) code. Functions can be used in data ingestion pipelines to transform, enrich, or filter incoming log, metric, and trace data. Support complex data transformations, field extraction, format conversion, and conditional processing to standardize data before storage and indexing.","operationId":"createFunction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Function data","content":{"application/json":{"schema":{"type":"object","required":["function"],"properties":{"function":{"type":"string"},"name":{"type":"string"},"numArgs":{"type":"integer","format":"int32","minimum":0},"params":{"type":"string"},"streams":{"type":["array","null"],"items":{"$ref":"#/components/schemas/StreamOrder"}},"transType":{"type":["integer","null"],"format":"int32","minimum":0}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create a VRL (Vector Remap Language) function","category":"functions"},"x-o2-ratelimit":{"module":"Functions","operation":"create"}}},"/api/{org_id}/functions/test":{"post":{"tags":["Functions"],"summary":"Validate VRL function syntax","description":"Validates VRL (Vector Remap Language) transformation function syntax by testing it against sample events. Returns validation results with any syntax errors or successful transformation output. Use this to verify VRL code is correct before creating or updating a function. Accepts function code, sample events to test against, and optional trans_type (0 for VRL, 1 for JS).","operationId":"testFunction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Test run function","content":{"application/json":{"schema":{"type":"object","required":["function","events"],"properties":{"events":{"type":"array","items":{}},"function":{"type":"string"},"trans_type":{"type":["integer","null"],"format":"int32","minimum":0}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"category":"functions"}}},"/api/{org_id}/functions/{name}":{"get":{"tags":["Functions"],"summary":"Get function pipeline dependencies","description":"Lists all data processing pipelines that currently use the specified transformation function. Returns pipeline names, types, and usage details to help administrators understand the impact scope before making changes to the function. Essential for change management and ensuring data processing continuity during function updates.","operationId":"functionPipelineDependency","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Function name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Transform"}}}}}}},"404":{"description":"Function not found","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Check function dependencies","category":"functions"},"x-o2-ratelimit":{"module":"Functions","operation":"get"}},"put":{"tags":["Functions"],"summary":"Update function","description":"Updates an existing transformation function with new VRL code, parameters, or configuration settings. Changes take effect immediately and apply to all data processing pipelines currently using this function. Test function changes thoroughly before deployment to avoid data transformation errors in production pipelines.","operationId":"updateFunction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Function name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Function data","content":{"application/json":{"schema":{"type":"object","required":["function"],"properties":{"function":{"type":"string"},"name":{"type":"string"},"numArgs":{"type":"integer","format":"int32","minimum":0},"params":{"type":"string"},"streams":{"type":["array","null"],"items":{"$ref":"#/components/schemas/StreamOrder"}},"transType":{"type":["integer","null"],"format":"int32","minimum":0}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update a VRL function","category":"functions"},"x-o2-ratelimit":{"module":"Functions","operation":"update"}},"delete":{"tags":["Functions"],"summary":"Delete function","description":"Permanently deletes a custom transformation function from the organization. The function must not be in use by active pipelines unless the force parameter is specified. Once deleted, any pipelines previously using this function will need to be updated with alternative transformation logic to continue functioning properly.","operationId":"deleteFunction","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Function name","required":true,"schema":{"type":"string"}},{"name":"force","in":"query","description":"Force delete function regardless pipeline dependencies","required":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Functions","operation":"delete"},"x-o2-mcp":{"description":"Delete a function","category":"functions","requires_confirmation":true}}},"/api/{org_id}/groups":{"get":{"tags":["Groups"],"summary":"List organization groups","description":"Retrieves a list of all user groups in the organization. Users will only see groups they have permissions to view when role-based access control is active. Useful for managing group-based permissions and understanding organizational structure. Requires enterprise features to be enabled.","operationId":"ListGroups","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"string"}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]},"post":{"tags":["Groups"],"summary":"Create user group","description":"Creates a new user group with specified users and roles. Groups allow efficient management of permissions by assigning roles to groups instead of individual users. Requires enterprise features to be enabled.","operationId":"CreateGroup","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"UserGroup","content":{"application/json":{"schema":{"type":"object","required":["name"],"properties":{"name":{"type":"string"},"roles":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true},"users":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/groups/{group_name}":{"get":{"tags":["Groups"],"summary":"Get group details","description":"Retrieves detailed information about a specific user group including its members, assigned roles, and configuration. Useful for understanding group composition and permissions. Requires enterprise features to be enabled.","operationId":"GetGroup","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"group_name","in":"path","description":"Group name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["name"],"properties":{"name":{"type":"string"},"roles":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true},"users":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true}}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]},"put":{"tags":["Groups"],"summary":"Update user group","description":"Updates an existing user group by adding or removing users and roles. Allows dynamic management of group membership and permissions to maintain proper access control. Requires enterprise features to be enabled.","operationId":"UpdateGroup","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"group_name","in":"path","description":"Group name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"UserGroupRequest","content":{"application/json":{"schema":{"type":"object","properties":{"add_roles":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true},"add_users":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true},"remove_roles":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true},"remove_users":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]},"delete":{"tags":["Groups"],"summary":"Delete user group","description":"Permanently removes a user group from the organization. Users in the group will lose group-based permissions but retain any directly assigned roles. This action cannot be undone. Requires enterprise features to be enabled.","operationId":"DeleteGroup","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"group_name","in":"path","description":"Group name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/ingest/metrics/_json":{"post":{"tags":["Metrics"],"summary":"Ingest metrics via JSON","description":"Ingests metrics data using JSON format. Accepts an array of metric objects containing metric name, type (counter, gauge, histogram, or summary), labels, timestamp, and value. This endpoint is ideal for custom applications and systems that generate metrics in JSON format rather than protocol buffers.","operationId":"MetricsIngestionJson","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Ingest data (json array)","content":{"application/json":{"schema":{"type":"string"},"example":[{"__name__":"metrics stream name","__type__":"counter / gauge / histogram / summary","label_name1":"label_value1","label_name2":"label_value2","_timestamp":1687175143,"value":1.2}]}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"status":[{"name":"up","successful":3,"failed":0}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/kv":{"get":{"tags":["KV"],"summary":"List keys from key-value store","description":"Retrieves a list of all keys stored in the organization's key-value store. You can optionally filter keys by providing a prefix to only return keys that start with specific characters. This is useful for organizing related configuration settings or browsing available stored data.","operationId":"ListKVKeys","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"prefix","in":"query","description":"Key prefix","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"string"}}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"List all keys","category":"kv-store"},"x-o2-ratelimit":{"module":"Key Values","operation":"list"}}},"/api/{org_id}/kv/{key}":{"get":{"tags":["KV"],"summary":"Get value from key-value store","description":"Retrieves the stored value for a specific key from the organization's key-value store. Returns the raw text value if the key exists, or a 404 error if the key is not found. Useful for storing and retrieving configuration settings, application state, or other simple data.","operationId":"GetKVValue","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"key","in":"path","description":"Key name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"text/plain":{"schema":{"type":"string"}}}},"404":{"description":"NotFound","content":{"text/plain":{"schema":{"type":"string"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Key Values","operation":"get"},"x-o2-mcp":{"description":"Get value by key","category":"kv-store"}},"post":{"tags":["KV"],"summary":"Store value in key-value store","description":"Stores a text value under the specified key in the organization's key-value store. Creates a new key if it doesn't exist, or updates the existing value. The key-value store is perfect for configuration settings, feature flags, application state, and other simple data that needs to persist across sessions.","operationId":"SetKVValue","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"key","in":"path","description":"Key name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Value of the key","content":{"text/plain":{"schema":{"type":"string"}}},"required":true},"responses":{"200":{"description":"Success","content":{"text/plain":{"schema":{"type":"string"}}}},"500":{"description":"Failure","content":{"text/plain":{"schema":{"type":"string"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Key Values","operation":"create"},"x-o2-mcp":{"description":"Set key-value pair","category":"kv-store"}},"delete":{"tags":["KV"],"summary":"Delete key from key-value store","description":"Permanently removes a key and its associated value from the organization's key-value store. Returns a success response if the key was deleted, or a 404 error if the key doesn't exist. This operation cannot be undone, so use carefully when cleaning up unused configuration or application data.","operationId":"RemoveKVValue","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"key","in":"path","description":"Key name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"text/plain":{"schema":{"type":"string"}}}},"404":{"description":"NotFound","content":{"text/plain":{"schema":{"type":"string"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Key Values","operation":"delete"},"x-o2-mcp":{"description":"Delete key-value pair","category":"kv-store","requires_confirmation":true}}},"/api/{org_id}/loki/api/v1/push":{"post":{"tags":["Logs"],"summary":"Ingest logs via Loki API","description":"Ingests log data using Grafana Loki-compatible API format. Supports both JSON and Protocol Buffers content types with optional compression (gzip for JSON, snappy for Protobuf). Stream names are extracted from the 'stream_name' label in stream metadata. Provides seamless migration path from Loki deployments to OpenObserve while maintaining API compatibility.","operationId":"LogsIngestionLoki","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Loki-compatible log push data in JSON format. Stream names are extracted from 'stream_name' label in the stream labels. Also supports Protobuf format (application/x-protobuf) with optional compression (gzip for JSON, snappy for Protobuf)","content":{"application/json":{"schema":{"type":"object","description":"Internal Loki JSON types for native Loki push API format\nLoki push request - matches native JSON format exactly","required":["streams"],"properties":{"streams":{"type":"array","items":{"$ref":"#/components/schemas/LokiStream"},"description":"Array of log streams, each containing labels and log entries"}}},"example":{"streams":[{"stream":{"stream_name":"application_logs","service":"api","environment":"production"},"values":[["1609459200000000000","API request processed successfully"],["1609459201000000000","Database connection established",{"trace_id":"abc123","span_id":"def456"}]]}]}}},"required":true},"responses":{"204":{"description":"Success - logs ingested successfully"},"400":{"description":"Bad Request - Possible causes: empty stream data, invalid labels format (e.g., empty labels), invalid timestamp format (e.g., non-numeric timestamp), unsupported content type (only application/json and application/x-protobuf supported), unsupported content encoding (only gzip for JSON and snappy for Protobuf), protobuf decode errors, JSON parsing errors, or compression/decompression failures","content":{"text/plain":{"schema":{"type":"string"}}}},"500":{"description":"Internal Server Error - Server error during log processing","content":{"text/plain":{"schema":{"type":"string"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/mcp":{"post":{"tags":["MCP"],"summary":"Handler for MCP POST requests (single request/response)","description":"Per MCP 2025-11-25 (Streamable HTTP transport):\n- Requests with `id` → 200 with JSON or SSE response\n- Notifications (no `id`) → 202 Accepted, no body\n- Validates `MCP-Protocol-Version` header on non-initialize requests","operationId":"MCPRequest","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"MCP request payload","content":{"application/json":{"schema":{"type":"object","required":["jsonrpc","method"],"properties":{"id":{},"jsonrpc":{"type":"string"},"method":{"type":"string"},"params":{}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{}}},"202":{"description":"Accepted (notification, no response body)"},"400":{"description":"Bad Request (unsupported protocol version)"},"500":{"description":"Internal Server Error"}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"mcp","operation":"post"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/organizations/assume_service_account":{"post":{"tags":["Organizations"],"summary":"Assume a service account in a target organization","description":"This endpoint allows meta service accounts to obtain temporary session tokens\nfor accessing a target organization as a specific service account. The session\nautomatically expires after the specified duration.\n\n# Security\n- Only meta service accounts can call this endpoint\n- The service account must exist in both _meta and target organization\n- The service account must have the appropriate role in the target organization\n- Maximum session duration is capped at 24 hours\n\n# Example\n```bash\ncurl -X POST http://localhost:5080/api/_meta/assume_service_account \\\n  -H \"Authorization: Bearer <meta_sa_token>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"org_id\": \"customer1\",\n    \"service_account\": \"tenant_admin_sa\",\n    \"duration_seconds\": 3600\n  }'\n```","operationId":"AssumeServiceAccount","parameters":[{"name":"org_id","in":"path","description":"Organization name (must be _meta)","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Assume service account request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssumeServiceAccountRequest"}}},"required":true},"responses":{"200":{"description":"Session created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AssumeServiceAccountResponse"}}}},"400":{"description":"Invalid request"},"403":{"description":"Not authorized or service account not assigned"},"500":{"description":"Internal server error"},"501":{"description":"Not available in non-enterprise builds"}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Organizations","operation":"assume"},"x-o2-mcp":{"description":"Assume service account identity","category":"users"}}},"/api/{org_id}/passcode":{"get":{"tags":["Organizations"],"summary":"Get user's ingestion token","description":"Retrieves the current ingestion token (passcode) for the authenticated user within the specified organization. This token is used to authenticate data ingestion requests and can be used with various ingestion endpoints.","operationId":"GetOrganizationUserIngestToken","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/IngestionPasscode"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Ingestion Token","operation":"get"}},"put":{"tags":["Organizations"],"summary":"Update user's ingestion token","description":"Generates a new ingestion token (passcode) for the authenticated user within the specified organization. The old token will be invalidated and all ingestion processes using the old token will need to be updated with the new token.","operationId":"UpdateOrganizationUserIngestToken","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/IngestionPasscode"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Ingestion Token","operation":"update"}}},"/api/{org_id}/pipelines":{"get":{"tags":["Pipelines"],"summary":"List organization pipelines","description":"Retrieves all data processing pipelines configured for the organization, including their status and associated triggers","operationId":"listPipelines","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Pipeline"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Pipeline","operation":"list"},"x-o2-mcp":{"description":"List all pipelines","category":"pipelines","summary_fields":["pipeline_id","name","description","enabled"]}},"put":{"tags":["Pipelines"],"summary":"Update pipeline","description":"Updates an existing data processing pipeline with new transformation rules, routing configurations, or other settings","operationId":"updatePipeline","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Pipeline data","content":{"application/json":{"schema":{"type":"object","required":["name","nodes","edges"],"properties":{"description":{"type":"string"},"edges":{"type":"array","items":{"$ref":"#/components/schemas/Edge"}},"enabled":{"type":"boolean"},"name":{"type":"string"},"nodes":{"type":"array","items":{"$ref":"#/components/schemas/Node"}},"org":{"type":"string"},"pipeline_id":{"type":"string"},"source":{"$ref":"#/components/schemas/PipelineSource"},"version":{"type":"integer","format":"int32"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Pipeline","operation":"update"},"x-o2-mcp":{"description":"Update an existing pipeline. Uses the same schema as createPipeline - include pipeline_id and version from the existing pipeline. See createPipeline for full node/edge structure documentation.","category":"pipelines"}},"post":{"tags":["Pipelines"],"summary":"Create new pipeline","description":"Creates a new data processing pipeline with specified transformations and routing rules. Pipelines define how incoming data is processed before storage","operationId":"createPipeline","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Pipeline data","content":{"application/json":{"schema":{"type":"object","required":["name","nodes","edges"],"properties":{"description":{"type":"string"},"edges":{"type":"array","items":{"$ref":"#/components/schemas/Edge"}},"enabled":{"type":"boolean"},"name":{"type":"string"},"nodes":{"type":"array","items":{"$ref":"#/components/schemas/Node"}},"org":{"type":"string"},"pipeline_id":{"type":"string"},"source":{"$ref":"#/components/schemas/PipelineSource"},"version":{"type":"integer","format":"int32"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create a data pipeline for processing and transforming data streams.\n\nPIPELINE STRUCTURE:\n- name: Pipeline name (required, lowercase)\n- source: { \"source_type\": \"realtime\" } for real-time pipelines\n- nodes: Array of processing nodes (required)\n- edges: Array of connections between nodes (required)\n\nNODE STRUCTURE (each node requires):\n- id: Unique identifier (use UUID format)\n- io_type: MUST be one of: \"input\" (source stream), \"output\" (destination stream), \"default\" (processing node like function/condition)\n- position: { \"x\": number, \"y\": number } for visual layout\n- data: Node configuration (structure depends on node_type)\n\nNODE DATA TYPES:\n1. Stream node (input/output): { \"node_type\": \"stream\", \"org_id\": \"default\", \"stream_name\": \"your_stream\", \"stream_type\": \"logs\"|\"metrics\"|\"traces\" }\n2. Function node: { \"node_type\": \"function\", \"name\": \"function_name\", \"after_flatten\": true|false }\n3. Condition node (MUST use version 2): { \"node_type\": \"condition\", \"version\": 2, \"conditions\": <group> }\n\nCONDITION FORMAT (version 2):\nThe conditions field is a group containing a flat array of items. Each item has a logicalOperator field (AND/OR) — this is the boolean connector BEFORE that item. The first item's logicalOperator is ignored but must be present (use AND). AND has higher precedence than OR. Use nested groups for explicit parentheses.\n- Group: { \"filterType\": \"group\", \"logicalOperator\": \"AND\", \"conditions\": [...] }\n- Condition: { \"filterType\": \"condition\", \"column\": \"field\", \"operator\": \"<op>\", \"value\": \"val\", \"logicalOperator\": \"AND\"|\"OR\" }\n- Operators: =, !=, >, >=, <, <=, contains, not_contains\n\nEXAMPLE - status = \"error\" AND (level > 5 OR source = \"nginx\"):\n{ \"node_type\": \"condition\", \"version\": 2, \"conditions\": { \"filterType\": \"group\", \"logicalOperator\": \"AND\", \"conditions\": [{ \"filterType\": \"condition\", \"column\": \"status\", \"operator\": \"=\", \"value\": \"error\", \"logicalOperator\": \"AND\" }, { \"filterType\": \"group\", \"logicalOperator\": \"AND\", \"conditions\": [{ \"filterType\": \"condition\", \"column\": \"level\", \"operator\": \">\", \"value\": \"5\", \"logicalOperator\": \"OR\" }, { \"filterType\": \"condition\", \"column\": \"source\", \"operator\": \"=\", \"value\": \"nginx\", \"logicalOperator\": \"OR\" }] }] } }\n\nEDGE STRUCTURE:\n- id: Format \"e{source_id}-{target_id}\"\n- source: Source node id\n- target: Target node id\n\nEXAMPLE - Simple pipeline with function:\n{\n  \"name\": \"my_pipeline\",\n  \"source\": { \"source_type\": \"realtime\" },\n  \"nodes\": [\n    { \"id\": \"input-1\", \"io_type\": \"input\", \"position\": {\"x\": 100, \"y\": 100}, \"data\": {\"node_type\": \"stream\", \"org_id\": \"default\", \"stream_name\": \"source_stream\", \"stream_type\": \"logs\"} },\n    { \"id\": \"func-1\", \"io_type\": \"default\", \"position\": {\"x\": 100, \"y\": 200}, \"data\": {\"node_type\": \"function\", \"name\": \"my_function\", \"after_flatten\": true} },\n    { \"id\": \"output-1\", \"io_type\": \"output\", \"position\": {\"x\": 100, \"y\": 300}, \"data\": {\"node_type\": \"stream\", \"org_id\": \"default\", \"stream_name\": \"dest_stream\", \"stream_type\": \"logs\"} }\n  ],\n  \"edges\": [\n    { \"id\": \"einput-1-func-1\", \"source\": \"input-1\", \"target\": \"func-1\" },\n    { \"id\": \"efunc-1-output-1\", \"source\": \"func-1\", \"target\": \"output-1\" }\n  ]\n}","category":"pipelines"},"x-o2-ratelimit":{"module":"Pipeline","operation":"create"}}},"/api/{org_id}/pipelines/backfill":{"get":{"tags":["Pipelines"],"summary":"List all backfill jobs for an organization","description":"Returns a list of all backfill jobs in the specified organization.","operationId":"ListBackfillJobs","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"List of backfill jobs","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/BackfillJobStatus"}}}}},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}},"/api/{org_id}/pipelines/bulk/enable":{"post":{"tags":["Pipelines"],"summary":"Enable or disable pipeline in bulk","description":"Enables or disables data processing pipelines in bulk. Disabled pipelines will not process incoming data until re-enabled","operationId":"enablePipelineBulk","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"value","in":"query","description":"Enable or disable pipeline","required":true,"schema":{"type":"boolean"}}],"requestBody":{"description":"Pipeline id list","content":{"application/json":{"schema":{"type":"object","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string"}}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Pipeline","operation":"update"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/pipelines/history":{"get":{"tags":["Pipelines"],"summary":"Get pipeline execution history","description":"Retrieves the execution history of pipelines for the organization. This endpoint queries the _meta organization's triggers stream to provide details about when pipelines were triggered, their status, and execution details.","operationId":"GetPipelineHistory","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"query","description":"Filter by specific pipeline id","required":false,"schema":{"type":"string"}},{"name":"start_time","in":"query","description":"Start time in Unix timestamp microseconds","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"end_time","in":"query","description":"End time in Unix timestamp microseconds","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"from","in":"query","description":"Pagination offset (default: 0)","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"size","in":"query","description":"Number of results to return (default: 100, max: 1000)","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"sort_by","in":"query","description":"Field to sort by: timestamp, pipeline_name, status, is_realtime, is_silenced, start_time, end_time, duration, retries, delay_in_secs, evaluation_took_in_secs, source_node, query_took, is_partial (default: timestamp)","required":false,"schema":{"type":"string"}},{"name":"sort_order","in":"query","description":"Sort order: asc or desc (default: desc)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PipelineHistoryResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{}}},"403":{"description":"Forbidden","content":{"application/json":{}}},"500":{"description":"Internal Server Error","content":{"application/json":{}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/pipelines/streams":{"get":{"tags":["Pipelines"],"summary":"Get streams with pipelines","description":"Retrieves a list of streams that have associated data processing pipelines, showing the relationship between streams and their transformation rules","operationId":"getStreamsWithPipeline","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Pipeline"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Pipeline","operation":"list"},"x-o2-mcp":{"description":"List streams using pipelines","category":"pipelines"}}},"/api/{org_id}/pipelines/{pipeline_id}":{"get":{"tags":["Pipelines"],"summary":"Get pipeline by ID","description":"Retrieves the details of a specific data processing pipeline by its ID, including its status, trigger info, and any recent errors","operationId":"getPipeline","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["name","nodes","edges"],"properties":{"description":{"type":"string"},"edges":{"type":"array","items":{"$ref":"#/components/schemas/Edge"}},"enabled":{"type":"boolean"},"last_error":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PipelineErrorInfo"}]},"name":{"type":"string"},"nodes":{"type":"array","items":{"$ref":"#/components/schemas/Node"}},"org":{"type":"string"},"paused_at":{"type":["integer","null"],"format":"int64"},"pipeline_id":{"type":"string"},"source":{"$ref":"#/components/schemas/PipelineSource"},"version":{"type":"integer","format":"int32"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Pipeline","operation":"get"},"x-o2-mcp":{"description":"Get pipeline details by ID","category":"pipelines"}},"delete":{"tags":["Pipelines"],"summary":"Delete pipeline","description":"Permanently deletes a data processing pipeline. This will stop any ongoing data transformations using this pipeline","operationId":"deletePipeline","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Pipeline","operation":"delete"},"x-o2-mcp":{"description":"Delete a pipeline","category":"pipelines","requires_confirmation":true}}},"/api/{org_id}/pipelines/{pipeline_id}/backfill":{"post":{"tags":["Pipelines"],"summary":"Create a backfill job","description":"Creates a new backfill job to fill gaps in summary streams.","operationId":"CreateBackfillJob","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Backfill parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BackfillRequest"},"example":{"start_time":1704067200000000,"end_time":1704153600000000,"chunk_period_minutes":60,"delay_between_chunks_secs":5,"delete_before_backfill":false}}},"required":true},"responses":{"200":{"description":"Backfill job created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BackfillResponse"}}}},"400":{"description":"Bad request"},"404":{"description":"Pipeline not found"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}},"/api/{org_id}/pipelines/{pipeline_id}/backfill/{job_id}":{"get":{"tags":["Pipelines"],"summary":"Get backfill job status","description":"Returns the status of a specific backfill job.","operationId":"GetBackfillJob","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Backfill job ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Backfill job status","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BackfillJobStatus"}}}},"404":{"description":"Job not found"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]},"put":{"tags":["Pipelines"],"summary":"Update an existing backfill job","operationId":"UpdateBackfillJob","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Backfill job ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Backfill job parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BackfillRequest"}}},"required":true},"responses":{"200":{"description":"Backfill job updated successfully"},"400":{"description":"Bad request"},"404":{"description":"Backfill job not found"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}},"delete":{"tags":["Pipelines"],"summary":"Delete a backfill job","description":"Deletes a backfill job permanently.","operationId":"DeleteBackfillJob","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Backfill job ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Backfill job deleted successfully"},"404":{"description":"Job not found"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}},"/api/{org_id}/pipelines/{pipeline_id}/backfill/{job_id}/enable":{"put":{"tags":["Pipelines"],"summary":"Enable or disable a backfill job","description":"Enables (resumes) or disables (pauses) a backfill job.","operationId":"EnableBackfillJob","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Backfill job ID","required":true,"schema":{"type":"string"}},{"name":"value","in":"query","description":"Enable (true) or disable (false) the backfill job","required":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Backfill job status updated successfully"},"400":{"description":"Bad request"},"404":{"description":"Job not found"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}},"/api/{org_id}/pipelines/{pipeline_id}/enable":{"put":{"tags":["Pipelines"],"summary":"Enable or disable pipeline","description":"Enables or disables a data processing pipeline. Disabled pipelines will not process incoming data until re-enabled","operationId":"enablePipeline","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"pipeline_id","in":"path","description":"Pipeline ID","required":true,"schema":{"type":"string"}},{"name":"value","in":"query","description":"Enable or disable pipeline","required":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Pipeline","operation":"update"},"x-o2-mcp":{"description":"Enable or disable a pipeline","category":"pipelines"}}},"/api/{org_id}/prometheus/api/v1/format_query":{"get":{"tags":["Metrics"],"summary":"Format Prometheus query","description":"Formats and prettifies a Prometheus query expression. Returns the query in a standardized, readable format which helps with query validation, debugging, and ensuring consistent query formatting across applications.","operationId":"PrometheusFormatQuery","parameters":[{"name":"query","in":"query","description":"Prometheus expression query string.","required":true,"schema":{"type":"string"}},{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"status":"success","data":"foo / bar"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Metrics","operation":"get"},"x-o2-mcp":{"description":"Format PromQL query","category":"metrics"}}},"/api/{org_id}/prometheus/api/v1/label/{label_name}/values":{"get":{"tags":["Metrics"],"summary":"Get label values","description":"Returns all possible values for a specific label name within the specified time range. Optionally filter by series selector to get values for specific metrics. Essential for building filters and understanding label cardinality.","operationId":"PrometheusLabelValues","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"label_name","in":"path","description":"Label name","required":true,"schema":{"type":"string"}},{"name":"match[]","in":"query","description":"Series selector argument that selects the series from which to read the label values","required":true,"schema":{"type":"string"}},{"name":"start","in":"query","description":"<rfc3339 | unix_timestamp>: Start timestamp","required":false,"schema":{"type":"string"}},{"name":"end","in":"query","description":"<rfc3339 | unix_timestamp>: End timestamp","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"status":"success","data":["node","prometheus"]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Metrics","operation":"get"},"x-o2-mcp":{"description":"Get Prometheus label values","category":"metrics"}}},"/api/{org_id}/prometheus/api/v1/labels":{"get":{"tags":["Metrics"],"summary":"Get metric label names","description":"Returns a list of label names available in the metric data within the specified time range. Optionally filter by series selector to get labels for specific metrics. Useful for building dynamic queries and understanding data structure.","operationId":"PrometheusLabels","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"match[]","in":"query","description":"Series selector argument that selects the series from which to read the label names","required":true,"schema":{"type":"string"}},{"name":"start","in":"query","description":"<rfc3339 | unix_timestamp>: Start timestamp","required":false,"schema":{"type":"string"}},{"name":"end","in":"query","description":"<rfc3339 | unix_timestamp>: End timestamp","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"status":"success","data":["__name__","call","code","config","dialer_name","endpoint","event","goversion","handler","instance","interval","job","le","listener_name","name","quantile","reason","role","scrape_job","slice","version"]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Metrics","operation":"get"},"x-o2-mcp":{"description":"Get Prometheus label names, must have start and end time","category":"metrics"}}},"/api/{org_id}/prometheus/api/v1/metadata":{"get":{"tags":["Metrics"],"summary":"Get metric metadata","description":"Retrieves metadata information about metrics including their type, help text, and units. Provides essential information for understanding metric semantics and proper usage in queries and visualizations.","operationId":"PrometheusMetadata","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"limit","in":"query","description":"Maximum number of metrics to return","required":true,"schema":{"type":"string"}},{"name":"metric","in":"query","description":"A metric name to filter metadata for. All metric metadata is retrieved if left empty","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"status":"success","data":{"cortex_ring_tokens":[{"type":"gauge","help":"Number of tokens in the ring","unit":""}],"http_requests_total":[{"type":"counter","help":"Number of HTTP requests","unit":""},{"type":"counter","help":"Amount of HTTP requests","unit":""}]}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get Prometheus metadata","category":"metrics"},"x-o2-ratelimit":{"module":"Metrics","operation":"get"}}},"/api/{org_id}/prometheus/api/v1/query":{"get":{"tags":["Metrics"],"summary":"Execute Prometheus instant query","description":"Executes a Prometheus instant query at a single point in time. Returns current values for metrics matching the query expression. Compatible with Prometheus instant query API for seamless integration with existing monitoring tools.","operationId":"PrometheusQuery","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"query","in":"query","description":"Prometheus expression query string","required":true,"schema":{"type":"string"}},{"name":"time","in":"query","description":"<rfc3339 | unix_timestamp>: Evaluation timestamp. Optional","required":false,"schema":{"type":"string"}},{"name":"timeout","in":"query","description":"Evaluation timeout","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"status":"success","data":{"resultType":"vector","result":[{"metric":{"__name__":"up","job":"prometheus","instance":"localhost:9090"},"value":[1435781451.781,"1"]},{"metric":{"__name__":"up","job":"node","instance":"localhost:9100"},"value":[1435781451.781,"0"]}]}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Metrics","operation":"get"},"x-o2-mcp":{"description":"Execute PromQL instant query","category":"metrics"}}},"/api/{org_id}/prometheus/api/v1/query_range":{"get":{"tags":["Metrics"],"summary":"Execute Prometheus range query","description":"Executes a Prometheus range query over a specified time period. Returns time series data with multiple data points for metrics matching the query expression. Compatible with Prometheus range query API for time series analysis and visualization.","operationId":"PrometheusRangeQuery","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"query","in":"query","description":"Prometheus expression query string","required":true,"schema":{"type":"string"}},{"name":"start","in":"query","description":"<rfc3339 | unix_timestamp>: Start timestamp, inclusive","required":true,"schema":{"type":"string"}},{"name":"end","in":"query","description":"<rfc3339 | unix_timestamp>: End timestamp, inclusive","required":true,"schema":{"type":"string"}},{"name":"step","in":"query","description":"Query resolution step width in duration format or float number of seconds","required":false,"schema":{"type":"string"}},{"name":"timeout","in":"query","description":"Evaluation timeout","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"status":"success","data":{"resultType":"matrix","result":[{"metric":{"__name__":"up","job":"prometheus","instance":"localhost:9090"},"values":[[1435781430.781,"1"],[1435781445.781,"1"],[1435781460.781,"1"]]},{"metric":{"__name__":"up","job":"node","instance":"localhost:9091"},"values":[[1435781430.781,"0"],[1435781445.781,"0"],[1435781460.781,"1"]]}]}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Metrics","operation":"get"},"x-o2-mcp":{"description":"Execute PromQL range query","category":"metrics","pinned":true}}},"/api/{org_id}/prometheus/api/v1/series":{"get":{"tags":["Metrics"],"summary":"Find metric series","description":"Finds time series that match given label matchers. Returns the unique combinations of metric names and labels that exist in the specified time range. Useful for discovering available metrics and their label combinations.","operationId":"PrometheusSeries","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"match[]","in":"query","description":"<series_selector>: Series selector argument that selects the series to return","required":true,"schema":{"type":"string"}},{"name":"start","in":"query","description":"<rfc3339 | unix_timestamp>: Start timestamp","required":false,"schema":{"type":"string"}},{"name":"end","in":"query","description":"<rfc3339 | unix_timestamp>: End timestamp","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"status":"success","data":[{"__name__":"up","job":"prometheus","instance":"localhost:9090"},{"__name__":"up","job":"node","instance":"localhost:9091"},{"__name__":"process_start_time_seconds","job":"prometheus","instance":"localhost:9090"}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Metrics","operation":"get"},"x-o2-mcp":{"description":"Get Prometheus series, must have start and end time","category":"metrics"}}},"/api/{org_id}/prometheus/api/v1/write":{"post":{"tags":["Metrics"],"summary":"Ingest Prometheus metrics","description":"Receives Prometheus metrics data via remote write protocol. Accepts protobuf-encoded WriteRequest payloads containing time series data and stores them for querying. Compatible with standard Prometheus remote write configuration.","operationId":"PrometheusRemoteWrite","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"prometheus WriteRequest","content":{"application/x-protobuf":{"schema":{"type":"string"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/ratelimit/module_list":{"get":{"tags":["Ratelimit"],"summary":"List module rate limit rules","description":"Retrieves rate limiting rules applied at the organization module level, including thresholds and configurations for different API groups","operationId":"listModuleRatelimitRule","parameters":[{"name":"org_id","in":"path","description":"Organization Name","required":true,"schema":{"type":"string"}},{"name":"org_id","in":"query","description":"Organization Name","required":true,"schema":{"type":"string"}},{"name":"interval","in":"query","description":"Time interval: second/minute/hour (default: second)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Ratelimit","operation":"list"}}},"/api/{org_id}/ratelimit/role_list":{"get":{"tags":["Ratelimit"],"summary":"List role-based rate limit rules","description":"Retrieves rate limiting rules applied to specific user roles within the organization, showing how different roles have different API usage limits","operationId":"listRoleRatelimitRule","parameters":[{"name":"org_id","in":"path","description":"Organization Name","required":true,"schema":{"type":"string"}},{"name":"org_id","in":"query","description":"Organization Name","required":true,"schema":{"type":"string"}},{"name":"user_role","in":"query","description":"User Role Name","required":true,"schema":{"type":"string"}},{"name":"interval","in":"query","description":"Time interval: second/minute/hour (default: second)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Ratelimit","operation":"list"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/ratelimit/update":{"put":{"tags":["Ratelimit"],"summary":"Update rate limit rules","description":"Updates rate limiting rules for modules or user roles. Allows setting custom thresholds for different API operations and groups","operationId":"UpdateRatelimitRule","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"org_id","in":"query","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"update_type","in":"query","description":"Update Type","required":true,"schema":{"type":"string"}},{"name":"user_role","in":"query","description":"UserRole name","required":false,"schema":{"type":"string"}},{"name":"interval","in":"query","description":"Time interval: second/minute/hour (default: second)","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"json array","content":{"application/json":{"schema":{"type":"string"},"example":{"Key Values":{"list":0,"create":0,"delete":0,"get":0},"Service Accounts":{"update":0,"list":0,"create":0,"delete":0,"get":0}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Ratelimit","operation":"update"},"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/rename":{"put":{"tags":["Organizations"],"summary":"Rename organization","description":"Changes the display name of an organization. The organization identifier remains unchanged, but the human-readable name is updated. This helps with organization management and branding without affecting API integrations or data access.","operationId":"RenameOrganization","parameters":[{"name":"org_id","in":"path","description":"Organization id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Organization new name","content":{"application/json":{"schema":{"type":"object","required":["new_name"],"properties":{"new_name":{"type":"string"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["name"],"properties":{"identifier":{"type":"string"},"name":{"type":"string","description":"Only alphanumeric characters (A-Z, a-z, 0-9), spaces, and underscores are allowed"},"org_type":{"type":"string"},"service_account":{"type":["string","null"],"description":"Optional service account email to add to the organization\nWhen specified, only this service account will be added (not the API caller)"}}}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/reports":{"get":{"tags":["Reports"],"summary":"List dashboard reports","description":"Retrieves a list of all dashboard reports configured for the organization. Optionally filter by folder or dashboard to get specific report subsets. Returns report metadata including schedules, status, destinations, and execution history to help administrators manage automated reporting and monitor delivery performance.","operationId":"ListReports","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}}}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"list"},"x-o2-mcp":{"description":"List all reports","category":"dashboards","summary_fields":["name","description","enabled","folder_name"]}},"post":{"tags":["Reports"],"summary":"Create dashboard report","description":"Creates a new automated dashboard report configuration. Reports can be scheduled to automatically generate and distribute dashboard snapshots via email or other notification channels. Includes support for custom time ranges, recipient lists, delivery schedules, and output formats to keep stakeholders informed of key metrics and trends.","operationId":"CreateReport","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Report details","content":{"application/json":{"schema":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}},"example":{"title":"Network Traffic Overview","description":"Traffic patterns and network performance of the infrastructure"}}},"required":true},"responses":{"201":{"description":"Report created","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create a scheduled report","category":"dashboards"},"x-o2-ratelimit":{"module":"Reports","operation":"create"}}},"/api/{org_id}/reports/{name}":{"get":{"tags":["Reports"],"summary":"Get dashboard report","description":"Retrieves the complete configuration and details for a specific dashboard report. Returns report parameters including schedule settings, dashboard selection, recipient lists, delivery options, and execution status. Used for reviewing existing report configurations before making modifications or troubleshooting delivery issues.","operationId":"GetReport","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Report name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"","content":{"application/json":{"schema":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}}}}},"404":{"description":"Report not found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get report details","category":"dashboards"},"x-o2-ratelimit":{"module":"Reports","operation":"get"}},"put":{"tags":["Reports"],"summary":"Update dashboard report","description":"Updates an existing dashboard report configuration. Allows modification of report parameters including schedule, recipients, dashboard selection, time ranges, and delivery options. Changes take effect on the next scheduled execution, ensuring report distribution continues with updated settings and content selection.","operationId":"UpdateReport","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Report name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Report details","content":{"application/json":{"schema":{"type":"object","required":["orgId","dashboards","destinations","owner","lastEditedBy"],"properties":{"createdAt":{"type":"string","format":"date-time"},"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboard"}},"description":{"type":"string"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/ReportDestination"}},"enabled":{"type":"boolean"},"frequency":{"$ref":"#/components/schemas/ReportFrequency","description":"Frequency of report generation. E.g. - Weekly."},"imagePreview":{"type":"boolean","description":"When `true` and the report type is PDF, a PNG screenshot is also captured and embedded\ninline in the email body alongside the PDF attachment."},"lastEditedBy":{"type":"string"},"message":{"type":"string","description":"Message to include in the email"},"name":{"type":"string"},"orgId":{"type":"string"},"owner":{"type":"string"},"start":{"type":"integer","format":"int64","description":"Start time of report generation in UNIX microseconds."},"timezone":{"type":"string"},"timezoneOffset":{"type":"integer","format":"int32","description":"Fixed timezone offset in minutes"},"title":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}}}}},"required":true},"responses":{"200":{"description":"Report updated","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Report not found","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failed to update the report","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Reports","operation":"update"},"x-o2-mcp":{"description":"Update a report","category":"dashboards"}},"delete":{"tags":["Reports"],"summary":"Delete dashboard report","description":"Removes a dashboard report configuration from the organization. This action cancels any scheduled report deliveries and permanently removes the report configuration. Recipients will no longer receive automated report deliveries, and the report configuration cannot be recovered once deleted.","operationId":"DeleteReport","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Report name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete a report","category":"dashboards","requires_confirmation":true},"x-o2-ratelimit":{"module":"Reports","operation":"delete"}}},"/api/{org_id}/reports/{name}/enable":{"put":{"tags":["Report"],"summary":"Enable or disable dashboard report","description":"Enables or disables automated execution of a dashboard report. When disabled, scheduled report deliveries are paused but the configuration is preserved. When re-enabled, report deliveries resume according to the configured schedule. Useful for temporarily stopping report distribution without losing the complete report setup.","operationId":"EnableReport","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Report name","required":true,"schema":{"type":"string"}},{"name":"value","in":"query","description":"Enable or disable report","required":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/reports/{name}/trigger":{"put":{"tags":["Reports"],"summary":"Manually trigger dashboard report","description":"Manually triggers immediate execution of a dashboard report outside of its regular schedule. Generates the report with current data and delivers it to configured destinations. Useful for ad-hoc reporting needs, testing report configurations, or providing immediate updates to stakeholders between scheduled deliveries.","operationId":"TriggerReport","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"name","in":"path","description":"Report name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/roles":{"get":{"tags":["Roles"],"summary":"List organization roles","description":"Retrieves a list of all roles available in the organization, including both standard predefined roles and custom roles. Users will only see roles they have permissions to view when role-based access control is active. Requires enterprise features to be enabled.","operationId":"ListRoles","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"string"}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Roles","operation":"list"},"x-o2-mcp":{"description":"List all roles","category":"authorization"}},"post":{"tags":["Roles"],"summary":"Create custom role","description":"Creates a new custom role with specified permissions and capabilities. Custom roles allow fine-grained access control beyond the standard predefined roles. Requires enterprise features to be enabled.","operationId":"CreateRoles","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"UserRoleRequest","content":{"application/json":{"schema":{"type":"object","required":["role"],"properties":{"custom_role":{"type":["array","null"],"items":{"type":"string"}},"role":{"type":"string"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create a role","category":"authorization"},"x-o2-ratelimit":{"module":"Roles","operation":"create"}}},"/api/{org_id}/roles/{role_id}":{"put":{"tags":["Roles"],"summary":"Update role permissions","description":"Updates an existing role by adding or removing permissions and users. Allows modification of role capabilities and user assignments to maintain proper access control. Standard roles cannot be modified. Requires enterprise features to be enabled.","operationId":"UpdateRoles","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"role_id","in":"path","description":"Role Id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"RoleRequest","content":{"application/json":{"schema":{"type":"object","required":["add","remove"],"properties":{"add":{"type":"array","items":{"$ref":"#/components/schemas/O2EntityAuthorization"}},"add_users":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true},"remove":{"type":"array","items":{"$ref":"#/components/schemas/O2EntityAuthorization"}},"remove_users":{"type":["array","null"],"items":{"type":"string"},"uniqueItems":true}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update a role","category":"authorization"},"x-o2-ratelimit":{"module":"Roles","operation":"update"}},"delete":{"tags":["Roles"],"summary":"Delete custom role","description":"Permanently removes a custom role from the organization. Users and groups assigned to this role will lose the associated permissions. Standard predefined roles cannot be deleted. Requires enterprise features to be enabled.","operationId":"DeleteRole","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"role_id","in":"path","description":"Role Id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Roles","operation":"delete"},"x-o2-mcp":{"description":"Delete a role","category":"authorization","requires_confirmation":true}}},"/api/{org_id}/roles/{role_id}/permissions/{resource}":{"get":{"tags":["Roles"],"summary":"Get role permissions for resource","description":"Retrieves detailed permissions that a specific role has on a particular resource type. Useful for understanding access control capabilities and auditing role assignments. Requires enterprise features to be enabled.","operationId":"GetResourcePermission","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"role_id","in":"path","description":"Role Id","required":true,"schema":{"type":"string"}},{"name":"resource","in":"path","description":"resource","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"object"}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/roles/{role_id}/users":{"get":{"tags":["Roles"],"summary":"Get users assigned to role","description":"Retrieves a list of all users who are currently assigned to a specific role. Useful for role management, auditing user permissions, and understanding access control assignments. Requires enterprise features to be enabled.","operationId":"GetRoleUsers","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"role_id","in":"path","description":"Role Id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"string"}}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/rumtoken":{"get":{"tags":["Organizations"],"summary":"Get user's RUM ingestion token","description":"Retrieves the current Real User Monitoring (RUM) ingestion token for the authenticated user within the specified organization. This token is specifically used for ingesting RUM data from web applications and mobile apps.","operationId":"GetOrganizationUserRumIngestToken","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/RumIngestionToken"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Rumtokens","operation":"get"},"x-o2-mcp":{"enabled":false}},"put":{"tags":["Organizations"],"summary":"Update user's RUM ingestion token","description":"Generates a new Real User Monitoring (RUM) ingestion token for the authenticated user within the specified organization. The old RUM token will be invalidated and all RUM data collection processes using the old token will need to be updated.","operationId":"UpdateOrganizationUserRumIngestToken","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/RumIngestionToken"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Rumtokens","operation":"update"}},"post":{"tags":["Organizations"],"summary":"Create user's RUM ingestion token","description":"Creates a new Real User Monitoring (RUM) ingestion token for the authenticated user within the specified organization. This endpoint is used when no RUM token exists yet and you need to generate the initial token for RUM data collection.","operationId":"CreateOrganizationUserRumIngestToken","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/RumIngestionToken"}}}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Rumtokens","operation":"create"}}},"/api/{org_id}/savedviews":{"get":{"tags":["Saved Views"],"summary":"List saved views","description":"Retrieves a list of all saved search views for the organization. This provides an overview of all stored queries and visualizations that users have created and saved for reuse. Each view includes basic metadata such as name and ID, allowing users to identify and select the views they want to load.","operationId":"ListSavedViews","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":[{"org_id":"some-org-id","view_name":"view-name","view_id":"view-id","payload":"base-64-encoded-versioned-payload"}]}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"List all saved views","category":"search"},"x-o2-ratelimit":{"module":"Saved Views","operation":"list"}},"post":{"tags":["Saved Views"],"summary":"Create a new saved view","description":"Creates a saved search view with specified query parameters and filters","operationId":"CreateSavedViews","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Create view data","content":{"application/json":{"schema":{"type":"object","required":["data","view_name"],"properties":{"data":{"description":"Base64 encoded string, containing all the data for a given view.\nThis data is expected to be versioned so that the frontend can\ndeserialize as required."},"view_name":{"type":"string","description":"User-readable name of the view, doesn't need to be unique."}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["org_id","view_id","view_name"],"properties":{"org_id":{"type":"string"},"view_id":{"type":"string"},"view_name":{"type":"string"}}},"example":[{"org_id":"some-org-id","view_id":"view_id"}]}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Saved Views","operation":"create"},"x-o2-mcp":{"description":"Create a saved view","category":"search"}}},"/api/{org_id}/savedviews/{view_id}":{"get":{"tags":["Saved Views"],"summary":"Get saved view","description":"Retrieves a specific saved search view by its ID. Saved views allow users to store and reuse complex search queries, filters, and visualization settings. The view contains all the necessary information to recreate the exact search state, including query parameters, time ranges, and display configurations.","operationId":"GetSavedView","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"view_id","in":"path","description":"The view_id which was stored","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["org_id","data","view_id","view_name"],"properties":{"data":{},"org_id":{"type":"string"},"view_id":{"type":"string"},"view_name":{"type":"string"}}},"example":{"org_id":"some-org-id","view_id":"some-uuid-v4","view_name":"view-name","payload":"base64-encoded-object-as-sent-by-frontend"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Saved Views","operation":"get"},"x-o2-mcp":{"description":"Get saved view details","category":"search"}},"put":{"tags":["Saved Views"],"summary":"Update an existing saved view","description":"Updates the configuration and parameters of an existing saved search view","operationId":"UpdateSavedViews","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"view_id","in":"path","description":"View id to be updated","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Update view data","content":{"application/json":{"schema":{"type":"object","required":["data","view_name"],"properties":{"data":{"description":"Base64 encoded string, containing all the data for a given view.\nThis data is expected to be versioned so that the frontend can\ndeserialize as required."},"view_name":{"type":"string","description":"User-readable name of the view, doesn't need to be unique."}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["org_id","data","view_id","view_name"],"properties":{"data":{},"org_id":{"type":"string"},"view_id":{"type":"string"},"view_name":{"type":"string"}}},"example":[{"org_id":"some-org-id","view_name":"view-name","view_id":"view-id","payload":"base-64-encoded-versioned-payload"}]}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Saved Views","operation":"update"},"x-o2-mcp":{"description":"Update a saved view","category":"search"}},"delete":{"tags":["Saved Views"],"summary":"Delete saved view","description":"Permanently removes a saved search view from the organization. This action deletes the stored query configuration, visualization settings, and all associated metadata. Once deleted, the view cannot be recovered, so use this operation carefully when cleaning up unused or outdated saved views.","operationId":"DeleteSavedViews","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"view_id","in":"path","description":"The view_id to delete","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["org_id","view_id"],"properties":{"org_id":{"type":"string"},"view_id":{"type":"string"}}},"example":[{"org_id":"some-org-id","view_id":"view_id"}]}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Saved Views","operation":"delete"},"x-o2-mcp":{"description":"Delete a saved view","category":"search","requires_confirmation":true}}},"/api/{org_id}/search_jobs":{"get":{"tags":["Search Jobs"],"summary":"List search jobs","description":"Retrieves a list of all search jobs for the organization, including their current status, execution details, and metadata. This includes both active and completed jobs, allowing you to monitor the progress of running searches and access historical job information for analysis and debugging purposes.","operationId":"ListSearchJobs","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"List of search jobs","content":{"application/json":{"schema":{"type":"array","items":{"type":"object"}},"example":[{"id":"abc123","trace_id":"xyz789","org_id":"default","user_id":"user1","stream_type":"logs","stream_names":"[\"stream1\"]","payload":"...","start_time":1675182660872049,"end_time":1675185660872049,"created_at":1675182660872049,"updated_at":1675182660872049,"status":1,"cluster":"cluster1","result_path":"/path/to/result"}]}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search Jobs","operation":"list"},"x-o2-mcp":{"description":"List all search jobs","category":"search"}},"post":{"tags":["Search Jobs"],"summary":"Submit search job","description":"Submits a new asynchronous search job for execution. Search jobs are useful for long-running queries that might exceed normal timeout limits or for scheduling queries to run in the background. The job is queued for execution and returns a job ID that can be used to monitor progress and retrieve results later.","operationId":"SubmitSearchJob","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Search query","content":{"application/json":{"schema":{"type":"object","required":["query"],"properties":{"clear_cache":{"type":"boolean"},"clusters":{"type":"array","items":{"type":"string"}},"encoding":{"$ref":"#/components/schemas/RequestEncoding"},"local_mode":{"type":["boolean","null"]},"query":{"$ref":"#/components/schemas/SearchQuery"},"regions":{"type":"array","items":{"type":"string"}},"search_event_context":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventContext"}]},"search_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventType"}]},"timeout":{"type":"integer","format":"int64"},"use_cache":{"type":"boolean"}}},"example":{"query":{"sql":"select * from k8s ","start_time":1675182660872049,"end_time":1675185660872049,"limit":100,"offset":0}}}},"required":true},"responses":{"200":{"description":"Search Job submitted successfully","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search Jobs","operation":"create"},"x-o2-mcp":{"description":"Submit async search job","category":"search"}}},"/api/{org_id}/search_jobs/{job_id}":{"get":{"tags":["Search Jobs"],"summary":"Get search job status","description":"Retrieves the current status and metadata for a specific search job. This includes execution state, timing information, error messages if any, and other job details. Use this to monitor job progress and determine when results are ready for retrieval or if the job encountered any issues during execution.","operationId":"GetSearchJobStatus","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Search job ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Search job status","content":{"application/json":{"schema":{"type":"object"},"example":{"id":"abc123","trace_id":"xyz789","org_id":"default","user_id":"user1","stream_type":"logs","stream_names":"[\"stream1\"]","payload":"...","start_time":1675182660872049,"end_time":1675185660872049,"created_at":1675182660872049,"updated_at":1675182660872049,"status":1,"cluster":"cluster1","result_path":"/path/to/result"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get search job status","category":"search"},"x-o2-ratelimit":{"module":"Search Jobs","operation":"get"}},"delete":{"tags":["Search Jobs"],"summary":"Delete search job","description":"Permanently deletes a search job and its associated results from the system. This action first cancels the job if it's still running, then removes all job data including metadata and stored results. Use this to clean up completed jobs and free up storage space. This operation cannot be undone.","operationId":"DeleteSearchJob","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Search job ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Search job deleted successfully","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"message":"[Job_Id: abc123] Running Search Job deleted successfully."}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search Jobs","operation":"delete"},"x-o2-mcp":{"description":"Delete a search job","category":"search","requires_confirmation":true}}},"/api/{org_id}/search_jobs/{job_id}/cancel":{"post":{"tags":["Search Jobs"],"summary":"Cancel search job","description":"Cancels a running or pending search job, stopping its execution and freeing up resources. This is useful for stopping long-running queries that are no longer needed or consuming too many resources. Once cancelled, the job cannot be resumed and no results will be available.","operationId":"CancelSearchJob","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Search job ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Search job cancelled successfully","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"message":"[Job_Id: abc123] Running Search Job cancelled successfully."}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search Jobs","operation":"update"},"x-o2-mcp":{"description":"Cancel a running search job","category":"search"}}},"/api/{org_id}/search_jobs/{job_id}/result":{"get":{"tags":["Search Jobs"],"summary":"Get search job results","description":"Retrieves the results from a completed search job with optional pagination. The job must have finished successfully before results can be accessed. Results include the matching records, total count, execution timing, and metadata. Use pagination parameters to retrieve large result sets in manageable chunks.","operationId":"GetSearchJobResult","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Search job ID","required":true,"schema":{"type":"string"}},{"name":"from","in":"query","description":"Pagination start offset","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"size","in":"query","description":"Number of results to return","required":false,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Search job results","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"hits":[],"total":27179431,"from":0,"size":100}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search Jobs","operation":"get"},"x-o2-mcp":{"description":"Get search job results","category":"search"}}},"/api/{org_id}/search_jobs/{job_id}/retry":{"post":{"tags":["Search Jobs"],"summary":"Retry search job","description":"Retries a previously failed or cancelled search job by resubmitting it for execution. This is useful for handling transient failures or resource constraints that may have caused the original job to fail. Only cancelled or finished (failed) jobs can be retried. The job will be re-queued with the same original parameters and query.","operationId":"RetrySearchJob","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"job_id","in":"path","description":"Search job ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Search job retry initiated successfully","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"message":"[Job_Id: abc123] Search Job retry successfully."}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object"}}}},"403":{"description":"Forbidden - Job cannot be retried","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Retry a failed search job","category":"search"},"x-o2-ratelimit":{"module":"Search Jobs","operation":"update"}}},"/api/{org_id}/service_accounts":{"get":{"tags":["ServiceAccounts"],"summary":"List service accounts","description":"Retrieves a list of all service accounts in the organization. Service accounts are special user accounts designed for automated systems and applications to authenticate and access resources without human intervention. Each service account has an associated API token for programmatic access.","operationId":"ServiceAccountsList","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"List service accounts","category":"users","summary_fields":["email","role","first_name","last_name"]},"x-o2-ratelimit":{"module":"Service Accounts","operation":"list"}},"post":{"tags":["ServiceAccounts"],"summary":"Create service account","description":"Creates a new service account for automated systems and applications. Service accounts provide a secure way for non-human users to authenticate and access resources programmatically. Each service account is automatically assigned an API token that can be used for authentication in automated workflows and integrations.","operationId":"ServiceAccountSave","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"ServiceAccount data","content":{"application/json":{"schema":{"type":"object","required":["email"],"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"last_name":{"type":"string"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Service Accounts","operation":"create"},"x-o2-mcp":{"description":"Create service account","category":"users"}}},"/api/{org_id}/service_accounts/{email_id}":{"put":{"tags":["ServiceAccounts"],"summary":"Update service account","description":"Updates an existing service account's information such as first name and last name. You can also rotate the API token by adding the 'rotateToken=true' query parameter, which generates a new authentication token while invalidating the old one. This is useful for security maintenance and credential rotation policies.","operationId":"ServiceAccountUpdate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"email_id","in":"path","description":"Service Account email id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Service Account data","content":{"application/json":{"schema":{"type":"object","properties":{"first_name":{"type":"string"},"last_name":{"type":"string"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Service Accounts","operation":"update"},"x-o2-mcp":{"description":"Update service account","category":"users"}},"delete":{"tags":["ServiceAccounts"],"summary":"Delete service account","description":"Permanently removes a service account from the organization. This action immediately invalidates the associated API token and revokes all access permissions for the service account. Use this when decommissioning automated systems or cleaning up unused accounts. This operation cannot be undone.","operationId":"RemoveServiceAccount","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"email_id","in":"path","description":"Service Account email id","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete service account","category":"users","requires_confirmation":true},"x-o2-ratelimit":{"module":"Service Accounts","operation":"delete"}}},"/api/{org_id}/settings":{"get":{"tags":["Organizations"],"summary":"Get organization settings","description":"Retrieves the current configuration settings for an organization, including scrape intervals, field mappings, ingestion preferences, and streaming options. Returns default settings if none have been configured previously for the organization.","operationId":"OrganizationSettingGet","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Settings","operation":"get"},"x-o2-mcp":{"description":"Get organization settings","category":"users"}},"post":{"tags":["Organizations"],"summary":"Update organization settings","description":"Creates or updates organization-specific settings such as scrape interval, trace field names, ingestion toggles, and streaming configurations. Allows administrators to customize organizational behavior and operational parameters to match specific requirements and use cases.","operationId":"OrganizationSettingCreate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Organization settings","content":{"application/json":{"schema":{"type":"object","properties":{"claim_parser_function":{"type":["string","null"]},"cross_links":{"type":["array","null"],"items":{"$ref":"#/components/schemas/CrossLink"}},"dark_mode_theme_color":{"type":["string","null"]},"enable_streaming_search":{"type":["boolean","null"]},"light_mode_theme_color":{"type":["string","null"]},"max_series_per_query":{"type":["integer","null"],"minimum":0},"min_auto_refresh_interval":{"type":["integer","null"],"format":"int32","minimum":0},"scrape_interval":{"type":["integer","null"],"format":"int32","description":"Ideally this should be the same as prometheus-scrape-interval (in\nseconds).","minimum":0},"span_id_field_name":{"type":["string","null"]},"streaming_aggregation_enabled":{"type":["boolean","null"]},"toggle_ingestion_logs":{"type":["boolean","null"]},"trace_id_field_name":{"type":["string","null"]},"usage_stream_enabled":{"type":["boolean","null"]}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Settings","operation":"create"},"x-o2-mcp":{"description":"Create/update org settings","category":"users"}}},"/api/{org_id}/settings/v2":{"get":{"tags":["Organizations"],"summary":"List all resolved system settings","description":"Lists all settings with multi-level resolution applied. Merges system, org, and user levels, returning the most specific value for each key.","operationId":"SystemSettingListResolved","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"user_id","in":"query","description":"User ID for user-level resolution","required":false,"schema":{"type":"string"}},{"name":"category","in":"query","description":"Filter by setting category","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Settings","operation":"list"},"x-o2-mcp":{"description":"List resolved system settings","category":"system"}},"post":{"tags":["Organizations"],"summary":"Set organization-level setting","description":"Creates or updates an organization-level setting. This setting applies to all users in the organization unless overridden at the user level.","operationId":"SystemSettingSetOrg","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Setting to create/update","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemSettingPayload"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemSetting"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Settings","operation":"create"},"x-o2-mcp":{"description":"Set org-level system setting","category":"system"}}},"/api/{org_id}/settings/v2/user/{user_id}":{"post":{"tags":["Organizations"],"summary":"Set user-level setting","description":"Creates or updates a user-level setting. This setting applies only to the specific user and overrides org-level and system-level settings.","operationId":"SystemSettingSetUser","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"user_id","in":"path","description":"User ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Setting to create/update","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemSettingPayload"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SystemSetting"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Settings","operation":"create"},"x-o2-mcp":{"description":"Set user-level system setting","category":"system"}}},"/api/{org_id}/settings/v2/user/{user_id}/{key}":{"delete":{"tags":["Organizations"],"summary":"Delete user-level setting","description":"Deletes a user-level setting. After deletion, queries for this key will fall back to org-level or system-level settings.","operationId":"SystemSettingDeleteUser","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"user_id","in":"path","description":"User ID","required":true,"schema":{"type":"string"}},{"name":"key","in":"path","description":"Setting key","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Settings","operation":"delete"},"x-o2-mcp":{"description":"Delete user system setting","category":"system","requires_confirmation":true}}},"/api/{org_id}/settings/v2/{key}":{"get":{"tags":["Organizations"],"summary":"Get resolved system setting","description":"Retrieves a setting value with multi-level resolution. Checks user-level first, then org-level, then system-level defaults. Returns the most specific setting found, or null if no setting exists at any level.","operationId":"SystemSettingGetResolved","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"key","in":"path","description":"Setting key","required":true,"schema":{"type":"string"}},{"name":"user_id","in":"query","description":"User ID for user-level resolution","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SystemSetting"}]}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Settings","operation":"get"},"x-o2-mcp":{"description":"Get resolved system setting","category":"system"}},"delete":{"tags":["Organizations"],"summary":"Delete organization-level setting","description":"Deletes an organization-level setting. After deletion, queries for this key will fall back to system-level defaults.","operationId":"SystemSettingDeleteOrg","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"key","in":"path","description":"Setting key","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete org system setting","category":"system","requires_confirmation":true},"x-o2-ratelimit":{"module":"Settings","operation":"delete"}}},"/api/{org_id}/short":{"post":{"tags":["Short Url"],"summary":"Create short URL","description":"Generates a shortened URL from a longer original URL. This is useful for creating more manageable links for dashboards, reports, or search queries that can be easily shared via email, chat, or documentation. The short URL remains valid and can be used to redirect back to the original destination.","operationId":"createShortUrl","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"The original URL to shorten","content":{"application/json":{"schema":{"type":"object","required":["original_url"],"properties":{"original_url":{"type":"string"}}},"example":{"original_url":"https://example.com/some/long/url"}}},"required":true},"responses":{"200":{"description":"Shortened URL","content":{"application/json":{"schema":{"type":"object","required":["short_url"],"properties":{"short_url":{"type":"string"}}},"example":{"short_url":"http://localhost:5080/short/ddbffcea3ad44292"}}}},"400":{"description":"Invalid request","content":{"application/json":{}}}},"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"ShortUrl","operation":"create"}}},"/api/{org_id}/streams":{"get":{"tags":["Streams"],"summary":"List organization streams","description":"Retrieves a paginated list of streams within the organization, with optional filtering by type and keyword. Supports sorting by various metrics","operationId":"StreamList","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. one of: logs, metrics, traces. Defaults to logs.","required":false,"schema":{"type":"string"}},{"name":"keyword","in":"query","description":"Keyword","required":false,"schema":{"type":"string"}},{"name":"offset","in":"query","description":"Offset","required":false,"schema":{"type":"integer","format":"int32","minimum":0}},{"name":"limit","in":"query","description":"Limit","required":false,"schema":{"type":"integer","format":"int32","minimum":0}},{"name":"sort","in":"query","description":"Sort","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","required":["list","total"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Stream"}},"total":{"type":"integer","minimum":0}}}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Streams","operation":"list"},"x-o2-mcp":{"description":"List all streams in the organization, you can filter by type and keyword.","category":"streams","summary_fields":["name","stream_type","stats.storage_size"],"pinned":true}}},"/api/{org_id}/streams/{stream_name}":{"post":{"tags":["Streams"],"summary":"Create new stream","description":"Creates a new stream with specified settings and schema definition. The stream will be used to store and organize data of the specified type","operationId":"StreamCreate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. one of: logs, metrics, traces. Defaults to logs.","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Stream create","content":{"application/json":{"schema":{"type":"object","required":["fields","settings"],"properties":{"fields":{"type":"array","items":{"$ref":"#/components/schemas/StreamField"}},"settings":{"$ref":"#/components/schemas/StreamSettings"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Streams","operation":"create"},"x-o2-mcp":{"description":"Create a new stream","category":"streams"}},"delete":{"tags":["Streams"],"summary":"Delete stream","description":"Permanently deletes a stream and all its associated data. Use delete_all parameter to remove related resources like alerts and dashboards","operationId":"StreamDelete","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. one of: logs, metrics, traces. Defaults to logs.","required":false,"schema":{"type":"string"}},{"name":"delete_all","in":"query","description":"Delete all related feature resources","required":true,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Delete a stream","category":"streams","requires_confirmation":true},"x-o2-ratelimit":{"module":"Streams","operation":"delete"}}},"/api/{org_id}/streams/{stream_name}/delete_fields":{"put":{"tags":["Streams"],"summary":"Delete stream fields","description":"Removes specified fields from the stream schema. This operation will affect how future data is indexed and queried for this stream","operationId":"StreamDeleteFields","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. one of: logs, metrics, traces. Defaults to logs.","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Stream delete fields","content":{"application/json":{"schema":{"type":"object","required":["fields"],"properties":{"fields":{"type":"array","items":{"type":"string"}}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Streams","operation":"delete"}}},"/api/{org_id}/streams/{stream_name}/patterns/extract":{"post":{"tags":["Patterns"],"summary":"Extract patterns from search results","description":"This endpoint runs a search query and extracts patterns from the results.\nIt internally uses the same search infrastructure as _search but returns\nonly the extracted patterns.\n\nPOST /api/{org_id}/streams/{stream_name}/patterns/extract","operationId":"ExtractPatterns","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Search query (same format as _search endpoint)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchRequest"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{}}}},"400":{"description":"Bad Request"},"403":{"description":"Forbidden - Enterprise feature only or Unauthorized Access"},"500":{"description":"Internal Server Error"}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search","operation":"get"},"x-o2-mcp":{"description":"Extract log patterns","category":"patterns"}}},"/api/{org_id}/streams/{stream_name}/schema":{"get":{"tags":["Streams"],"summary":"Get stream schema","description":"Retrieves the schema definition for a specific stream, including field types and metadata. Supports filtering by keyword and pagination","operationId":"StreamSchema","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. one of: logs, metrics, traces. Defaults to logs.","required":false,"schema":{"type":"string"}},{"name":"keyword","in":"query","description":"Keyword filter for field names (default: empty)","required":false,"schema":{"type":"string"}},{"name":"offset","in":"query","description":"Pagination offset (default: 0)","required":false,"schema":{"type":"integer","format":"int32","minimum":0}},{"name":"limit","in":"query","description":"Pagination limit (default: 0 = all)","required":false,"schema":{"type":"integer","format":"int32","minimum":0}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get stream schema","category":"streams","pinned":true},"x-o2-ratelimit":{"module":"Streams","operation":"get"}}},"/api/{org_id}/streams/{stream_name}/settings":{"put":{"tags":["Streams"],"summary":"Update stream settings","description":"Updates configuration settings for an existing stream, including retention policies, partitioning, and other stream-specific options","operationId":"UpdateStreamSettings","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. one of: logs, metrics, traces. Defaults to logs.","required":false,"schema":{"type":"string"}}],"requestBody":{"description":"Stream settings","content":{"application/json":{"schema":{"type":"object","properties":{"approx_partition":{"type":["boolean","null"]},"bloom_filter_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"cross_links":{"$ref":"#/components/schemas/UpdateSettingsWrapper_CrossLink"},"data_retention":{"type":["integer","null"],"format":"int64"},"defined_schema_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"distinct_value_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"enable_distinct_fields":{"type":["boolean","null"]},"enable_log_patterns_extraction":{"type":["boolean","null"]},"extended_retention_days":{"$ref":"#/components/schemas/UpdateSettingsWrapper_TimeRange"},"flatten_level":{"type":["integer","null"],"format":"int64"},"full_text_search_keys":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"index_all_values":{"type":["boolean","null"]},"index_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"index_original_data":{"type":["boolean","null"]},"max_query_range":{"type":["integer","null"],"format":"int64"},"partition_keys":{"$ref":"#/components/schemas/UpdateSettingsWrapper_StreamPartition"},"pattern_associations":{"$ref":"#/components/schemas/UpdateSettingsWrapper_PatternAssociation"},"storage_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/StorageType"}]},"store_original_data":{"type":["boolean","null"]}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update stream settings","category":"streams","requires_confirmation":true},"x-o2-ratelimit":{"module":"Streams","operation":"update"}}},"/api/{org_id}/summary":{"get":{"tags":["Organizations"],"summary":"Get organization summary","description":"Retrieves comprehensive summary statistics and information about an organization including data ingestion metrics, storage usage, stream counts, and other key performance indicators useful for monitoring organization health and usage.","operationId":"GetOrganizationSummary","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get organization summary","category":"organizations"},"x-o2-ratelimit":{"module":"Summary","operation":"get"}}},"/api/{org_id}/traces/service_graph/topology/current":{"get":{"tags":["Traces"],"summary":"Get current service graph topology","description":"Returns service graph topology from stream storage (last 60 minutes). Stream-only - NO in-memory metrics.","operationId":"GetCurrentServiceGraphTopology","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"query","description":"Optional stream name to filter service graph topology","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"403":{"description":"Forbidden - Enterprise feature","content":{"application/json":{"schema":{"type":"string"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Traces","operation":"service_graph_topology"}}},"/api/{org_id}/users":{"get":{"tags":["Users"],"summary":"List organization users","description":"Retrieves a list of all users within the specified organization, including their roles, status, and basic profile information. Optionally filter to list users across all organizations if the requesting user has sufficient permissions. Returns user metadata such as email addresses, assigned roles, last login times, and account status.","operationId":"UserList","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Users","operation":"list"},"x-o2-mcp":{"description":"List all users","category":"users","summary_fields":["email","role","first_name","last_name"]}},"post":{"tags":["Users"],"summary":"Create new user","description":"Creates a new user account within the organization with specified role and authentication credentials. The password must be at least 8 characters long and the email address must be valid. Users are automatically assigned to the organization with the specified role and can begin accessing resources immediately upon creation.","operationId":"UserSave","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"User data","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/UserRoleRequest"},{"type":"object","required":["email","password"],"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"is_external":{"type":"boolean","description":"Is the user created via ldap flow."},"last_name":{"type":"string"},"password":{"type":"string"},"token":{"type":["string","null"]}}}]}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Create a new user","category":"users"},"x-o2-ratelimit":{"module":"Users","operation":"create"}}},"/api/{org_id}/users/{email_id}":{"put":{"tags":["Users"],"summary":"Update user account","description":"Updates user account information including role assignments, password changes, or other profile details. Users can modify their own account settings, while administrators have broader permissions to update any user account. Password changes require the new password to be at least 8 characters long for security compliance.","operationId":"UserUpdate","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"email_id","in":"path","description":"User's email id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"User data","content":{"application/json":{"schema":{"allOf":[{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRoleRequest"}]},{"type":"object","properties":{"change_password":{"type":"boolean"},"first_name":{"type":["string","null"]},"last_name":{"type":["string","null"]},"new_password":{"type":["string","null"]},"old_password":{"type":["string","null"]},"token":{"type":["string","null"]}}}]}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Update user details","category":"users"},"x-o2-ratelimit":{"module":"Users","operation":"update"}},"post":{"tags":["Users"],"summary":"Add user to organization","description":"Adds an existing user account to the organization with the specified role assignment. The user must already exist in the system with valid authentication credentials. This operation grants the user access to organization resources and data according to their assigned role permissions.","operationId":"AddUserToOrg","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"email_id","in":"path","description":"User's email id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"User role","content":{"application/json":{"schema":{"type":"object","required":["role"],"properties":{"custom_role":{"type":["array","null"],"items":{"type":"string"}},"role":{"type":"string"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Add user to organization","category":"users"},"x-o2-ratelimit":{"module":"Users","operation":"create"}},"delete":{"tags":["Users"],"summary":"Remove user from organization","description":"Removes a user from the organization, immediately revoking their access to all organization resources, data, and services. The user account itself remains active and can be added back to organizations later. This action is permanent and cannot be undone without re-adding the user explicitly.","operationId":"RemoveUserFromOrg","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"email_id","in":"path","description":"User name","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"}}}},"404":{"description":"NotFound","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Users","operation":"delete"},"x-o2-mcp":{"description":"Remove user from organization","category":"users","requires_confirmation":true}}},"/api/{org_id}/v1/traces":{"post":{"tags":["Traces"],"summary":"Ingest trace data","description":"Accepts and processes distributed tracing data from applications and services. Supports both Protocol Buffers and JSON formats for OTLP (OpenTelemetry Protocol) trace ingestion. Use this endpoint to send trace spans, timing information, and service dependency data for observability and performance monitoring.","operationId":"PostTraces","parameters":[{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"ExportTraceServiceRequest","content":{"application/x-protobuf":{"schema":{"type":"string"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/{stream_name}/_around":{"get":{"tags":["Search"],"summary":"Search around specific log entry","description":"Searches for log entries around a specific key (timestamp or record identifier) within a stream. Returns logs before and after the specified key, useful for investigating context around specific events or errors.","operationId":"SearchAround","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"stream_name name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. Must be one of: logs, metrics, traces. Defaults to logs if not specified.","required":false,"schema":{"type":"string"}},{"name":"key","in":"query","description":"around key","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"size","in":"query","description":"around size","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"regions","in":"query","description":"regions, split by comma","required":false,"schema":{"type":"string"}},{"name":"timeout","in":"query","description":"timeout, seconds","required":false,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"hits":[{"_p":"F","_timestamp":1674213225158000,"kubernetes":{"container_hash":"dkr.ecr.us-west-2.amazonaws.com/openobserve@sha256:3dbbb0dc1eab2d5a3b3e4a75fd87d194e8095c92d7b2b62e7cdbd07020f54589","container_image":"dkr.ecr.us-west-2.amazonaws.com/openobserve:v0.0.3","container_name":"openobserve","docker_id":"eb0983bdb9ff9360d227e6a0b268fe3b24a0868c2c2d725a1516c11e88bf5789","host":"ip.us-east-2.compute.internal","namespace_name":"openobserve","pod_id":"35a0421f-9203-4d73-9663-9ff0ce26d409","pod_name":"openobserve-ingester-0"},"log":"[2023-01-20T11:13:45Z INFO  actix_web::middleware::logger] 10.2.80.192 \"POST /api/demo/_bulk HTTP/1.1\" 200 68","stream":"stderr"}],"total":10,"from":0,"size":10,"scan_size":28943}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-ratelimit":{"module":"Search","operation":"get"},"x-o2-mcp":{"description":"Search logs around a timestamp. Note: in summary mode, hits are capped at 100 and only hits/total/took/columns/scan_size/function_error are returned.","category":"search"}},"post":{"tags":["Search"],"summary":"Search around specific log record","description":"Advanced version of around search that accepts a full log record in the request body instead of just a key. Searches for log entries around the specified record, providing better context matching based on the complete record data.","operationId":"SearchAroundV2","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"stream_name name","required":true,"schema":{"type":"string"}},{"name":"size","in":"query","description":"around size","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"regions","in":"query","description":"regions, split by comma","required":false,"schema":{"type":"string"}},{"name":"timeout","in":"query","description":"timeout, seconds","required":false,"schema":{"type":"integer","format":"int64"}}],"requestBody":{"description":"around record data","content":{"application/json":{"schema":{"type":"string"},"example":{"_timestamp":1675182660872049,"container_image":"dkr.ecr.us-west-2.amazonaws.com/openobserve:v0.0.3","container_name":"openobserve","docker_id":"eb0983bdb9ff9360d227e6a0b268fe3b24a0868c2c2d725a1516c11e88bf5789","host":"ip.us-east-2.compute.internal","namespace_name":"openobserve","pod_id":"35a0421f-9203-4d73-9663-9ff0ce26d409","pod_name":"openobserve-ingester-0"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"hits":[{"_p":"F","_timestamp":1674213225158000,"kubernetes":{"container_hash":"dkr.ecr.us-west-2.amazonaws.com/openobserve@sha256:3dbbb0dc1eab2d5a3b3e4a75fd87d194e8095c92d7b2b62e7cdbd07020f54589","container_image":"dkr.ecr.us-west-2.amazonaws.com/openobserve:v0.0.3","container_name":"openobserve","docker_id":"eb0983bdb9ff9360d227e6a0b268fe3b24a0868c2c2d725a1516c11e88bf5789","host":"ip.us-east-2.compute.internal","namespace_name":"openobserve","pod_id":"35a0421f-9203-4d73-9663-9ff0ce26d409","pod_name":"openobserve-ingester-0"},"log":"[2023-01-20T11:13:45Z INFO  actix_web::middleware::logger] 10.2.80.192 \"POST /api/demo/_bulk HTTP/1.1\" 200 68","stream":"stderr"}],"total":10,"from":0,"size":10,"scan_size":28943}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false},"x-o2-ratelimit":{"module":"Search","operation":"get"}}},"/api/{org_id}/{stream_name}/_json":{"post":{"tags":["Logs"],"summary":"Ingest logs via JSON array","description":"Ingests log data using a JSON array format where multiple log records are submitted as an array in a single request. This is ideal for batch processing scenarios where applications collect multiple log entries before sending them together for improved efficiency.","operationId":"LogsIngestionJson","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Ingest data (json array)","content":{"application/json":{"schema":{"type":"string"},"example":[{"Year":1896,"City":"Athens","Sport":"Aquatics","Discipline":"Swimming","Athlete":"Alfred","Country":"HUN"},{"Year":1896,"City":"Athens","Sport":"Aquatics","Discipline":"Swimming","Athlete":"HERSCHMANN","Country":"CHN"}]}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"status":[{"name":"olympics","successful":3,"failed":0}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Ingest logs via JSON array","category":"logs"}}},"/api/{org_id}/{stream_name}/_multi":{"post":{"tags":["Logs"],"summary":"Ingest logs via multi-line JSON","description":"Ingests log data using multi-line JSON format where each line contains a separate JSON object representing a log record. This format is efficient for streaming applications and tools that generate logs in newline-delimited JSON format.","operationId":"LogsIngestionMulti","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Ingest data (multiple line json)","content":{"application/json":{"schema":{"type":"string"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"status":[{"name":"olympics","successful":3,"failed":0}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/api/{org_id}/{stream_name}/_values":{"get":{"tags":["Search"],"summary":"Get distinct field values","description":"Retrieves the top N distinct values for specified fields within a stream and time range. Supports filtering, keyword search, and frequency counting. Essential for building dynamic filters, dropdowns, and understanding data cardinality in dashboards and analytics.","operationId":"SearchValues","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"stream_name name","required":true,"schema":{"type":"string"}},{"name":"type","in":"query","description":"Stream type. Must be one of: logs, metrics, traces. Defaults to logs if not specified.","required":false,"schema":{"type":"string"}},{"name":"fields","in":"query","description":"fields, split by comma","required":true,"schema":{"type":"string"}},{"name":"filter","in":"query","description":"filter, eg: a=b","required":false,"schema":{"type":"string"}},{"name":"keyword","in":"query","description":"keyword, eg: abc","required":false,"schema":{"type":"string"}},{"name":"size","in":"query","description":"size","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"from","in":"query","description":"from","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"start_time","in":"query","description":"start time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"end_time","in":"query","description":"end time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"regions","in":"query","description":"regions, split by comma","required":false,"schema":{"type":"string"}},{"name":"timeout","in":"query","description":"timeout, seconds","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"no_count","in":"query","description":"no need count, true of false","required":false,"schema":{"type":"boolean"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"values":[{"field":"field1","values":["value1","value2"]}]}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"description":"Get distinct values for a field","category":"search"},"x-o2-ratelimit":{"module":"Search","operation":"get"}}},"/api/{org_id}/{stream_name}/traces/latest":{"get":{"tags":["Traces"],"summary":"Get recent trace data","description":"Retrieves the most recent trace data from a specific stream within a time range. Returns trace summaries including trace IDs, span counts, service names, and timing information. You can filter results and control pagination to analyze distributed system performance and identify bottlenecks or errors in your applications.","operationId":"GetLatestTraces","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"filter","in":"query","description":"filter, eg: a=b AND c=d","required":false,"schema":{"type":"string"}},{"name":"from","in":"query","description":"from","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"size","in":"query","description":"size","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"start_time","in":"query","description":"start time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"end_time","in":"query","description":"end time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"timeout","in":"query","description":"timeout, seconds","required":false,"schema":{"type":"integer","format":"int64"}},{"name":"sort_by","in":"query","description":"sort by field: start_time, duration (default: start_time)","required":false,"schema":{"type":"string"}},{"name":"sort_order","in":"query","description":"sort order: asc, desc (default: desc)","required":false,"schema":{"type":"string"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"hits":[{"trace_id":"12345678","spans":[1,2],"service_name":[{"job1":1,"job2":0}],"first_event":{"start_time":1234567890,"operation_name":"operation_name"}}]}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/{stream_name}/traces/session":{"get":{"tags":["Traces"],"summary":"Get recent session data","description":"Retrieves the most recent LLM session data from a specific trace stream within a time range. Sessions group multiple traces that share the same session ID. Returns session summaries including session IDs, trace counts, LLM usage statistics, cost, and timing information.","operationId":"GetLatestSessions","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"filter","in":"query","description":"filter, eg: a=b AND c=d","required":false,"schema":{"type":"string"}},{"name":"from","in":"query","description":"from","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"size","in":"query","description":"size","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"start_time","in":"query","description":"start time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"end_time","in":"query","description":"end time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"timeout","in":"query","description":"timeout, seconds","required":false,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"total":2,"from":0,"size":10,"hits":[{"session_id":"session-abc-123","start_time":1234567890,"end_time":1234567900,"duration":10,"trace_count":3,"llm_usage_tokens_input":100,"llm_usage_tokens_output":50,"llm_usage_tokens_total":150,"llm_usage_cost_total":0.005}]}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/{stream_name}/traces/user":{"get":{"tags":["Traces"],"summary":"Get recent user data","description":"Retrieves the most recent LLM user data from a specific trace stream within a time range. Users group multiple traces that share the same user ID. Returns user summaries including user IDs, event counts, LLM usage statistics, cost, and timing information.","operationId":"GetLatestUsers","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"filter","in":"query","description":"filter, eg: a=b AND c=d","required":false,"schema":{"type":"string"}},{"name":"from","in":"query","description":"from","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"size","in":"query","description":"size","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"start_time","in":"query","description":"start time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"end_time","in":"query","description":"end time","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"timeout","in":"query","description":"timeout, seconds","required":false,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"took":155,"total":2,"from":0,"size":10,"hits":[{"user_id":"user-12345","first_event":1234567890,"last_event":1234567900,"total_events":16,"llm_usage_tokens_total":885,"llm_usage_cost_total":105.3}]}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/api/{org_id}/{stream_name}/traces/{trace_id}/dag":{"get":{"tags":["Traces"],"summary":"Get trace DAG structure","description":"Retrieves the DAG (Directed Acyclic Graph) structure of all spans for a specific trace. Returns nodes (spans) and edges (parent-child relationships) that can be visualized as a trace execution graph. Each node contains span details like service name, operation, and status information.","operationId":"GetTraceDAG","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}},{"name":"stream_name","in":"path","description":"Stream name","required":true,"schema":{"type":"string"}},{"name":"trace_id","in":"path","description":"Trace ID","required":true,"schema":{"type":"string"}},{"name":"start_time","in":"query","description":"start time in microseconds","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"end_time","in":"query","description":"end time in microseconds","required":true,"schema":{"type":"integer","format":"int64"}},{"name":"timeout","in":"query","description":"timeout, seconds","required":false,"schema":{"type":"integer","format":"int64"}}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"trace_id":"12345678","nodes":[{"span_id":"span1","parent_span_id":null,"service_name":"frontend","operation_name":"GET /api","span_status":"OK"}],"edges":[{"from":"span1","to":"span2"}]}}}},"400":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}]}},"/healthz":{"get":{"tags":["Meta"],"summary":"System health check","description":"Performs a basic health check to verify that the OpenObserve service is running and responding to requests. Returns a simple status indicator that can be used by load balancers, monitoring systems, and orchestration platforms to determine service availability and readiness.","operationId":"HealthCheck","responses":{"200":{"description":"Status OK","content":{"application/json":{"schema":{"type":"object","required":["status"],"properties":{"status":{"type":"string"}}},"example":{"status":"ok"}}}}},"x-o2-mcp":{"enabled":false}}},"/rum/v1/{org_id}/logs":{"post":{"tags":["Rum"],"summary":"Ingest RUM log events","description":"Ingests Real User Monitoring (RUM) log events and client-side application logs in JSON array format. Captures browser console logs, application errors, debug information, and custom log messages generated by client-side JavaScript. Logs are enriched with browser and session context for comprehensive client-side debugging and monitoring.","operationId":"LogIngestionJson","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Ingest data (json array)","content":{"application/json":{"schema":{"type":"string"},"example":[{"Year":1896,"City":"Athens","Sport":"Aquatics","Discipline":"Swimming","Athlete":"Alfred","Country":"HUN"},{"Year":1896,"City":"Athens","Sport":"Aquatics","Discipline":"Swimming","Athlete":"HERSCHMANN","Country":"CHN"}]}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"status":[{"name":"olympics","successful":3,"failed":0}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/rum/v1/{org_id}/replay":{"post":{"tags":["Rum"],"summary":"Ingest session replay data","description":"Ingests Real User Monitoring (RUM) session replay data as compressed multipart form data. Captures user interactions, DOM snapshots, and browser events to enable complete session replay functionality. Data is compressed using zlib compression and includes session metadata such as timing, view information, and interaction sequences for comprehensive user experience analysis.","operationId":"ReplayIngestionJson","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Multipart form data containing compressed session replay segment and event metadata","content":{"multipart/form-data":{"schema":{"type":"object","description":"Multipart form data being ingested in the form of session-replay","required":["segment","event"],"properties":{"event":{"type":"string","format":"binary"},"segment":{"type":"string","format":"binary"}}}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"status":[{"name":"olympics","successful":3,"failed":0}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/rum/v1/{org_id}/rum":{"post":{"tags":["Rum"],"summary":"Ingest RUM data events","description":"Ingests Real User Monitoring (RUM) data events in JSON format. Collects client-side performance metrics, user interactions, application errors, and user experience data for comprehensive web application monitoring. Data is automatically enriched with metadata and stored for analysis and dashboard visualization.","operationId":"RumIngestionMulti","parameters":[{"name":"org_id","in":"path","description":"Organization name","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Ingest data (multiple line json)","content":{"application/json":{"schema":{"type":"string"}}},"required":true},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object"},"example":{"code":200,"status":[{"name":"olympics","successful":3,"failed":0}]}}}},"500":{"description":"Failure","content":{"application/json":{"schema":{"default":null}}}}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/short/{org_id}/short/{short_id}":{"get":{"tags":["Short Url"],"summary":"Resolve short URL","description":"Resolves a shortened URL back to its original destination. By default, this endpoint redirects the user to the original URL. When the 'type=ui' query parameter is provided, it returns the original URL as JSON instead of performing a redirect. This is useful for applications that need to inspect or validate URLs before navigation.","operationId":"resolveShortUrl","parameters":[{"name":"short_id","in":"path","description":"The short ID to retrieve the original URL","required":true,"schema":{"type":"string"},"example":"ddbffcea3ad44292"},{"name":"type","in":"query","description":"Response type - if 'ui', returns JSON object instead of redirect","required":false,"schema":{"type":"string"},"example":"ui"},{"name":"org_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"JSON response when type=ui","content":{"application/json":{"schema":{"type":"string"}}}},"302":{"description":"Redirect to original URL (if < 1024 chars) or /web/short_url/{short_id}","headers":{"Location":{"schema":{"type":"string"},"description":"The original URL or /web/short_url/{short_id} to which the client is redirected"}}},"404":{"description":"Short URL not found","content":{"text/plain":{}}}},"x-o2-ratelimit":{"module":"ShortUrl","operation":"get"},"x-o2-mcp":{"enabled":false}}},"/{org_id}/service_streams":{"get":{"tags":["Service Streams"],"operationId":"ListServiceStreams","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"List of discovered services"},"401":{"description":"Unauthorized"},"403":{"description":"Forbidden - Enterprise feature"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}},"/{org_id}/service_streams/_analytics":{"get":{"tags":["Service Streams"],"summary":"GET /api/{org_id}/service_streams/_analytics","description":"Get comprehensive dimension analytics including cardinality classification\n\nReturns:\n- Cardinality of each dimension\n- Cardinality class (VeryLow/Low/Medium/High/VeryHigh)\n- Recommended priority dimensions for correlation\n- Sample values for each dimension\n\nThis endpoint provides the data needed to understand which dimensions\nare stable (good for correlation) vs transient (good for filtering only)","operationId":"GetServiceStreamAnalytics","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Dimension analytics","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DimensionAnalyticsSummary"}}}},"401":{"description":"Unauthorized - Authentication required"},"403":{"description":"Forbidden - Enterprise feature"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}},"/{org_id}/service_streams/_correlate":{"post":{"tags":["Service Streams"],"summary":"POST /api/{org_id}/service_streams/_correlate","description":"Find related telemetry streams for a given log/trace/metric event\n\nRequest body:\n{\n  \"source_stream\": \"default\",\n  \"source_type\": \"logs\",\n  \"available_dimensions\": {\n    \"k8s-cluster\": \"prod\",\n    \"k8s-namespace\": \"app\",\n    \"k8s-deployment\": \"api\",\n    \"k8s-pod\": \"api-xyz\",\n    \"host\": \"node-123\"\n  }\n}\n\nResponse includes:\n- The matched service\n- Which dimensions were used for matching (minimal set)\n- Which dimensions are available for additional filtering\n- All related streams (logs/traces/metrics) with their dimension requirements","operationId":"CorrelateServiceStreams","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Correlation request parameters","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CorrelationRequest"}}},"required":true},"responses":{"200":{"description":"Correlation results","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CorrelationResponse"}}}},"400":{"description":"Bad request"},"401":{"description":"Unauthorized - Authentication required"},"403":{"description":"Forbidden - Enterprise feature"},"404":{"description":"No matching service found"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}],"x-o2-mcp":{"enabled":false}}},"/{org_id}/service_streams/config/identity":{"get":{"tags":["Service Streams"],"operationId":"GetServiceIdentityConfig","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Current identity config"},"401":{"description":"Unauthorized"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]},"put":{"tags":["Service Streams"],"operationId":"SaveServiceIdentityConfig","parameters":[{"name":"org_id","in":"path","description":"Organization ID","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"ServiceIdentityConfig JSON","content":{"application/json":{"schema":{}}},"required":true},"responses":{"200":{"description":"Config saved"},"400":{"description":"Invalid config"},"401":{"description":"Unauthorized"},"500":{"description":"Internal server error"}},"security":[{"Authorization":[]}]}}},"components":{"schemas":{"AggFunction":{"type":"string","enum":["avg","min","max","sum","count","median","p50","p75","p90","p95","p99"]},"Aggregation":{"type":"object","required":["function","having"],"properties":{"function":{"$ref":"#/components/schemas/AggFunction"},"group_by":{"type":["array","null"],"items":{"type":"string"}},"having":{"$ref":"#/components/schemas/Condition"}}},"AggregationFunc":{"type":"string","enum":["count","count-distinct","histogram","sum","min","max","avg","median","p50","p90","p95","p99"]},"Alert":{"type":"object","properties":{"context_attributes":{"type":["object","null"],"default":null,"additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"creates_incident":{"type":"boolean","description":"When true, this alert creates/joins incidents instead of sending direct notifications.\nNotification is sent only when a new incident is created or a new alert type joins\nan existing incident. Repeated firings are suppressed.\nWhen false (default), the alert sends notifications directly and does not correlate\nto any incident.","default":false},"deduplication":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DeduplicationConfig"}],"default":null},"description":{"type":"string","default":""},"destinations":{"type":"array","items":{"type":"string"},"default":[]},"enabled":{"type":"boolean","default":false},"id":{"type":["string","null"],"default":null},"is_real_time":{"type":"boolean","default":false},"last_edited_by":{"type":["string","null"],"default":null},"last_satisfied_at":{"type":["integer","null"],"format":"int64","description":"Will be removed in the future.","default":null},"last_triggered_at":{"type":["integer","null"],"format":"int64","description":"Will be removed in the future.","default":null},"name":{"type":"string","default":""},"org_id":{"type":"string","default":""},"owner":{"type":["string","null"],"default":null},"query_condition":{"oneOf":[{"$ref":"#/components/schemas/QueryCondition"}],"default":{"type":"custom","conditions":null,"sql":null,"promql":null,"promql_condition":null,"aggregation":null,"vrl_function":null,"search_event_type":null,"multi_time_range":null}},"row_template":{"type":"string","default":""},"row_template_type":{"oneOf":[{"$ref":"#/components/schemas/RowTemplateType"}],"default":"String"},"stream_name":{"type":"string","default":""},"stream_type":{"oneOf":[{"$ref":"#/components/schemas/StreamType"}],"default":"logs"},"template":{"type":["string","null"],"description":"Optional template name. When specified, this template is used for all\ndestinations instead of destination-level templates. This allows using\ndifferent templates for different alerts while reusing the same destinations.","default":null},"trigger_condition":{"oneOf":[{"$ref":"#/components/schemas/TriggerCondition"}],"default":{"period":0,"operator":"=","threshold":0,"frequency":0,"cron":"","frequency_type":"minutes","silence":0,"tolerance_in_secs":null,"align_time":false}},"tz_offset":{"type":"integer","format":"int32","description":"Timezone offset in minutes.\nThe negative secs means the Western Hemisphere","default":0},"updated_at":{"type":"string","format":"date-time","default":null}}},"AlertEdge":{"type":"object","description":"Edge in the alert flow graph","required":["from_node_index","to_node_index","edge_type"],"properties":{"edge_type":{"$ref":"#/components/schemas/EdgeType","description":"Type of relationship"},"from_node_index":{"type":"integer","description":"Source node index","minimum":0},"to_node_index":{"type":"integer","description":"Target node index","minimum":0}}},"AlertHistoryEntry":{"type":"object","required":["timestamp","alert_name","org","status","is_realtime","is_silenced","start_time","end_time","retries"],"properties":{"alert_name":{"type":"string"},"anomaly_count":{"type":["integer","null"],"format":"int32","description":"Number of anomalies found in this evaluation run (anomaly detection only)."},"dedup_count":{"type":["integer","null"],"format":"int32"},"dedup_enabled":{"type":["boolean","null"]},"dedup_suppressed":{"type":["boolean","null"]},"delay_in_secs":{"type":["integer","null"],"format":"int64"},"end_time":{"type":"integer","format":"int64"},"error":{"type":["string","null"]},"evaluation_took_in_secs":{"type":["number","null"],"format":"double"},"group_size":{"type":["integer","null"],"format":"int32"},"grouped":{"type":["boolean","null"]},"is_partial":{"type":["boolean","null"]},"is_realtime":{"type":"boolean"},"is_silenced":{"type":"boolean"},"org":{"type":"string"},"query_took":{"type":["integer","null"],"format":"int64"},"retries":{"type":"integer","format":"int32"},"source_node":{"type":["string","null"]},"start_time":{"type":"integer","format":"int64"},"status":{"type":"string"},"success_response":{"type":["string","null"]},"timestamp":{"type":"integer","format":"int64"}}},"AlertNode":{"type":"object","description":"Node in the alert flow graph","required":["alert_id","alert_name","service_name","alert_count","first_fired_at","last_fired_at"],"properties":{"alert_count":{"type":"integer","format":"int32","description":"Number of times this alert fired","minimum":0},"alert_id":{"type":"string","description":"Unique alert identifier (from alert definition)"},"alert_name":{"type":"string","description":"Human-readable alert name for display"},"first_fired_at":{"type":"integer","format":"int64","description":"Timestamp of first occurrence (microseconds)"},"last_fired_at":{"type":"integer","format":"int64","description":"Timestamp of last occurrence (microseconds)"},"service_name":{"type":"string","description":"Service name (may be \"unknown\")"}}},"AlertSummary":{"type":"object","required":["num_realtime","num_scheduled","trigger_status"],"properties":{"num_realtime":{"type":"integer","format":"int64"},"num_scheduled":{"type":"integer","format":"int64"},"trigger_status":{"$ref":"#/components/schemas/TriggerStatus"}}},"AlertTypeFilter":{"type":"string","description":"Filters the alert list by alert type (scheduled, realtime, anomaly detection, or all).","enum":["all","scheduled","realtime","anomaly_detection"]},"AnomalyAlertFields":{"type":"object","description":"Anomaly-detection-specific fields for `CreateAlertRequestBody`.","required":["query_mode","detection_function","histogram_interval","schedule_interval","detection_window_seconds"],"properties":{"alert_enabled":{"type":["boolean","null"]},"custom_sql":{"type":["string","null"]},"detection_function":{"type":"string","description":"Aggregation function, e.g. \"count(*)\" or \"avg(cpu_usage)\""},"detection_function_field":{"type":["string","null"],"description":"Field to aggregate (required for avg/sum/min/max/pXX, ignored for count).\nCombined with `detection_function` into \"avg(field)\" before saving."},"detection_window_seconds":{"type":"integer","format":"int64","description":"Look-back window per detection run, in seconds"},"filters":{},"histogram_interval":{"type":"string","description":"SQL histogram bucket size, e.g. \"5m\", \"1h\""},"percentile":{"type":["number","null"],"format":"double","description":"Percentile threshold (50.0–99.9). Default: 97.0\nAlso accepts the name `threshold` (integer, e.g. 97) for API convenience."},"query_mode":{"type":"string","description":"\"filters\" or \"custom_sql\""},"rcf_num_trees":{"type":["integer","null"],"format":"int32"},"rcf_shingle_size":{"type":["integer","null"],"format":"int32"},"rcf_tree_size":{"type":["integer","null"],"format":"int32"},"retrain_interval_days":{"type":["integer","null"],"format":"int32","description":"0 = never retrain automatically; otherwise days between retrains"},"schedule_interval":{"type":"string","description":"How often the detection job fires, e.g. \"1h\", \"30m\""},"training_window_days":{"type":["integer","null"],"format":"int32"}}},"AssumeServiceAccountRequest":{"type":"object","description":"Request to assume a service account in a target organization\n\nThis allows meta service accounts to obtain temporary session tokens\nfor accessing a target organization as a specific service account.","required":["org_id"],"properties":{"duration_seconds":{"type":["integer","null"],"format":"int64","description":"Optional duration in seconds (default: 3600, max: 86400)","minimum":0},"org_id":{"type":"string","description":"Target organization ID"},"service_account":{"type":["string","null"],"description":"Service account email to assume (optional, defaults to caller's user_id)"}}},"AssumeServiceAccountResponse":{"type":"object","description":"Response from assume service account operation\n\nContains the session credentials needed to access the target organization.","required":["session_id","org_id","role_name","expires_at","expires_in"],"properties":{"expires_at":{"type":"string","description":"Expiration timestamp (ISO 8601)"},"expires_in":{"type":"integer","format":"int64","description":"Duration in seconds until expiration","minimum":0},"org_id":{"type":"string","description":"Target organization ID"},"role_name":{"type":"string","description":"Assumed service account role"},"session_id":{"type":"string","description":"Session ID to use for authentication"}}},"AxisArg":{"type":"object","properties":{"type":{"type":["string","null"]},"value":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisArgValueWrapper"}]}}},"AxisArgValue":{"type":"object","properties":{"field":{"type":["string","null"]},"streamAlias":{"type":["string","null"]}}},"AxisArgValueWrapper":{"oneOf":[{"$ref":"#/components/schemas/AxisArgValue"},{"type":"string"},{"type":"number","format":"double"}]},"AxisItem":{"type":"object","required":["label","alias"],"properties":{"alias":{"type":"string"},"args":{"type":["array","null"],"items":{"$ref":"#/components/schemas/AxisArg"}},"color":{"type":["string","null"]},"column":{"type":["string","null"]},"functionName":{"type":["string","null"]},"havingConditions":{"type":["array","null"],"items":{"$ref":"#/components/schemas/HavingConditions"}},"isDerived":{"type":["boolean","null"]},"label":{"type":"string"},"rawQuery":{"type":["string","null"]},"showFieldAsJson":{"type":["boolean","null"]},"sortBy":{"type":["string","null"]},"treatAsNonTimestamp":{"type":["boolean","null"]},"type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisType"}]}}},"AxisType":{"type":"string","enum":["build","raw","custom"]},"BackfillJobStatus":{"type":"object","required":["job_id","pipeline_id","start_time","end_time","current_position","progress_percent","status","enabled"],"properties":{"chunk_period_minutes":{"type":["integer","null"],"format":"int64"},"chunks_completed":{"type":["integer","null"],"format":"int64","minimum":0},"chunks_total":{"type":["integer","null"],"format":"int64","minimum":0},"created_at":{"type":["integer","null"],"format":"int64"},"current_position":{"type":"integer","format":"int64"},"delay_between_chunks_secs":{"type":["integer","null"],"format":"int64"},"delete_before_backfill":{"type":["boolean","null"]},"deletion_job_ids":{"type":["array","null"],"items":{"type":"string"}},"deletion_status":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DeletionStatus"}]},"enabled":{"type":"boolean"},"end_time":{"type":"integer","format":"int64"},"error":{"type":["string","null"]},"job_id":{"type":"string"},"last_triggered_at":{"type":["integer","null"],"format":"int64"},"pipeline_id":{"type":"string"},"pipeline_name":{"type":["string","null"]},"progress_percent":{"type":"integer","format":"int32","minimum":0},"start_time":{"type":"integer","format":"int64"},"status":{"type":"string"}}},"BackfillRequest":{"type":"object","required":["start_time","end_time"],"properties":{"chunk_period_minutes":{"type":["integer","null"],"format":"int64"},"delay_between_chunks_secs":{"type":["integer","null"],"format":"int64"},"delete_before_backfill":{"type":"boolean"},"end_time":{"type":"integer","format":"int64","description":"End time in microseconds"},"start_time":{"type":"integer","format":"int64","description":"Start time in microseconds"}}},"BackfillResponse":{"type":"object","required":["job_id","message"],"properties":{"job_id":{"type":"string"},"message":{"type":"string"}}},"Background":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"value":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/BackgroundValue"}]}}},"BackgroundValue":{"type":"object","required":["color"],"properties":{"color":{"type":"string"}}},"BaseMap":{"type":"object","properties":{"type":{"type":["string","null"],"default":null}}},"BulkDeleteRequest":{"type":"object","required":["ids"],"properties":{"ids":{"type":"array","items":{"type":"string"}}}},"BulkDeleteResponse":{"type":"object","required":["successful","unsuccessful"],"properties":{"err":{"type":["string","null"]},"successful":{"type":"array","items":{"type":"string"}},"unsuccessful":{"type":"array","items":{"type":"string"}}}},"BulkResponse":{"type":"object","required":["took","errors","items"],"properties":{"errors":{"type":"boolean"},"items":{"type":"array","items":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/BulkResponseItem"},"propertyNames":{"type":"string"}}},"took":{"type":"integer","minimum":0}}},"BulkResponseError":{"type":"object","required":["type","reason","index_uuid","shard","index"],"properties":{"index":{"type":"string"},"index_uuid":{"type":"string"},"reason":{"type":"string"},"shard":{"type":"string"},"type":{"type":"string"}}},"BulkResponseItem":{"type":"object","required":["_index","_id","status"],"properties":{"_id":{"type":"string"},"_index":{"type":"string"},"_primary_term":{"type":["integer","null"],"format":"int64"},"_seq_no":{"type":["integer","null"],"format":"int64"},"_shards":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ShardResponse"}]},"_version":{"type":["integer","null"],"format":"int64"},"error":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/BulkResponseError"}]},"originalRecord":{"type":"object"},"result":{"type":["string","null"]},"status":{"type":"integer","format":"int64"}}},"CancelQueryResponse":{"type":"object","required":["trace_id","is_success"],"properties":{"is_success":{"type":"boolean"},"trace_id":{"type":"string"}}},"CardinalityClass":{"type":"string","description":"Cardinality classification for dimensions\n\nUsed to determine which dimensions are stable (good for correlation)\nvs transient (should be filtered out or used only for additional filtering)","enum":["VeryLow","Low","Medium","High","VeryHigh"]},"ColorBySeries":{"type":"object","properties":{"color":{"type":["string","null"],"default":null},"type":{"type":["string","null"],"default":null},"value":{"type":["string","null"],"default":null}}},"ColorCfg":{"type":"object","properties":{"colorBySeries":{"type":["array","null"],"items":{"$ref":"#/components/schemas/ColorBySeries"},"default":null},"fixedColor":{"type":["array","null"],"items":{"type":"string"},"default":null},"mode":{"type":["string","null"],"default":null},"seriesBy":{"type":["string","null"],"default":null}}},"CompareHistoricData":{"type":"object","required":["offSet"],"properties":{"offSet":{"type":"string"}}},"Condition":{"type":"object","required":["column","operator","value"],"properties":{"column":{"type":"string"},"ignore_case":{"type":"boolean"},"operator":{"$ref":"#/components/schemas/Operator"},"value":{"type":"object"}}},"Config":{"oneOf":[{"type":"object","required":["type"],"properties":{"type":{"type":"string","enum":["unit"]},"value":{}}},{"type":"object","required":["type"],"properties":{"autoColor":{"type":"boolean"},"type":{"type":"string","enum":["unique_value_color"]}}}]},"CorrelationReason":{"type":"string","description":"How an alert was correlated to an incident","enum":["service_discovery","primary_match","secondary_match","alert_id"]},"CorrelationRequest":{"type":"object","required":["source_stream","source_type","available_dimensions"],"properties":{"available_dimensions":{"type":"object","description":"Available dimensions from the source event","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"source_stream":{"type":"string","description":"Source stream name"},"source_type":{"type":"string","description":"Source stream type (logs/traces/metrics)"}}},"CorrelationResponse":{"type":"object","description":"Response from the correlate API","required":["service_name","matched_dimensions","additional_dimensions","related_streams"],"properties":{"additional_dimensions":{"type":"object","description":"Additional dimensions available for filtering","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"all_streams":{"type":"array","items":{"$ref":"#/components/schemas/StreamInfo"},"description":"Flattened list of all streams with explicit stream_type\n\nThis field provides a flat list of all streams where each stream has its\nstream_type explicitly set. This is useful for UIs that:\n1. Display all streams in a single list/table\n2. Need to query streams without maintaining the nested structure\n3. Pass streams between components (type info is preserved)"},"matched_dimensions":{"type":"object","description":"Dimensions that were used for matching (minimal set)","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"matched_set_id":{"type":["string","null"],"description":"The identity set that was selected for this correlation (by best-coverage resolution).\n`None` if the feature is not enabled or the set was not determined."},"related_streams":{"$ref":"#/components/schemas/RelatedStreams","description":"Related streams grouped by type (for backward compatibility)"},"service_name":{"type":"string","description":"Matched service name"}}},"CreateAlertRequestBody":{"allOf":[{"oneOf":[{"type":"object","description":"Alert configuration for monitoring streams and triggering notifications.\n\nAn alert watches a stream (logs, metrics, or traces) using SQL or PromQL queries,\nand sends notifications to configured destinations when trigger conditions are met.","properties":{"context_attributes":{"type":["object","null"],"description":"Optional key-value attributes to include in alert notifications.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"creates_incident":{"type":"boolean","description":"When true, this alert routes notifications through the incident system\ninstead of sending direct alert notifications."},"deduplication":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DeduplicationConfig","description":"Optional deduplication configuration to prevent alert spam."}]},"description":{"type":"string","description":"Human-readable description of what this alert monitors.","example":"Fires when error count exceeds threshold in the specified time window"},"destinations":{"type":"array","items":{"type":"string"},"description":"List of destination names to notify when alert fires.\nDestinations must be pre-configured in the system.\nAccepts either `destinations` or `alert_destinations` as the JSON field name.","example":["slack-alerts","pagerduty"]},"enabled":{"type":"boolean","description":"Whether the alert is active. Disabled alerts are not evaluated."},"id":{"type":["string","null"],"description":"Unique identifier for the alert. Auto-generated on creation.","readOnly":true},"is_real_time":{"type":"boolean","description":"If true, alert evaluates in real-time as data arrives.\nIf false, alert runs on a schedule defined by trigger_condition.frequency."},"last_edited_by":{"type":["string","null"],"description":"Username who last edited the alert.","readOnly":true},"last_satisfied_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert condition was last satisfied.","readOnly":true},"last_triggered_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert was last triggered.","readOnly":true},"name":{"type":"string","description":"Human-readable name for the alert. Must be unique within the organization.","example":"High Error Rate Alert"},"org_id":{"type":"string","description":"Organization ID. Usually set automatically from the request context."},"owner":{"type":["string","null"],"description":"Username of the alert owner."},"query_condition":{"$ref":"#/components/schemas/QueryCondition","description":"Query configuration: SQL query or PromQL expression to evaluate."},"row_template":{"type":"string","description":"Template for formatting individual rows in the alert message."},"row_template_type":{"$ref":"#/components/schemas/RowTemplateType","description":"Format type for the row template."},"stream_name":{"type":"string","description":"Name of the stream to monitor.","example":"default"},"stream_type":{"$ref":"#/components/schemas/StreamType","description":"Type of stream to monitor: logs, metrics, or traces."},"template":{"type":["string","null"],"description":"Optional template name. When specified, this template is used for all\ndestinations instead of destination-level templates. This allows using\ndifferent templates for different alerts while reusing the same destinations."},"trigger_condition":{"$ref":"#/components/schemas/TriggerCondition","description":"Trigger configuration: when and how often to evaluate, thresholds."},"tz_offset":{"type":"integer","format":"int32","description":"Timezone offset in minutes. Negative values for western hemisphere."},"updated_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of last modification.","readOnly":true}}}],"description":"The alert configuration. All fields from Alert are flattened into this request body."},{"type":"object","properties":{"alert_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AlertTypeFilter","description":"Discriminates the alert type. Defaults to scheduled alert when absent.\nSet to `\"anomaly_detection\"` to create an anomaly detection config instead."}]},"anomaly_config":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AnomalyAlertFields","description":"Anomaly-detection-specific fields (nested object)."}]},"folder_id":{"type":["string","null"],"description":"Optional folder ID indicating the folder in which to create the alert.\nIf omitted the alert will be created in the default folder.","example":"default"}}}],"description":"HTTP request body for `CreateAlert` endpoint.\n\nCreates a new alert with the specified configuration. The alert monitors\na stream (logs, metrics, or traces) and triggers notifications when conditions are met.\n\n## Example\n\n```json\n{\n    \"name\": \"High Error Rate Alert\",\n    \"stream_type\": \"logs\",\n    \"stream_name\": \"default\",\n    \"is_real_time\": false,\n    \"query_condition\": {\n        \"type\": \"sql\",\n        \"sql\": \"SELECT count(*) as count FROM \\\"default\\\" WHERE level = 'error'\"\n    },\n    \"trigger_condition\": {\n        \"period\": 15,\n        \"operator\": \">=\",\n        \"threshold\": 100,\n        \"frequency\": 5,\n        \"frequency_type\": \"minutes\",\n        \"silence\": 60\n    },\n    \"destinations\": [\"slack-alerts\"],\n    \"enabled\": true,\n    \"description\": \"Alert when error count exceeds 100 in 15 minutes\"\n}\n```"},"CreateFolderRequestBody":{"type":"object","description":"HTTP request body for `CreateFolder` endpoint.","required":["name","description"],"properties":{"description":{"type":"string"},"name":{"type":"string"}}},"CreateFolderResponseBody":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `CreateFolder` endpoint."},"CreateViewRequest":{"type":"object","required":["data","view_name"],"properties":{"data":{"description":"Base64 encoded string, containing all the data for a given view.\nThis data is expected to be versioned so that the frontend can\ndeserialize as required."},"view_name":{"type":"string","description":"User-readable name of the view, doesn't need to be unique."}}},"CreateViewResponse":{"type":"object","required":["org_id","view_id","view_name"],"properties":{"org_id":{"type":"string"},"view_id":{"type":"string"},"view_name":{"type":"string"}}},"CrossLink":{"type":"object","description":"A cross-link entry for drill-down/navigation from log/trace records","required":["name","url"],"properties":{"fields":{"type":"array","items":{"$ref":"#/components/schemas/CrossLinkField"},"description":"Show link only when at least one field matches the record.\nIf empty, the link is always shown."},"name":{"type":"string","description":"Display name for the link"},"url":{"type":"string","description":"URL template with {field_name} placeholders"}}},"CrossLinkField":{"type":"object","required":["name"],"properties":{"alias":{"type":["string","null"],"description":"Populated by result_schema: the alias used in the query for this field."},"name":{"type":"string"}}},"CustomFieldsOption":{"type":"object","properties":{"label":{"type":"string","default":""},"selected":{"type":["boolean","null"],"default":null},"value":{"type":"string","default":""}}},"Dashboard":{"type":"object","required":["title","description"],"properties":{"created":{"type":"string","format":"date-time","default":"1970-01-01T00:00:00Z"},"dashboardId":{"type":"string","default":""},"defaultDatetimeDuration":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DateTimeOptions"}],"default":null},"description":{"type":"string","default":""},"owner":{"type":"string","default":""},"role":{"type":"string","default":""},"tabs":{"type":"array","items":{"$ref":"#/components/schemas/Tab"},"default":[]},"title":{"type":"string","default":""},"variables":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Variables"}],"default":null},"version":{"type":"integer","format":"int32","default":0}}},"DashboardRequestBody":{"oneOf":[{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"},{"$ref":"#/components/schemas/Dashboard"}],"description":"HTTP request body for the `CreateDashboard`/`UpdateDashboard` endpoints."},"DashboardResponseBody":{"$ref":"#/components/schemas/Dashboard","description":"HTTP response body for `CreateDashboard`/`UpdateDashboard` endpoints."},"DateTimeOptions":{"type":"object","properties":{"endTime":{"type":["integer","null"],"format":"int64","default":null},"relativeTimePeriod":{"type":["string","null"],"default":null},"startTime":{"type":["integer","null"],"format":"int64","default":null},"type":{"type":"string","default":""}}},"DedupSummaryResponse":{"type":"object","required":["total_alerts","alerts_with_dedup","suppressions_total","passed_total","suppression_rate","pending_batches","timestamp"],"properties":{"alerts_with_dedup":{"type":"integer","description":"Number of alerts with deduplication enabled","minimum":0},"passed_total":{"type":"integer","format":"int64","description":"Total alerts that passed dedup in time period"},"pending_batches":{"type":"integer","format":"int64","description":"Current pending batches (grouping)"},"suppression_rate":{"type":"number","format":"double","description":"Suppression rate (0.0 to 1.0)"},"suppressions_total":{"type":"integer","format":"int64","description":"Total alerts suppressed in time period"},"timestamp":{"type":"integer","format":"int64","description":"Timestamp when data was collected"},"total_alerts":{"type":"integer","description":"Total number of alerts in organization","minimum":0}}},"DeduplicationConfig":{"type":"object","description":"Per-alert deduplication configuration (from main branch)\n\nThis is stored on each Alert and specifies which fields to use for fingerprinting.\nThis matches the structure from the main branch exactly.\nConfiguration for alert deduplication","properties":{"enabled":{"type":"boolean","description":"Enable/disable deduplication","default":false},"fingerprint_fields":{"type":"array","items":{"type":"string"},"description":"Fields from query results to use for fingerprinting\nIf empty, auto-detect based on query type:\n- Custom: Fields from query conditions\n- SQL: GROUP BY columns\n- PromQL: All label dimensions","default":[]},"grouping":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/GroupingConfig","description":"Optional alert grouping configuration"}],"default":null},"time_window_minutes":{"type":["integer","null"],"format":"int32","description":"Time window in minutes for deduplication\nIf None, defaults to 2x alert frequency","default":null}}},"DeleteViewResponse":{"type":"object","required":["org_id","view_id"],"properties":{"org_id":{"type":"string"},"view_id":{"type":"string"}}},"DeletionStatus":{"type":"string","enum":["not_required","pending","in_progress","completed"]},"DerivedStream":{"type":"object","properties":{"delay":{"type":["integer","null"],"format":"int32","default":null},"org_id":{"type":"string","default":""},"query_condition":{"oneOf":[{"$ref":"#/components/schemas/QueryCondition"}],"default":{"type":"custom","conditions":null,"sql":null,"promql":null,"promql_condition":null,"aggregation":null,"vrl_function":null,"search_event_type":null,"multi_time_range":null}},"start_at":{"type":["integer","null"],"format":"int64","description":"The datetime from when the pipeline should check for ingested data","default":null},"stream_type":{"oneOf":[{"$ref":"#/components/schemas/StreamType"}],"default":"logs"},"trigger_condition":{"oneOf":[{"$ref":"#/components/schemas/TriggerCondition"}],"default":{"period":0,"operator":"=","threshold":0,"frequency":0,"cron":"","frequency_type":"minutes","silence":0,"tolerance_in_secs":null,"align_time":false}},"tz_offset":{"type":"integer","format":"int32","description":"Timezone offset in minutes.\nThe negative secs means the Western Hemisphere","default":0}}},"Destination":{"type":"object","description":"Alert destination configuration for sending notifications when alerts trigger.\n\nIMPORTANT: The `template` field is REQUIRED to create an alert destination.\nWithout a template, the destination becomes a pipeline destination and cannot be used with\nalerts.\n\n# Example - Creating an HTTP alert destination\n```json\n{\n  \"name\": \"my_alert_webhook\",\n  \"url\": \"https://example.com/webhook\",\n  \"method\": \"post\",\n  \"type\": \"http\",\n  \"template\": \"Default\",\n  \"skip_tls_verify\": false\n}\n```\n\n# Example - Creating an Email alert destination\n```json\n{\n  \"name\": \"my_email_dest\",\n  \"type\": \"email\",\n  \"emails\": [\"alerts@example.com\", \"team@example.com\"],\n  \"template\": \"Default\"\n}\n```","properties":{"action_id":{"type":["string","null"],"description":"Action ID for enterprise Action destinations. Required when `type` is `action`."},"aws_region":{"type":["string","null"],"description":"AWS region for SNS destinations. Required when `type` is `sns`."},"destination_type_name":{"type":["string","null"],"description":"Specific destination type identifier (e.g., \"openobserve\", \"splunk\", \"elasticsearch\")."},"emails":{"type":"array","items":{"type":"string"},"description":"Email recipients for Email destinations. Required when `type` is `email`."},"headers":{"type":["object","null"],"description":"Optional HTTP headers to include with webhook requests.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"metadata":{"type":"object","description":"Optional key-value metadata for the destination.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"method":{"$ref":"#/components/schemas/HTTPType","description":"HTTP method for HTTP destinations. Typically \"post\" for webhooks."},"name":{"type":"string","description":"Unique name for this destination. Must be unique within the organization.","example":"my_alert_webhook"},"output_format":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/HTTPOutputFormat","description":"Output format for HTTP destinations (json or text). Default is json."}]},"skip_tls_verify":{"type":"boolean","description":"Whether to skip TLS certificate verification for HTTP destinations."},"sns_topic_arn":{"type":["string","null"],"description":"SNS topic ARN for SNS destinations. Required when `type` is `sns`."},"template":{"type":["string","null"],"description":"REQUIRED for alert destinations. Name of the template to use for formatting alert messages.\nUse \"Default\" for the built-in default template. Without a template, the destination\nbecomes a pipeline destination and cannot be used with alerts.","example":"Default"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Destination type: `http` (webhook), `email`, or `sns`. Default is `http`."},"url":{"type":"string","description":"Webhook URL for HTTP destinations. Required when `type` is `http`.","example":"https://example.com/webhook"}}},"DestinationType":{"type":"string","enum":["http","email","sns","action"]},"DimensionAnalytics":{"type":"object","description":"Dimension analytics tracking","required":["dimension_name","cardinality","cardinality_class","service_count","first_seen","last_updated"],"properties":{"cardinality":{"type":"integer","description":"Current cardinality (number of unique values seen)","minimum":0},"cardinality_class":{"$ref":"#/components/schemas/CardinalityClass","description":"Cardinality class"},"dimension_name":{"type":"string","description":"Dimension name (e.g., \"k8s-cluster\", \"environment\", \"service\")"},"first_seen":{"type":"integer","format":"int64","description":"When this dimension was first seen"},"last_updated":{"type":"integer","format":"int64","description":"When this dimension was last updated"},"sample_values":{"type":"object","description":"Sample values mapped by stream type, then stream name (limited to 10 for inspection)","additionalProperties":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"propertyNames":{"type":"string"}},"propertyNames":{"type":"string"}},"service_count":{"type":"integer","description":"Number of services that have this dimension","minimum":0},"value_children":{"type":"object","description":"For each unique value of this dimension, the co-occurring values of other dimensions.\nExample: { \"common-dev\": { \"k8s-namespace\": [\"introspection\", \"ziox\", \"dev\"] } }","additionalProperties":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"propertyNames":{"type":"string"}},"propertyNames":{"type":"string"}},"value_counts":{"type":"object","description":"Number of services that carry each specific value of this dimension.\nExample: { \"staging\": 42, \"prod-us-east\": 18, \"prod-us-west\": 11 }\nUsed for per-value coverage: value_counts[v] / service_count = fraction of\nenv services in that specific group value.","additionalProperties":{"type":"integer","minimum":0},"propertyNames":{"type":"string"}}}},"DimensionAnalyticsSummary":{"type":"object","description":"Dimension analytics summary for an organization","required":["org_id","total_dimensions","by_cardinality","recommended_priority_dimensions","dimensions","generated_at"],"properties":{"available_groups":{"type":"array","items":{"$ref":"#/components/schemas/FoundGroup"},"description":"All alias groups found in the org's stream schemas"},"by_cardinality":{"type":"object","description":"Dimensions by cardinality class","additionalProperties":{"type":"array","items":{"type":"string"}},"propertyNames":{"type":"string"}},"dimensions":{"type":"array","items":{"$ref":"#/components/schemas/DimensionAnalytics"},"description":"All dimension analytics (dimensions with ingested data)"},"generated_at":{"type":"integer","format":"int64","description":"When this summary was generated"},"org_id":{"type":"string","description":"Organization ID"},"recommended_priority_dimensions":{"type":"array","items":{"type":"string"},"description":"Recommended priority dimensions for correlation\n(sorted by cardinality, lowest first)"},"service_field_sources":{"type":"array","items":{"$ref":"#/components/schemas/ServiceFieldSource"},"description":"Field name sources for the \"service\" semantic group, ranked by hit count.\nShows which actual field names in each stream type contributed a service name."},"total_dimensions":{"type":"integer","description":"Total number of dimensions tracked","minimum":0}}},"DistinctField":{"type":"object","description":"WARNING: this implements Eq trait based only on the name,\nso the timestamp will not be considered when comparing two entries","required":["name","added_ts"],"properties":{"added_ts":{"type":"integer","format":"int64"},"name":{"type":"string"}}},"DrillDown":{"type":"object","properties":{"data":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DrillDownData"}],"default":null},"findBy":{"type":["string","null"],"default":null},"name":{"type":["string","null"],"default":null},"targetBlank":{"type":["boolean","null"],"default":null},"type":{"type":["string","null"],"default":null}}},"DrillDownData":{"type":"object","properties":{"dashboard":{"type":["string","null"],"default":null},"folder":{"type":["string","null"],"default":null},"logsMode":{"type":["string","null"],"default":null},"logsQuery":{"type":["string","null"],"default":null},"passAllVariables":{"type":["boolean","null"],"default":null},"tab":{"type":["string","null"],"default":null},"url":{"type":["string","null"],"default":null},"variables":{"type":["array","null"],"items":{"$ref":"#/components/schemas/DrillDownVariables"},"default":null}}},"DrillDownVariables":{"type":"object","properties":{"name":{"type":["string","null"],"default":null},"value":{"type":["string","null"],"default":null}}},"Edge":{"type":"object","description":"Connection between two nodes in the pipeline","required":["id","source","target"],"properties":{"id":{"type":"string","description":"Edge identifier, format: \"e{source_id}-{target_id}\"","example":"einput-1-func-1"},"source":{"type":"string","description":"Source node id (data flows from this node)"},"target":{"type":"string","description":"Target node id (data flows to this node)"}}},"EdgeType":{"type":"string","description":"Type of relationship between alert nodes","enum":["temporal","service_dependency"]},"EnableAlertResponseBody":{"type":"object","description":"HTTP response body for `EnableAlert` endpoint.","required":["enabled"],"properties":{"enabled":{"type":"boolean"}}},"EnrichmentTableStatus":{"type":"string","enum":["pending","processing","completed","failed"]},"EnrichmentTableUrlJob":{"type":"object","required":["id","org_id","table_name","url","status","created_at","updated_at","total_bytes_fetched","total_records_processed","retry_count","append_data","last_byte_position","supports_range"],"properties":{"append_data":{"type":"boolean"},"created_at":{"type":"integer","format":"int64"},"error_message":{"type":["string","null"]},"id":{"type":"string"},"last_byte_position":{"type":"integer","format":"int64","minimum":0},"org_id":{"type":"string"},"retry_count":{"type":"integer","format":"int32","minimum":0},"status":{"$ref":"#/components/schemas/EnrichmentTableStatus"},"supports_range":{"type":"boolean"},"table_name":{"type":"string"},"total_bytes_fetched":{"type":"integer","format":"int64","minimum":0},"total_records_processed":{"type":"integer","format":"int64"},"updated_at":{"type":"integer","format":"int64"},"url":{"type":"string"}}},"EnrichmentTableUrlRequest":{"type":"object","description":"Request body for creating an enrichment table from a public URL.\n\nThe URL must point to a publicly accessible CSV file. Authentication-required\nURLs (e.g., S3 presigned URLs with complex headers) are not currently supported.\n\nThe `append` behavior is controlled via query parameter, matching the file upload endpoint.","required":["url"],"properties":{"replace_failed":{"type":"boolean","description":"Replace only the failed job's URL (optional, default: false)\n\nWhen true, only updates the failed job with the new URL while keeping\nall successful jobs unchanged. Useful for fixing typos or broken URLs\nwithout re-downloading working data sources."},"url":{"type":"string","description":"Public URL to the CSV file.\n\nRequirements:\n- Must start with http:// or https://\n- Must be publicly accessible (no authentication)\n- Should return CSV content-type (not enforced but recommended)\n- File can be any size - streaming handles large files efficiently"}}},"Field":{"type":"object","properties":{"matchBy":{"type":"string","default":""},"value":{"type":"string","default":""}}},"FieldAlias":{"type":"object","description":"Field alias group — defines a set of field names that represent the same concept.\n\nUsed for:\n- Mapping equivalent field names across logs, traces, and metrics (e.g., `service`,\n  `service.name`, `app` all mean \"service identity\")\n- Alert deduplication fingerprinting\n- Populating `ServiceIdentityConfig` and `IncidentGroupingConfig` via the recommendations UI\n\n# Field Name Overlaps\n\nField names can appear in multiple semantic groups. When extracting dimensions,\nthe **first-defined group** takes precedence. This allows flexible configurations\nwhere a field like \"service\" can have different meanings in different contexts.\n\nExample:\n```\n// Group 1: service-primary (defined first)\n//   field_names: [\"service\", \"primary_service\"]\n//\n// Group 2: service-backup (defined second)\n//   field_names: [\"service\", \"backup_service\"]\n//\n// When extracting dimensions from {\"service\": \"api\"}:\n// → Matches \"service-primary\" group (first occurrence wins)\n```","required":["id","display","fields"],"properties":{"display":{"type":"string","description":"Human-readable display name (e.g., \"Host\", \"K8s Cluster\")"},"fields":{"type":"array","items":{"type":"string"},"description":"List of field names that are equivalent (e.g., [\"host\", \"hostname\", \"node\"])\n\nNote: Field names can overlap with other groups. First-defined group wins."},"group":{"type":["string","null"],"description":"Category/group this semantic field belongs to (e.g., \"Common\", \"Kubernetes\", \"AWS\", \"GCP\",\n\"Azure\") Used for UI organization and preset templates"},"id":{"type":"string","description":"Unique identifier (lowercase, dash-separated, e.g., \"host\", \"k8s-cluster\")"},"is_workload_type":{"type":"boolean","description":"When true, this alias is a workload-type dimension used to build identity sets.\nAliases with this flag are grouped by their `group` field to form `IdentitySet`\nentries with `distinguish_by` populated from those alias IDs.\nAliases without this flag (HTTP, Database, System, etc.) are never used as\nidentity set discriminators."}}},"FilterCondition":{"type":"object","required":["type","values","logicalOperator","filterType"],"properties":{"column":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/StreamFieldObj"}]},"filterType":{"type":"string"},"logicalOperator":{"type":"string"},"operator":{"type":["string","null"]},"type":{"type":"string"},"value":{"type":["string","null"]},"values":{"type":"array","items":{"type":"string"}}}},"Filters":{"type":"object","properties":{"name":{"type":["string","null"],"default":null},"operator":{"type":["string","null"],"default":null},"value":{"type":"string","default":""}}},"Folder":{"type":"object","description":"Common folder fields used in HTTP request and response bodies.","required":["name","description"],"properties":{"description":{"type":"string"},"folderId":{"type":"string"},"name":{"type":"string"}}},"FolderType":{"type":"string","description":"Indicates the type of data that the folder can contain.","enum":["dashboards","alerts","reports"]},"FoundGroup":{"type":"object","description":"A semantic alias group found in the org's stream schemas.","required":["group_id","display","stream_types","aliases","recommended"],"properties":{"aliases":{"type":"object","description":"Actual field name found per stream type, e.g., {\"logs\": \"k8s_cluster_name\"}","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"cardinality_class":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/CardinalityClass","description":"Cardinality class derived from unique_values (None if no data yet)"}]},"display":{"type":"string","description":"Human-readable display name, e.g., \"K8s Cluster\""},"group_id":{"type":"string","description":"Semantic group ID, e.g., \"k8s-cluster\""},"recommended":{"type":"boolean","description":"True if this group appears in 2+ stream types AND has acceptable cardinality\n(Deprecated: logic moving to UI)"},"stream_types":{"type":"array","items":{"type":"string"},"description":"Which stream types contain a field from this group (e.g., [\"logs\", \"traces\"])"},"unique_values":{"type":["integer","null"],"description":"Number of unique values seen in actual data (None if no data collected yet)","minimum":0}}},"FrequencyType":{"type":"string","enum":["cron","minutes"]},"FunctionList":{"type":"object","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Transform"}}}},"GenerateSqlMetadata":{"type":"object","description":"Metadata about the generated SQL query.","required":["has_aggregation","has_conditions","has_group_by"],"properties":{"has_aggregation":{"type":"boolean","description":"Whether aggregation is present"},"has_conditions":{"type":"boolean","description":"Whether WHERE clause is present"},"has_group_by":{"type":"boolean","description":"Whether GROUP BY is present"}}},"GetAlertResponseBody":{"$ref":"#/components/schemas/Alert","description":"HTTP response body for `GetAlert` endpoint."},"GetFolderResponseBody":{"$ref":"#/components/schemas/Folder","description":"HTTP response body for `GetFolder` endpoint."},"GlobalDeduplicationConfig":{"type":"object","description":"Organization-level deduplication configuration (Global settings)\n\nThis configuration is stored at the organization level and defines:\n- Whether deduplication is enabled globally\n- Semantic field groups that map field name variations to canonical dimensions\n- Cross-alert deduplication based on shared semantic dimensions\n- Default time window for deduplication\n\nPer-alert fingerprint fields are stored in the Alert.deduplication field.","properties":{"alert_dedup_enabled":{"type":"boolean","description":"Enable cross-alert deduplication based on shared semantic dimensions\n\nWhen true, alerts from DIFFERENT alert rules that share semantic dimensions\nwill be deduplicated if one already fired recently.\n\nExample:\n- Alert A fires: {host: \"srv01\", service: \"api\"}\n- Alert B fires 30s later: {host: \"srv01\", region: \"us-east\"}\n- If cross_alert_dedup=true: Alert B suppressed (shares \"host\" dimension)\n- If cross_alert_dedup=false: Both sent (per-alert dedup only)","default":false},"alert_fingerprint_groups":{"type":"array","items":{"type":"string"},"description":"Semantic group IDs to use for cross-alert fingerprinting\n\nWhen cross_alert_dedup is enabled, these semantic group IDs are used\nto generate fingerprints across all alerts (instead of per-alert fingerprint_fields).\nMust reference IDs from semantic field groups (stored in system_settings).\n\nExample: [\"host\", \"service\"] means fingerprint = hash(host_value + service_value)\nRequired when cross_alert_dedup is true.","default":[]},"enabled":{"type":"boolean","description":"Enable/disable deduplication globally for this organization","default":false},"time_window_minutes":{"type":["integer","null"],"format":"int32","description":"Default time window in minutes for deduplication\n\nAlerts with the same fingerprint within this window are suppressed.\nIf None, defaults to 2x the alert evaluation frequency.\nCan be overridden per-alert.","default":null},"upgrade_window_minutes":{"type":"integer","format":"int64","description":"Time window for hierarchical incident upgrade (minutes)\nIncidents created within this window can be upgraded from weak to strong correlation keys.","default":0,"minimum":0}}},"GroupType":{"type":"object","required":["filterType","logicalOperator","conditions"],"properties":{"conditions":{"type":"array","items":{"type":"object"}},"filterType":{"type":"string"},"logicalOperator":{"type":"string"}}},"GroupingConfig":{"type":"object","description":"Configuration for alert grouping","properties":{"enabled":{"type":"boolean","description":"Enable alert grouping"},"group_wait_seconds":{"type":"integer","format":"int64","description":"Initial wait time before sending first notification (seconds)"},"max_group_size":{"type":"integer","description":"Maximum number of alerts in a single group","minimum":0},"send_strategy":{"$ref":"#/components/schemas/SendStrategy","description":"How to send grouped notifications"}}},"HTTPOutputFormat":{"oneOf":[{"type":"string","enum":["json"]},{"type":"string","enum":["ndjson"]},{"type":"string","enum":["nestedevent"]},{"type":"object","required":["esbulk"],"properties":{"esbulk":{"type":"object","required":["index"],"properties":{"index":{"type":"string"}}}}},{"type":"object","required":["stringseparated"],"properties":{"stringseparated":{"type":"object","required":["separator"],"properties":{"separator":{"type":"string"}}}}}]},"HTTPType":{"type":"string","enum":["post","put","get"]},"HavingConditions":{"type":"object","properties":{"operator":{"type":["string","null"]},"value":{"type":["number","null"],"format":"double"}}},"HealthzResponse":{"type":"object","required":["status"],"properties":{"status":{"type":"string"}}},"HttpResponse":{"type":"object","description":"HTTP response\ncode 200 is success\ncode 400 is error\ncode 404 is not found\ncode 500 is internal server error\ncode 503 is service unavailable\ncode >= 1000 is custom error code\nmessage is the message or error message","required":["code","message"],"properties":{"code":{"type":"integer","format":"int32","minimum":0},"error_detail":{"type":["string","null"]},"id":{"type":["string","null"]},"message":{"type":"string"},"name":{"type":["string","null"]},"trace_id":{"type":["string","null"]}}},"IdentitySet":{"type":"object","description":"One identity set — a disambiguation scheme for one class of workloads.\n\nThe `id` is the semantic category slug (e.g. \"k8s\", \"aws\", \"gcp\", \"azure\").\nAt processing time the system tries ALL configured sets against each record and\npicks the one whose `distinguish_by` fields yield the most non-empty values\n(best-coverage wins; ties broken by first-in-list).","required":["id","label","distinguish_by"],"properties":{"distinguish_by":{"type":"array","items":{"type":"string"},"description":"Semantic group IDs used for disambiguation (1..=5)."},"id":{"type":"string","description":"Semantic category slug: \"k8s\", \"aws\", \"gcp\", \"azure\", or a custom slug.\nMust be lowercase, alphanumeric, dash-separated (same rules as FieldAlias IDs)."},"label":{"type":"string","description":"Human-readable display name, e.g. \"Kubernetes\"."}}},"Incident":{"type":"object","description":"Main incident entity - a group of correlated alerts","required":["id","org_id","status","severity","first_alert_at","last_alert_at","alert_count","created_at","updated_at"],"properties":{"alert_count":{"type":"integer","format":"int32"},"assigned_to":{"type":["string","null"]},"created_at":{"type":"integer","format":"int64"},"first_alert_at":{"type":"integer","format":"int64","description":"Timestamps in microseconds"},"group_values":{},"id":{"type":"string","description":"KSUID (27 chars)"},"key_type":{"$ref":"#/components/schemas/KeyType"},"last_alert_at":{"type":"integer","format":"int64"},"org_id":{"type":"string"},"resolved_at":{"type":["integer","null"],"format":"int64"},"severity":{"$ref":"#/components/schemas/IncidentSeverity"},"status":{"$ref":"#/components/schemas/IncidentStatus"},"title":{"type":["string","null"]},"topology_context":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/IncidentTopology"}]},"updated_at":{"type":"integer","format":"int64"}}},"IncidentAlert":{"type":"object","description":"Alert info within an incident (junction table representation)","required":["incident_id","alert_id","alert_name","alert_fired_at","correlation_reason","created_at"],"properties":{"alert_fired_at":{"type":"integer","format":"int64"},"alert_id":{"type":"string"},"alert_name":{"type":"string"},"correlation_reason":{"$ref":"#/components/schemas/CorrelationReason"},"created_at":{"type":"integer","format":"int64"},"incident_id":{"type":"string"}}},"IncidentSeverity":{"type":"string","description":"Incident severity levels (P1 = highest priority)","enum":["P1","P2","P3","P4"]},"IncidentStats":{"type":"object","description":"Statistics for incidents dashboard","required":["total_incidents","open_incidents","acknowledged_incidents","resolved_incidents","by_severity","by_service","alerts_per_incident_avg"],"properties":{"acknowledged_incidents":{"type":"integer","format":"int64"},"alerts_per_incident_avg":{"type":"number","format":"double","description":"Average alerts per incident"},"by_service":{"type":"object","additionalProperties":{"type":"integer","format":"int64"},"propertyNames":{"type":"string"}},"by_severity":{"type":"object","additionalProperties":{"type":"integer","format":"int64"},"propertyNames":{"type":"string"}},"mttr_minutes":{"type":["number","null"],"format":"double","description":"Mean time to resolve in minutes"},"open_incidents":{"type":"integer","format":"int64"},"resolved_incidents":{"type":"integer","format":"int64"},"total_incidents":{"type":"integer","format":"int64"}}},"IncidentStatus":{"type":"string","description":"Incident status lifecycle: Open → Acknowledged → Resolved","enum":["open","acknowledged","resolved"]},"IncidentTopology":{"type":"object","description":"Alert flow graph showing how alerts cascaded across services over time","required":["nodes","edges","related_incident_ids"],"properties":{"edges":{"type":"array","items":{"$ref":"#/components/schemas/AlertEdge"},"description":"Edges showing temporal and service dependency relationships"},"nodes":{"type":"array","items":{"$ref":"#/components/schemas/AlertNode"},"description":"Alert nodes - each unique (service, alert) pair"},"related_incident_ids":{"type":"array","items":{"type":"string"},"description":"Related incident IDs (for cross-incident correlation)"},"suggested_root_cause":{"type":["string","null"],"description":"AI-generated root cause analysis (markdown)"}}},"IncidentWithAlerts":{"allOf":[{"$ref":"#/components/schemas/Incident"},{"type":"object","required":["triggers","alerts"],"properties":{"alerts":{"type":"array","items":{"$ref":"#/components/schemas/Alert"},"description":"Unique alerts with full details"},"triggers":{"type":"array","items":{"$ref":"#/components/schemas/IncidentAlert"},"description":"Alert triggers (each alert firing is a separate trigger)"}}}],"description":"Incident with its alerts (for detail view)"},"IngestionPasscode":{"type":"object","required":["passcode","user"],"properties":{"passcode":{"type":"string"},"user":{"type":"string"}}},"IngestionResponse":{"type":"object","required":["code"],"properties":{"code":{"type":"integer","format":"int32","minimum":0},"error":{"type":["string","null"]},"status":{"type":"array","items":{"$ref":"#/components/schemas/StreamStatus"}}}},"Join":{"type":"object","required":["stream","streamAlias","joinType","conditions"],"properties":{"conditions":{"type":"array","items":{"$ref":"#/components/schemas/JoinCondition"}},"joinType":{"type":"string"},"stream":{"type":"string"},"streamAlias":{"type":"string"}}},"JoinCondition":{"type":"object","required":["leftField","rightField","operation"],"properties":{"leftField":{"$ref":"#/components/schemas/SelectedField"},"operation":{"type":"string"},"rightField":{"$ref":"#/components/schemas/SelectedField"}}},"KeyType":{"type":"string","description":"Classification of correlation key strength for hierarchical upgrade logic\n\nHierarchy: AlertId (weakest) → Secondary → Primary (strongest)\nUpgrades only move UP the hierarchy, never down.","enum":["alert_id","secondary","primary"]},"LabelOption":{"type":"object","properties":{"position":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/LabelPosition"}],"default":null},"rotate":{"type":["number","null"],"format":"double","default":null}}},"LabelPosition":{"type":"string","enum":["top","left","right","bottom","inside","insideLeft","insideRight","insideTop","insideBottom","insideTopLeft","insideBottomLeft","insideTopRight","insideBottomRight","outside"]},"Layout":{"type":"object","properties":{"h":{"type":"integer","format":"int64","default":0},"i":{"type":"integer","format":"int64","default":0},"w":{"type":"integer","format":"int64","default":0},"x":{"type":"integer","format":"int64","default":0},"y":{"type":"integer","format":"int64","default":0}}},"LegendHeight":{"type":"object","properties":{"unit":{"type":["string","null"],"default":null},"value":{"type":["number","null"],"format":"double","default":null}}},"LegendWidth":{"type":"object","properties":{"unit":{"type":["string","null"],"default":null},"value":{"type":["number","null"],"format":"double","default":null}}},"LineInterpolation":{"type":"string","enum":["smooth","linear","step-start","step-end","step-middle"]},"ListAlertsResponseBody":{"type":"object","description":"HTTP response body for `ListAlerts` endpoint.","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/ListAlertsResponseBodyItem"}}}},"ListAlertsResponseBodyItem":{"type":"object","description":"An item in the list returned by the `ListAlerts` endpoint.\n\nFor `scheduled` and `realtime` alert types, `condition` and\n`trigger_condition` are always present. For `anomaly_detection` items they\nare absent; use `last_trained_at` and `status` instead.","required":["alert_id","folder_id","folder_name","name","alert_type","enabled","is_real_time"],"properties":{"alert_id":{"type":"string"},"alert_type":{"type":"string","description":"Discriminator: \"scheduled\" | \"realtime\" | \"anomaly_detection\""},"condition":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryCondition"}]},"description":{"type":["string","null"]},"enabled":{"type":"boolean"},"folder_id":{"type":"string"},"folder_name":{"type":"string"},"is_real_time":{"type":"boolean"},"last_error":{"type":["string","null"],"description":"Last error message from training or detection. Only present for `anomaly_detection` items."},"last_satisfied_at":{"type":["integer","null"],"format":"int64"},"last_trained_at":{"type":["integer","null"],"format":"int64","description":"Timestamp (µs) when the anomaly model was last successfully trained.\nOnly present for `anomaly_detection` items."},"last_triggered_at":{"type":["integer","null"],"format":"int64"},"name":{"type":"string"},"owner":{"type":["string","null"]},"status":{"type":["string","null"],"description":"Scheduler status string. Only present for `anomaly_detection` items.\nValues: \"waiting\" | \"ready\" | \"training\" | \"failed\" | \"disabled\""},"trigger_condition":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/TriggerCondition"}]}}},"ListDashboardsResponseBody":{"type":"object","description":"HTTP response body for `ListDashboards` endpoint.","required":["dashboards"],"properties":{"dashboards":{"type":"array","items":{"$ref":"#/components/schemas/ListDashboardsResponseBodyItem"}}}},"ListDashboardsResponseBodyItem":{"type":"object","description":"An item in the list returned by the `ListDashboards` endpoint.","required":["version","hash","folder_id","folder_name","dashboard_id","title","description","role","owner","created","updatedAt"],"properties":{"created":{"type":"string","format":"date-time"},"dashboard_id":{"type":"string"},"description":{"type":"string"},"folder_id":{"type":"string"},"folder_name":{"type":"string"},"hash":{"type":"string"},"owner":{"type":"string"},"role":{"type":"string"},"title":{"type":"string"},"updatedAt":{"type":"integer","format":"int64"},"v1":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"v2":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"v3":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"v4":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"v5":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"v6":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"v7":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"v8":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Dashboard"}]},"version":{"type":"integer","format":"int32"}}},"ListFoldersResponseBody":{"type":"object","description":"HTTP response body for `ListFolder` endpoint.","required":["list"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Folder"}}}},"ListIncidentsQuery":{"type":"object","description":"Query parameters for listing incidents","properties":{"limit":{"type":"integer","format":"int64","description":"Maximum number of results","minimum":0},"offset":{"type":"integer","format":"int64","description":"Offset for pagination","minimum":0},"status":{"type":["string","null"],"description":"Filter by status (open, acknowledged, resolved)"}}},"ListIncidentsResponse":{"type":"object","description":"Response for list incidents","required":["incidents","total"],"properties":{"incidents":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"total":{"type":"integer","format":"int64","minimum":0}}},"ListStream":{"type":"object","required":["list","total"],"properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/Stream"}},"total":{"type":"integer","minimum":0}}},"LokiEntry":{"type":"object","description":"Loki log entry containing timestamp, message, and optional metadata","required":["timestamp","line"],"properties":{"line":{"type":"string","description":"Log message content"},"structured_metadata":{"type":["object","null"],"description":"Optional structured metadata as key-value pairs","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"timestamp":{"type":"string","description":"Timestamp as nanosecond unix epoch string (e.g., \"1609459200000000000\")"}}},"LokiPushRequest":{"type":"object","description":"Internal Loki JSON types for native Loki push API format\nLoki push request - matches native JSON format exactly","required":["streams"],"properties":{"streams":{"type":"array","items":{"$ref":"#/components/schemas/LokiStream"},"description":"Array of log streams, each containing labels and log entries"}}},"LokiPushResponse":{"type":"object","description":"Loki Push Response (for documentation only - actual responses are 204 No Content or plain text)","required":["success"],"properties":{"success":{"type":"boolean","description":"Success indicator"}}},"LokiStream":{"type":"object","description":"Loki stream containing labels and log entries","required":["stream","values"],"properties":{"stream":{"type":"object","description":"Stream labels as key-value pairs (e.g., {\"service\": \"api\", \"stream_name\": \"logs\"})","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"values":{"type":"array","items":{"$ref":"#/components/schemas/LokiEntry"},"description":"Array of log entries, each containing timestamp, message, and optional structured metadata"}}},"MapSymbolStyle":{"type":"object","properties":{"size":{"type":"string","default":""},"size_by_value":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SizeByValue"}],"default":null},"size_fixed":{"type":"number","format":"double","default":0.0}}},"MapType":{"type":"object","properties":{"type":{"type":["string","null"],"default":null}}},"MapView":{"type":"object","properties":{"lat":{"type":"number","format":"double","default":0.0},"lng":{"type":"number","format":"double","default":0.0},"zoom":{"type":"number","format":"double","default":0.0}}},"Mapping":{"type":"object","properties":{"color":{"type":["string","null"],"default":null},"from":{"type":["string","null"],"default":null},"match":{"type":["string","null"],"default":null},"pattern":{"type":["string","null"],"default":null},"text":{"type":["string","null"],"default":null},"to":{"type":["string","null"],"default":null},"type":{"type":["string","null"],"default":null},"value":{"type":["string","null"],"default":null}}},"MarkLine":{"type":"object","properties":{"name":{"type":["string","null"],"default":null},"type":{"type":["string","null"],"default":null},"value":{"type":["string","null"],"default":null}}},"Metadata":{"type":"object","required":["metric_type","metric_family_name","help","unit"],"properties":{"help":{"type":"string"},"metric_family_name":{"type":"string"},"metric_type":{"$ref":"#/components/schemas/MetricType"},"unit":{"type":"string"}}},"MetricType":{"type":"string","enum":["Unknown","Counter","Gauge","Histogram","GaugeHistogram","ExponentialHistogram","Summary","Info","StateSet","Empty"]},"MoveAlertsRequestBody":{"type":"object","description":"HTTP request body for `MoveAlerts` endpoint.","required":["alert_ids","dst_folder_id"],"properties":{"alert_ids":{"type":"array","items":{"type":"string"},"description":"IDs of the alerts to move."},"anomaly_config_ids":{"type":"array","items":{"type":"string"},"description":"IDs of anomaly detection configs to move. Defaults to empty when not\nprovided. Callers should always supply this to avoid per-ID DB lookups."},"dst_folder_id":{"type":"string","description":"Indicates the folder to which alerts should be moved."}}},"MoveDashboardRequestBody":{"type":"object","description":"HTTP request body for `MoveDashboard` endpoint.","required":["from","to"],"properties":{"from":{"type":"string"},"to":{"type":"string"}}},"MoveDashboardsRequestBody":{"type":"object","description":"HTTP request body for `MoveDashboards` endpoint.","required":["dashboard_ids","dst_folder_id"],"properties":{"dashboard_ids":{"type":"array","items":{"type":"string"},"description":"IDs of the dashboards to move."},"dst_folder_id":{"type":"string","description":"Indicates the folder to which dashboard should be moved."}}},"Node":{"type":"object","required":["id","data","position","io_type"],"properties":{"data":{"type":"object","description":"Node configuration. Structure depends on node_type:\n- stream: { \"node_type\": \"stream\", \"org_id\": \"org\", \"stream_name\": \"name\", \"stream_type\":\n  \"logs\"|\"metrics\"|\"traces\" }\n- function: { \"node_type\": \"function\", \"name\": \"func_name\", \"after_flatten\": bool }\n- condition: { \"node_type\": \"condition\", \"conditions\": {...} }\n- query: { \"node_type\": \"query\", \"org_id\": \"org\", \"stream_type\": \"logs\", \"query_condition\":\n  {...}, \"trigger_condition\": {...} }\n- remote_stream: { \"node_type\": \"remote_stream\", \"org_id\": \"org\", \"destination_name\":\n  \"dest\" }"},"id":{"type":"string","description":"Unique identifier for the node (use UUID format)"},"io_type":{"type":"string","description":"Node role in the pipeline. MUST be one of:\n- \"input\": Source stream node (first node in pipeline)\n- \"output\": Destination stream node (last node in pipeline)\n- \"default\": Processing node (function, condition, etc.)","example":"input"},"meta":{"type":["object","null"],"additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"position":{"$ref":"#/components/schemas/Position","description":"Visual position for UI rendering"},"style":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/NodeStyle"}]}}},"NodeStyle":{"type":"object","properties":{"backgroundColor":{"type":["string","null"]}}},"O2EntityAuthorization":{"type":"object","required":["object","permission"],"properties":{"object":{"type":"string"},"permission":{"$ref":"#/components/schemas/Permission"}}},"Operator":{"type":"string","enum":["=","!=",">",">=","<","<=","contains","not_contains"]},"OrderBy":{"type":"string","enum":["desc","asc"]},"OrgDetails":{"type":"object","required":["id","identifier","name","user_email","ingest_threshold","search_threshold","type","UserObj"],"properties":{"UserObj":{"$ref":"#/components/schemas/OrgUser"},"id":{"type":"integer","format":"int64"},"identifier":{"type":"string"},"ingest_threshold":{"type":"integer","format":"int64"},"name":{"type":"string"},"plan":{"type":"integer","format":"int32"},"search_threshold":{"type":"integer","format":"int64"},"type":{"type":"string"},"user_email":{"type":"string"}}},"OrgRenameBody":{"type":"object","required":["new_name"],"properties":{"new_name":{"type":"string"}}},"OrgRoleMapping":{"type":"object","required":["org_id","org_name","role"],"properties":{"org_id":{"type":"string"},"org_name":{"type":"string"},"role":{"$ref":"#/components/schemas/UserRole"}}},"OrgSummary":{"type":"object","required":["streams","pipelines","alerts","total_functions","total_dashboards"],"properties":{"alerts":{"$ref":"#/components/schemas/AlertSummary"},"pipelines":{"$ref":"#/components/schemas/PipelineSummary"},"streams":{"$ref":"#/components/schemas/StreamSummary"},"total_dashboards":{"type":"integer","format":"int64"},"total_functions":{"type":"integer","format":"int64"}}},"OrgUser":{"type":"object","required":["first_name","last_name","email"],"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"last_name":{"type":"string"}}},"Organization":{"type":"object","required":["name"],"properties":{"identifier":{"type":"string"},"name":{"type":"string","description":"Only alphanumeric characters (A-Z, a-z, 0-9), spaces, and underscores are allowed"},"org_type":{"type":"string"},"service_account":{"type":["string","null"],"description":"Optional service account email to add to the organization\nWhen specified, only this service account will be added (not the API caller)"}}},"OrganizationResponse":{"type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/OrgDetails"}}}},"OrganizationSetting":{"type":"object","properties":{"claim_parser_function":{"type":"string"},"cross_links":{"type":"array","items":{"$ref":"#/components/schemas/CrossLink"}},"dark_mode_theme_color":{"type":["string","null"]},"enable_streaming_search":{"type":"boolean"},"free_trial_expiry":{"type":["integer","null"],"format":"int64"},"light_mode_theme_color":{"type":["string","null"]},"max_series_per_query":{"type":["integer","null"],"minimum":0},"min_auto_refresh_interval":{"type":"integer","format":"int32","minimum":0},"scrape_interval":{"type":"integer","format":"int32","description":"Ideally this should be the same as prometheus-scrape-interval (in\nseconds).","minimum":0},"span_id_field_name":{"type":"string"},"streaming_aggregation_enabled":{"type":"boolean"},"toggle_ingestion_logs":{"type":"boolean"},"trace_id_field_name":{"type":"string"},"usage_stream_enabled":{"type":"boolean"}}},"OrganizationSettingResponse":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/OrganizationSetting"}}},"OverrideConfig":{"type":"object","properties":{"config":{"type":["array","null"],"items":{"$ref":"#/components/schemas/Config"},"default":null},"field":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Field"}],"default":null}}},"Panel":{"type":"object","required":["id","type","title","description","config","queries"],"properties":{"config":{"$ref":"#/components/schemas/PanelConfig"},"customChartContent":{"type":["string","null"]},"description":{"type":"string"},"htmlContent":{"type":["string","null"]},"id":{"type":"string"},"layout":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Layout"}]},"markdownContent":{"type":["string","null"]},"queries":{"type":"array","items":{"$ref":"#/components/schemas/Query"}},"queryType":{"type":"string"},"title":{"type":"string"},"type":{"type":"string"}}},"PanelConfig":{"type":"object","required":["show_legends"],"properties":{"aggregation":{"type":["string","null"]},"axis_border_show":{"type":["boolean","null"]},"axis_label_rotate":{"type":["number","null"],"format":"double"},"axis_label_truncate_width":{"type":["number","null"],"format":"double"},"axis_width":{"type":["number","null"],"format":"double"},"background":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Background"}]},"base_map":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/BaseMap"}]},"chart_align":{"type":["string","null"]},"color":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ColorCfg"}]},"column_order":{"type":["array","null"],"items":{"type":"string"}},"connect_nulls":{"type":["boolean","null"]},"decimals":{"type":["number","null"],"format":"double"},"drilldown":{"type":["array","null"],"items":{"$ref":"#/components/schemas/DrillDown"}},"hidden_columns":{"type":["array","null"],"items":{"type":"string"}},"label_option":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/LabelOption"}]},"lat_label":{"type":["string","null"]},"legend_height":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/LegendHeight"}]},"legend_width":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/LegendWidth"}]},"legends_position":{"type":["string","null"]},"legends_type":{"type":["string","null"]},"line_interpolation":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/LineInterpolation"}]},"line_thickness":{"type":["number","null"],"format":"double"},"lon_label":{"type":["string","null"]},"map_symbol_style":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MapSymbolStyle"}]},"map_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MapType"}]},"map_view":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/MapView"}]},"mappings":{"type":["array","null"],"items":{"$ref":"#/components/schemas/Mapping"}},"mark_line":{"type":["array","null"],"items":{"$ref":"#/components/schemas/MarkLine"}},"name_label":{"type":["string","null"]},"no_value_replacement":{"type":["string","null"]},"override_config":{"type":["array","null"],"items":{"$ref":"#/components/schemas/OverrideConfig"}},"panel_time_enabled":{"type":["boolean","null"]},"panel_time_range":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DateTimeOptions"}]},"promql_table_mode":{"type":["string","null"]},"show_gridlines":{"type":["boolean","null"]},"show_legends":{"type":"boolean"},"show_symbol":{"type":["boolean","null"]},"step_value":{"type":["string","null"]},"sticky_columns":{"type":["array","null"],"items":{"type":"string"}},"sticky_first_column":{"type":["boolean","null"]},"table_aggregations":{"type":["array","null"],"items":{"type":"string"}},"table_dynamic_columns":{"type":["boolean","null"]},"table_pagination":{"type":["boolean","null"]},"table_pagination_rows_per_page":{"type":["integer","null"],"format":"int64"},"table_pivot_show_col_totals":{"type":["boolean","null"]},"table_pivot_show_row_totals":{"type":["boolean","null"]},"table_pivot_sticky_col_totals":{"type":["boolean","null"]},"table_pivot_sticky_row_totals":{"type":["boolean","null"]},"table_transpose":{"type":["boolean","null"]},"top_results":{"type":["number","null"],"format":"double"},"top_results_others":{"type":["boolean","null"]},"trellis":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Trellis"}]},"unit":{"type":["string","null"]},"unit_custom":{"type":["string","null"]},"visible_columns":{"type":["array","null"],"items":{"type":"string"}},"weight_label":{"type":["string","null"]},"wrap_table_cells":{"type":["boolean","null"]},"y_axis_max":{"type":["number","null"],"format":"double"},"y_axis_min":{"type":["number","null"],"format":"double"}}},"PanelFields":{"type":"object","required":["stream","stream_type","x","y","filter"],"properties":{"breakdown":{"type":["array","null"],"items":{"$ref":"#/components/schemas/AxisItem"}},"filter":{"$ref":"#/components/schemas/PanelFilter"},"latitude":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"longitude":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"name":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"promql_labels":{"type":"array","items":{"$ref":"#/components/schemas/PromQLLabelFilter"}},"promql_operations":{"type":"array","items":{"$ref":"#/components/schemas/PromQLOperation"}},"source":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"stream":{"type":"string"},"stream_type":{"$ref":"#/components/schemas/StreamType"},"target":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"value":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"value_for_maps":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"weight":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AxisItem"}]},"x":{"type":"array","items":{"$ref":"#/components/schemas/AxisItem"}},"y":{"type":"array","items":{"$ref":"#/components/schemas/AxisItem"}},"z":{"type":"array","items":{"$ref":"#/components/schemas/AxisItem"}}}},"PanelFilter":{"oneOf":[{"$ref":"#/components/schemas/FilterCondition"},{"$ref":"#/components/schemas/GroupType"}]},"PasscodeResponse":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/IngestionPasscode"}}},"PatternAssociation":{"type":"object","required":["field","pattern_name","description","pattern","pattern_id","policy","apply_at"],"properties":{"apply_at":{"type":"string"},"description":{"type":"string"},"field":{"type":"string"},"pattern":{"type":"string"},"pattern_id":{"type":"string"},"pattern_name":{"type":"string"},"policy":{"type":"string"}}},"Permission":{"type":"string","enum":["AllowAll","AllowDelete","AllowGet","AllowList","AllowPost","AllowPut","None"]},"Pipeline":{"type":"object","required":["name","nodes","edges"],"properties":{"description":{"type":"string"},"edges":{"type":"array","items":{"$ref":"#/components/schemas/Edge"}},"enabled":{"type":"boolean"},"last_error":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/PipelineErrorInfo"}]},"name":{"type":"string"},"nodes":{"type":"array","items":{"$ref":"#/components/schemas/Node"}},"org":{"type":"string"},"paused_at":{"type":["integer","null"],"format":"int64"},"pipeline_id":{"type":"string"},"source":{"$ref":"#/components/schemas/PipelineSource"},"version":{"type":"integer","format":"int32"}}},"PipelineErrorInfo":{"type":"object","required":["last_error_timestamp"],"properties":{"error_summary":{"type":["string","null"]},"last_error_timestamp":{"type":"integer","format":"int64"},"node_errors":{}}},"PipelineHistoryEntry":{"type":"object","required":["timestamp","pipeline_name","org","status","is_realtime","is_silenced","start_time","end_time","retries"],"properties":{"delay_in_secs":{"type":["integer","null"],"format":"int64"},"end_time":{"type":"integer","format":"int64"},"error":{"type":["string","null"]},"evaluation_took_in_secs":{"type":["number","null"],"format":"double"},"is_partial":{"type":["boolean","null"]},"is_realtime":{"type":"boolean"},"is_silenced":{"type":"boolean"},"org":{"type":"string"},"pipeline_name":{"type":"string"},"query_took":{"type":["integer","null"],"format":"int64"},"retries":{"type":"integer","format":"int32"},"source_node":{"type":["string","null"]},"start_time":{"type":"integer","format":"int64"},"status":{"type":"string"},"success_response":{"type":["string","null"]},"timestamp":{"type":"integer","format":"int64"}}},"PipelineHistoryResponse":{"type":"object","required":["total","from","size","hits"],"properties":{"from":{"type":"integer","format":"int64"},"hits":{"type":"array","items":{"$ref":"#/components/schemas/PipelineHistoryEntry"}},"size":{"type":"integer","format":"int64"},"total":{"type":"integer","minimum":0}}},"PipelineSource":{"oneOf":[{"allOf":[{"$ref":"#/components/schemas/StreamParams","description":"Real-time pipeline: processes data immediately as it's ingested.\nExample: { \"source_type\": \"realtime\" }"},{"type":"object","required":["source_type"],"properties":{"source_type":{"type":"string","enum":["realtime"]}}}],"description":"Real-time pipeline: processes data immediately as it's ingested.\nExample: { \"source_type\": \"realtime\" }"},{"allOf":[{"$ref":"#/components/schemas/DerivedStream","description":"Scheduled pipeline: runs periodically based on trigger_condition.\nExample: { \"source_type\": \"scheduled\", \"org_id\": \"default\", \"stream_type\": \"logs\",\n\"query_condition\": {...}, \"trigger_condition\": {...} }"},{"type":"object","required":["source_type"],"properties":{"source_type":{"type":"string","enum":["scheduled"]}}}],"description":"Scheduled pipeline: runs periodically based on trigger_condition.\nExample: { \"source_type\": \"scheduled\", \"org_id\": \"default\", \"stream_type\": \"logs\",\n\"query_condition\": {...}, \"trigger_condition\": {...} }"}],"description":"Pipeline source type determines when the pipeline runs.\nUse \"realtime\" for processing data as it arrives, \"scheduled\" for periodic batch processing."},"PipelineSummary":{"type":"object","required":["num_realtime","num_scheduled","trigger_status"],"properties":{"num_realtime":{"type":"integer","format":"int64"},"num_scheduled":{"type":"integer","format":"int64"},"trigger_status":{"$ref":"#/components/schemas/TriggerStatus"}}},"Position":{"type":"object","required":["x","y"],"properties":{"x":{"type":"number","format":"float"},"y":{"type":"number","format":"float"}}},"PostUserRequest":{"allOf":[{"$ref":"#/components/schemas/UserRoleRequest"},{"type":"object","required":["email","password"],"properties":{"email":{"type":"string"},"first_name":{"type":"string"},"is_external":{"type":"boolean","description":"Is the user created via ldap flow."},"last_name":{"type":"string"},"password":{"type":"string"},"token":{"type":["string","null"]}}}]},"PromQLLabelFilter":{"type":"object","properties":{"label":{"type":"string","default":""},"op":{"type":"string","default":""},"value":{"type":"string","default":""}}},"PromQLOperation":{"type":"object","properties":{"id":{"type":"string","default":""},"params":{"type":["array","null"],"items":{"$ref":"#/components/schemas/PromQLOperationParam"},"default":null}}},"PromQLOperationParam":{"oneOf":[{"type":"array","items":{"type":"string"}},{"type":"string"},{"type":"number","format":"double"},{"type":"boolean"}]},"Query":{"type":"object","required":["customQuery","fields","config"],"properties":{"config":{"$ref":"#/components/schemas/QueryConfig"},"customQuery":{"type":"boolean"},"fields":{"$ref":"#/components/schemas/PanelFields"},"joins":{"type":["array","null"],"items":{"$ref":"#/components/schemas/Join"}},"query":{"type":["string","null"]},"vrlFunctionQuery":{"type":["string","null"]}}},"QueryCondition":{"type":"object","properties":{"aggregation":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Aggregation"}]},"conditions":{"type":["object","null"]},"multi_time_range":{"type":["array","null"],"items":{"$ref":"#/components/schemas/CompareHistoricData"}},"promql":{"type":["string","null"]},"promql_condition":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Condition"}]},"search_event_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventType"}]},"sql":{"type":["string","null"]},"type":{"$ref":"#/components/schemas/QueryType"},"vrl_function":{"type":["string","null"]}}},"QueryConfig":{"type":"object","required":["promql_legend"],"properties":{"layer_type":{"type":["string","null"]},"limit":{"type":["number","null"],"format":"double"},"max":{"type":["number","null"],"format":"double"},"min":{"type":["number","null"],"format":"double"},"promql_legend":{"type":"string"},"step_value":{"type":["string","null"]},"time_shift":{"type":["array","null"],"items":{"$ref":"#/components/schemas/TimeShift"}},"weight_fixed":{"type":["number","null"],"format":"double"}}},"QueryData":{"type":"object","properties":{"field":{"type":"string","default":""},"filter":{"type":["array","null"],"items":{"$ref":"#/components/schemas/Filters"},"default":null},"max_record_size":{"type":["integer","null"],"format":"int64","default":null},"stream":{"type":"string","default":""},"stream_type":{"oneOf":[{"$ref":"#/components/schemas/StreamType"}],"default":"logs"}}},"QueryInfo":{"type":"object","required":["sql","start_time","end_time"],"properties":{"end_time":{"type":"integer","format":"int64"},"sql":{"type":"string"},"start_time":{"type":"integer","format":"int64"}}},"QueryStatus":{"type":"object","required":["trace_id","status","created_at","started_at","work_group"],"properties":{"created_at":{"type":"integer","format":"int64"},"org_id":{"type":["string","null"]},"query":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryInfo"}]},"scan_stats":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ScanStats"}]},"search_event_context":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventContext"}]},"search_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventType"}]},"started_at":{"type":"integer","format":"int64"},"status":{"type":"string"},"stream_type":{"type":["string","null"]},"trace_id":{"type":"string"},"user_id":{"type":["string","null"]},"work_group":{"type":"string"}}},"QueryStatusResponse":{"type":"object","required":["status"],"properties":{"status":{"type":"array","items":{"$ref":"#/components/schemas/QueryStatus"}}}},"QueryType":{"type":"string","enum":["custom","sql","promql"]},"RcaResponse":{"type":"object","description":"Response for RCA analysis","required":["rca_content"],"properties":{"rca_content":{"type":"string"}}},"RecordStatus":{"type":"object","required":["successful","failed"],"properties":{"error":{"type":"string"},"failed":{"type":"integer","format":"int32","minimum":0},"successful":{"type":"integer","format":"int32","minimum":0}}},"RelatedStreams":{"type":"object","description":"Related streams grouped by type","required":["logs","traces","metrics"],"properties":{"logs":{"type":"array","items":{"$ref":"#/components/schemas/StreamInfo"}},"metrics":{"type":"array","items":{"$ref":"#/components/schemas/StreamInfo"}},"traces":{"type":"array","items":{"$ref":"#/components/schemas/StreamInfo"}}}},"ReportAttachmentDimensions":{"type":"object","required":["width","height"],"properties":{"height":{"type":"integer","format":"int32","minimum":0},"width":{"type":"integer","format":"int32","minimum":0}}},"ReportDashboard":{"type":"object","required":["dashboard","folder","tabs"],"properties":{"attachment_dimensions":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/ReportAttachmentDimensions","description":"Optional override for the browser viewport dimensions used when capturing the report.\nWhen `None` the report server's configured defaults are used."}]},"dashboard":{"type":"string"},"email_attachment_type":{"$ref":"#/components/schemas/ReportEmailAttachmentType","description":"How the attachment is sent in the email — as a downloadable file or embedded inline."},"folder":{"type":"string"},"report_type":{"$ref":"#/components/schemas/ReportMediaType","description":"The type of report attachment — PDF or PNG."},"tabs":{"type":"array","items":{"type":"string"}},"timerange":{"$ref":"#/components/schemas/ReportTimerange","description":"The timerange of dashboard data."},"variables":{"type":"array","items":{"$ref":"#/components/schemas/ReportDashboardVariable"}}}},"ReportDashboardVariable":{"type":"object","required":["key","value"],"properties":{"id":{"type":["string","null"]},"key":{"type":"string"},"value":{"type":"string"}}},"ReportDestination":{"oneOf":[{"type":"object","required":["email"],"properties":{"email":{"type":"string"}}}]},"ReportEmailAttachmentType":{"type":"string","enum":["standard","inline"]},"ReportFrequency":{"type":"object","properties":{"align_time":{"type":"boolean"},"cron":{"type":"string","description":"Cron expression"},"interval":{"type":"integer","format":"int64","description":"Frequency interval in the `frequency_type` unit"},"type":{"$ref":"#/components/schemas/ReportFrequencyType"}}},"ReportFrequencyType":{"type":"string","enum":["once","hours","days","weeks","months","cron"]},"ReportMediaType":{"type":"string","enum":["pdf","png"]},"ReportTimerange":{"type":"object","required":["type","period","from","to"],"properties":{"from":{"type":"integer","format":"int64"},"period":{"type":"string"},"to":{"type":"integer","format":"int64"},"type":{"$ref":"#/components/schemas/ReportTimerangeType"}}},"ReportTimerangeType":{"type":"string","enum":["relative","absolute"]},"RequestEncoding":{"type":"string","enum":["base64","Empty"]},"ResponseTook":{"type":"object","required":["total","cache_took","file_list_took","wait_in_queue","idx_took","search_took"],"properties":{"cache_took":{"type":"integer","minimum":0},"file_list_took":{"type":"integer","minimum":0},"idx_took":{"type":"integer","minimum":0},"search_took":{"type":"integer","minimum":0},"total":{"type":"integer","minimum":0},"wait_in_queue":{"type":"integer","minimum":0}}},"RowTemplateType":{"type":"string","enum":["String","Json"]},"RumIngestionResponse":{"type":"object","required":["data"],"properties":{"data":{"$ref":"#/components/schemas/RumIngestionToken"}}},"RumIngestionToken":{"type":"object","required":["user"],"properties":{"rum_token":{"type":["string","null"]},"user":{"type":"string"}}},"ScanStats":{"type":"object","required":["files","records","original_size","compressed_size","querier_files","querier_memory_cached_files","querier_disk_cached_files","idx_scan_size","idx_took","file_list_took","aggs_cache_ratio","peak_memory_usage"],"properties":{"aggs_cache_ratio":{"type":"integer","format":"int64"},"compressed_size":{"type":"integer","format":"int64"},"file_list_took":{"type":"integer","format":"int64"},"files":{"type":"integer","format":"int64"},"idx_scan_size":{"type":"integer","format":"int64"},"idx_took":{"type":"integer","format":"int64"},"original_size":{"type":"integer","format":"int64"},"peak_memory_usage":{"type":"integer","format":"int64"},"querier_disk_cached_files":{"type":"integer","format":"int64"},"querier_files":{"type":"integer","format":"int64"},"querier_memory_cached_files":{"type":"integer","format":"int64"},"records":{"type":"integer","format":"int64"}}},"SearchEventContext":{"type":"object","properties":{"alert_key":{"type":["string","null"]},"alert_name":{"type":["string","null"]},"dashboard_id":{"type":["string","null"]},"dashboard_name":{"type":["string","null"]},"derived_stream_key":{"type":["string","null"]},"folder_id":{"type":["string","null"]},"folder_name":{"type":["string","null"]},"report_id":{"type":["string","null"]}}},"SearchEventType":{"type":"string","enum":["ui","dashboards","reports","alerts","values","other","rum","derivedstream","searchjob","download","insights"]},"SearchHistoryRequest":{"type":"object","description":"Request parameters for querying search history","required":["start_time","end_time"],"properties":{"end_time":{"type":"integer","format":"int64","description":"end time in micro seconds"},"org_id":{"type":["string","null"],"description":"Organization ID to filter search history by"},"size":{"type":"integer","format":"int64","description":"Maximum number of search history records to return"},"start_time":{"type":"integer","format":"int64","description":"start time in micro seconds"},"stream_name":{"type":["string","null"],"description":"Name of the specific stream to filter by"},"stream_type":{"type":["string","null"],"description":"Type of stream to filter by (e.g., logs, metrics, traces)"},"trace_id":{"type":["string","null"],"description":"Trace ID to filter search history by"},"user_email":{"type":["string","null"],"description":"Email of the user to filter search history by"}}},"SearchPartitionRequest":{"type":"object","required":["sql","start_time","end_time"],"properties":{"clusters":{"type":"array","items":{"type":"string"}},"encoding":{"$ref":"#/components/schemas/RequestEncoding"},"end_time":{"type":"integer","format":"int64"},"histogram_interval":{"type":"integer","format":"int64"},"query_fn":{"type":["string","null"]},"regions":{"type":"array","items":{"type":"string"}},"sampling_ratio":{"type":["number","null"],"format":"double"},"sql":{"type":"string"},"start_time":{"type":"integer","format":"int64"},"streaming_output":{"type":"boolean"}}},"SearchPartitionResponse":{"type":"object","required":["trace_id","file_num","records","original_size","compressed_size","max_query_range","partitions","order_by","limit","streaming_output","streaming_aggs"],"properties":{"compressed_size":{"type":"integer","minimum":0},"file_num":{"type":"integer","minimum":0},"histogram_interval":{"type":["integer","null"],"format":"int64"},"is_histogram_eligible":{"type":"boolean"},"limit":{"type":"integer","format":"int64"},"max_query_range":{"type":"integer","format":"int64"},"order_by":{"$ref":"#/components/schemas/OrderBy"},"original_size":{"type":"integer","minimum":0},"partitions":{"type":"array","items":{"type":"array","items":{"type":"integer","format":"int64"}}},"records":{"type":"integer","minimum":0},"streaming_aggs":{"type":"boolean"},"streaming_id":{"type":["string","null"]},"streaming_output":{"type":"boolean"},"trace_id":{"type":"string"}}},"SearchQuery":{"type":"object","required":["sql","start_time","end_time"],"properties":{"action_id":{"type":["string","null"]},"end_time":{"type":"integer","format":"int64"},"from":{"type":"integer","format":"int64"},"histogram_interval":{"type":"integer","format":"int64"},"query_fn":{"type":["string","null"]},"query_type":{"type":"string"},"quick_mode":{"type":"boolean"},"sampling_config":{"type":["object","null"]},"sampling_ratio":{"type":["number","null"],"format":"double","description":"Simplified sampling API: just specify ratio (0.0-1.0), backend uses optimal defaults\nTakes precedence over sampling_config if both are provided"},"size":{"type":"integer","format":"int64"},"skip_wal":{"type":"boolean"},"sql":{"type":"string"},"start_time":{"type":"integer","format":"int64"},"streaming_id":{"type":["string","null"]},"streaming_output":{"type":"boolean"},"track_total_hits":{"type":"boolean"},"uses_zo_fn":{"type":"boolean"}}},"SearchRequest":{"type":"object","required":["query"],"properties":{"clear_cache":{"type":"boolean"},"clusters":{"type":"array","items":{"type":"string"}},"encoding":{"$ref":"#/components/schemas/RequestEncoding"},"local_mode":{"type":["boolean","null"]},"query":{"$ref":"#/components/schemas/SearchQuery"},"regions":{"type":"array","items":{"type":"string"}},"search_event_context":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventContext"}]},"search_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/SearchEventType"}]},"timeout":{"type":"integer","format":"int64"},"use_cache":{"type":"boolean"}}},"SearchResponse":{"type":"object","required":["took","hits","total","from","size","cached_ratio","scan_size","idx_scan_size","scan_records"],"properties":{"cached_ratio":{"type":"integer","minimum":0},"columns":{"type":"array","items":{"type":"string"}},"converted_histogram_query":{"type":["string","null"]},"from":{"type":"integer","format":"int64"},"function_error":{"type":"array","items":{"type":"string"}},"histogram_breakdown_field":{"type":["string","null"]},"histogram_interval":{"type":["integer","null"],"format":"int64"},"hits":{"type":"array","items":{"type":"object"}},"idx_scan_size":{"type":"integer","minimum":0},"is_histogram_eligible":{"type":["boolean","null"]},"is_partial":{"type":"boolean"},"new_end_time":{"type":["integer","null"],"format":"int64"},"new_start_time":{"type":["integer","null"],"format":"int64"},"order_by":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/OrderBy"}]},"order_by_metadata":{"type":"array","items":{"type":"array","items":false,"prefixItems":[{"type":"string"},{"type":"string","enum":["desc","asc"]}]}},"peak_memory_usage":{"type":["number","null"],"format":"double"},"query_index":{"type":["integer","null"],"minimum":0},"response_type":{"type":"string"},"result_cache_ratio":{"type":"integer","minimum":0},"scan_records":{"type":"integer","minimum":0},"scan_size":{"type":"integer","minimum":0},"size":{"type":"integer","format":"int64"},"took":{"type":"integer","minimum":0},"took_detail":{"$ref":"#/components/schemas/ResponseTook"},"total":{"type":"integer","minimum":0},"trace_id":{"type":"string"},"work_group":{"type":["string","null"]}}},"SelectedField":{"type":"object","required":["field"],"properties":{"field":{"type":"string"},"streamAlias":{"type":["string","null"]}}},"SemanticGroupDiff":{"type":"object","required":["additions","modifications","unchanged"],"properties":{"additions":{"type":"array","items":{"$ref":"#/components/schemas/FieldAlias"},"description":"Groups that exist in the imported JSON but not in DB (new)"},"modifications":{"type":"array","items":{"$ref":"#/components/schemas/SemanticGroupModification"},"description":"Groups that exist in both but have different content"},"unchanged":{"type":"array","items":{"$ref":"#/components/schemas/FieldAlias"},"description":"Groups that are identical in both"}}},"SemanticGroupModification":{"type":"object","required":["current","proposed"],"properties":{"current":{"$ref":"#/components/schemas/FieldAlias","description":"Current version in DB"},"proposed":{"$ref":"#/components/schemas/FieldAlias","description":"New version from import"}}},"SendStrategy":{"type":"string","description":"Strategy for sending grouped alert notifications","enum":["first_with_count","summary","all"]},"ServiceAccountTokenInfo":{"type":"object","required":["email","role","message"],"properties":{"email":{"type":"string"},"message":{"type":"string","description":"Instructions for obtaining a temporary session token"},"role":{"type":"string"}}},"ServiceFieldSource":{"type":"object","description":"Describes a raw field name that was used to populate a semantic group,\nalong with which stream types it appeared in and how many services used it.","required":["field_name","stream_types","hit_count"],"properties":{"field_name":{"type":"string","description":"The raw field name in the stream, e.g. \"kubernetes_labels_app\""},"hit_count":{"type":"integer","description":"Number of services where this field provided the semantic group value","minimum":0},"stream_types":{"type":"array","items":{"type":"string"},"description":"Stream types where this field was used, e.g. [\"logs\", \"traces\"]"}}},"ServiceIdentityConfig":{"type":"object","description":"Org-level service identity configuration.\n\nContains 1–5 identity sets. Service name is always derived from the \"service\"\nsemantic group — hardcoded, not configurable.\n\nAt processing time each record is matched against ALL sets; the set whose\n`distinguish_by` fields yield the most non-empty values wins (best coverage).\nIf no set has any coverage the record is skipped.","required":["sets"],"properties":{"sets":{"type":"array","items":{"$ref":"#/components/schemas/IdentitySet"}},"tracked_alias_ids":{"type":"array","items":{"type":"string"},"description":"Semantic alias group IDs whose values are tracked per service record.\nEach entry is the `id` of a `FieldAlias` group (e.g. \"k8s-cluster\", \"environment\").\nThe \"service\" group is always tracked implicitly and must NOT be listed here."}}},"SettingScope":{"type":"string","description":"Setting scope levels","enum":["system","org","user"]},"ShardResponse":{"type":"object","required":["total","successful","failed"],"properties":{"failed":{"type":"integer","format":"int64"},"successful":{"type":"integer","format":"int64"},"total":{"type":"integer","format":"int64"}}},"ShortenUrlRequest":{"type":"object","required":["original_url"],"properties":{"original_url":{"type":"string"}}},"ShortenUrlResponse":{"type":"object","required":["short_url"],"properties":{"short_url":{"type":"string"}}},"SignInResponse":{"type":"object","required":["status","message"],"properties":{"message":{"type":"string"},"status":{"type":"boolean"}}},"SizeByValue":{"type":"object","properties":{"max":{"type":"number","format":"double","default":0.0},"min":{"type":"number","format":"double","default":0.0}}},"StorageType":{"type":"string","enum":["normal","compliance"]},"Stream":{"type":"object","required":["name","storage_type","stream_type","stats","schema","settings","total_fields"],"properties":{"is_derived":{"type":["boolean","null"]},"metrics_meta":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Metadata"}]},"name":{"type":"string"},"pattern_associations":{"type":"array","items":{"$ref":"#/components/schemas/PatternAssociation"}},"schema":{"type":"array","items":{"$ref":"#/components/schemas/StreamField"}},"settings":{"$ref":"#/components/schemas/StreamSettings"},"stats":{"$ref":"#/components/schemas/StreamStats"},"storage_type":{"type":"string"},"stream_type":{"$ref":"#/components/schemas/StreamType"},"total_fields":{"type":"integer","minimum":0},"uds_schema":{"type":"array","items":{"$ref":"#/components/schemas/StreamField"}}}},"StreamCreate":{"type":"object","required":["fields","settings"],"properties":{"fields":{"type":"array","items":{"$ref":"#/components/schemas/StreamField"}},"settings":{"$ref":"#/components/schemas/StreamSettings"}}},"StreamDeleteFields":{"type":"object","required":["fields"],"properties":{"fields":{"type":"array","items":{"type":"string"}}}},"StreamField":{"type":"object","required":["name","type"],"properties":{"name":{"type":"string"},"type":{"type":"string"}}},"StreamFieldObj":{"type":"object","properties":{"field":{"type":["string","null"]},"streamAlias":{"type":["string","null"]}}},"StreamInfo":{"type":"object","description":"Information about a stream where a service was discovered","required":["stream_name"],"properties":{"filters":{"type":"object","description":"Optional filter conditions that identify this service in the stream\nExample: {\"namespace\": \"production\", \"cluster\": \"us-east-1\"}","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"stream_name":{"type":"string","description":"Stream name"},"stream_type":{"$ref":"#/components/schemas/StreamType","description":"Stream type (logs, metrics, traces)\n\nThis field explicitly identifies the stream type, enabling UIs to:\n1. Query the correct API endpoint (logs/_search vs metrics/_search)\n2. Display appropriate type badges/icons\n3. Handle flattened stream lists without losing type information"}}},"StreamOrder":{"type":"object","properties":{"applyBeforeFlattening":{"type":"boolean"},"isRemoved":{"type":"boolean"},"order":{"type":"integer","format":"int32","minimum":0},"stream":{"type":"string"},"streamType":{"$ref":"#/components/schemas/StreamType"}}},"StreamParams":{"type":"object","properties":{"org_id":{"type":"string","default":""},"stream_name":{"type":"string","default":""},"stream_type":{"oneOf":[{"$ref":"#/components/schemas/StreamType"}],"default":"logs"}}},"StreamPartition":{"type":"object","required":["field"],"properties":{"disabled":{"type":"boolean"},"field":{"type":"string"},"types":{"$ref":"#/components/schemas/StreamPartitionType"}}},"StreamPartitionType":{"oneOf":[{"type":"string","enum":["value"]},{"type":"object","required":["hash"],"properties":{"hash":{"type":"integer","format":"int64","minimum":0}}},{"type":"string","enum":["prefix"]}]},"StreamSettings":{"type":"object","properties":{"approx_partition":{"type":"boolean"},"bloom_filter_fields":{"type":"array","items":{"type":"string"}},"cross_links":{"type":"array","items":{"$ref":"#/components/schemas/CrossLink"}},"data_retention":{"type":"integer","format":"int64"},"defined_schema_fields":{"type":"array","items":{"type":"string"}},"distinct_value_fields":{"type":"array","items":{"$ref":"#/components/schemas/DistinctField"}},"enable_distinct_fields":{"type":"boolean"},"enable_log_patterns_extraction":{"type":"boolean"},"extended_retention_days":{"type":"array","items":{"$ref":"#/components/schemas/TimeRange"}},"flatten_level":{"type":["integer","null"],"format":"int64"},"full_text_search_keys":{"type":"array","items":{"type":"string"}},"index_all_values":{"type":"boolean"},"index_fields":{"type":"array","items":{"type":"string"}},"index_original_data":{"type":"boolean"},"index_updated_at":{"type":"integer","format":"int64"},"is_llm_stream":{"type":"boolean"},"max_query_range":{"type":"integer","format":"int64"},"partition_keys":{"type":"array","items":{"$ref":"#/components/schemas/StreamPartition"}},"storage_type":{"$ref":"#/components/schemas/StorageType"},"store_original_data":{"type":"boolean"}}},"StreamStats":{"type":"object","required":["created_at","doc_time_min","doc_time_max","doc_num","file_num","storage_size","compressed_size","index_size"],"properties":{"compressed_size":{"type":"number","format":"double"},"created_at":{"type":"integer","format":"int64"},"doc_num":{"type":"integer","format":"int64"},"doc_time_max":{"type":"integer","format":"int64"},"doc_time_min":{"type":"integer","format":"int64"},"file_num":{"type":"integer","format":"int64"},"index_size":{"type":"number","format":"double"},"storage_size":{"type":"number","format":"double"}}},"StreamStatus":{"allOf":[{"$ref":"#/components/schemas/RecordStatus"},{"type":"object","required":["name"],"properties":{"name":{"type":"string"}}}]},"StreamSummary":{"type":"object","required":["num_streams","total_records","total_storage_size","total_compressed_size","total_index_size"],"properties":{"num_streams":{"type":"integer","format":"int64"},"total_compressed_size":{"type":"number","format":"double"},"total_index_size":{"type":"number","format":"double"},"total_records":{"type":"integer","format":"int64"},"total_storage_size":{"type":"number","format":"double"}}},"StreamType":{"type":"string","enum":["logs","metrics","traces","service_graph","enrichment_tables","file_list","metadata","index"]},"SystemSetting":{"type":"object","description":"A system setting record","required":["scope","setting_key","setting_value"],"properties":{"created_at":{"type":"integer","format":"int64","description":"Created timestamp (microseconds)"},"created_by":{"type":["string","null"],"description":"User who created this setting"},"description":{"type":["string","null"],"description":"Optional description"},"id":{"type":["integer","null"],"format":"int64","description":"Unique identifier"},"org_id":{"type":["string","null"],"description":"Organization ID (required for org/user scope)"},"scope":{"$ref":"#/components/schemas/SettingScope","description":"Setting scope (system, org, user)"},"setting_category":{"type":["string","null"],"description":"Optional category for grouping"},"setting_key":{"type":"string","description":"Setting key identifier"},"setting_value":{"description":"The setting value (JSON)"},"updated_at":{"type":"integer","format":"int64","description":"Updated timestamp (microseconds)"},"updated_by":{"type":["string","null"],"description":"User who last updated this setting"},"user_id":{"type":["string","null"],"description":"User ID (required for user scope)"}}},"SystemSettingPayload":{"type":"object","description":"Request to create or update a setting","required":["setting_key","setting_value"],"properties":{"description":{"type":["string","null"],"description":"Optional description"},"setting_category":{"type":["string","null"],"description":"Optional category"},"setting_key":{"type":"string","description":"Setting key"},"setting_value":{"description":"Setting value (JSON)"}}},"Tab":{"type":"object","required":["tabId","name"],"properties":{"name":{"type":"string"},"panels":{"type":"array","items":{"$ref":"#/components/schemas/Panel"}},"tabId":{"type":"string"}}},"Template":{"type":"object","properties":{"body":{"type":"string"},"isDefault":{"type":["boolean","null"]},"name":{"type":"string"},"title":{"type":"string"},"type":{"$ref":"#/components/schemas/DestinationType","description":"Indicates whether the body is\nhttp or email body"}}},"TemplateType":{"oneOf":[{"type":"string","enum":["http"]},{"type":"object","required":["email"],"properties":{"email":{"type":"object","required":["title"],"properties":{"title":{"type":"string"}}}}},{"type":"string","enum":["sns"]}]},"TestVRLRequest":{"type":"object","required":["function","events"],"properties":{"events":{"type":"array","items":{}},"function":{"type":"string"},"trans_type":{"type":["integer","null"],"format":"int32","minimum":0}}},"TimeRange":{"type":"object","required":["start","end"],"properties":{"end":{"type":"integer","format":"int64","description":"End timestamp in microseconds"},"start":{"type":"integer","format":"int64","description":"Start timestamp in microseconds"}}},"TimeShift":{"type":"object","properties":{"offSet":{"type":["string","null"],"default":null}}},"TimedAnnotation":{"type":"object","properties":{"annotation_id":{"type":["string","null"],"default":null},"end_time":{"type":["integer","null"],"format":"int64","default":null},"panels":{"type":"array","items":{"type":"string"},"default":[]},"start_time":{"type":"integer","format":"int64","default":0},"tags":{"type":"array","items":{"type":"string"},"default":[]},"text":{"type":["string","null"],"default":null},"title":{"type":"string","default":""}}},"TimedAnnotationDelete":{"type":"object","required":["annotation_ids"],"properties":{"annotation_ids":{"type":"array","items":{"type":"string"}}}},"TimedAnnotationReq":{"type":"object","required":["timed_annotations"],"properties":{"timed_annotations":{"type":"array","items":{"$ref":"#/components/schemas/TimedAnnotation"}}}},"TimedAnnotationUpdate":{"type":"object","properties":{"end_time":{"type":["integer","null"],"format":"int64"},"panels":{"type":["array","null"],"items":{"type":"string"}},"start_time":{"type":["integer","null"],"format":"int64"},"tags":{"type":["array","null"],"items":{"type":"string"}},"text":{"type":["string","null"]},"title":{"type":["string","null"]}}},"Transform":{"type":"object","required":["function"],"properties":{"function":{"type":"string"},"name":{"type":"string"},"numArgs":{"type":"integer","format":"int32","minimum":0},"params":{"type":"string"},"streams":{"type":["array","null"],"items":{"$ref":"#/components/schemas/StreamOrder"}},"transType":{"type":["integer","null"],"format":"int32","minimum":0}}},"Trellis":{"type":"object","properties":{"group_by_y_axis":{"type":["boolean","null"],"default":null},"layout":{"type":["string","null"],"default":null},"num_of_columns":{"type":"integer","format":"int64","default":0}}},"TriggerCondition":{"type":"object","properties":{"align_time":{"type":"boolean","default":false},"cron":{"type":"string","default":""},"frequency":{"type":"integer","format":"int64","description":"(seconds)","default":0},"frequency_type":{"oneOf":[{"$ref":"#/components/schemas/FrequencyType"}],"default":"minutes"},"operator":{"oneOf":[{"$ref":"#/components/schemas/Operator"}],"default":"="},"period":{"type":"integer","format":"int64","description":"(minutes)","default":0},"silence":{"type":"integer","format":"int64","description":"(minutes)","default":0},"threshold":{"type":"integer","format":"int64","default":0},"timezone":{"type":["string","null"],"default":null},"tolerance_in_secs":{"type":["integer","null"],"format":"int64","description":"(seconds)","default":null}}},"TriggerStatus":{"type":"object","required":["healthy","failed","warning"],"properties":{"failed":{"type":"integer","format":"int64"},"healthy":{"type":"integer","format":"int64"},"warning":{"type":"integer","format":"int64"}}},"UpdateAlertRequestBody":{"allOf":[{"oneOf":[{"type":"object","description":"Alert configuration for monitoring streams and triggering notifications.\n\nAn alert watches a stream (logs, metrics, or traces) using SQL or PromQL queries,\nand sends notifications to configured destinations when trigger conditions are met.","properties":{"context_attributes":{"type":["object","null"],"description":"Optional key-value attributes to include in alert notifications.","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"creates_incident":{"type":"boolean","description":"When true, this alert routes notifications through the incident system\ninstead of sending direct alert notifications."},"deduplication":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/DeduplicationConfig","description":"Optional deduplication configuration to prevent alert spam."}]},"description":{"type":"string","description":"Human-readable description of what this alert monitors.","example":"Fires when error count exceeds threshold in the specified time window"},"destinations":{"type":"array","items":{"type":"string"},"description":"List of destination names to notify when alert fires.\nDestinations must be pre-configured in the system.\nAccepts either `destinations` or `alert_destinations` as the JSON field name.","example":["slack-alerts","pagerduty"]},"enabled":{"type":"boolean","description":"Whether the alert is active. Disabled alerts are not evaluated."},"id":{"type":["string","null"],"description":"Unique identifier for the alert. Auto-generated on creation.","readOnly":true},"is_real_time":{"type":"boolean","description":"If true, alert evaluates in real-time as data arrives.\nIf false, alert runs on a schedule defined by trigger_condition.frequency."},"last_edited_by":{"type":["string","null"],"description":"Username who last edited the alert.","readOnly":true},"last_satisfied_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert condition was last satisfied.","readOnly":true},"last_triggered_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of when alert was last triggered.","readOnly":true},"name":{"type":"string","description":"Human-readable name for the alert. Must be unique within the organization.","example":"High Error Rate Alert"},"org_id":{"type":"string","description":"Organization ID. Usually set automatically from the request context."},"owner":{"type":["string","null"],"description":"Username of the alert owner."},"query_condition":{"$ref":"#/components/schemas/QueryCondition","description":"Query configuration: SQL query or PromQL expression to evaluate."},"row_template":{"type":"string","description":"Template for formatting individual rows in the alert message."},"row_template_type":{"$ref":"#/components/schemas/RowTemplateType","description":"Format type for the row template."},"stream_name":{"type":"string","description":"Name of the stream to monitor.","example":"default"},"stream_type":{"$ref":"#/components/schemas/StreamType","description":"Type of stream to monitor: logs, metrics, or traces."},"template":{"type":["string","null"],"description":"Optional template name. When specified, this template is used for all\ndestinations instead of destination-level templates. This allows using\ndifferent templates for different alerts while reusing the same destinations."},"trigger_condition":{"$ref":"#/components/schemas/TriggerCondition","description":"Trigger configuration: when and how often to evaluate, thresholds."},"tz_offset":{"type":"integer","format":"int32","description":"Timezone offset in minutes. Negative values for western hemisphere."},"updated_at":{"type":["integer","null"],"format":"int64","description":"Unix timestamp of last modification.","readOnly":true}}}],"description":"Alert configuration fields (used for scheduled/realtime alerts)."},{"type":"object","properties":{"alert_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/AlertTypeFilter","description":"Discriminates the alert type. When `\"anomaly_detection\"`, delegates to the\nanomaly config update path."}]},"anomaly_config":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UpdateAnomalyAlertFields","description":"Anomaly-detection-specific fields to update (partial — only supplied fields\nare changed)."}]}}}],"description":"HTTP request body for `UpdateAlert` endpoint.\n\nUpdates an existing alert. Provide the full alert configuration — this replaces\nthe existing alert entirely (not a partial update). The request body is the same\nstructure as Alert.\n\nFor anomaly detection configs, set `alert_type = \"anomaly_detection\"` and supply\nanomaly-specific fields directly at the top level (flat). Only fields present in\nthe request body will be updated (partial update semantics for anomaly fields)."},"UpdateAnomalyAlertFields":{"type":"object","description":"Anomaly-detection-specific fields for `UpdateAlertRequestBody` (all optional).","properties":{"alert_enabled":{"type":["boolean","null"]},"custom_sql":{"type":["string","null"]},"description":{"type":["string","null"]},"detection_function":{"type":["string","null"]},"detection_function_field":{"type":["string","null"],"description":"Field to aggregate. Combined with `detection_function` into \"avg(field)\" before saving."},"detection_window_seconds":{"type":["integer","null"],"format":"int64"},"enabled":{"type":["boolean","null"]},"filters":{},"folder_id":{"type":["string","null"]},"histogram_interval":{"type":["string","null"]},"name":{"type":["string","null"]},"owner":{"type":["string","null"]},"percentile":{"type":["number","null"],"format":"double"},"query_mode":{"type":["string","null"]},"retrain_interval_days":{"type":["integer","null"],"format":"int32"},"schedule_interval":{"type":["string","null"]},"training_window_days":{"type":["integer","null"],"format":"int32"}}},"UpdateFolderRequestBody":{"$ref":"#/components/schemas/Folder","description":"HTTP request body for `UpdateFolder` endpoint."},"UpdatePayload":{"oneOf":[{"type":"object","description":"Update incident title","required":["title"],"properties":{"title":{"type":"string"}}},{"type":"object","description":"Update incident severity","required":["severity"],"properties":{"severity":{"$ref":"#/components/schemas/IncidentSeverity"}}},{"type":"object","description":"Update incident status","required":["status"],"properties":{"status":{"$ref":"#/components/schemas/IncidentStatus"}}}],"description":"Update payload enum for incident field updates\nEnsures only one field can be updated per request"},"UpdateSettingsWrapper_CrossLink":{"type":"object","properties":{"add":{"type":"array","items":{"type":"object","description":"A cross-link entry for drill-down/navigation from log/trace records","required":["name","url"],"properties":{"fields":{"type":"array","items":{"$ref":"#/components/schemas/CrossLinkField"},"description":"Show link only when at least one field matches the record.\nIf empty, the link is always shown."},"name":{"type":"string","description":"Display name for the link"},"url":{"type":"string","description":"URL template with {field_name} placeholders"}}}},"remove":{"type":"array","items":{"type":"object","description":"A cross-link entry for drill-down/navigation from log/trace records","required":["name","url"],"properties":{"fields":{"type":"array","items":{"$ref":"#/components/schemas/CrossLinkField"},"description":"Show link only when at least one field matches the record.\nIf empty, the link is always shown."},"name":{"type":"string","description":"Display name for the link"},"url":{"type":"string","description":"URL template with {field_name} placeholders"}}}}}},"UpdateSettingsWrapper_PatternAssociation":{"type":"object","properties":{"add":{"type":"array","items":{"type":"object","required":["field","pattern_name","description","pattern","pattern_id","policy","apply_at"],"properties":{"apply_at":{"type":"string"},"description":{"type":"string"},"field":{"type":"string"},"pattern":{"type":"string"},"pattern_id":{"type":"string"},"pattern_name":{"type":"string"},"policy":{"type":"string"}}}},"remove":{"type":"array","items":{"type":"object","required":["field","pattern_name","description","pattern","pattern_id","policy","apply_at"],"properties":{"apply_at":{"type":"string"},"description":{"type":"string"},"field":{"type":"string"},"pattern":{"type":"string"},"pattern_id":{"type":"string"},"pattern_name":{"type":"string"},"policy":{"type":"string"}}}}}},"UpdateSettingsWrapper_StreamPartition":{"type":"object","properties":{"add":{"type":"array","items":{"type":"object","required":["field"],"properties":{"disabled":{"type":"boolean"},"field":{"type":"string"},"types":{"$ref":"#/components/schemas/StreamPartitionType"}}}},"remove":{"type":"array","items":{"type":"object","required":["field"],"properties":{"disabled":{"type":"boolean"},"field":{"type":"string"},"types":{"$ref":"#/components/schemas/StreamPartitionType"}}}}}},"UpdateSettingsWrapper_String":{"type":"object","properties":{"add":{"type":"array","items":{"type":"string"}},"remove":{"type":"array","items":{"type":"string"}}}},"UpdateSettingsWrapper_TimeRange":{"type":"object","properties":{"add":{"type":"array","items":{"type":"object","required":["start","end"],"properties":{"end":{"type":"integer","format":"int64","description":"End timestamp in microseconds"},"start":{"type":"integer","format":"int64","description":"Start timestamp in microseconds"}}}},"remove":{"type":"array","items":{"type":"object","required":["start","end"],"properties":{"end":{"type":"integer","format":"int64","description":"End timestamp in microseconds"},"start":{"type":"integer","format":"int64","description":"Start timestamp in microseconds"}}}}}},"UpdateStreamSettings":{"type":"object","properties":{"approx_partition":{"type":["boolean","null"]},"bloom_filter_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"cross_links":{"$ref":"#/components/schemas/UpdateSettingsWrapper_CrossLink"},"data_retention":{"type":["integer","null"],"format":"int64"},"defined_schema_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"distinct_value_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"enable_distinct_fields":{"type":["boolean","null"]},"enable_log_patterns_extraction":{"type":["boolean","null"]},"extended_retention_days":{"$ref":"#/components/schemas/UpdateSettingsWrapper_TimeRange"},"flatten_level":{"type":["integer","null"],"format":"int64"},"full_text_search_keys":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"index_all_values":{"type":["boolean","null"]},"index_fields":{"$ref":"#/components/schemas/UpdateSettingsWrapper_String"},"index_original_data":{"type":["boolean","null"]},"max_query_range":{"type":["integer","null"],"format":"int64"},"partition_keys":{"$ref":"#/components/schemas/UpdateSettingsWrapper_StreamPartition"},"pattern_associations":{"$ref":"#/components/schemas/UpdateSettingsWrapper_PatternAssociation"},"storage_type":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/StorageType"}]},"store_original_data":{"type":["boolean","null"]}}},"UpdateUser":{"allOf":[{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/UserRoleRequest"}]},{"type":"object","properties":{"change_password":{"type":"boolean"},"first_name":{"type":["string","null"]},"last_name":{"type":["string","null"]},"new_password":{"type":["string","null"]},"old_password":{"type":["string","null"]},"token":{"type":["string","null"]}}}]},"UpdateViewRequest":{"type":"object","required":["data","view_name"],"properties":{"data":{"description":"Base64 encoded string, containing all the data for a given view.\nThis data is expected to be versioned so that the frontend can\ndeserialize as required."},"view_name":{"type":"string","description":"User-readable name of the view, doesn't need to be unique."}}},"UserList":{"type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/UserResponse"}}}},"UserOrgRole":{"type":"object","required":["role"],"properties":{"custom_role":{"type":["array","null"],"items":{"type":"string"}},"role":{"$ref":"#/components/schemas/UserRole"}}},"UserResponse":{"type":"object","required":["email","role","created_at"],"properties":{"created_at":{"type":"integer","format":"int64"},"description":{"type":["string","null"],"description":"Human-readable description of what this account is used for."},"email":{"type":"string"},"first_name":{"type":"string"},"is_external":{"type":"boolean"},"is_system":{"type":"boolean","description":"True when this account is a system-managed service account.\nThe UI should display \"System Managed\" for the role instead of the raw role string."},"last_name":{"type":"string"},"orgs":{"type":["array","null"],"items":{"$ref":"#/components/schemas/OrgRoleMapping"}},"role":{"type":"string"},"token":{"type":["string","null"]}}},"UserRole":{"type":"string","enum":["root","admin","editor","viewer","user","service_account","sre_agent"]},"UserRoleRequest":{"type":"object","required":["role"],"properties":{"custom_role":{"type":["array","null"],"items":{"type":"string"}},"role":{"type":"string"}}},"VariableList":{"type":"object","properties":{"customMultiSelectValue":{"type":["array","null"],"items":{"type":"string"},"default":null},"escapeSingleQuotes":{"type":["boolean","null"],"default":null},"hideOnDashboard":{"type":["boolean","null"],"default":null},"label":{"type":"string","default":""},"multiSelect":{"type":["boolean","null"],"default":null},"name":{"type":"string","default":""},"options":{"type":["array","null"],"items":{"$ref":"#/components/schemas/CustomFieldsOption"},"default":null},"panels":{"type":["array","null"],"items":{"type":"string"},"default":null},"query_data":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/QueryData"}],"default":null},"scope":{"type":["string","null"],"default":null},"selectAllValueForMultiSelect":{"type":["string","null"],"default":null},"tabs":{"type":["array","null"],"items":{"type":"string"},"default":null},"type":{"type":"string","default":""},"value":{"type":["string","null"],"default":null}}},"Variables":{"type":"object","properties":{"list":{"type":"array","items":{"$ref":"#/components/schemas/VariableList"},"default":[]},"showDynamicFilters":{"type":["boolean","null"],"default":null}}},"View":{"type":"object","required":["org_id","data","view_id","view_name"],"properties":{"data":{},"org_id":{"type":"string"},"view_id":{"type":"string"},"view_name":{"type":"string"}}},"ViewWithoutData":{"type":"object","description":"Save the bandwidth for a given view, without sending the actual data\nThis is expected to be used for listing views.","required":["org_id","view_id","view_name"],"properties":{"org_id":{"type":"string"},"view_id":{"type":"string"},"view_name":{"type":"string"}}},"ViewsWithoutData":{"type":"object","required":["views"],"properties":{"views":{"type":"array","items":{"$ref":"#/components/schemas/ViewWithoutData"}}}}},"securitySchemes":{"Authorization":{"type":"apiKey","in":"header","name":"Authorization"},"BasicAuth":{"type":"http","scheme":"basic"}}},"tags":[{"name":"Meta","description":"Meta details about the OpenObserve state itself. e.g. healthz"},{"name":"Auth","description":"User login authentication"},{"name":"Logs","description":"Logs data ingestion operations"},{"name":"Dashboards","description":"Dashboard operations"},{"name":"Search","description":"Search/Query operations"},{"name":"Saved Views","description":"Collection of saved search views for easy retrieval"},{"name":"Alerts","description":"Alerts retrieval & management operations"},{"name":"Incidents","description":"Alert incident correlation & management operations"},{"name":"AI","description":"AI agent chat analysis and SRE agent operations (enterprise)"},{"name":"Functions","description":"Functions retrieval & management operations"},{"name":"Organizations","description":"Organizations retrieval & management operations"},{"name":"Streams","description":"Stream retrieval & management operations"},{"name":"Users","description":"Users retrieval & management operations"},{"name":"KV","description":"Key Value retrieval & management operations"},{"name":"Metrics","description":"Metrics data ingestion operations"},{"name":"Traces","description":"Traces data ingestion operations"},{"name":"Clusters","description":"Super cluster operations"},{"name":"Short Url","description":"Short Url Service"},{"name":"Ratelimit","description":"Ratelimit operations"},{"name":"Patterns","description":"Log pattern extraction operations (enterprise)"},{"name":"Service Streams","description":"Multi-signal correlation across logs, traces, and metrics (enterprise)"}]}