{
  "$schema": "https://json-structure.org/meta/core/v0/#",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-structure/sase-aggregate-monitoring-api-aggregation-response-structure.json",
  "name": "AggregationResponse",
  "description": "AggregationResponse schema from Palo Alto Networks SASE Aggregate Monitoring API",
  "type": "object",
  "properties": {
    "total": {
      "type": "int32",
      "description": "Total number of matching records before count limit."
    },
    "count": {
      "type": "int32",
      "description": "Number of records returned."
    },
    "time_range": {
      "type": "object",
      "properties": {
        "start": {
          "type": "datetime"
        },
        "end": {
          "type": "datetime"
        }
      }
    },
    "data": {
      "type": "array",
      "description": "Array of result objects. Schema varies by query type and group_by dimensions.",
      "items": {
        "type": "object",
        "additionalProperties": true
      }
    },
    "histogram": {
      "type": "array",
      "description": "Time-series histogram buckets when histogram configuration was specified in the query.",
      "items": {
        "type": "object",
        "properties": {
          "timestamp": {
            "type": "datetime"
          },
          "count": {
            "type": "int32"
          },
          "values": {
            "type": "object",
            "additionalProperties": true
          }
        }
      }
    }
  }
}