diff --git a/go.mod b/go.mod index 0db0f08..fb0def4 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli go 1.26.0 require ( - github.com/flashcatcloud/go-flashduty v0.15.14 + github.com/flashcatcloud/go-flashduty v0.15.15-0.20261010142149-a2783aa8de6d github.com/mattn/go-runewidth v0.0.30 github.com/spf13/cobra v1.10.2 github.com/spf13/pflag v1.0.10 diff --git a/go.sum b/go.sum index 11bf3d1..6b85cdc 100644 --- a/go.sum +++ b/go.sum @@ -3,6 +3,8 @@ github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/flashcatcloud/go-flashduty v0.15.14 h1:185WAkgahlRnLBk3jI6kYL2t8IoH5YtQ9Pd4ckEPRWM= github.com/flashcatcloud/go-flashduty v0.15.14/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= +github.com/flashcatcloud/go-flashduty v0.15.15-0.20261010142149-a2783aa8de6d h1:KMx5LQPuDr57zNEoQp2M+Fqf3rSvkkWTuzzmaqIncno= +github.com/flashcatcloud/go-flashduty v0.15.15-0.20261010142149-a2783aa8de6d/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk= diff --git a/internal/cli/zz_generated_alert_rules.go b/internal/cli/zz_generated_alert_rules.go index 9135d6f..4ce8a87 100644 --- a/internal/cli/zz_generated_alert_rules.go +++ b/internal/cli/zz_generated_alert_rules.go @@ -231,8 +231,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional. - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object. - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query] + - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars) - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'. - - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991) + - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991) - query (object) (required) — Query payload. - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates. - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates. @@ -477,8 +478,9 @@ Request fields: - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional. - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object. - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query] + - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars) - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'. - - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991) + - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991) - query (object) (required) — Query payload. - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates. - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates. @@ -562,8 +564,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional. - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object. - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query] + - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars) - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'. - - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991) + - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991) - query (object) (required) — Query payload. - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates. - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates. @@ -1112,8 +1115,9 @@ Request fields: - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional. - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object. - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query] + - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars) - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'. - - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991) + - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991) - query (object) (required) — Query payload. - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates. - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates. @@ -1197,8 +1201,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional. - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object. - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query] + - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars) - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'. - - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991) + - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991) - query (object) (required) — Query payload. - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates. - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates. diff --git a/internal/cli/zz_generated_response_help.go b/internal/cli/zz_generated_response_help.go index db2e961..807ac4a 100644 --- a/internal/cli/zz_generated_response_help.go +++ b/internal/cli/zz_generated_response_help.go @@ -26,12 +26,12 @@ var responseHelpBySDKMethod = map[string]string{ "AlertRules.ReadAuditDetail": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) (required) — ID of the account that owns the rule.\n - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n - id (integer) (required) — Audit record ID.\n", "AlertRules.ReadAudits": "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — ID of the account that owns the rule.\n - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n - id (integer) (required) — Audit record ID.\n", "AlertRules.ReadCounterTotal": "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — ID of the account this snapshot belongs to.\n - clock (string) (required) — Sample timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - id (integer) (required) — ID of this snapshot record.\n - num (integer) (required) — Rule count at the sample time.\n", - "AlertRules.ReadInfoV2": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n - channel_ids (array) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n - description (string) — Rule description, Markdown format.\n - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n - ds_ids (array) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n - ds_list (array) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n - enabled_times (array) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n - days (array) — Days of week (0=Sunday).\n - etime (string) — End time, e.g. `18:00`.\n - stime (string) — Start time, e.g. `09:00`.\n - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n - investigation_targets (array) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n - query (object) (required) — Query payload.\n - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n - labels (object) — Custom labels.\n - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n - critical (string) — Critical threshold expression referencing query results as `$` or `$.`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n - enabled (boolean) — Whether the threshold check is enabled.\n - info (string) — Info threshold expression; same syntax as `critical`.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n - warning (string) — Warning threshold expression; same syntax as `critical`.\n - queries (array) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n - args (object) — Datasource-specific query parameters; keys follow the `.` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n - expr (string) — Query expression.\n - label_fields (array) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n - value_fields (array) — Numeric result fields evaluated by threshold expressions (referenced as `$A.`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n - relate_queries (array) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n - expr (string) — Query expression.\n - name (string) — Auxiliary query identifier.\n - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n", + "AlertRules.ReadInfoV2": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n - channel_ids (array) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n - description (string) — Rule description, Markdown format.\n - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n - ds_ids (array) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n - ds_list (array) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n - enabled_times (array) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n - days (array) — Days of week (0=Sunday).\n - etime (string) — End time, e.g. `18:00`.\n - stime (string) — Start time, e.g. `09:00`.\n - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n - investigation_targets (array) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)\n - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)\n - query (object) (required) — Query payload.\n - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n - labels (object) — Custom labels.\n - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n - critical (string) — Critical threshold expression referencing query results as `$` or `$.`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n - enabled (boolean) — Whether the threshold check is enabled.\n - info (string) — Info threshold expression; same syntax as `critical`.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n - warning (string) — Warning threshold expression; same syntax as `critical`.\n - queries (array) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n - args (object) — Datasource-specific query parameters; keys follow the `.` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n - expr (string) — Query expression.\n - label_fields (array) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n - value_fields (array) — Numeric result fields evaluated by threshold expressions (referenced as `$A.`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n - relate_queries (array) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n - expr (string) — Query expression.\n - name (string) — Auxiliary query identifier.\n - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n", "AlertRules.ReadList": "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID.\n - active_alert_count (integer) (required) — Number of currently active (unrecovered) alerts fired by this rule. `triggered` equals `active_alert_count > 0`.\n - created_at (string) (required) — Creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — ID of the user who created the rule.\n - creator_name (string) (required) — Name of the user who created the rule.\n - cron_pattern (string) (required) — Schedule expression: a 6-field cron with seconds, e.g. `0 * * * * *`, or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n - debug_log_enabled (boolean) (required) — Whether debug logging is enabled.\n - delay_seconds (integer) (required) — Evaluation delay in seconds.\n - ds_type (string) (required) — Data source type, e.g. `prometheus`.\n - enabled (boolean) (required) — Whether the rule is enabled.\n - folder_id (integer) (required) — Folder ID.\n - id (integer) (required) — Unique rule ID.\n - labels (object) (required) — Custom labels.\n - name (string) (required) — Rule name.\n - runtime_state (string) — Runtime evaluation state, derived from edge heartbeats and the edge-reported rule status. Omitted when the state is unavailable. | Value | Meaning | |---|---| | `disabled` | The rule is disabled. | | `offline` | The edge instance or cluster owning this rule is offline. | | `abnormal` | The edge reports evaluation errors. | | `stale` | The edge's runtime status report is outdated. | | `no_datasource` | No datasource currently matches the rule's `ds_list` / `ds_ids`. | | `config_pending` | The latest rule config has not been delivered to the edge yet. | | `waiting` | Enabled, but the edge has not reported runtime status yet. | | `normal` | Evaluating normally. | [disabled, offline, abnormal, stale, no_datasource, config_pending, waiting, normal]\n - timezone (string) (required) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n - triggered (boolean) (required) — True if the rule currently has active alerts.\n - updated_at (string) (required) — Last modification time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - updater_id (integer) (required) — ID of the user who last modified the rule.\n - updater_name (string) (required) — Name of the user who last modified the rule.\n", - "AlertRules.WriteCreateV2": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n - channel_ids (array) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n - description (string) — Rule description, Markdown format.\n - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n - ds_ids (array) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n - ds_list (array) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n - enabled_times (array) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n - days (array) — Days of week (0=Sunday).\n - etime (string) — End time, e.g. `18:00`.\n - stime (string) — Start time, e.g. `09:00`.\n - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n - investigation_targets (array) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n - query (object) (required) — Query payload.\n - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n - labels (object) — Custom labels.\n - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n - critical (string) — Critical threshold expression referencing query results as `$` or `$.`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n - enabled (boolean) — Whether the threshold check is enabled.\n - info (string) — Info threshold expression; same syntax as `critical`.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n - warning (string) — Warning threshold expression; same syntax as `critical`.\n - queries (array) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n - args (object) — Datasource-specific query parameters; keys follow the `.` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n - expr (string) — Query expression.\n - label_fields (array) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n - value_fields (array) — Numeric result fields evaluated by threshold expressions (referenced as `$A.`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n - relate_queries (array) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n - expr (string) — Query expression.\n - name (string) — Auxiliary query identifier.\n - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n", + "AlertRules.WriteCreateV2": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n - channel_ids (array) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n - description (string) — Rule description, Markdown format.\n - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n - ds_ids (array) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n - ds_list (array) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n - enabled_times (array) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n - days (array) — Days of week (0=Sunday).\n - etime (string) — End time, e.g. `18:00`.\n - stime (string) — Start time, e.g. `09:00`.\n - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n - investigation_targets (array) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)\n - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)\n - query (object) (required) — Query payload.\n - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n - labels (object) — Custom labels.\n - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n - critical (string) — Critical threshold expression referencing query results as `$` or `$.`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n - enabled (boolean) — Whether the threshold check is enabled.\n - info (string) — Info threshold expression; same syntax as `critical`.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n - warning (string) — Warning threshold expression; same syntax as `critical`.\n - queries (array) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n - args (object) — Datasource-specific query parameters; keys follow the `.` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n - expr (string) — Query expression.\n - label_fields (array) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n - value_fields (array) — Numeric result fields evaluated by threshold expressions (referenced as `$A.`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n - relate_queries (array) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n - expr (string) — Query expression.\n - name (string) — Auxiliary query identifier.\n - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n", "AlertRules.WriteFieldsUpdate": "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - message (string) (required) — Empty on success, error message on failure.\n - name (string) (required) — Rule name.\n", "AlertRules.WriteMove": "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - message (string) (required) — Empty on success, error message on failure.\n - name (string) (required) — Rule name.\n", - "AlertRules.WriteUpdateV2": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n - channel_ids (array) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n - description (string) — Rule description, Markdown format.\n - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n - ds_ids (array) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n - ds_list (array) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n - enabled_times (array) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n - days (array) — Days of week (0=Sunday).\n - etime (string) — End time, e.g. `18:00`.\n - stime (string) — Start time, e.g. `09:00`.\n - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n - investigation_targets (array) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n - query (object) (required) — Query payload.\n - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n - labels (object) — Custom labels.\n - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n - critical (string) — Critical threshold expression referencing query results as `$` or `$.`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n - enabled (boolean) — Whether the threshold check is enabled.\n - info (string) — Info threshold expression; same syntax as `critical`.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n - warning (string) — Warning threshold expression; same syntax as `critical`.\n - queries (array) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n - args (object) — Datasource-specific query parameters; keys follow the `.` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n - expr (string) — Query expression.\n - label_fields (array) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n - value_fields (array) — Numeric result fields evaluated by threshold expressions (referenced as `$A.`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n - relate_queries (array) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n - expr (string) — Query expression.\n - name (string) — Auxiliary query identifier.\n - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n", + "AlertRules.WriteUpdateV2": "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n - channel_ids (array) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n - description (string) — Rule description, Markdown format.\n - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n - ds_ids (array) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n - ds_list (array) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n - enabled_times (array) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n - days (array) — Days of week (0=Sunday).\n - etime (string) — End time, e.g. `18:00`.\n - stime (string) — Start time, e.g. `09:00`.\n - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n - investigation_targets (array) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)\n - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)\n - query (object) (required) — Query payload.\n - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n - labels (object) — Custom labels.\n - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n - critical (string) — Critical threshold expression referencing query results as `$` or `$.`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n - enabled (boolean) — Whether the threshold check is enabled.\n - info (string) — Info threshold expression; same syntax as `critical`.\n - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `.` convention as a query's `args`. Not returned when empty.\n - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n - value_fields (array) — Numeric result fields the recovery expression references as `$A.`; same semantics as a query's `value_fields`. Not returned when empty.\n - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n - warning (string) — Warning threshold expression; same syntax as `critical`.\n - queries (array) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n - args (object) — Datasource-specific query parameters; keys follow the `.` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n - expr (string) — Query expression.\n - label_fields (array) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n - value_fields (array) — Numeric result fields evaluated by threshold expressions (referenced as `$A.`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n - relate_queries (array) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n - expr (string) — Query expression.\n - name (string) — Auxiliary query identifier.\n - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n", "Alerts.EventReadList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Alerts.ReadEventList": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) — Account ID.\n - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n - alert_key (string) — Deduplication key used to merge events into an alert.\n - channel_id (integer) — Channel ID the event is routed to.\n - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - description (string) — Event description.\n - event_id (string) — Event ID (MongoDB ObjectID).\n - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - images (array) — Images attached to the event.\n - alt (string) — Alt text.\n - href (string) — Optional link URL when the image is clicked.\n - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n - integration_id (integer) — Integration that produced this event.\n - integration_type (string) — Type/plugin key of the integration that produced this event.\n - labels (object) — Label key-value pairs.\n - title (string) — Event title.\n - title_rule (string) — Title template used to derive `title` from labels.\n - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n", "Alerts.ReadFeed": "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n - account_id (integer) (required) — Account ID.\n - agent_session_id (string) — AI SRE session that produced the entry. Omitted when no agent wrote it.\n - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.\n - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - detail (object) (required) — Type-specific payload; the concrete shape is determined by `type`. May be `null` for entries stored without detail.\n - comment (string) — Comment body.\n - in_secs (integer) — Window in seconds over which the state changes were counted. Omitted when zero.\n - max_changes (integer) — State-change count threshold that triggered flapping detection. Omitted when zero.\n - mute_secs (integer) — Mute duration in seconds. Omitted when zero.\n - owner_id (integer) — New owner member ID set on the target incident. Omitted when unchanged.\n - rule_id (string) — Silence rule ID that muted the alert. Omitted when empty.\n - rule_name (string) — Silence rule name, resolved at read time. Omitted when empty.\n - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n - source_alert_id (string) — ID of the source alert that triggered the inhibition. Omitted when empty.\n - source_alert_title (string) — Title of the source alert, resolved at read time. Omitted when empty.\n - source_alerts (array) — Source alerts merged into the target incident. Omitted when empty.\n - alert_id (string) — Alert ID (ObjectID hex string).\n - title (string) — Alert title, resolved at read time. Omitted when empty.\n - status (string) — Severity level. [Ok, Critical, Warning, Info]\n - target_incident (object) — Incident the alerts were merged into. Omitted when not recorded.\n - incident_id (string) — Incident ID (ObjectID hex string).\n - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n - title (string) — Incident title.\n - title (string) — New title set on the target incident. Omitted when unchanged.\n - ref_id (string) (required) — ObjectID of the alert this entry references.\n - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching `detail` payload shape is determined by this field. | Type | Meaning | |---|---| | `a_new` | Alert triggered by an incoming event. | | `a_update` | Alert severity or status changed on an incoming event. | | `a_comm` | Comment added on the alert. | | `a_merge` | Alert merged into an incident. | | `a_m_silence` | Alert muted by a silence rule. | | `a_m_inhibit` | Alert muted by an inhibit rule. | | `a_m_flapping` | Alert muted by flapping detection (historical data only; no longer produced). | | `a_ack` | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | `a_unack` | Alert acknowledgement revoked (historical data only). | | `a_close` | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]\n - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n - via (string) — Surface that wrote the entry on a user's behalf; currently only `ai_sre`. Omitted when a user created the entry directly.\n",