Skip to main content

Response format

Every successful response has the same outer shape:
  • total: implicit COUNT(*) for the row. Always present.
  • <aggregationKey>: one key per requested aggregation. The key is <type><Column> in camelCase (e.g. countAgentName, p99LatencyMs).
  • <groupByKey>: one key per groupBy entry. The key is the lowerCamelCase form of the underlying column. Two special mappings:
    • userEmail and virtualaccount both map to createdBySubjectSlug in the response.
    • team maps to team (the value is a single unnested scalar, not an array). All other groupBy keys preserve their lowerCamelCase name.
  • startTimestamp: present only for timeseries responses. Bucket start as an ISO 8601 timestamp string (e.g. "2026-04-29T12:00:00.000Z"). Distribution responses omit it.
  • endTimestamp: present only for timeseries responses. Bucket end as an ISO 8601 timestamp string, equal to the next bucket’s startTimestamp (e.g. "2026-04-29T13:00:00.000Z"). Distribution responses omit it.
By default the response includes non-agent traffic (rows where agentName is null), since IS_NULL is not a valid operator on agentName. Most dashboards either render these as “unknown agent” or filter them out client-side. To scope server-side to specific known agents, use {"fieldName": "agentName", "operator": "IN", "value": [...]}.

Distribution response example

Timeseries response example

If groupBy is empty or omitted, the response collapses to a single row (or one row per timeseries bucket) summarising every agent invocation inside the window.

Error responses

A malformed query returns 400 Bad Request:
Common causes:
  • Operator not allowed on this field, for example, EQUAL or IS_NULL on agentName (it supports only IN, NOT_IN, and the STRING_* operators).
  • Missing required value (or wrong shape, e.g. scalar where array is expected for IN / BETWEEN).
  • Unknown field name for the datasource.
  • Invalid interval format (compound expressions, unrecognised unit, non-positive integer).
  • Missing required interval for a timeseries query.
Other status codes:
  • 401 Unauthorized: missing or invalid bearer token.
  • 403 Forbidden: caller does not have permission for the requested scope.
  • 500 Internal Server Error: unexpected server error while executing the query.