> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Query structured data

> Run a synchronous ad-hoc query against a configured data source and return a stable `query_result.v1` result whose natural shape is frames, records, or samples. This public API requires monit-edge v0.65.0 or later.

## Restrictions

| Aspect           | Value                                                                     |
| ---------------- | ------------------------------------------------------------------------- |
| Rate limits      | **100 requests/minute**; **5 requests/second** per account                |
| Permissions      | Any valid `app_key` (read-only; not gated by a specific permission class) |
| Edge requirement | Supported deployments require **monit-edge v0.65.0 or later**             |

## Usage

* Treat **monit-edge v0.65.0** as the minimum supported Edge version for this public API. WebAPI retains migration adapters for older Edge versions: query.v2 results may still preserve frames, records, or samples, while legacy rows can expose only the information they retained. These adapters do not change the support floor; older protocols lack query.v3 cancellation and error-lifecycle semantics, and data already lost by legacy rows cannot be recovered.
* The public response format is always `query_result.v1` and is independent of the internal Edge query protocol. Dispatch on `result.kind` (`frames`, `records`, or `samples`); do not infer the result shape from `ds_type` or the Edge version.
* A `frames` result may contain multiple table or time-series frames. Field values are columnar and all fields in one frame have the same length.
* A `records` result may contain nested JSON and null records. Integer literals outside JavaScript's safe integer range are returned as decimal strings.
* A `samples` result contains label sets and instant values. A value may be a number or one of the strings `NaN`, `+Inf`, and `-Inf`.
* The final success response is limited to 8 MiB and query results are limited to 1,000 rows. Narrow the time range, reduce fields, or aggregate at the source when a request exceeds a limit.
* Query failures use non-2xx HTTP status codes and the standard error envelope. Do not transparently fall back to the deprecated `/monit/query/rows` endpoint.
* Query execution may take up to 35 seconds across WebAPI forwarding and Edge execution. Configure client timeouts to at least 40 seconds and propagate cancellation when the caller abandons a query.


## OpenAPI

````yaml /api-reference/monitors.openapi.en.json post /monit/query/data
openapi: 3.1.0
info:
  title: Flashduty Open API
  description: >-
    Public HTTP API for the Flashduty incident management platform — incidents,
    notification templates, channels, schedules, monitors, RUM, and platform
    administration. Every operation is authenticated with an `app_key` query
    parameter issued from the Flashduty console under Account → APP Keys.
    Responses follow a uniform envelope: `{ request_id, data }` on success, `{
    request_id, error }` on failure.
  version: 1.0.0
servers:
  - url: https://api.flashcat.cloud
    description: Flashduty Open API
security:
  - AppKeyAuth: []
tags:
  - name: Monitors/Alert rules
    description: >-
      Create, manage, and export monitor alert rules. Query rule counters and
      audit history.
  - name: Monitors/Data sources
    description: Manage monitoring data sources used by alert rules to query metrics.
  - name: Monitors/Rule sets
    description: >-
      Manage shared rule sets (rulesets) in the Monitors rule repository.
      Rulesets can be shared publicly or within an account.
  - name: Monitors/Diagnostics
    description: >-
      Diagnostic and query endpoints used by Flashduty AI SRE — ad-hoc data
      source queries, log/metric diagnostics, and target-side tool invocation.
  - name: Monitors/Monitor utilities
    description: Monitors service activation and data preview utilities.
  - name: Monitors/Service map
    description: >-
      Query network-observed service topology, dependency summaries, and
      ServiceMap collection status across hosts.
paths:
  /monit/query/data:
    post:
      tags:
        - Monitors/Diagnostics
      summary: Query structured data
      description: >-
        Run a synchronous ad-hoc query against a configured data source and
        return a stable `query_result.v1` result whose natural shape is frames,
        records, or samples. This public API requires monit-edge v0.65.0 or
        later.
      operationId: monit-read-query-data
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/QueryDataRequest'
            example:
              ds_type: prometheus
              ds_name: prod-prom
              expr: sum by (job) (rate(http_requests_total[5m]))
              delay_seconds: 0
              args: {}
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessEnvelope'
                  - type: object
                    properties:
                      data:
                        $ref: '#/components/schemas/QueryDataResponse'
              example:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                data:
                  format: query_result.v1
                  result:
                    kind: samples
                    samples:
                      - labels:
                          job: api
                        value: 1.25
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          description: The request or final response exceeds its size limit.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '499':
          description: The client canceled the query.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          description: The query timed out.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    QueryDataRequest:
      description: >-
        Request for the stable structured query endpoint. It uses the same query
        fields as the deprecated rows endpoint.
      allOf:
        - $ref: '#/components/schemas/QueryRowsRequest'
    SuccessEnvelope:
      type: object
      description: >-
        Success response envelope. On every 2xx response, `request_id`
        identifies the call (also mirrored in the `Flashcat-Request-Id` header)
        and `data` holds the endpoint-specific payload. Failure responses use a
        different shape — see `ErrorResponse`.
      properties:
        request_id:
          type: string
          description: >-
            Unique ID for this request. Mirrored in the Flashcat-Request-Id
            response header. Include it when reporting issues.
          example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
        data:
          description: Endpoint-specific payload. See each operation's 200 response schema.
      required:
        - request_id
        - data
    QueryDataResponse:
      type: object
      description: Stable, Edge-version-independent structured query response.
      required:
        - format
        - result
      properties:
        format:
          type: string
          enum:
            - query_result.v1
          description: >-
            Public result-contract version. It is independent of the internal
            monit-edge query protocol version. Fixed at `query_result.v1`, which
            defines the structure of the `result` field.
        result:
          $ref: '#/components/schemas/QueryResult'
    ErrorResponse:
      type: object
      description: Response envelope for errors. `error` is required; `data` is absent.
      properties:
        request_id:
          type: string
          example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
          description: >-
            Unique trace ID of this request; include it when reporting issues so
            logs can be located.
        error:
          $ref: '#/components/schemas/DutyError'
      required:
        - request_id
        - error
    QueryRowsRequest:
      type: object
      required:
        - ds_type
        - ds_name
        - expr
      properties:
        account_id:
          type: integer
          format: int64
          description: >-
            Optional consistency check. Must equal the authenticated account
            when supplied; mismatched values are rejected. Business execution
            always uses the authenticated account.
        ds_type:
          type: string
          description: >-
            Data source type; must match a configured data source under the
            tenant. Examples: `prometheus`, `loki`, `victorialogs`, `sls`,
            `elasticsearch`, `mysql`, `postgres`, `oracle`, `clickhouse`.
        ds_name:
          type: string
          description: >-
            Data source name; must match a configured data source under the
            tenant.
        expr:
          type: string
          description: >-
            Query expression. Syntax depends on `ds_type` and is interpreted by
            the corresponding monit-edge client (PromQL for Prometheus, LogQL
            for Loki, SQL for SQL sources, etc.).
        delay_seconds:
          type: integer
          description: >-
            Look-back offset in seconds applied to point-in-time queries
            (Prometheus, Loki stats, VictoriaLogs stats). Ignored for raw /
            detail queries.
          default: 0
        args:
          type: object
          description: >-
            Polymorphic key/value extension parameters forwarded verbatim to
            monit-edge. All values must be strings, and keys are always
            namespaced by source (e.g. `sls.project`, `loki.type`). Validation
            depends on `ds_type`: SLS requires `sls.project` + `sls.logstore`.
            Elasticsearch accepts `es.type` of `sql`, or omitted — any other
            value is rejected. Loki and VictoriaLogs accept `<source>.type` of
            `stats`, `raw`, or omitted; `raw` additionally requires a time
            range, either `<source>.start` + `<source>.end` or
            `<source>.timespan.value` + `<source>.timespan.unit` (unit one of
            `s`, `m`, `h`, `d`). Prometheus and the remaining SQL sources ignore
            `args` entirely.
          additionalProperties:
            type: string
    QueryResult:
      description: Exactly one natural result shape, selected by `kind`.
      oneOf:
        - $ref: '#/components/schemas/QueryFramesResult'
        - $ref: '#/components/schemas/QueryRecordsResult'
        - $ref: '#/components/schemas/QuerySamplesResult'
      discriminator:
        propertyName: kind
        mapping:
          frames:
            $ref: '#/components/schemas/QueryFramesResult'
          records:
            $ref: '#/components/schemas/QueryRecordsResult'
          samples:
            $ref: '#/components/schemas/QuerySamplesResult'
    DutyError:
      type: object
      description: >-
        Error payload inside the response envelope. Present only on non-2xx
        responses.
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
          description: >-
            Human-readable error message, localized by the caller's
            Accept-Language. May contain field names, IDs, or other context from
            the failing request.
          example: The specified parameter template_id is not valid.
      required:
        - code
        - message
    QueryFramesResult:
      type: object
      required:
        - kind
        - frames
      properties:
        kind:
          type: string
          enum:
            - frames
          description: >-
            Result-kind discriminator, always `frames`, indicating the `frames`
            payload of typed table/time-series frames.
        frames:
          type: array
          description: >-
            Typed table or time-series frames. A response can contain more than
            one frame.
          items:
            $ref: '#/components/schemas/QueryFrame'
    QueryRecordsResult:
      type: object
      required:
        - kind
        - records
      properties:
        kind:
          type: string
          enum:
            - records
          description: >-
            Result-kind discriminator, always `records`, indicating the
            `records` payload of schemaless record objects.
        records:
          type: array
          description: >-
            Schema-flexible records. Records may have different fields, contain
            nested JSON, or be null. Integers outside JavaScript's safe range
            are encoded as decimal strings.
          items:
            oneOf:
              - type: object
                additionalProperties: true
              - type: 'null'
    QuerySamplesResult:
      type: object
      required:
        - kind
        - samples
      properties:
        kind:
          type: string
          enum:
            - samples
          description: >-
            Result-kind discriminator, always `samples`, indicating the
            `samples` payload of labeled instant samples.
        samples:
          type: array
          description: Instant samples with their complete label sets.
          items:
            $ref: '#/components/schemas/QuerySample'
    ErrorCode:
      type: string
      description: >-
        Flashduty error code enum. Every failed API response sets `error.code`
        to one of these stable wire strings. HTTP status is informational — the
        authoritative signal is the enum value.


        | Code | HTTP | Meaning |

        |---|---|---|

        | `OK` | 200 | Reserved — not returned on real errors. |

        | `InvalidParameter` | 400 | A required parameter is missing or failed
        validation. |

        | `BadRequest` | 400 | Generic 400 used when no more specific code fits.
        |

        | `InvalidContentType` | 400 | The `Content-Type` header is not
        `application/json`. |

        | `ResourceNotFound` | 400 | The referenced resource does not exist.
        Note: returned as HTTP 400, not 404 (historical choice). |

        | `NoLicense` | 400 | The feature is license-gated and no active license
        was found. |

        | `ReferenceExist` | 400 | Deletion blocked — other entities still
        reference this resource. |

        | `Unauthorized` | 401 | `app_key` is missing, invalid, or expired. |

        | `BalanceNotEnough` | 402 | Billing-gated operation with insufficient
        account balance. |

        | `AccessDenied` | 403 | Authenticated but lacking the permission
        required for this operation. |

        | `RouteNotFound` | 404 | The request URL path is not a known route. |

        | `MethodNotAllowed` | 405 | The HTTP method is not allowed on this
        otherwise-known path. |

        | `UndonedOrderExist` | 409 | An outstanding billing order blocks this
        new one. Wait and retry. |

        | `RequestLocked` | 423 | Operation temporarily locked due to repeated
        failures. |

        | `EntityTooLarge` | 413 | Request body exceeds the configured max size.
        |

        | `RequestTooFrequently` | 429 | Rate limit hit — API-global,
        per-account, or per-integration. |

        | `RequestVerifyRequired` | 428 | Second-factor verification required
        but not supplied. |

        | `DangerousOperation` | 428 | High-risk operation requires MFA
        verification. |

        | `InternalError` | 500 | Unhandled server-side error. Include
        `request_id` in the bug report. |

        | `ServiceUnavailable` | 503 | A backend dependency is unavailable. Try
        again later. |
      enum:
        - OK
        - InvalidParameter
        - BadRequest
        - InvalidContentType
        - ResourceNotFound
        - NoLicense
        - ReferenceExist
        - Unauthorized
        - BalanceNotEnough
        - AccessDenied
        - RouteNotFound
        - MethodNotAllowed
        - UndonedOrderExist
        - RequestLocked
        - EntityTooLarge
        - RequestTooFrequently
        - RequestVerifyRequired
        - DangerousOperation
        - InternalError
        - ServiceUnavailable
      x-enumDescriptions:
        OK: Reserved — not returned on real errors.
        InvalidParameter: A required parameter is missing or failed validation.
        BadRequest: Generic 400 used when no more specific code fits.
        InvalidContentType: The `Content-Type` header is not `application/json`.
        ResourceNotFound: >-
          The referenced resource does not exist. Note: returned as HTTP 400,
          not 404 (historical choice).
        NoLicense: The feature is license-gated and no active license was found.
        ReferenceExist: Deletion blocked — other entities still reference this resource.
        Unauthorized: '`app_key` is missing, invalid, or expired.'
        BalanceNotEnough: Billing-gated operation with insufficient account balance.
        AccessDenied: Authenticated but lacking the permission required for this operation.
        RouteNotFound: The request URL path is not a known route.
        MethodNotAllowed: The HTTP method is not allowed on this otherwise-known path.
        UndonedOrderExist: An outstanding billing order blocks this new one. Wait and retry.
        RequestLocked: Operation temporarily locked due to repeated failures.
        EntityTooLarge: Request body exceeds the configured max size.
        RequestTooFrequently: Rate limit hit — API-global, per-account, or per-integration.
        RequestVerifyRequired: Second-factor verification required but not supplied.
        DangerousOperation: High-risk operation requires MFA verification.
        InternalError: Unhandled server-side error. Include `request_id` in the bug report.
        ServiceUnavailable: A backend dependency is unavailable. Try again later.
      example: InvalidParameter
    QueryFrame:
      type: object
      description: >-
        A typed, columnar table or time-series frame. All fields in one frame
        have the same number of values. A `time_series` frame contains one time
        field and one float field; labels belong to the float field.
      required:
        - kind
        - fields
      properties:
        kind:
          type: string
          enum:
            - table
            - time_series
          description: >-
            Frame type: `table` for a generic table, `time_series` for a series
            (exactly one time field and one float field).
        fields:
          type: array
          items:
            $ref: '#/components/schemas/QueryField'
          description: >-
            Columns of the frame; all fields share the same `values` length and
            row i is composed of each field's `values[i]`.
    QuerySample:
      type: object
      required:
        - labels
        - value
      properties:
        labels:
          type: object
          additionalProperties:
            type: string
          description: >-
            The sample's full label set; may be an empty object but is always
            present.
        value:
          description: >-
            Finite numeric value or a JSON-safe representation of a non-finite
            float.
          oneOf:
            - type: number
            - type: string
              enum:
                - NaN
                - +Inf
                - '-Inf'
    QueryField:
      type: object
      description: >-
        One typed column. `string` fields contain string or null values; `time`
        fields contain RFC 3339 Nano strings or null; `float` fields contain
        numbers, null, or the special strings `NaN`, `+Inf`, and `-Inf`.
      required:
        - name
        - type
        - values
      properties:
        name:
          type: string
          description: >-
            Column name; on a time-series float field, series are distinguished
            by `labels` and `name` is usually the metric name.
        type:
          type: string
          enum:
            - string
            - float
            - time
          description: >-
            Value type governing `values` encoding: `string` = strings or null,
            `float` = numbers or `NaN`/`±Inf` strings or null, `time` = RFC 3339
            Nano strings or null.
        labels:
          type: object
          description: Series labels. Present on the float field of a time-series frame.
          additionalProperties:
            type: string
        values:
          type: array
          items:
            oneOf:
              - type: string
              - type: number
              - type: 'null'
          description: >-
            All values of this column in row order; length matches the other
            fields in the frame.
  responses:
    BadRequest:
      description: Invalid request — usually a missing or malformed parameter.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missingParameter:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: InvalidParameter
                  message: The specified parameter is not valid.
    Unauthorized:
      description: Missing or invalid app_key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missingAppKey:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: Unauthorized
                  message: You are unauthorized.
    Forbidden:
      description: The app_key is valid but lacks permission for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            noEditPermission:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: AccessDenied
                  message: Access Denied.
    TooManyRequests:
      description: >-
        Rate limit hit. Either the global API limit, a per-account limit, or a
        per-integration limit.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            rateLimited:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: RequestTooFrequently
                  message: Request too frequently.
    ServerError:
      description: Unexpected server-side error. Include the request_id when reporting.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            internal:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: InternalError
                  message: >-
                    We encountered an internal error, and it has been reported.
                    Please try again later.
    ServiceUnavailable:
      description: >-
        The ServiceMap subsystem is not enabled or not reachable on this
        deployment. Include the request_id when reporting.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            serviceMapDisabled:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: ServiceUnavailable
                  message: servicemap store is not initialized
  securitySchemes:
    AppKeyAuth:
      type: apiKey
      in: query
      name: app_key
      description: >-
        App key issued from the Flashduty console under Account → APP Keys.
        Required on every public API call. Keep it secret — it grants the same
        access as the owning account.

````