> ## Documentation Index > Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt > Use this file to discover all available pages before exploring further. # Run Explore query > Run an Explore query against a configured data source and return frames, samples, or logs. ## Restrictions | Aspect | Value | | ---------------- | ------------------------------------------------------------- | | Rate limits | **100 requests/minute**; **16 requests/second** per account | | Permissions | **Datasources Read** (`monit`) | | Edge requirement | Supported deployments require **monit-edge v0.68.0 or later** | ## Usage * Use this endpoint when you need the data source's native result shape; `/monit/query/data` returns the stable `query_result.v1` contract instead. Dispatch on `data.result.kind` (`frames`, `samples`, or `logs`) here. * `execution.kind` decides which companion fields are accepted: `instant` needs only `to_ms`, `range` requires `from_ms`, `to_ms`, and `max_data_points`, and `window` takes `from_ms` and `to_ms`. `step_seconds` is not accepted; the step is derived from `max_data_points` and `min_step_seconds`. * `args` carries macro substitutions such as Grafana-style variables; every value is a string. * A `logs` result is capped at 1,000 entries and reports `applied_limit` plus `has_more`. Time-series and sample results are capped at 1,000 items each and the whole success response at 8 MiB. * Query execution may take up to 35 seconds across WebAPI forwarding and Edge execution. Configure client timeouts to at least 40 seconds. ## OpenAPI ````yaml /api-reference/monitors.openapi.en.json post /monit/query/explore openapi: 3.1.0 info: title: Flashduty Open API description: >- Public HTTP API for the Flashduty incident management platform — incidents, notification templates, channels, schedules, monitors, RUM, and platform administration. Every operation is authenticated with an `app_key` query parameter issued from the Flashduty console under Account → APP Keys. Responses follow a uniform envelope: `{ request_id, data }` on success, `{ request_id, error }` on failure. version: 1.0.0 servers: - url: https://api.flashcat.cloud description: Flashduty Open API security: - AppKeyAuth: [] tags: - name: Monitors/Alert rules description: >- Create, manage, and export monitor alert rules. Query rule counters and audit history. - name: Monitors/Data sources description: Manage monitoring data sources used by alert rules to query metrics. - name: Monitors/Diagnostics description: >- Diagnostic and query endpoints used by Flashduty AI SRE — ad-hoc data source queries, log/metric diagnostics, and target-side tool invocation. - name: Monitors/Monitor utilities description: Monitors service activation and data preview utilities. paths: /monit/query/explore: post: tags: - Monitors/Diagnostics summary: Run Explore query description: >- Run an Explore query against a configured data source and return frames, samples, or logs. operationId: monit-read-query-explore requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/QueryExploreRequest' example: datasource_id: 101 expr: rate(http_requests_total[5m]) args: {} execution: kind: range from_ms: 1787187600000 to_ms: 1787191200000 max_data_points: 1200 min_step_seconds: 15 responses: '200': description: Success content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - type: object properties: data: $ref: '#/components/schemas/ExploreData' example: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: format: explore_result.v1 result: kind: frames frames: - kind: time_series fields: - name: time type: time values: - '2026-08-20T10:00:00Z' - '2026-08-20T10:01:00Z' - name: value type: float labels: job: api values: - 1.25 - null execution: kind: range effective_step_seconds: 60 '400': description: 'Standard HTTP error; error.reason: invalid_request.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': $ref: '#/components/responses/Unauthorized' '403': description: 'Standard HTTP error; error.reason: access_denied.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: 'Standard HTTP error; error.reason: datasource_not_found.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '413': description: >- Standard HTTP error; error.reason: source_too_large, result_too_large. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: 'Standard HTTP error; error.reason: overloaded.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '499': description: 'Standard HTTP error; error.reason: canceled.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: 'Standard HTTP error; error.reason: internal.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': description: >- Standard HTTP error; error.reason: no_active_edge, edge_upgrade_required, mixed_edge_versions, edge_unavailable. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '504': description: 'Standard HTTP error; error.reason: timeout.' content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: QueryExploreRequest: type: object description: >- Explore query request. All four top-level fields are required and unknown fields are rejected. required: - datasource_id - expr - args - execution properties: datasource_id: type: integer format: int64 minimum: 1 maximum: 9007199254740991 description: >- Data source ID from `/monit/datasource/list`. Must be a positive JavaScript-safe integer and belong to the authenticated account. expr: type: string minLength: 1 description: >- Query expression in the data source's native language (PromQL, LogsQL, SQL, and so on). Non-empty UTF-8 of at most 64 KiB; some data source types enforce a lower limit. args: type: object additionalProperties: type: string maxProperties: 128 description: >- Macro substitutions keyed by variable name, used for Grafana-style variables. Keys are at most 256 bytes, values at most 64 KiB, with a 128 KiB total budget. execution: $ref: '#/components/schemas/QueryExploreExecution' SuccessEnvelope: type: object description: >- Success response envelope. On every 2xx response, `request_id` identifies the call (also mirrored in the `Flashcat-Request-Id` header) and `data` holds the endpoint-specific payload. Failure responses use a different shape — see `ErrorResponse`. properties: request_id: type: string description: >- Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: description: Endpoint-specific payload. See each operation's 200 response schema. required: - request_id - data ExploreData: type: object description: Explore query result payload. required: - format - result properties: format: type: string enum: - explore_result.v1 description: Result contract version; always `explore_result.v1`. result: $ref: '#/components/schemas/ExploreResult' execution: $ref: '#/components/schemas/ExploreResponseExecution' ErrorResponse: type: object description: Response envelope for errors. `error` is required; `data` is absent. properties: request_id: type: string example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 description: >- Unique trace ID of this request; include it when reporting issues so logs can be located. error: $ref: '#/components/schemas/DutyError' required: - request_id - error QueryExploreExecution: type: object description: >- Time semantics of the query. The accepted companion fields depend on `kind`: `instant` takes only `to_ms` (plus optional `from_ms`), `range` requires `from_ms`, `to_ms`, and `max_data_points`, and `window` takes only `from_ms` and `to_ms`. `step_seconds` is never accepted over HTTP. required: - kind properties: kind: type: string enum: - instant - range - window description: >- Execution kind. `instant` evaluates at a single point in time, `range` evaluates a series over a range, and `window` returns raw rows inside a time window. from_ms: type: integer format: int64 description: >- Unix timestamp in milliseconds for the start of the range. Required for `range` and `window`; optional for `instant`. to_ms: type: integer format: int64 description: >- Unix timestamp in milliseconds for the end of the range. Required for every execution kind. max_data_points: type: integer format: int64 minimum: 2 maximum: 5000 description: >- Maximum number of points to return. Required for `range` and rejected for `instant` and `window`. min_step_seconds: type: integer format: int64 minimum: 1 description: >- Lower bound, in seconds, for the step derived from `max_data_points`. Optional and only accepted for `range`. ExploreResult: type: object description: >- Result body. Exactly one of `frames`, `samples`, or `entries` is present and matches `kind`. required: - kind properties: kind: type: string enum: - frames - samples - logs description: >- Result shape. `frames` returns columnar tables or time series, `samples` returns instant values with labels, and `logs` returns log entries. frames: type: array items: $ref: '#/components/schemas/ExploreFrame' description: >- Columnar frames. Present when `kind` is `frames`; at most 1,000 frames. samples: type: array items: $ref: '#/components/schemas/ExploreSample' description: >- Instant samples. Present when `kind` is `samples`; at most 1,000 samples. entries: type: array items: $ref: '#/components/schemas/ExploreLogEntry' description: >- Log entries. Present when `kind` is `logs`; never longer than `applied_limit`. applied_limit: type: integer description: Entry limit applied to a logs result; at most 1000. has_more: type: boolean description: Whether a logs result was truncated by `applied_limit`. ExploreResponseExecution: type: object description: >- Execution actually used, present when the data source returned a stepped result. required: - kind - effective_step_seconds properties: kind: type: string enum: - range description: Execution kind; always `range` when this object is present. effective_step_seconds: type: integer format: int64 description: >- Step, in seconds, the query was executed with after applying `max_data_points` and `min_step_seconds`. DutyError: type: object description: >- Error payload inside the response envelope. Present only on non-2xx responses. properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string description: >- Human-readable error message, localized by the caller's Accept-Language. May contain field names, IDs, or other context from the failing request. example: The specified parameter template_id is not valid. reason: description: >- Optional machine-readable rejection reason, including datasource tool failures. Inspect alongside HTTP status and code. type: string x-flashduty-preserve-absence: true required: - code - message ExploreFrame: type: object description: >- One columnar frame. Every field in the frame has the same number of values. required: - kind - fields properties: kind: type: string enum: - table - time_series description: >- Frame shape. `table` is an unlabeled table, while `time_series` carries exactly one time field and one float field. fields: type: array items: $ref: '#/components/schemas/ExploreField' description: Columns of the frame. ExploreSample: type: object description: One instant sample. required: - labels - value properties: labels: type: object additionalProperties: type: string description: Label set of the sample. May be empty but never null. value: description: >- Sample value: a number, or one of the strings `NaN`, `+Inf`, and `-Inf`. Never null. ExploreLogEntry: type: object description: One log entry. required: - timestamp_ns - fields properties: timestamp_ns: type: string description: >- Entry time as a canonical unsigned decimal string of Unix epoch nanoseconds, at most 20 digits. fields: type: object additionalProperties: true description: >- Log fields as raw JSON values. Integer literals outside JavaScript's safe integer range are returned as decimal strings. ErrorCode: type: string description: >- Flashduty error code enum. Every failed API response sets `error.code` to one of these stable wire strings. HTTP status is informational — the authoritative signal is the enum value. | Code | HTTP | Meaning | |---|---|---| | `OK` | 200 | Reserved — not returned on real errors. | | `InvalidParameter` | 400 | A required parameter is missing or failed validation. | | `BadRequest` | 400 | Generic 400 used when no more specific code fits. | | `InvalidContentType` | 400 | The `Content-Type` header is not `application/json`. | | `ResourceNotFound` | 400 | The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). | | `NoLicense` | 400 | The feature is license-gated and no active license was found. | | `ReferenceExist` | 400 | Deletion blocked — other entities still reference this resource. | | `Unauthorized` | 401 | `app_key` is missing, invalid, or expired. | | `BalanceNotEnough` | 402 | Billing-gated operation with insufficient account balance. | | `AccessDenied` | 403 | Authenticated but lacking the permission required for this operation. | | `RouteNotFound` | 404 | The request URL path is not a known route. | | `MethodNotAllowed` | 405 | The HTTP method is not allowed on this otherwise-known path. | | `UndonedOrderExist` | 409 | An outstanding billing order blocks this new one. Wait and retry. | | `RequestLocked` | 423 | Operation temporarily locked due to repeated failures. | | `EntityTooLarge` | 413 | Request body exceeds the configured max size. | | `RequestTooFrequently` | 429 | Rate limit hit — API-global, per-account, or per-integration. | | `RequestVerifyRequired` | 428 | Second-factor verification required but not supplied. | | `DangerousOperation` | 428 | High-risk operation requires MFA verification. | | `InternalError` | 500 | Unhandled server-side error. Include `request_id` in the bug report. | | `ServiceUnavailable` | 503 | A backend dependency is unavailable. Try again later. | enum: - OK - InvalidParameter - BadRequest - InvalidContentType - ResourceNotFound - NoLicense - ReferenceExist - Unauthorized - BalanceNotEnough - AccessDenied - RouteNotFound - MethodNotAllowed - UndonedOrderExist - RequestLocked - EntityTooLarge - RequestTooFrequently - RequestVerifyRequired - DangerousOperation - InternalError - ServiceUnavailable x-enumDescriptions: OK: Reserved — not returned on real errors. InvalidParameter: A required parameter is missing or failed validation. BadRequest: Generic 400 used when no more specific code fits. InvalidContentType: The `Content-Type` header is not `application/json`. ResourceNotFound: >- The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). NoLicense: The feature is license-gated and no active license was found. ReferenceExist: Deletion blocked — other entities still reference this resource. Unauthorized: '`app_key` is missing, invalid, or expired.' BalanceNotEnough: Billing-gated operation with insufficient account balance. AccessDenied: Authenticated but lacking the permission required for this operation. RouteNotFound: The request URL path is not a known route. MethodNotAllowed: The HTTP method is not allowed on this otherwise-known path. UndonedOrderExist: An outstanding billing order blocks this new one. Wait and retry. RequestLocked: Operation temporarily locked due to repeated failures. EntityTooLarge: Request body exceeds the configured max size. RequestTooFrequently: Rate limit hit — API-global, per-account, or per-integration. RequestVerifyRequired: Second-factor verification required but not supplied. DangerousOperation: High-risk operation requires MFA verification. InternalError: Unhandled server-side error. Include `request_id` in the bug report. ServiceUnavailable: A backend dependency is unavailable. Try again later. example: InvalidParameter ExploreField: type: object description: One column of a frame. Values are columnar and may contain nulls. required: - name - type - values properties: name: type: string description: Column name, at most 1 MiB of UTF-8. type: type: string enum: - string - float - time description: >- Column type. `string` is rejected inside a `time_series` frame; `float` holds numbers and `time` holds UTC RFC3339Nano strings. labels: type: object additionalProperties: type: string description: >- Label set of this column. Only `time_series` value fields may carry labels; a `table` field must not. values: type: array items: description: >- One cell. `time` cells are UTC RFC3339Nano strings; `float` cells may be the strings `NaN`, `+Inf`, and `-Inf`; any cell may be null except a time value inside a `time_series` frame. description: Column values in row order. responses: Unauthorized: description: Missing or invalid app_key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingAppKey: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: Unauthorized message: You are unauthorized. securitySchemes: AppKeyAuth: type: apiKey in: query name: app_key description: >- App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account. ````