> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Invoke target tools

> Invoke up to 8 monit-agent tools concurrently on a single target. Results come back in the order of the input `tools` array. Long-running — individual tools have per-tool timeouts on the agent and the whole request may take tens of seconds.

## Restrictions

| Aspect      | Value                                                                     |
| ----------- | ------------------------------------------------------------------------- |
| Rate limits | **600 requests/minute**; **10 requests/second** per account               |
| Permissions | Any valid `app_key` (read-only; not gated by a specific permission class) |

## Usage

* Up to **8** tools per call (`MaxToolsPerInvoke`); larger batches must be split client-side. The 8-tool cap aligns with the per-target agent concurrency.
* Tools execute in parallel on the agent; webapi returns `results[]` aligned with the request `tools[]` order.
* Long-running: set client timeouts to **at least 35 s**. The endpoint is intended for AI-SRE / human-RCA flows, not interactive UI.
* Request-level errors (`target_unavailable`, `ambiguous_target_kind`, `unknown_toolset_hash`, `forward_failed`) appear as HTTP 200 with `data.error` set and `data.results = []`.
* Per-tool failures appear as HTTP 200 with `data.error = null` and `results[i].error` populated — always check **all three** layers (outer envelope `error`, `data.error`, then each `results[i].error`).
* Each result carries two latency fields: `agent_elapsed_ms` (agent-self-reported, excludes network) and `e2e_elapsed_ms` (webapi-observed end-to-end). A large gap between them indicates network / edge slowness rather than slow tool execution.
* Construct `tools[].params` against the `input_schema` returned by `/monit/tools/catalog`. For no-arg tools always pass `params: {}` explicitly.


## OpenAPI

````yaml /api-reference/monitors.openapi.en.json post /monit/tools/invoke
openapi: 3.1.0
info:
  title: Flashduty Open API
  description: >-
    Public HTTP API for the Flashduty incident management platform — incidents,
    notification templates, channels, schedules, monitors, RUM, and platform
    administration. Every operation is authenticated with an `app_key` query
    parameter issued from the Flashduty console under Account → APP Keys.
    Responses follow a uniform envelope: `{ request_id, data }` on success, `{
    request_id, error }` on failure.
  version: 1.0.0
servers:
  - url: https://api.flashcat.cloud
    description: Flashduty Open API
security:
  - AppKeyAuth: []
tags:
  - name: Monitors/Alert rules
    description: >-
      Create, manage, and export monitor alert rules. Query rule counters and
      audit history.
  - name: Monitors/Data sources
    description: Manage monitoring data sources used by alert rules to query metrics.
  - name: Monitors/Rule sets
    description: >-
      Manage shared rule sets (rulesets) in the Monitors rule repository.
      Rulesets can be shared publicly or within an account.
  - name: Monitors/Diagnostics
    description: >-
      Diagnostic and query endpoints used by Flashduty AI SRE — ad-hoc data
      source queries, log/metric diagnostics, and target-side tool invocation.
  - name: Monitors/Monitor utilities
    description: Monitors service activation and data preview utilities.
paths:
  /monit/tools/invoke:
    post:
      tags:
        - Monitors/Diagnostics
      summary: Invoke target tools
      description: >-
        Invoke up to 8 monit-agent tools concurrently on a single target.
        Results come back in the order of the input `tools` array. Long-running
        — individual tools have per-tool timeouts on the agent and the whole
        request may take tens of seconds.
      operationId: monit-read-tools-invoke
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ToolInvokeRequest'
            example:
              account_id: 10001
              target_locator: web-01
              tools:
                - tool: os.overview
                  params: {}
                - tool: net.tcp_ping
                  params:
                    host: 10.0.0.10
                    port: 3306
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessEnvelope'
                  - type: object
                    properties:
                      data:
                        $ref: '#/components/schemas/ToolInvokeResponse'
              example:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                data:
                  target:
                    kind: host
                    locator: web-01
                  results:
                    - tool: os.overview
                      tool_version: 0.5.0
                      data:
                        data:
                          sample_interval_sec: 3
                          degraded: false
                          degradation_reasons: []
                        summary: os.overview ...
                        truncated:
                          truncated: false
                      error: null
                      agent_elapsed_ms: 3120
                      e2e_elapsed_ms: 3188
                    - tool: net.tcp_ping
                      tool_version: 0.5.0
                      data: null
                      error:
                        code: target_unreachable
                        message: 'dial tcp 10.0.0.10:3306: i/o timeout'
                      agent_elapsed_ms: 0
                      e2e_elapsed_ms: 2008
                  error: null
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  schemas:
    ToolInvokeRequest:
      type: object
      required:
        - target_locator
        - tools
      properties:
        account_id:
          type: integer
          format: int64
          description: >-
            Optional consistency check. Must equal the authenticated account
            when supplied.
        target_locator:
          type: string
          description: Target identifier. Same validation rules as `/monit/tools/catalog`.
        target_kind:
          type: string
          description: Optional target kind; auto-inferred when omitted.
        tools:
          type: array
          minItems: 1
          maxItems: 8
          description: >-
            Up to 8 tool calls; webapi executes them concurrently and returns
            results in input order.
          items:
            type: object
            required:
              - tool
            properties:
              tool:
                type: string
                description: Tool name, typically from `/monit/tools/catalog`.
              params:
                type: object
                description: >-
                  Tool parameters matching the catalog `input_schema`. For
                  no-arg tools pass `{}` explicitly.
                additionalProperties: true
    SuccessEnvelope:
      type: object
      description: >-
        Success response envelope. On every 2xx response, `request_id`
        identifies the call (also mirrored in the `Flashcat-Request-Id` header)
        and `data` holds the endpoint-specific payload. Failure responses use a
        different shape — see `ErrorResponse`.
      properties:
        request_id:
          type: string
          description: >-
            Unique ID for this request. Mirrored in the Flashcat-Request-Id
            response header. Include it when reporting issues.
          example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
        data:
          description: Endpoint-specific payload. See each operation's 200 response schema.
      required:
        - request_id
        - data
    ToolInvokeResponse:
      type: object
      properties:
        target:
          type: object
          nullable: true
          description: Resolved target.
          properties:
            kind:
              type: string
            locator:
              type: string
        results:
          type: array
          description: >-
            Per-tool results aligned with the request `tools[]` order. Empty
            when `error` is non-null.
          items:
            type: object
            properties:
              tool:
                type: string
              tool_version:
                type: string
                description: >-
                  Agent-executed tool version. Empty when execution failed
                  before the agent picked a version.
              data:
                type: object
                nullable: true
                description: >-
                  Successful tool payload — passthrough of monit-agent
                  `ToolResultPayload.data` (typically `data` / `summary` /
                  `truncated`). `null` when the per-tool `error` is set.
              error:
                type: object
                nullable: true
                description: Per-tool error. Mutually exclusive with `data`.
                properties:
                  code:
                    type: string
                    description: >-
                      Common values: `timeout`, `target_unavailable`,
                      `edge_unsupported`, `invalid_tool_result`, `internal`,
                      `invalid_args`, `unknown_tool`, `unknown_tool_version`,
                      `unknown_toolset_hash`, `target_not_owned`, `wrong_agent`,
                      `overloaded`, `denied`, `permission_denied`,
                      `credential_unavailable`, `target_unreachable`.
                  message:
                    type: string
              agent_elapsed_ms:
                type: integer
                format: int64
                description: >-
                  Agent-self-reported tool execution time in milliseconds,
                  excludes network. May be 0 when the failure occurred before
                  the agent started executing.
              e2e_elapsed_ms:
                type: integer
                format: int64
                description: >-
                  Webapi-observed end-to-end time in milliseconds (webapi → ws →
                  edge → agent → ws → webapi). A large gap vs `agent_elapsed_ms`
                  indicates network / edge slowness.
        error:
          type: object
          nullable: true
          description: Request-level business error. `null` on success.
          properties:
            code:
              type: string
              enum:
                - target_unavailable
                - unknown_toolset_hash
                - forward_failed
                - invalid_tool_result
                - ambiguous_target_kind
            message:
              type: string
            target_kinds:
              type: array
              items:
                type: string
    ErrorResponse:
      type: object
      description: Response envelope for errors. `error` is required; `data` is absent.
      properties:
        request_id:
          type: string
          example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
        error:
          $ref: '#/components/schemas/DutyError'
      required:
        - request_id
        - error
    DutyError:
      type: object
      description: >-
        Error payload inside the response envelope. Present only on non-2xx
        responses.
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
          description: >-
            Human-readable error message, localized by the caller's
            Accept-Language. May contain field names, IDs, or other context from
            the failing request.
          example: The specified parameter template_id is not valid.
      required:
        - code
        - message
    ErrorCode:
      type: string
      description: >-
        Flashduty error code enum. Every failed API response sets `error.code`
        to one of these stable wire strings. HTTP status is informational — the
        authoritative signal is the enum value.


        | Code | HTTP | Meaning |

        |---|---|---|

        | `OK` | 200 | Reserved — not returned on real errors. |

        | `InvalidParameter` | 400 | A required parameter is missing or failed
        validation. |

        | `BadRequest` | 400 | Generic 400 used when no more specific code fits.
        |

        | `InvalidContentType` | 400 | The `Content-Type` header is not
        `application/json`. |

        | `ResourceNotFound` | 400 | The referenced resource does not exist.
        Note: returned as HTTP 400, not 404 (historical choice). |

        | `NoLicense` | 400 | The feature is license-gated and no active license
        was found. |

        | `ReferenceExist` | 400 | Deletion blocked — other entities still
        reference this resource. |

        | `Unauthorized` | 401 | `app_key` is missing, invalid, or expired. |

        | `BalanceNotEnough` | 402 | Billing-gated operation with insufficient
        account balance. |

        | `AccessDenied` | 403 | Authenticated but lacking the permission
        required for this operation. |

        | `RouteNotFound` | 404 | The request URL path is not a known route. |

        | `MethodNotAllowed` | 405 | The HTTP method is not allowed on this
        otherwise-known path. |

        | `UndonedOrderExist` | 409 | An outstanding billing order blocks this
        new one. Wait and retry. |

        | `RequestLocked` | 423 | Operation temporarily locked due to repeated
        failures. |

        | `EntityTooLarge` | 413 | Request body exceeds the configured max size.
        |

        | `RequestTooFrequently` | 429 | Rate limit hit — API-global,
        per-account, or per-integration. |

        | `RequestVerifyRequired` | 428 | Second-factor verification required
        but not supplied. |

        | `DangerousOperation` | 428 | High-risk operation requires MFA
        verification. |

        | `InternalError` | 500 | Unhandled server-side error. Include
        `request_id` in the bug report. |

        | `ServiceUnavailable` | 503 | A backend dependency is unavailable. Try
        again later. |
      enum:
        - OK
        - InvalidParameter
        - BadRequest
        - InvalidContentType
        - ResourceNotFound
        - NoLicense
        - ReferenceExist
        - Unauthorized
        - BalanceNotEnough
        - AccessDenied
        - RouteNotFound
        - MethodNotAllowed
        - UndonedOrderExist
        - RequestLocked
        - EntityTooLarge
        - RequestTooFrequently
        - RequestVerifyRequired
        - DangerousOperation
        - InternalError
        - ServiceUnavailable
      x-enumDescriptions:
        OK: Reserved — not returned on real errors.
        InvalidParameter: A required parameter is missing or failed validation.
        BadRequest: Generic 400 used when no more specific code fits.
        InvalidContentType: The `Content-Type` header is not `application/json`.
        ResourceNotFound: >-
          The referenced resource does not exist. Note: returned as HTTP 400,
          not 404 (historical choice).
        NoLicense: The feature is license-gated and no active license was found.
        ReferenceExist: Deletion blocked — other entities still reference this resource.
        Unauthorized: '`app_key` is missing, invalid, or expired.'
        BalanceNotEnough: Billing-gated operation with insufficient account balance.
        AccessDenied: Authenticated but lacking the permission required for this operation.
        RouteNotFound: The request URL path is not a known route.
        MethodNotAllowed: The HTTP method is not allowed on this otherwise-known path.
        UndonedOrderExist: An outstanding billing order blocks this new one. Wait and retry.
        RequestLocked: Operation temporarily locked due to repeated failures.
        EntityTooLarge: Request body exceeds the configured max size.
        RequestTooFrequently: Rate limit hit — API-global, per-account, or per-integration.
        RequestVerifyRequired: Second-factor verification required but not supplied.
        DangerousOperation: High-risk operation requires MFA verification.
        InternalError: Unhandled server-side error. Include `request_id` in the bug report.
        ServiceUnavailable: A backend dependency is unavailable. Try again later.
      example: InvalidParameter
  responses:
    BadRequest:
      description: Invalid request — usually a missing or malformed parameter.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missingParameter:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: InvalidParameter
                  message: The specified parameter is not valid.
    Unauthorized:
      description: Missing or invalid app_key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missingAppKey:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: Unauthorized
                  message: You are unauthorized.
    TooManyRequests:
      description: >-
        Rate limit hit. Either the global API limit, a per-account limit, or a
        per-integration limit.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            rateLimited:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: RequestTooFrequently
                  message: Request too frequently.
    ServerError:
      description: Unexpected server-side error. Include the request_id when reporting.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            internal:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: InternalError
                  message: >-
                    We encountered an internal error, and it has been reported.
                    Please try again later.
  securitySchemes:
    AppKeyAuth:
      type: apiKey
      in: query
      name: app_key
      description: >-
        App key issued from the Flashduty console under Account → APP Keys.
        Required on every public API call. Keep it secret — it grants the same
        access as the owning account.

````