> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get service map topology

> Return the outbound dependency graph around a host, discovered by live network observation.

## Restrictions

| Aspect      | Value                                                    |
| ----------- | -------------------------------------------------------- |
| Rate limits | **20 requests/minute**; **1 request/second** per account |
| Permissions | **Service Map Read** (`monit`)                           |

## Usage

* ServiceMap is an optional subsystem: a deployment without `redis.servicemap` configured returns `ServiceUnavailable`.
* `at` currently only accepts `now` (or empty, which behaves identically).
* `direction` currently only accepts `outbound` (or empty).
* `anchor.host_id` must already be known to ServiceMap (have a current or recently retired graph); otherwise this returns `ResourceNotFound`.
* `depth` (max 3), `max_nodes` (max 500), and `max_edges` (max 1000) bound the traversal; when a bound is hit, `truncated=true` and `truncation_reasons` explains why.
* `unresolved_mode=summary` (vs. the default `full`) omits unresolved edges from `edges` and returns only a bounded sample in `unresolved_endpoints`.


## OpenAPI

````yaml /api-reference/monitors.openapi.en.json post /monit/servicemap/topology
openapi: 3.1.0
info:
  title: Flashduty Open API
  description: >-
    Public HTTP API for the Flashduty incident management platform — incidents,
    notification templates, channels, schedules, monitors, RUM, and platform
    administration. Every operation is authenticated with an `app_key` query
    parameter issued from the Flashduty console under Account → APP Keys.
    Responses follow a uniform envelope: `{ request_id, data }` on success, `{
    request_id, error }` on failure.
  version: 1.0.0
servers:
  - url: https://api.flashcat.cloud
    description: Flashduty Open API
security:
  - AppKeyAuth: []
tags:
  - name: Monitors/Alert rules
    description: >-
      Create, manage, and export monitor alert rules. Query rule counters and
      audit history.
  - name: Monitors/Data sources
    description: Manage monitoring data sources used by alert rules to query metrics.
  - name: Monitors/Rule sets
    description: >-
      Manage shared rule sets (rulesets) in the Monitors rule repository.
      Rulesets can be shared publicly or within an account.
  - name: Monitors/Diagnostics
    description: >-
      Diagnostic and query endpoints used by Flashduty AI SRE — ad-hoc data
      source queries, log/metric diagnostics, and target-side tool invocation.
  - name: Monitors/Monitor utilities
    description: Monitors service activation and data preview utilities.
  - name: Monitors/Service map
    description: >-
      Query network-observed service topology, dependency summaries, and
      ServiceMap collection status across hosts.
paths:
  /monit/servicemap/topology:
    post:
      tags:
        - Monitors/Service map
      summary: Get service map topology
      description: >-
        Return the outbound dependency graph around a host, discovered by live
        network observation.
      operationId: monit-servicemap-read-topology
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceMapTopologyRequest'
            example:
              anchor:
                host_id: host_0123456789abcdef0123456789abcdef
              depth: 2
              max_nodes: 100
              max_edges: 200
              include_metrics: true
              unresolved_mode: full
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessEnvelope'
                  - type: object
                    properties:
                      data:
                        $ref: '#/components/schemas/ServiceMapTopologyResponse'
              example:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                data:
                  network_scope_id: ns_0123456789abcdef0123456789abcdef
                  anchor_host_id: host_0123456789abcdef0123456789abcdef
                  observed_at_ms: 1784635556072
                  freshness:
                    status: fresh
                    newest_received_at_ms: 1784635557272
                    oldest_received_at_ms: 1784635557272
                    max_age_ms: 1200
                  coverage:
                    direction: outbound
                    hosts_loaded: 2
                    degraded_hosts: 0
                    truncated_hosts: 0
                    capture_modes:
                      - ebpf
                    network_inventory_status: complete
                    kubernetes_enrichment_status: unavailable
                    listener_address_family_status: complete
                    ipv6_wildcard_listener_count: 0
                    ipv6_only_known_listener_count: 0
                    ipv6_only_unknown_listener_count: 0
                  truncated: false
                  nodes:
                    - host_id: host_0123456789abcdef0123456789abcdef
                      id: procw_v1_source
                      kind: process
                      display_name: orders.service
                      systemd_unit: orders.service
                      first_seen: '2026-07-01T02:00:00Z'
                      last_seen: '2026-07-21T18:45:56.072+08:00'
                    - host_id: host_fedcba9876543210fedcba9876543210
                      id: procw_v1_mysql
                      kind: process
                      display_name: mysqld.service
                      systemd_unit: mysqld.service
                      first_seen: '2026-07-01T02:00:00Z'
                      last_seen: '2026-07-21T18:45:56.072+08:00'
                  edges:
                    - host_id: host_0123456789abcdef0123456789abcdef
                      id: edge_v1_example
                      source_entity_id: procw_v1_source
                      source_netns_id: netns_v1_default
                      destination:
                        ip: 203.0.113.105
                        port: 3306
                        protocol: tcp
                      evidence: connect
                      last_seen: '2026-07-21T18:45:56.072+08:00'
                      depth: 1
                      endpoint_resolution:
                        status: resolved
                        endpoint:
                          ip: 203.0.113.105
                          port: 3306
                          protocol: tcp
                        candidates:
                          - host_id: host_fedcba9876543210fedcba9876543210
                            entity_id: procw_v1_mysql
                            netns_id: netns_v1_default
                            listener_id: listener_v1_mysql
                            listener_ip: 203.0.113.105
                            effective_ip: 203.0.113.105
                            protocol: tcp
                            port: 3306
                            match_kind: exact
                            confidence: 1
                            node_kind: process
                            node_display_name: mysqld.service
                            graph_sequence: 42
                            observed_at_ms: 1784635556072
                  unresolved_endpoints: []
                  resolution_counts:
                    resolved: 1
                    ambiguous: 0
                    unresolved: 0
                  unresolved_projection:
                    mode: full
                    total: 0
                    returned: 0
                    omitted: 0
                    by_reason: []
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/ServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
components:
  schemas:
    ServiceMapTopologyRequest:
      type: object
      description: Query parameters for the outbound topology traversal.
      required:
        - anchor
      properties:
        anchor:
          $ref: '#/components/schemas/ServiceMapAnchor'
          description: Host (and optional entity) to start the traversal from.
        network_scope_id:
          type: string
          description: >-
            Optional integrity check: if set, must match the network scope
            already associated with `anchor.host_id`, or the request is rejected
            with `InvalidParameter`.
        at:
          type: string
          enum:
            - now
          description: >-
            Time selector for the query. Only `now` is currently supported;
            omitting the field behaves the same.
        direction:
          type: string
          enum:
            - outbound
          description: >-
            Traversal direction. Only `outbound` is currently supported;
            omitting the field behaves the same.
        depth:
          type: integer
          description: Maximum traversal depth from the anchor. Default 1, maximum 3.
          default: 1
          maximum: 3
        max_nodes:
          type: integer
          description: >-
            Maximum number of nodes to return before truncating. Default 100,
            maximum 500.
          default: 100
          maximum: 500
        max_edges:
          type: integer
          description: >-
            Maximum number of edges to examine before truncating. Default 200,
            maximum 1000.
          default: 200
          maximum: 1000
        include_metrics:
          type: boolean
          description: >-
            Whether to include the raw per-edge `metrics` payload in the
            response. Default `false`.
          default: false
        unresolved_mode:
          type: string
          enum:
            - summary
            - full
          description: >-
            How unresolved edges are projected. `full` (default) includes them
            in `edges` and `unresolved_endpoints`; `summary` omits them from
            `edges` and returns only a bounded sample in `unresolved_endpoints`.
          default: full
    SuccessEnvelope:
      type: object
      description: >-
        Success response envelope. On every 2xx response, `request_id`
        identifies the call (also mirrored in the `Flashcat-Request-Id` header)
        and `data` holds the endpoint-specific payload. Failure responses use a
        different shape — see `ErrorResponse`.
      properties:
        request_id:
          type: string
          description: >-
            Unique ID for this request. Mirrored in the Flashcat-Request-Id
            response header. Include it when reporting issues.
          example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
        data:
          description: Endpoint-specific payload. See each operation's 200 response schema.
      required:
        - request_id
        - data
    ServiceMapTopologyResponse:
      type: object
      description: The outbound dependency graph discovered around the anchor host.
      required:
        - network_scope_id
        - anchor_host_id
        - observed_at_ms
        - freshness
        - coverage
        - truncated
        - nodes
        - edges
        - unresolved_endpoints
        - resolution_counts
        - unresolved_projection
      properties:
        network_scope_id:
          type: string
          description: Network scope the graph was resolved within.
        anchor_host_id:
          type: string
          description: Echo of the requested anchor host ID.
        anchor_entity_id:
          type: string
          description: Echo of the requested anchor entity ID, when one was given.
        observed_at_ms:
          type: integer
          format: int64
          description: >-
            Unix timestamp in milliseconds the underlying data was observed by
            the agent (the most recent among loaded hosts).
        freshness:
          $ref: '#/components/schemas/ServiceMapFreshness'
          description: How recent the graph data is.
        coverage:
          $ref: '#/components/schemas/ServiceMapTopologyCoverage'
          description: Aggregate coverage and enrichment status across loaded hosts.
        truncated:
          type: boolean
          description: >-
            True if any bound (`max_nodes`, `max_edges`, or an internal query
            budget) cut the traversal short.
        truncation_reasons:
          type: array
          description: >-
            Machine-readable reasons the traversal was truncated, when
            `truncated=true`.
          items:
            type: string
        nodes:
          type: array
          description: Nodes discovered during the traversal.
          items:
            $ref: '#/components/schemas/ServiceMapNode'
        edges:
          type: array
          description: >-
            Edges discovered during the traversal. Excludes unresolved edges
            when `unresolved_mode=summary`.
          items:
            $ref: '#/components/schemas/ServiceMapEdge'
        unresolved_endpoints:
          type: array
          description: >-
            Sample or full set of edges whose destination could not be resolved,
            per `unresolved_projection`.
          items:
            $ref: '#/components/schemas/ServiceMapUnresolvedEndpoint'
        resolution_counts:
          $ref: '#/components/schemas/ServiceMapResolutionCounts'
          description: Counts of edges by resolution outcome.
        unresolved_projection:
          $ref: '#/components/schemas/ServiceMapUnresolvedProjection'
          description: How unresolved edges were projected into this response.
    ServiceMapAnchor:
      type: object
      description: >-
        Identifies the host (and optionally the specific process/entity) to
        anchor the query on.
      required:
        - host_id
      properties:
        host_id:
          type: string
          description: >-
            Stable ServiceMap host identifier, e.g. `host_0123...`. Must already
            be known to ServiceMap.
          pattern: ^host_[a-z0-9_-]+$
          maxLength: 128
        entity_id:
          type: string
          description: >-
            Optional process/entity ID within the host to anchor on. Omit to
            anchor on the whole host.
    ServiceMapFreshness:
      type: object
      description: Describes how recent the underlying graph data is.
      required:
        - status
        - newest_received_at_ms
        - oldest_received_at_ms
        - max_age_ms
      properties:
        status:
          type: string
          enum:
            - fresh
            - stale
            - unknown
          description: >-
            Freshness classification. `fresh` = the latest snapshot was received
            within 2× the report interval; `stale` = no new snapshot within 2×
            the report interval; `unknown` = no snapshot data, undecidable.
        newest_received_at_ms:
          type: integer
          format: int64
          description: >-
            Unix timestamp in milliseconds of the most recently received graph
            among the hosts covered.
        oldest_received_at_ms:
          type: integer
          format: int64
          description: >-
            Unix timestamp in milliseconds of the least recently received graph
            among the hosts covered.
        max_age_ms:
          type: integer
          format: int64
          description: Age in milliseconds of the staleest graph covered, relative to now.
    ServiceMapTopologyCoverage:
      type: object
      description: >-
        Aggregate coverage and enrichment status across every host graph loaded
        to answer the query.
      required:
        - direction
        - hosts_loaded
        - degraded_hosts
        - truncated_hosts
        - network_inventory_status
        - kubernetes_enrichment_status
        - listener_address_family_status
      properties:
        direction:
          type: string
          enum:
            - outbound
          description: >-
            Always `outbound`; ServiceMap currently only models outbound
            relations.
        hosts_loaded:
          type: integer
          format: int64
          description: Number of distinct host graphs loaded to answer the query.
        degraded_hosts:
          type: integer
          format: int64
          description: Number of loaded host graphs that were degraded at collection time.
        truncated_hosts:
          type: integer
          format: int64
          description: Number of loaded host graphs that were truncated at collection time.
        capture_modes:
          type: array
          description: Distinct capture modes (e.g. `ebpf`) seen across loaded hosts.
          items:
            type: string
        network_inventory_status:
          type: string
          enum:
            - unknown
            - complete
            - partial
            - unavailable
          description: >-
            Aggregate network-inventory enrichment coverage across loaded hosts
            (worst per-host status wins).


            | Value | Meaning |

            |---|---|

            | `complete` | Every requested network namespace on every host was
            scanned successfully with no errors. |

            | `partial` | At least one host failed to scan some namespaces, or
            scanning raised errors. |

            | `unavailable` | At least one host failed to scan all of its
            namespaces. |

            | `unknown` | No host loaded, or a host reported an unrecognized
            status. |
        kubernetes_enrichment_status:
          type: string
          enum:
            - unknown
            - complete
            - partial
            - unavailable
          description: >-
            Aggregate Kubernetes enrichment coverage across loaded hosts (worst
            per-host status wins).


            | Value | Meaning |

            |---|---|

            | `complete` | Every host has full pod-binding metadata for its
            entities. |

            | `partial` | At least one host has bindings but some pod metadata
            is missing or bindings were dropped. |

            | `unavailable` | At least one host has no pod bindings at all. |

            | `unknown` | No host loaded, or a host reported an unrecognized
            status. |
        listener_address_family_status:
          type: string
          enum:
            - unknown
            - complete
            - partial
            - unavailable
          description: >-
            Aggregate listener address-family (IPv4/IPv6) resolution coverage
            across loaded hosts (worst per-host status wins).


            | Value | Meaning |

            |---|---|

            | `complete` | On every host, the IPv6-only attribute of all IPv6
            wildcard listeners is known. |

            | `partial` | At least one host knows the IPv6-only attribute for
            only some IPv6 wildcard listeners. |

            | `unavailable` | At least one host knows the IPv6-only attribute of
            none of its IPv6 wildcard listeners. |

            | `unknown` | No host loaded, or a host reported an unrecognized
            status. |
        ipv6_wildcard_listener_count:
          type: integer
          format: int64
          description: Number of IPv6 wildcard (unspecified-address) listeners observed.
        ipv6_only_known_listener_count:
          type: integer
          format: int64
          description: Number of IPv6 wildcard listeners with a known IPV6_V6ONLY setting.
        ipv6_only_unknown_listener_count:
          type: integer
          format: int64
          description: >-
            Number of IPv6 wildcard listeners whose IPV6_V6ONLY setting could
            not be determined.
        reasons:
          type: array
          description: >-
            Machine-readable reason codes explaining any degraded or truncated
            state among loaded hosts.
          items:
            type: string
    ServiceMapNode:
      type: object
      description: A process, container, or workload discovered on a host.
      required:
        - host_id
        - id
        - kind
        - display_name
      properties:
        host_id:
          type: string
          description: Host the node was observed on.
        id:
          type: string
          description: Entity ID of the node, unique within its host.
        kind:
          type: string
          description: Node kind, e.g. `process`, `container`.
        display_name:
          type: string
          description: Human-readable display name.
        systemd_unit:
          type: string
          description: systemd unit name, when the node is a systemd-managed process.
        executable_name:
          type: string
          description: Executable file name.
        container_name:
          type: string
          description: Container name, when the node runs in a container.
        image_repository:
          type: string
          description: Container image repository.
        image_version:
          type: string
          description: Container image tag/version.
        namespace:
          type: string
          description: Kubernetes namespace, when known.
        workload_name:
          type: string
          description: Kubernetes workload name, when known.
        instance_count:
          type: integer
          description: >-
            Number of instances folded into this node, when the node represents
            a workload replica set.
        identity:
          description: Opaque, kind-specific identity payload. Shape depends on `kind`.
        sample_instances:
          description: >-
            Opaque sample of underlying instances folded into this node, when
            applicable.
        first_seen:
          type: string
          format: date-time
          description: Timestamp the node was first observed.
        last_seen:
          type: string
          format: date-time
          description: Timestamp the node was last observed.
    ServiceMapEdge:
      type: object
      description: >-
        An observed outbound network relation from a source node to a
        destination endpoint.
      required:
        - host_id
        - id
        - source_entity_id
        - source_netns_id
        - destination
        - evidence
        - depth
        - endpoint_resolution
      properties:
        host_id:
          type: string
          description: Host the edge's source node lives on.
        id:
          type: string
          description: Edge ID, unique within its host.
        source_entity_id:
          type: string
          description: Entity ID of the source node.
        source_netns_id:
          type: string
          description: Network namespace ID the connection originated from.
        destination:
          $ref: '#/components/schemas/ServiceMapEndpoint'
          description: Destination endpoint of the connection.
        evidence:
          type: string
          description: How the edge was observed, e.g. `connect`.
        first_seen:
          type: string
          format: date-time
          description: Timestamp the edge was first observed.
        last_seen:
          type: string
          format: date-time
          description: Timestamp the edge was last observed.
        metrics:
          description: >-
            Opaque per-edge metrics payload, only present when
            `include_metrics=true` was requested.
        depth:
          type: integer
          description: Traversal depth this edge was discovered at, relative to the anchor.
        endpoint_resolution:
          $ref: '#/components/schemas/ServiceMapEndpointResolution'
          description: Resolution of the destination endpoint to candidate target nodes.
    ServiceMapUnresolvedEndpoint:
      type: object
      description: >-
        An outbound edge whose destination endpoint could not be confidently
        resolved to a node.
      required:
        - host_id
        - edge_id
        - source_entity_id
        - source_netns_id
        - destination
        - reason
      properties:
        host_id:
          type: string
          description: Host the edge's source node lives on.
        edge_id:
          type: string
          description: Edge ID, unique within its host.
        source_entity_id:
          type: string
          description: Entity ID of the source node.
        source_netns_id:
          type: string
          description: Network namespace ID the connection originated from.
        destination:
          $ref: '#/components/schemas/ServiceMapEndpoint'
          description: Destination endpoint of the connection.
        reason:
          type: string
          description: Machine-readable reason the endpoint could not be resolved.
    ServiceMapResolutionCounts:
      type: object
      description: Counts of edges by resolution outcome.
      required:
        - resolved
        - ambiguous
        - unresolved
      properties:
        resolved:
          type: integer
          description: Number of edges resolved to exactly one confident candidate.
        ambiguous:
          type: integer
          description: Number of edges resolved to multiple or low-confidence candidates.
        unresolved:
          type: integer
          description: Number of edges with no resolvable candidate.
    ServiceMapUnresolvedProjection:
      type: object
      description: >-
        Summary of how unresolved edges were projected into the response,
        bounded by `unresolved_mode`.
      required:
        - mode
        - total
        - returned
        - omitted
        - by_reason
      properties:
        mode:
          type: string
          enum:
            - summary
            - full
          description: >-
            The `unresolved_mode` that was applied. `full` = unresolved
            destinations are listed completely in `unresolved_endpoints` and
            their edges stay in `edges` (default); `summary` = unresolved edges
            are excluded from `edges` and `unresolved_endpoints` keeps at most
            20 samples, complemented by the `by_reason` counts.
        total:
          type: integer
          description: >-
            Total number of unresolved edges found, regardless of how many were
            returned.
        returned:
          type: integer
          description: Number of unresolved edges included in `unresolved_endpoints`.
        omitted:
          type: integer
          description: >-
            Number of unresolved edges found but not returned (`total -
            returned`).
        by_reason:
          type: array
          description: Breakdown of `total` unresolved edges by reason code.
          items:
            $ref: '#/components/schemas/ServiceMapUnresolvedReasonCount'
    ErrorResponse:
      type: object
      description: Response envelope for errors. `error` is required; `data` is absent.
      properties:
        request_id:
          type: string
          example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
          description: >-
            Unique trace ID of this request; include it when reporting issues so
            logs can be located.
        error:
          $ref: '#/components/schemas/DutyError'
      required:
        - request_id
        - error
    ServiceMapEndpoint:
      type: object
      description: A network transport endpoint.
      required:
        - ip
        - port
        - protocol
      properties:
        ip:
          type: string
          description: Destination IP address.
        port:
          type: integer
          description: Destination port.
        protocol:
          type: string
          enum:
            - tcp
            - udp
          description: Transport protocol, `tcp` or `udp`.
    ServiceMapEndpointResolution:
      type: object
      description: >-
        The result of resolving an edge's destination endpoint to one or more
        candidate nodes.
      required:
        - status
        - endpoint
        - candidates
      properties:
        status:
          type: string
          enum:
            - resolved
            - ambiguous
            - unresolved
          description: >-
            Resolution outcome. `resolved` = exactly one confident candidate;
            `ambiguous` = multiple or low-confidence candidates; `unresolved` =
            no candidate found.
        reason:
          type: string
          description: >-
            Machine-readable reason code when `status` is not `resolved`, e.g.
            `no_current_listener`, `multiple_current_listeners`,
            `query_budget_exceeded`.
        endpoint:
          $ref: '#/components/schemas/ServiceMapEndpoint'
          description: The destination endpoint being resolved.
        candidates:
          type: array
          description: Candidate nodes found for this endpoint, ranked by confidence.
          items:
            $ref: '#/components/schemas/ServiceMapResolutionCandidate'
        candidates_truncated:
          type: boolean
          description: >-
            True if the candidate list was cut short by an internal query
            budget.
    ServiceMapUnresolvedReasonCount:
      type: object
      description: Count of unresolved edges sharing one reason.
      required:
        - reason
        - count
      properties:
        reason:
          type: string
          description: Machine-readable unresolved reason code.
        count:
          type: integer
          description: Number of unresolved edges with this reason.
    DutyError:
      type: object
      description: >-
        Error payload inside the response envelope. Present only on non-2xx
        responses.
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          type: string
          description: >-
            Human-readable error message, localized by the caller's
            Accept-Language. May contain field names, IDs, or other context from
            the failing request.
          example: The specified parameter template_id is not valid.
      required:
        - code
        - message
    ServiceMapResolutionCandidate:
      type: object
      description: >-
        One candidate node that could be the resolved target of an edge's
        destination endpoint.
      required:
        - host_id
        - entity_id
        - netns_id
        - listener_id
        - listener_ip
        - effective_ip
        - protocol
        - port
        - match_kind
        - confidence
        - graph_sequence
        - observed_at_ms
      properties:
        host_id:
          type: string
          description: Host ID of the candidate listener.
        entity_id:
          type: string
          description: Entity/process ID of the candidate listener.
        netns_id:
          type: string
          description: Network namespace ID the candidate listener is in.
        listener_id:
          type: string
          description: Identifier of the matched listener.
        listener_ip:
          type: string
          description: IP address the listener is bound to (may be a wildcard address).
        effective_ip:
          type: string
          description: Destination IP actually being resolved against this candidate.
        protocol:
          type: string
          enum:
            - tcp
            - udp
          description: Transport protocol, `tcp` or `udp`.
        port:
          type: integer
          description: Destination port.
        match_kind:
          type: string
          description: >-
            How the listener matched the destination, e.g. `exact`, `wildcard`,
            `wildcard_dual_stack`, `wildcard_address_family_unknown`.
        confidence:
          type: number
          description: >-
            Match confidence in `[0, 1]`; capped at 0.6 whenever more than one
            candidate is returned.
        node_kind:
          type: string
          description: Kind of the candidate's owning node, when known.
        node_display_name:
          type: string
          description: Display name of the candidate's owning node, when known.
        graph_sequence:
          type: integer
          format: uint64
          description: >-
            Sequence number of the graph generation this candidate was observed
            in.
        observed_at_ms:
          type: integer
          format: int64
          description: >-
            Unix timestamp in milliseconds when the candidate's graph generation
            was observed by the agent.
    ErrorCode:
      type: string
      description: >-
        Flashduty error code enum. Every failed API response sets `error.code`
        to one of these stable wire strings. HTTP status is informational — the
        authoritative signal is the enum value.


        | Code | HTTP | Meaning |

        |---|---|---|

        | `OK` | 200 | Reserved — not returned on real errors. |

        | `InvalidParameter` | 400 | A required parameter is missing or failed
        validation. |

        | `BadRequest` | 400 | Generic 400 used when no more specific code fits.
        |

        | `InvalidContentType` | 400 | The `Content-Type` header is not
        `application/json`. |

        | `ResourceNotFound` | 400 | The referenced resource does not exist.
        Note: returned as HTTP 400, not 404 (historical choice). |

        | `NoLicense` | 400 | The feature is license-gated and no active license
        was found. |

        | `ReferenceExist` | 400 | Deletion blocked — other entities still
        reference this resource. |

        | `Unauthorized` | 401 | `app_key` is missing, invalid, or expired. |

        | `BalanceNotEnough` | 402 | Billing-gated operation with insufficient
        account balance. |

        | `AccessDenied` | 403 | Authenticated but lacking the permission
        required for this operation. |

        | `RouteNotFound` | 404 | The request URL path is not a known route. |

        | `MethodNotAllowed` | 405 | The HTTP method is not allowed on this
        otherwise-known path. |

        | `UndonedOrderExist` | 409 | An outstanding billing order blocks this
        new one. Wait and retry. |

        | `RequestLocked` | 423 | Operation temporarily locked due to repeated
        failures. |

        | `EntityTooLarge` | 413 | Request body exceeds the configured max size.
        |

        | `RequestTooFrequently` | 429 | Rate limit hit — API-global,
        per-account, or per-integration. |

        | `RequestVerifyRequired` | 428 | Second-factor verification required
        but not supplied. |

        | `DangerousOperation` | 428 | High-risk operation requires MFA
        verification. |

        | `InternalError` | 500 | Unhandled server-side error. Include
        `request_id` in the bug report. |

        | `ServiceUnavailable` | 503 | A backend dependency is unavailable. Try
        again later. |
      enum:
        - OK
        - InvalidParameter
        - BadRequest
        - InvalidContentType
        - ResourceNotFound
        - NoLicense
        - ReferenceExist
        - Unauthorized
        - BalanceNotEnough
        - AccessDenied
        - RouteNotFound
        - MethodNotAllowed
        - UndonedOrderExist
        - RequestLocked
        - EntityTooLarge
        - RequestTooFrequently
        - RequestVerifyRequired
        - DangerousOperation
        - InternalError
        - ServiceUnavailable
      x-enumDescriptions:
        OK: Reserved — not returned on real errors.
        InvalidParameter: A required parameter is missing or failed validation.
        BadRequest: Generic 400 used when no more specific code fits.
        InvalidContentType: The `Content-Type` header is not `application/json`.
        ResourceNotFound: >-
          The referenced resource does not exist. Note: returned as HTTP 400,
          not 404 (historical choice).
        NoLicense: The feature is license-gated and no active license was found.
        ReferenceExist: Deletion blocked — other entities still reference this resource.
        Unauthorized: '`app_key` is missing, invalid, or expired.'
        BalanceNotEnough: Billing-gated operation with insufficient account balance.
        AccessDenied: Authenticated but lacking the permission required for this operation.
        RouteNotFound: The request URL path is not a known route.
        MethodNotAllowed: The HTTP method is not allowed on this otherwise-known path.
        UndonedOrderExist: An outstanding billing order blocks this new one. Wait and retry.
        RequestLocked: Operation temporarily locked due to repeated failures.
        EntityTooLarge: Request body exceeds the configured max size.
        RequestTooFrequently: Rate limit hit — API-global, per-account, or per-integration.
        RequestVerifyRequired: Second-factor verification required but not supplied.
        DangerousOperation: High-risk operation requires MFA verification.
        InternalError: Unhandled server-side error. Include `request_id` in the bug report.
        ServiceUnavailable: A backend dependency is unavailable. Try again later.
      example: InvalidParameter
  responses:
    BadRequest:
      description: Invalid request — usually a missing or malformed parameter.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missingParameter:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: InvalidParameter
                  message: The specified parameter is not valid.
    Unauthorized:
      description: Missing or invalid app_key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missingAppKey:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: Unauthorized
                  message: You are unauthorized.
    TooManyRequests:
      description: >-
        Rate limit hit. Either the global API limit, a per-account limit, or a
        per-integration limit.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            rateLimited:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: RequestTooFrequently
                  message: Request too frequently.
    ServerError:
      description: Unexpected server-side error. Include the request_id when reporting.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            internal:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: InternalError
                  message: >-
                    We encountered an internal error, and it has been reported.
                    Please try again later.
    ServiceUnavailable:
      description: >-
        The ServiceMap subsystem is not enabled or not reachable on this
        deployment. Include the request_id when reporting.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            serviceMapDisabled:
              value:
                request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4
                error:
                  code: ServiceUnavailable
                  message: servicemap store is not initialized
  securitySchemes:
    AppKeyAuth:
      type: apiKey
      in: query
      name: app_key
      description: >-
        App key issued from the Flashduty console under Account → APP Keys.
        Required on every public API call. Keep it secret — it grants the same
        access as the owning account.

````