Skip to main content
POST
List recent event samples

Restrictions

Usage

  • Samples are the events as they entered enrichment, so they show exactly the labels your rules match on.
  • The integration must exist and the caller must be allowed to read it.
  • Only the last 20 raw events of an integration are kept, for 7 days; the list is for checking rules, not for searching history.
  • A stored sample keeps its description up to 8 KiB (description_truncated marks one that was cut); an event larger than 64 KiB is not kept at all.
  • dropped marks a sample the integration discarded before it became an alert.

Authorizations

app_key
string
query
required

APP Key created in the Flashduty console under My → APP Key. Send it as the app_key query parameter or in the Fd-App-Key request header. Its effective access is the intersection of the key's permission scope and the creator's current role permissions. Keep it secret.

Body

application/json

Request body of POST /enrichment/sample/list.

integration_id
integer<int64>
required

Integration whose recent raw events to list.

Required range: x >= 1

Response

Success

Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.

request_id
string
required

Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues.

Example:

"01HK8XQE3Z7JM2NTFQ5YJ8P9R4"

data
object

Recent raw events of one integration.