> ## Documentation Index > Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt > Use this file to discover all available pages before exploring further. # List recent event samples > List the raw events an integration received most recently, newest first. ## Restrictions | Aspect | Value | | - | - | | Rate limits | **1,000 requests/minute**; **50 requests/second** per account | | Permissions | **Channels Manage** (`on-call`) or **Integrations Read** (`on-call`) or **Integrations Manage** (`on-call`) | ## Usage * Samples are the events as they entered enrichment, so they show exactly the labels your rules match on. * The integration must exist and the caller must be allowed to read it. * Only the last 20 raw events of an integration are kept, for 7 days; the list is for checking rules, not for searching history. * A stored sample keeps its description up to 8 KiB (`description_truncated` marks one that was cut); an event larger than 64 KiB is not kept at all. * `dropped` marks a sample the integration discarded before it became an alert. ## OpenAPI ````yaml /api-reference/on-call.openapi.en.json post /enrichment/sample/list openapi: 3.1.0 info: title: Flashduty Open API description: >- Public HTTP API for the Flashduty incident management platform — incidents, notification templates, channels, schedules, monitors, RUM, and platform administration. Every operation is authenticated with an `app_key` query parameter created in the Flashduty console under My → APP Key (or sent in the `Fd-App-Key` header). Responses follow a uniform envelope: `{ request_id, data }` on success, `{ request_id, error }` on failure. version: 1.0.0 servers: - url: https://api.flashcat.cloud description: Flashduty Open API security: - AppKeyAuth: [] tags: - name: On-call/Incidents description: '' - name: On-call/Channels description: '' - name: On-call/Alerts description: >- Search, inspect, and act on alerts. Manage card views and alert processing pipelines. - name: On-call/Integrations description: '' - name: On-call/IM integrations description: IM integration queries, such as which integrations have war room enabled. - name: On-call/Schedules description: '' - name: On-call/Licenses description: '' - name: On-call/Calendars description: '' - name: On-call/Notification templates description: '' - name: On-call/Alert enrichment description: Custom fields, enrichment rules, and data mapping (schema, data, API). - name: On-call/Analytics description: '' - name: On-call/Status pages description: '' - name: On-call/Changes description: '' paths: /enrichment/sample/list: post: tags: - On-call/Alert enrichment summary: List recent event samples description: List the raw events an integration received most recently, newest first. operationId: enrichment-sample-read-list requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/EnrichmentSampleListRequest' example: integration_id: 6113996590131 responses: '200': description: Success content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - type: object properties: data: $ref: '#/components/schemas/EnrichmentSampleListResponse' example: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: items: - received_at: 1792657352 event: title: CPU usage 94% on checkout-7 title_rule: $service::$check description: CPU usage above 90% for 5 minutes. alert_key: cpu-usage-high:checkout-7 event_status: Critical event_severity: Critical event_time: 1792657345 labels: check: cpu env: prod host: checkout-7 images: [] description_truncated: false '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' components: schemas: EnrichmentSampleListRequest: type: object description: Request body of `POST /enrichment/sample/list`. required: - integration_id properties: integration_id: type: integer format: int64 minimum: 1 description: Integration whose recent raw events to list. SuccessEnvelope: type: object description: >- Success response envelope. On every 2xx response, `request_id` identifies the call (also mirrored in the `Flashcat-Request-Id` header) and `data` holds the endpoint-specific payload. Failure responses use a different shape — see `ErrorResponse`. properties: request_id: type: string description: >- Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: description: >- Operation-specific payload, documented in each operation's 200 response. Operations without a payload return `{}` or omit `data` entirely. required: - request_id EnrichmentSampleListResponse: type: object description: Recent raw events of one integration. required: - items properties: items: type: array items: $ref: '#/components/schemas/EnrichmentSample' description: Samples, newest first. Empty when no event has arrived yet. EnrichmentSample: type: object description: One raw event an integration received, as it entered enrichment. required: - received_at - event - description_truncated properties: received_at: type: integer format: int64 description: >- Unix timestamp in seconds of when the integration received the event. event: $ref: '#/components/schemas/AlertEvent' description: The raw event, before any enrichment rule ran. description_truncated: type: boolean description: '`true` when the stored description was cut to the sample size limit.' dropped: type: boolean description: >- `true` when the integration discarded the event before it became an alert. Omitted when `false`. ErrorResponse: type: object description: Response envelope for errors. `error` is required; `data` is absent. properties: request_id: type: string example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 description: >- Unique trace ID of this request; include it when reporting issues so logs can be located. error: $ref: '#/components/schemas/DutyError' required: - request_id - error AlertEvent: type: object description: >- One raw alert event, in the shape the ingestion pipeline receives and stores. required: - event_status properties: title: type: string description: >- Event title. Required unless `title_rule` is set; the two are the source of the alert title. title_rule: type: string description: >- Title template such as `$service::$alertname`, built from `labels` when `title` is empty. description: type: string description: Event description, truncated to 2048 characters. alert_key: type: string description: >- Deduplication key that merges events into one alert. Empty is allowed: the preview mints a random key, so nothing is merged. event_status: type: string enum: - Critical - Warning - Info - Ok description: >- Event status. `Critical`, `Warning` and `Info` are firing events; `Ok` is a recovery. event_severity: type: string enum: - Critical - Warning - Info description: >- Severity carried by a firing event. The preview overwrites it with `event_status` for firing events. event_time: type: integer format: int64 description: >- Unix timestamp in seconds. The preview stamps the current time, so the value sent is ignored. labels: type: object additionalProperties: type: string description: >- Event labels. Up to 50 entries; keys are label names, values strings. images: type: array items: $ref: '#/components/schemas/AlertImage' description: Images attached to the event. DutyError: type: object description: >- Error payload inside the response envelope. Present only on non-2xx responses. properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string description: >- Human-readable error message in the response language (`locale` / `lang` query parameter or `Accept-Language` header). May name the offending field; do not parse it. example: The specified parameter template_id is not valid. required: - code - message AlertImage: type: object description: An image attachment on an alert or event. required: - src properties: href: type: string description: Optional link URL when the image is clicked. src: type: string description: >- Image source URL or internal image reference (starts with `img_` or `http`). alt: type: string description: >- Alternative text shown when the image cannot be displayed; empty when not set. ErrorCode: type: string description: >- Error code. Every failed response sets `error.code` to one of these stable strings; branch on it rather than on the HTTP status. | Code | HTTP | Meaning | |---|---|---| | `OK` | 200 | Reserved; never returned on a failed request. | | `InvalidParameter` | 400 | A parameter is missing, has the wrong type, or failed validation; `message` usually names the field. | | `BadRequest` | 400 | The request breaks a business rule or conflicts with the current state of an object; `message` says which. | | `InvalidContentType` | 400 | The body is not sent as `application/json`. | | `ResourceNotFound` | 400 | The referenced object does not exist in this account or was deleted. Returned as HTTP 400, not 404. | | `NoLicense` | 400 | The account's plan does not include the feature, a plan quota is used up, the plan has expired, or credits are insufficient. | | `ReferenceExist` | 400 | The object is still referenced by other objects, so it cannot be deleted. | | `Unauthorized` | 401 | The APP Key is missing, invalid, or deleted. | | `BalanceNotEnough` | 402 | Console-only (billing); not returned by Open API operations. | | `AccessDenied` | 403 | The APP Key's permission scope or the creator's role does not allow this operation or object. | | `RouteNotFound` | 404 | No operation matches the HTTP method and path. | | `MethodNotAllowed` | 405 | The path exists but not for this HTTP method. | | `UndonedOrderExist` | 409 | Console-only (billing); not returned by Open API operations. | | `EntityTooLarge` | 413 | The request body exceeds the size limit. | | `RequestLocked` | 423 | Console-only (sign-in protection); not returned by Open API operations. | | `RequestVerifyRequired` | 428 | Console-only (verification code); not returned by Open API operations. | | `DangerousOperation` | 428 | Console-only (MFA for high-risk actions); not returned by Open API operations. | | `RequestTooFrequently` | 429 | A rate limit was hit; wait for the `Flashcat-Request-Rate-Limit-Delay` response header (seconds) before retrying. | | `InternalError` | 500 | Unexpected server error; retry with backoff and include `request_id` when reporting. | | `ServiceUnavailable` | 503 | A backend dependency is overloaded or unavailable; retry with backoff. | enum: - OK - InvalidParameter - BadRequest - InvalidContentType - ResourceNotFound - NoLicense - ReferenceExist - Unauthorized - BalanceNotEnough - AccessDenied - RouteNotFound - MethodNotAllowed - UndonedOrderExist - EntityTooLarge - RequestLocked - RequestVerifyRequired - DangerousOperation - RequestTooFrequently - InternalError - ServiceUnavailable x-enumDescriptions: OK: Reserved; never returned on a failed request. InvalidParameter: >- A parameter is missing, has the wrong type, or failed validation; `message` usually names the field. BadRequest: >- The request breaks a business rule or conflicts with the current state of an object; `message` says which. InvalidContentType: The body is not sent as `application/json`. ResourceNotFound: >- The referenced object does not exist in this account or was deleted. Returned as HTTP 400, not 404. NoLicense: >- The account's plan does not include the feature, a plan quota is used up, the plan has expired, or credits are insufficient. ReferenceExist: >- The object is still referenced by other objects, so it cannot be deleted. Unauthorized: The APP Key is missing, invalid, or deleted. BalanceNotEnough: Console-only (billing); not returned by Open API operations. AccessDenied: >- The APP Key's permission scope or the creator's role does not allow this operation or object. RouteNotFound: No operation matches the HTTP method and path. MethodNotAllowed: The path exists but not for this HTTP method. UndonedOrderExist: Console-only (billing); not returned by Open API operations. EntityTooLarge: The request body exceeds the size limit. RequestLocked: >- Console-only (sign-in protection); not returned by Open API operations. RequestVerifyRequired: Console-only (verification code); not returned by Open API operations. DangerousOperation: >- Console-only (MFA for high-risk actions); not returned by Open API operations. RequestTooFrequently: >- A rate limit was hit; wait for the `Flashcat-Request-Rate-Limit-Delay` response header (seconds) before retrying. InternalError: >- Unexpected server error; retry with backoff and include `request_id` when reporting. ServiceUnavailable: A backend dependency is overloaded or unavailable; retry with backoff. example: InvalidParameter responses: BadRequest: description: Invalid request — usually a missing or malformed parameter. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingParameter: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InvalidParameter message: The specified parameter is not valid. Unauthorized: description: Missing or invalid app_key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingAppKey: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: Unauthorized message: You are unauthorized. Forbidden: description: >- The app_key is valid, but its permission scope or the creator's role does not allow this operation or object. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: noEditPermission: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: AccessDenied message: Access Denied. TooManyRequests: description: >- Rate limit hit. Wait for the number of seconds in `Flashcat-Request-Rate-Limit-Delay`, then retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: rateLimited: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: RequestTooFrequently message: Request too frequently. headers: Flashcat-Request-Rate-Limit-Delay: description: >- Seconds until the current rate-limit window resets. Absent when the request was rejected by the gateway's global protection limit. schema: type: integer minimum: 0 ServerError: description: Unexpected server-side error. Include the request_id when reporting. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InternalError message: >- We encountered an internal error, and it has been reported. Please try again later. securitySchemes: AppKeyAuth: type: apiKey in: query name: app_key description: >- APP Key created in the Flashduty console under My → APP Key. Send it as the `app_key` query parameter or in the `Fd-App-Key` request header. Its effective access is the intersection of the key's permission scope and the creator's current role permissions. Keep it secret. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.