{"version":"1.0","generated_for":"openai-function-calling","base_url":"https://api.24observe.com","auth":{"type":"bearer","token_format":"obs_<43-char-base64url>","header":"Authorization: Bearer <token>"},"tools":[{"type":"function","function":{"name":"create_monitors","description":"Create monitors\n\nIssue this as: POST https://api.24observe.com/api/v1/monitors/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"url":{"type":"string","minLength":1,"maxLength":2048},"type":{"type":"string","enum":["http","https","tcp","ping","port","ssl","keyword","heartbeat","dns","smtp","multi_step","browser"]},"intervalSec":{"type":"number","enum":[30,60,300,900,1800,3600]},"timeoutMs":{"type":"integer","minimum":1000,"maximum":30000},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":2048}},"expectedStatusCode":{"type":"integer","minimum":100,"maximum":599},"degradedResponseTimeMs":{"type":"integer","minimum":100,"maximum":60000},"port":{"type":"integer","minimum":1,"maximum":65535},"keyword":{"type":"string","maxLength":1024},"keywordMatchType":{"type":"string","enum":["contains","not_contains"]},"alertEmail":{"type":"string","format":"email","maxLength":255},"alertWebhookUrl":{"type":"string","format":"uri","maxLength":2048},"alertSlackUrl":{"type":"string","format":"uri","maxLength":2048},"alertDiscordUrl":{"type":"string","format":"uri","maxLength":2048},"alertMsteamsUrl":{"type":"string","format":"uri","maxLength":2048},"alertTelegramBotToken":{"type":"string","maxLength":128},"alertTelegramChatId":{"type":"string","maxLength":64},"alertPagerdutyRoutingKey":{"type":"string","minLength":8,"maxLength":512},"alertOpsgenieApiKey":{"type":"string","minLength":8,"maxLength":512},"alertSmsNumber":{"type":"string","pattern":"^\\+[1-9]\\d{6,14}$"},"alertVoiceNumber":{"type":"string","pattern":"^\\+[1-9]\\d{6,14}$"},"escalationPolicyId":{"type":"integer","exclusiveMinimum":0},"alertThreshold":{"type":"integer","minimum":1,"maximum":10},"alertOnDegraded":{"type":"boolean"},"paused":{"type":"boolean"},"heartbeatGraceSec":{"type":"integer","minimum":0,"maximum":86400},"uptimeTargetBp":{"type":"integer","minimum":1,"maximum":10000},"uptimeWindowDays":{"type":"integer","minimum":1,"maximum":365},"tags":{"type":"array","items":{"type":"string","minLength":1,"maxLength":50,"pattern":"^[a-z0-9][a-z0-9_-]*$"},"maxItems":20},"regions":{"type":"array","items":{"type":"string","enum":["local","weur","eeur","enam","wnam","apac","oc","sam","afr"]},"minItems":1,"maxItems":6},"steps":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128},"method":{"type":"string","enum":["GET","POST","PUT","PATCH","DELETE","HEAD"]},"url":{"type":"string","minLength":1,"maxLength":2048},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":2048}},"body":{"type":"string","maxLength":65536},"assertions":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string","enum":["status_code","response_time_ms","body_json","body_text","header"]},"path":{"type":"string","maxLength":512},"comparison":{"type":"string","enum":["eq","ne","contains","not_contains","gt","lt","exists","not_exists"]},"value":{"anyOf":[{"type":"string","maxLength":2048},{"type":"number"}]}},"required":["source","comparison"],"additionalProperties":false},"maxItems":20},"extract":{"type":"array","items":{"type":"object","properties":{"var":{"type":"string","minLength":1,"maxLength":64,"pattern":"^[a-zA-Z_][a-zA-Z0-9_]*$"},"source":{"type":"string","enum":["body_json","header"]},"path":{"type":"string","minLength":1,"maxLength":512}},"required":["var","source","path"],"additionalProperties":false},"maxItems":10}},"required":["name","method","url"],"additionalProperties":false},"minItems":1,"maxItems":20}},"required":["name","url","type","intervalSec","timeoutMs"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_monitors","description":"List monitors\n\nIssue this as: GET https://api.24observe.com/api/v1/monitors/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_monitors_by_id","description":"Read monitors {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/monitors/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_monitors_by_id","description":"Update monitors {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/monitors/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"url":{"type":"string","minLength":1,"maxLength":2048},"type":{"type":"string","enum":["http","https","tcp","ping","port","ssl","keyword","heartbeat","dns","smtp","multi_step","browser"]},"intervalSec":{"type":"number","enum":[30,60,300,900,1800,3600]},"timeoutMs":{"type":"integer","minimum":1000,"maximum":30000},"headers":{"anyOf":[{"type":"object","additionalProperties":{"type":"string","maxLength":2048}},{"type":"null"}]},"expectedStatusCode":{"anyOf":[{"type":"integer","minimum":100,"maximum":599},{"type":"null"}]},"degradedResponseTimeMs":{"anyOf":[{"type":"integer","minimum":100,"maximum":60000},{"type":"null"}]},"port":{"anyOf":[{"type":"integer","minimum":1,"maximum":65535},{"type":"null"}]},"keyword":{"anyOf":[{"type":"string","maxLength":1024},{"type":"null"}]},"keywordMatchType":{"anyOf":[{"type":"string","enum":["contains","not_contains"]},{"type":"null"}]},"alertEmail":{"anyOf":[{"type":"string","format":"email","maxLength":255},{"type":"null"}]},"alertWebhookUrl":{"anyOf":[{"type":"string","format":"uri","maxLength":2048},{"type":"null"}]},"alertSlackUrl":{"anyOf":[{"type":"string","format":"uri","maxLength":2048},{"type":"null"}]},"alertDiscordUrl":{"anyOf":[{"type":"string","format":"uri","maxLength":2048},{"type":"null"}]},"alertMsteamsUrl":{"anyOf":[{"type":"string","format":"uri","maxLength":2048},{"type":"null"}]},"alertTelegramBotToken":{"anyOf":[{"type":"string","maxLength":128},{"type":"null"}]},"alertTelegramChatId":{"anyOf":[{"type":"string","maxLength":64},{"type":"null"}]},"alertPagerdutyRoutingKey":{"anyOf":[{"type":"string","minLength":8,"maxLength":512},{"type":"null"}]},"alertOpsgenieApiKey":{"anyOf":[{"type":"string","minLength":8,"maxLength":512},{"type":"null"}]},"alertSmsNumber":{"anyOf":[{"type":"string","pattern":"^\\+[1-9]\\d{6,14}$"},{"type":"null"}]},"alertVoiceNumber":{"anyOf":[{"type":"string","pattern":"^\\+[1-9]\\d{6,14}$"},{"type":"null"}]},"escalationPolicyId":{"anyOf":[{"type":"integer","exclusiveMinimum":0},{"type":"null"}]},"alertThreshold":{"type":"integer","minimum":1,"maximum":10},"alertOnDegraded":{"type":"boolean"},"paused":{"type":"boolean"},"heartbeatGraceSec":{"type":"integer","minimum":0,"maximum":86400},"uptimeTargetBp":{"type":"integer","minimum":1,"maximum":10000},"uptimeWindowDays":{"type":"integer","minimum":1,"maximum":365},"tags":{"type":"array","items":{"type":"string","minLength":1,"maxLength":50,"pattern":"^[a-z0-9][a-z0-9_-]*$"},"maxItems":20},"regions":{"type":"array","items":{"type":"string","enum":["local","weur","eeur","enam","wnam","apac","oc","sam","afr"]},"minItems":1,"maxItems":6},"steps":{"anyOf":[{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128},"method":{"type":"string","enum":["GET","POST","PUT","PATCH","DELETE","HEAD"]},"url":{"type":"string","minLength":1,"maxLength":2048},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":2048}},"body":{"type":"string","maxLength":65536},"assertions":{"type":"array","items":{"type":"object","properties":{"source":{"type":"string","enum":["status_code","response_time_ms","body_json","body_text","header"]},"path":{"type":"string","maxLength":512},"comparison":{"type":"string","enum":["eq","ne","contains","not_contains","gt","lt","exists","not_exists"]},"value":{"anyOf":[{"type":"string","maxLength":2048},{"type":"number"}]}},"required":["source","comparison"],"additionalProperties":false},"maxItems":20},"extract":{"type":"array","items":{"type":"object","properties":{"var":{"type":"string","minLength":1,"maxLength":64,"pattern":"^[a-zA-Z_][a-zA-Z0-9_]*$"},"source":{"type":"string","enum":["body_json","header"]},"path":{"type":"string","minLength":1,"maxLength":512}},"required":["var","source","path"],"additionalProperties":false},"maxItems":10}},"required":["name","method","url"],"additionalProperties":false},"minItems":1,"maxItems":20},{"type":"null"}]}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_monitors_by_id_rotate_heartbeat_token","description":"Create monitors {id} rotate heartbeat token\n\nIssue this as: POST https://api.24observe.com/api/v1/monitors/{id}/rotate-heartbeat-token","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_monitors_bulk","description":"Create monitors bulk\n\nIssue this as: POST https://api.24observe.com/api/v1/monitors/bulk","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"update_monitors_bulk","description":"Update monitors bulk\n\nIssue this as: PATCH https://api.24observe.com/api/v1/monitors/bulk","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_incidents","description":"List incidents\n\nIssue this as: GET https://api.24observe.com/api/v1/incidents/","parameters":{"type":"object","properties":{"limit":{"type":"string"},"offset":{"type":"string"},"status":{"type":"string","enum":["investigating","identified","monitoring","resolved","open"]}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_incidents_by_id","description":"Read incidents {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/incidents/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_incidents_by_id_deliveries","description":"Read incidents {id} deliveries\n\nIssue this as: GET https://api.24observe.com/api/v1/incidents/{id}/deliveries","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_incidents_by_id_analysis","description":"Read incidents {id} analysis\n\nIssue this as: GET https://api.24observe.com/api/v1/incidents/{id}/analysis","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_incidents_by_id_updates","description":"Create incidents {id} updates\n\nIssue this as: POST https://api.24observe.com/api/v1/incidents/{id}/updates","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"status":{"type":"string","enum":["investigating","identified","monitoring","resolved"]},"body":{"type":"string","minLength":1,"maxLength":4096}},"required":["status","body"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id","body"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_incidents_by_id_acknowledge","description":"Create incidents {id} acknowledge\n\nIssue this as: POST https://api.24observe.com/api/v1/incidents/{id}/acknowledge","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"replace_incidents_by_id_postmortem","description":"Replace incidents {id} postmortem\n\nIssue this as: PUT https://api.24observe.com/api/v1/incidents/{id}/postmortem","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"postmortem":{"type":"string","maxLength":16384}},"required":["postmortem"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id","body"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_incidents_by_id_resolve","description":"Create incidents {id} resolve\n\nIssue this as: POST https://api.24observe.com/api/v1/incidents/{id}/resolve","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_incidents_by_id_context","description":"Read incidents {id} context\n\nIssue this as: GET https://api.24observe.com/api/v1/incidents/{id}/context","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_monitors_by_id_stats","description":"Read monitors {id} stats\n\nIssue this as: GET https://api.24observe.com/api/v1/monitors/{id}/stats","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_monitors_by_id_timeline","description":"Read monitors {id} timeline\n\nIssue this as: GET https://api.24observe.com/api/v1/monitors/{id}/timeline","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_monitors_stats_batch","description":"Read monitors stats batch\n\nIssue this as: GET https://api.24observe.com/api/v1/monitors/stats/batch","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_monitors_by_id_checks","description":"Read monitors {id} checks\n\nIssue this as: GET https://api.24observe.com/api/v1/monitors/{id}/checks","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_maintenance_windows","description":"Create maintenance\n\nIssue this as: POST https://api.24observe.com/api/v1/maintenance-windows/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"monitorId":{"type":"number"},"startsAt":{"type":"string","format":"date-time"},"endsAt":{"type":"string","format":"date-time"}},"required":["startsAt","endsAt"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_maintenance_windows","description":"List maintenance\n\nIssue this as: GET https://api.24observe.com/api/v1/maintenance-windows/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"update_maintenance_windows_by_id","description":"Update maintenance {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/maintenance-windows/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"monitorId":{"type":["number","null"]},"startsAt":{"type":"string","format":"date-time"},"endsAt":{"type":"string","format":"date-time"}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_audit_logs_verify","description":"Read audit verify\n\nIssue this as: GET https://api.24observe.com/api/v1/audit-logs/verify","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_audit_logs","description":"List audit\n\nIssue this as: GET https://api.24observe.com/api/v1/audit-logs/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_audit_logs_export","description":"Read audit export\n\nIssue this as: GET https://api.24observe.com/api/v1/audit-logs/export","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_overview","description":"List overview\n\nIssue this as: GET https://api.24observe.com/api/v1/overview/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_monitors_by_id_test_alert","description":"Create monitors {id} test alert\n\nIssue this as: POST https://api.24observe.com/api/v1/monitors/{id}/test-alert","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_export_monitorscsv","description":"Read export monitors.csv\n\nIssue this as: GET https://api.24observe.com/api/v1/export/monitors.csv","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_export_accountzip","description":"Export all of this organization's data as a ZIP of per-resource JSON files.\n\nIssue this as: GET https://api.24observe.com/api/v1/export/account.zip","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_heartbeats_by_token","description":"Create heartbeats {token}\n\nIssue this as: POST https://api.24observe.com/api/v1/heartbeats/{token}","parameters":{"type":"object","properties":{"token":{"type":"string"}},"required":["token"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_logs_ingest","description":"Create logs ingest\n\nIssue this as: POST https://api.24observe.com/api/v1/logs/ingest","parameters":{"type":"object","properties":{"body":{"anyOf":[{"type":"object","properties":{"ts":{"anyOf":[{"type":"string","format":"date-time"},{"type":"integer","exclusiveMinimum":0}]},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"service":{"type":"string","minLength":1,"maxLength":255},"source":{"type":"string","maxLength":255},"host":{"type":"string","maxLength":255},"message":{"type":"string","minLength":1,"maxLength":8192},"attrs":{"type":"object","additionalProperties":{}},"event_id":{"type":"string","minLength":1,"maxLength":128}},"required":["message"],"additionalProperties":false},{"type":"array","items":{"$ref":"#/anyOf/0"},"minItems":1,"maxItems":500}],"description":"JSON request body. Send as-is in the HTTP request body."}},"additionalProperties":false}}},{"type":"function","function":{"name":"create_logs_ingest_heroku_by_token","description":"Create logs ingest heroku {token}\n\nIssue this as: POST https://api.24observe.com/api/v1/logs/ingest/heroku/{token}","parameters":{"type":"object","properties":{"token":{"type":"string"}},"required":["token"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_logs_ingest_vercel_by_token","description":"Create logs ingest vercel {token}\n\nIssue this as: POST https://api.24observe.com/api/v1/logs/ingest/vercel/{token}","parameters":{"type":"object","properties":{"token":{"type":"string"}},"required":["token"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_logs_ingest_aws_firehose_by_token","description":"Create logs ingest aws firehose {token}\n\nIssue this as: POST https://api.24observe.com/api/v1/logs/ingest/aws-firehose/{token}","parameters":{"type":"object","properties":{"token":{"type":"string"}},"required":["token"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_logs_search","description":"Read logs search\n\nIssue this as: GET https://api.24observe.com/api/v1/logs/search","parameters":{"type":"object","properties":{"q":{"type":"string","maxLength":1024},"query":{"type":"string","maxLength":2048},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"from":{"type":"string","format":"date-time"},"to":{"type":"string","format":"date-time"},"limit":{"type":"integer","minimum":1,"maximum":1000},"cursor":{"type":"string","maxLength":64}},"additionalProperties":false}}},{"type":"function","function":{"name":"create_logs_query","description":"Create logs query\n\nIssue this as: POST https://api.24observe.com/api/v1/logs/query","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"query":{"type":"string","minLength":1,"maxLength":4096},"from":{"type":"string","format":"date-time"},"to":{"type":"string","format":"date-time"}},"required":["query"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_logs_patterns","description":"Read logs patterns\n\nIssue this as: GET https://api.24observe.com/api/v1/logs/patterns","parameters":{"type":"object","properties":{"from":{"type":"string","format":"date-time"},"to":{"type":"string","format":"date-time"},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"q":{"type":"string","maxLength":1024},"limit":{"type":"integer","minimum":1,"maximum":200}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_logs_archive","description":"Read logs archive\n\nIssue this as: GET https://api.24observe.com/api/v1/logs/archive","parameters":{"type":"object","properties":{"q":{"type":"string","maxLength":1024},"query":{"type":"string","maxLength":2048},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"from":{"type":"string","format":"date-time"},"to":{"type":"string","format":"date-time"},"limit":{"type":"integer","minimum":1,"maximum":1000},"cursor":{"type":"string","maxLength":64}},"additionalProperties":false}}},{"type":"function","function":{"name":"create_logs_tail_session","description":"Create logs tail session\n\nIssue this as: POST https://api.24observe.com/api/v1/logs/tail/session","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_logs_tail","description":"Read logs tail\n\nIssue this as: GET https://api.24observe.com/api/v1/logs/tail","parameters":{"type":"object","properties":{"q":{"type":"string","maxLength":1024},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"token":{"type":"string","maxLength":128}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_alerts","description":"List log alerts\n\nIssue this as: GET https://api.24observe.com/api/v1/log-alerts/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_log_alerts","description":"Create log alerts\n\nIssue this as: POST https://api.24observe.com/api/v1/log-alerts/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"kind":{"type":"string","enum":["threshold","anomaly"]},"query":{"type":"string","maxLength":1024},"kql":{"type":"string","maxLength":2048},"severity":{"type":"string","enum":["low","medium","high","critical"]},"mitreTechnique":{"type":"string","pattern":"^T\\d{4}(\\.\\d{3})?$","maxLength":16},"description":{"type":"string","maxLength":2048},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"threshold":{"type":"integer","minimum":1,"maximum":1000000},"windowSec":{"type":"integer","minimum":30,"maximum":86400},"baselineHours":{"type":"integer","minimum":1,"maximum":720},"ratioThreshold":{"type":"number","minimum":1.1,"maximum":1000},"minBaselineEvents":{"type":"integer","minimum":1,"maximum":1000000},"enabled":{"type":"boolean"},"alertEmail":{"type":"string","format":"email","maxLength":255},"alertWebhookUrl":{"type":"string","format":"uri","maxLength":2048},"alertSlackUrl":{"type":"string","format":"uri","maxLength":2048},"alertDiscordUrl":{"type":"string","format":"uri","maxLength":2048},"alertMsteamsUrl":{"type":"string","format":"uri","maxLength":2048},"alertTelegramBotToken":{"type":"string","maxLength":128},"alertTelegramChatId":{"type":"string","maxLength":64}},"required":["name"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_alerts_catalog","description":"Read log alerts catalog\n\nIssue this as: GET https://api.24observe.com/api/v1/log-alerts/catalog","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_log_alerts_seed","description":"Create log alerts seed\n\nIssue this as: POST https://api.24observe.com/api/v1/log-alerts/seed","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"packs":{"type":"array","items":{"type":"string","minLength":1,"maxLength":64},"maxItems":50},"enable":{"type":"boolean"}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_alerts_by_id","description":"Read log alerts {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/log-alerts/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_log_alerts_by_id","description":"Update log alerts {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/log-alerts/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"kind":{"type":"string","enum":["threshold","anomaly"]},"query":{"type":"string","maxLength":1024},"kql":{"type":"string","maxLength":2048},"severity":{"type":"string","enum":["low","medium","high","critical"]},"mitreTechnique":{"type":"string","pattern":"^T\\d{4}(\\.\\d{3})?$","maxLength":16},"description":{"type":"string","maxLength":2048},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"threshold":{"type":"integer","minimum":1,"maximum":1000000},"windowSec":{"type":"integer","minimum":30,"maximum":86400},"baselineHours":{"type":"integer","minimum":1,"maximum":720},"ratioThreshold":{"type":"number","minimum":1.1,"maximum":1000},"minBaselineEvents":{"type":"integer","minimum":1,"maximum":1000000},"enabled":{"type":"boolean"},"alertEmail":{"type":"string","format":"email","maxLength":255},"alertWebhookUrl":{"type":"string","format":"uri","maxLength":2048},"alertSlackUrl":{"type":"string","format":"uri","maxLength":2048},"alertDiscordUrl":{"type":"string","format":"uri","maxLength":2048},"alertMsteamsUrl":{"type":"string","format":"uri","maxLength":2048},"alertTelegramBotToken":{"type":"string","maxLength":128},"alertTelegramChatId":{"type":"string","maxLength":64}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_metric_alerts","description":"List metric alerts\n\nIssue this as: GET https://api.24observe.com/api/v1/metric-alerts/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_metric_alerts","description":"Create metric alerts\n\nIssue this as: POST https://api.24observe.com/api/v1/metric-alerts/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"metricName":{"type":"string","minLength":1,"maxLength":255},"service":{"type":"string","maxLength":255},"aggregation":{"type":"string","enum":["avg","sum","min","max","last"],"default":"avg"},"comparator":{"type":"string","enum":["gt","lt","gte","lte"],"default":"gt"},"threshold":{"type":"number"},"windowSec":{"type":"integer","minimum":60,"maximum":86400,"default":300},"severity":{"type":"string","enum":["low","medium","high","critical"],"default":"medium"},"enabled":{"type":"boolean","default":true}},"required":["name","metricName","threshold"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_metric_alerts_by_id","description":"Read metric alerts {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/metric-alerts/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_metric_alerts_by_id","description":"Update metric alerts {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/metric-alerts/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"enabled":{"type":"boolean"},"threshold":{"type":"number"}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_metrics","description":"List log metrics\n\nIssue this as: GET https://api.24observe.com/api/v1/log-metrics/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_log_metrics","description":"Create log metrics\n\nIssue this as: POST https://api.24observe.com/api/v1/log-metrics/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"query":{"type":"string","maxLength":1024},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"bucketSec":{"type":"number","enum":[60,300,900,1800,3600]},"enabled":{"type":"boolean"}},"required":["name"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_metrics_by_id","description":"Read log metrics {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/log-metrics/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_log_metrics_by_id","description":"Update log metrics {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/log-metrics/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"query":{"type":"string","maxLength":1024},"service":{"type":"string","maxLength":255},"level":{"type":"string","enum":["trace","debug","info","warn","error","fatal"]},"bucketSec":{"type":"number","enum":[60,300,900,1800,3600]},"enabled":{"type":"boolean"}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_metrics_by_id_series","description":"Read log metrics {id} series\n\nIssue this as: GET https://api.24observe.com/api/v1/log-metrics/{id}/series","parameters":{"type":"object","properties":{"from":{"type":"string","format":"date-time"},"to":{"type":"string","format":"date-time"},"bucketSec":{"type":"number","enum":[60,300,900,1800,3600]},"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_ai_agents_connection","description":"Read ai agents connection\n\nIssue this as: GET https://api.24observe.com/api/v1/ai-agents/connection","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_ai_agents_overview","description":"Read ai agents overview\n\nIssue this as: GET https://api.24observe.com/api/v1/ai-agents/overview","parameters":{"type":"object","properties":{"fromMs":{"type":"integer","minimum":0},"toMs":{"type":"integer","minimum":0}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_ai_agents_security","description":"Read ai agents security\n\nIssue this as: GET https://api.24observe.com/api/v1/ai-agents/security","parameters":{"type":"object","properties":{"fromMs":{"type":"integer","minimum":0},"toMs":{"type":"integer","minimum":0}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_errors","description":"List log errors\n\nIssue this as: GET https://api.24observe.com/api/v1/log-errors/","parameters":{"type":"object","properties":{"status":{"type":"string","enum":["open","resolved","ignored","all"]},"service":{"type":"string","maxLength":255},"limit":{"type":"integer","minimum":1,"maximum":200}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_log_errors_by_id","description":"Read log errors {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/log-errors/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_log_errors_by_id","description":"Update log errors {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/log-errors/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"resolved":{"type":"boolean"},"ignored":{"type":"boolean"}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_assets","description":"List siem context\n\nIssue this as: GET https://api.24observe.com/api/v1/assets","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_assets","description":"Create siem context\n\nIssue this as: POST https://api.24observe.com/api/v1/assets","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"ip":{"type":"string","minLength":1,"maxLength":45},"hostname":{"type":"string","maxLength":255},"owner":{"type":"string","maxLength":255},"criticality":{"type":"string","enum":["low","medium","high","critical"]},"tags":{"type":"array","items":{"type":"string","maxLength":64},"maxItems":50},"notes":{"type":"string","maxLength":2048}},"required":["ip"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_identities","description":"List siem context\n\nIssue this as: GET https://api.24observe.com/api/v1/identities","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_identities","description":"Create siem context\n\nIssue this as: POST https://api.24observe.com/api/v1/identities","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"principal":{"type":"string","minLength":1,"maxLength":255},"displayName":{"type":"string","maxLength":255},"isInternal":{"type":"boolean"},"risk":{"type":"string","enum":["low","medium","high"]},"tags":{"type":"array","items":{"type":"string","maxLength":64},"maxItems":50}},"required":["principal"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_correlation_rules","description":"List correlation\n\nIssue this as: GET https://api.24observe.com/api/v1/correlation-rules/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_correlation_rules","description":"Create correlation\n\nIssue this as: POST https://api.24observe.com/api/v1/correlation-rules/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"kind":{"type":"string","enum":["sequence","cardinality"]},"severity":{"type":"string","enum":["low","medium","high","critical"]},"mitreTechnique":{"type":"string","pattern":"^T\\d{4}(\\.\\d{3})?$","maxLength":16},"description":{"type":"string","maxLength":2048},"windowSec":{"type":"integer","minimum":30,"maximum":86400},"joinField":{"type":"string","minLength":1,"maxLength":255},"steps":{"type":"array","items":{"type":"object","properties":{"kql":{"type":"string","minLength":1,"maxLength":2048}},"required":["kql"],"additionalProperties":false},"minItems":2,"maxItems":6},"matchKql":{"type":"string","maxLength":2048},"distinctField":{"type":"string","maxLength":255},"threshold":{"type":"integer","minimum":1,"maximum":1000000},"enabled":{"type":"boolean"},"alertEmail":{"type":"string","format":"email","maxLength":255},"alertWebhookUrl":{"type":"string","format":"uri","maxLength":2048},"alertSlackUrl":{"type":"string","format":"uri","maxLength":2048},"alertDiscordUrl":{"type":"string","format":"uri","maxLength":2048},"alertMsteamsUrl":{"type":"string","format":"uri","maxLength":2048},"alertTelegramBotToken":{"type":"string","maxLength":128},"alertTelegramChatId":{"type":"string","maxLength":64}},"required":["name","kind","joinField"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_correlation_rules_catalog","description":"Read correlation catalog\n\nIssue this as: GET https://api.24observe.com/api/v1/correlation-rules/catalog","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_correlation_rules_seed","description":"Create correlation seed\n\nIssue this as: POST https://api.24observe.com/api/v1/correlation-rules/seed","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"enable":{"type":"boolean"}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_correlation_rules_by_id","description":"Read correlation {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/correlation-rules/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_correlation_rules_by_id","description":"Update correlation {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/correlation-rules/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"severity":{"type":"string","enum":["low","medium","high","critical"]},"mitreTechnique":{"type":"string","pattern":"^T\\d{4}(\\.\\d{3})?$","maxLength":16},"description":{"type":"string","maxLength":2048},"windowSec":{"type":"integer","minimum":30,"maximum":86400},"joinField":{"type":"string","minLength":1,"maxLength":255},"steps":{"type":"array","items":{"type":"object","properties":{"kql":{"type":"string","minLength":1,"maxLength":2048}},"required":["kql"],"additionalProperties":false},"minItems":2,"maxItems":6},"matchKql":{"type":"string","maxLength":2048},"distinctField":{"type":"string","maxLength":255},"threshold":{"type":"integer","minimum":1,"maximum":1000000},"enabled":{"type":"boolean"},"alertEmail":{"type":"string","format":"email","maxLength":255},"alertWebhookUrl":{"type":"string","format":"uri","maxLength":2048},"alertSlackUrl":{"type":"string","format":"uri","maxLength":2048},"alertDiscordUrl":{"type":"string","format":"uri","maxLength":2048},"alertMsteamsUrl":{"type":"string","format":"uri","maxLength":2048},"alertTelegramBotToken":{"type":"string","maxLength":128},"alertTelegramChatId":{"type":"string","maxLength":64}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_iocs","description":"List threat intel\n\nIssue this as: GET https://api.24observe.com/api/v1/iocs/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_iocs","description":"Create threat intel\n\nIssue this as: POST https://api.24observe.com/api/v1/iocs/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"type":{"type":"string","enum":["ip","domain","hash"]},"value":{"type":"string","minLength":1,"maxLength":512},"severity":{"type":"string","enum":["low","medium","high","critical"]},"description":{"type":"string","maxLength":2048}},"required":["type","value"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_iocs_feed_stats","description":"Read threat intel feed stats\n\nIssue this as: GET https://api.24observe.com/api/v1/iocs/feed-stats","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_cases","description":"List cases\n\nIssue this as: GET https://api.24observe.com/api/v1/cases/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_cases","description":"Create cases\n\nIssue this as: POST https://api.24observe.com/api/v1/cases/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"title":{"type":"string","minLength":1,"maxLength":255},"severity":{"type":"string","enum":["low","medium","high","critical"]},"summary":{"type":"string","maxLength":8192},"assigneeUserId":{"anyOf":[{"type":"integer"},{"type":"null"}]},"incidentIds":{"type":"array","items":{"type":"integer"},"maxItems":200}},"required":["title"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_cases_by_id","description":"Read cases {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/cases/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_cases_by_id","description":"Update cases {id}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/cases/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"title":{"type":"string","minLength":1,"maxLength":255},"status":{"type":"string","enum":["open","investigating","contained","closed"]},"severity":{"type":"string","enum":["low","medium","high","critical"]},"summary":{"type":"string","maxLength":8192},"assigneeUserId":{"anyOf":[{"type":"integer"},{"type":"null"}]},"disposition":{"anyOf":[{"type":"string","enum":["true_positive","false_positive","benign","duplicate"]},{"type":"null"}]}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_cases_by_id_incidents","description":"Create cases {id} incidents\n\nIssue this as: POST https://api.24observe.com/api/v1/cases/{id}/incidents","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"incidentId":{"type":"integer"}},"required":["incidentId"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id","body"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_cases_by_id_notes","description":"Create cases {id} notes\n\nIssue this as: POST https://api.24observe.com/api/v1/cases/{id}/notes","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"body":{"type":"string","minLength":1,"maxLength":8192}},"required":["body"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id","body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_metrics_names","description":"Read metrics names\n\nIssue this as: GET https://api.24observe.com/api/v1/metrics/names","parameters":{"type":"object","properties":{"since":{"type":"string","format":"date-time"},"limit":{"type":"integer","minimum":1,"maximum":1000}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_metrics_series","description":"Read metrics series\n\nIssue this as: GET https://api.24observe.com/api/v1/metrics/series","parameters":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"service":{"type":"string","maxLength":255},"to":{"type":"string","format":"date-time"},"from":{"type":"string","format":"date-time"},"bucket":{"type":"integer","minimum":1,"maximum":86400},"agg":{"type":"string","enum":["avg","sum","min","max","last"]}},"required":["name"],"additionalProperties":false}}},{"type":"function","function":{"name":"context_lookup_entity","description":"Resolve a name to an operational context entity\n\nLook up an entity by (type, key) to get its id, then call /context/entity/{id}/neighborhood. Returns { entity } or { entity: null }.\n\nIssue this as: GET https://api.24observe.com/api/v1/context/lookup","parameters":{"type":"object","properties":{"type":{"type":"string","description":"Entity type — service|host|asset|identity|ioc|monitor|incident|case|detection|ai_agent|ip|domain|model|tool|metric|location. Required."},"key":{"type":"string","description":"Canonical key to resolve (e.g. a service name or host). Required."}},"additionalProperties":false}}},{"type":"function","function":{"name":"context_get_entity","description":"Fetch one context entity by id\n\nReturn a single operational entity (type, canonical key, display name, attrs, first/last seen).\n\nIssue this as: GET https://api.24observe.com/api/v1/context/entity/{id}","parameters":{"type":"object","properties":{"id":{"type":"string","description":"Context entity id."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"context_entity_neighborhood","description":"One-hop neighborhood of an entity\n\nReturn the entity's directly-connected neighbors, ranked by edge strength + recency. Each edge carries confidence + evidence (a deep-link into the proving record). Use ?types to filter edge kinds.\n\nIssue this as: GET https://api.24observe.com/api/v1/context/entity/{id}/neighborhood","parameters":{"type":"object","properties":{"types":{"type":"string","description":"Optional CSV of edge types to filter, e.g. calls,runs_on,impacts,owns."},"limit":{"type":"string","description":"Max neighbors to return (default 100, capped at 500)."},"id":{"type":"string","description":"Context entity id."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"context_incident_summary","description":"Incident blast-radius, owners, and recent changes\n\nFor an incident (canonical key like inc-123), return the impacted services/assets, who owns them, and what changed in the lookback window. Every item is evidence-backed and deep-links into the existing API.\n\nIssue this as: GET https://api.24observe.com/api/v1/context/incident/{incidentKey}/summary","parameters":{"type":"object","properties":{"window":{"type":"string","description":"Change lookback window in minutes (default 60)."},"incidentKey":{"type":"string","description":"Incident canonical key, e.g. inc-123."}},"required":["incidentKey"],"additionalProperties":false}}},{"type":"function","function":{"name":"context_incident_blast","description":"N-hop graph blast-radius of an incident\n\nEverything reachable within N hops of an incident in the operational graph (impacted services, owners, related incidents on the same services, ...). Deeper than /summary; powered by the embedded-graph sidecar.\n\nIssue this as: GET https://api.24observe.com/api/v1/context/incident/{incidentKey}/blast","parameters":{"type":"object","properties":{"hops":{"type":"string","description":"Traversal depth 1..5 (default 3)."},"incidentKey":{"type":"string","description":"Incident canonical key, e.g. inc-123."}},"required":["incidentKey"],"additionalProperties":false}}},{"type":"function","function":{"name":"context_topology","description":"Whole-org topology with a health overlay\n\nThe entity/edge graph for the org (capped) plus a per-node health overlay: a node is \"critical\" when a host's Sensor is offline or the entity is implicated in an open incident, else \"ok\". Powers the topology health map.\n\nIssue this as: GET https://api.24observe.com/api/v1/context/topology","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_analyst_verdicts","description":"Read analyst verdicts\n\nIssue this as: GET https://api.24observe.com/api/v1/analyst/verdicts","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_analyst_metrics","description":"Read analyst metrics\n\nIssue this as: GET https://api.24observe.com/api/v1/analyst/metrics","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_analyst_verdicts_by_id_review","description":"Create analyst verdicts {id} review\n\nIssue this as: POST https://api.24observe.com/api/v1/analyst/verdicts/{id}/review","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"status":{"type":"string","enum":["accepted","overridden"]},"overrideDisposition":{"type":"string","enum":["true_positive","false_positive","benign","needs_human"]},"note":{"type":"string","maxLength":2000}},"required":["status"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id","body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_analyst_actions","description":"Read analyst actions\n\nIssue this as: GET https://api.24observe.com/api/v1/analyst/actions","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_analyst_actions_by_id_decide","description":"Create analyst actions {id} decide\n\nIssue this as: POST https://api.24observe.com/api/v1/analyst/actions/{id}/decide","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"approve":{"type":"boolean"}},"required":["approve"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id","body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_analyst_config","description":"Read analyst config\n\nIssue this as: GET https://api.24observe.com/api/v1/analyst/config","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_analyst_config","description":"Create analyst config\n\nIssue this as: POST https://api.24observe.com/api/v1/analyst/config","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"enabled":{"type":"boolean"},"redact":{"type":"boolean"},"llmApiKey":{"type":"string","maxLength":400},"llmModel":{"anyOf":[{"type":"string","maxLength":200},{"type":"null"}]},"llmBaseUrl":{"anyOf":[{"type":"string","format":"uri","maxLength":400},{"type":"null"}]},"dailyTokenBudget":{"anyOf":[{"type":"integer","minimum":0},{"type":"null"}]},"monthlyTokenBudget":{"anyOf":[{"type":"integer","minimum":0},{"type":"null"}]}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"additionalProperties":false}}},{"type":"function","function":{"name":"get_sensors","description":"List sensors\n\nIssue this as: GET https://api.24observe.com/api/v1/sensors/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_sensors_by_id","description":"Read sensors {id}\n\nIssue this as: GET https://api.24observe.com/api/v1/sensors/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_ingest_sources","description":"Create ingest sources\n\nIssue this as: POST https://api.24observe.com/api/v1/ingest/sources","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"sourceKey":{"type":"string","pattern":"^[a-z0-9][a-z0-9-]{1,62}$"},"name":{"type":"string","minLength":1,"maxLength":255},"format":{"type":"string","enum":["json","ndjson","cef"],"default":"json"},"mapping":{"type":"object","properties":{"format":{"$ref":"#/properties/format"},"timestamp":{"type":"object","properties":{"from":{"type":"string"},"parse":{"type":"string","enum":["epoch_ms","epoch_s","iso","auto"]}},"additionalProperties":false},"fields":{"type":"object","additionalProperties":{"type":"object","properties":{"from":{"type":"string"},"fromDefault":{"type":"string"},"const":{"type":"string"},"default":{"type":"string"},"map":{"type":"object","additionalProperties":{"type":"string"}},"lowercase":{"type":"boolean"}},"additionalProperties":false}}},"additionalProperties":true},"preset":{"type":"string","minLength":1,"maxLength":64}},"required":["sourceKey","name"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_ingest_sources","description":"Read ingest sources\n\nIssue this as: GET https://api.24observe.com/api/v1/ingest/sources","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"get_ingest_presets","description":"Read ingest presets\n\nIssue this as: GET https://api.24observe.com/api/v1/ingest/presets","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"update_ingest_sources_by_key","description":"Update ingest sources {key}\n\nIssue this as: PATCH https://api.24observe.com/api/v1/ingest/sources/{key}","parameters":{"type":"object","properties":{"key":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"format":{"type":"string","enum":["json","ndjson","cef"]},"mapping":{"type":"object","properties":{"format":{"$ref":"#/properties/format"},"timestamp":{"type":"object","properties":{"from":{"type":"string"},"parse":{"type":"string","enum":["epoch_ms","epoch_s","iso","auto"]}},"additionalProperties":false},"fields":{"type":"object","additionalProperties":{"type":"object","properties":{"from":{"type":"string"},"fromDefault":{"type":"string"},"const":{"type":"string"},"default":{"type":"string"},"map":{"type":"object","additionalProperties":{"type":"string"}},"lowercase":{"type":"boolean"}},"additionalProperties":false}}},"additionalProperties":true},"status":{"type":"string","enum":["active","learning","error","disabled"]}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["key"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_ingest_sources_by_key_infer_mapping","description":"Create ingest sources {key} infer mapping\n\nIssue this as: POST https://api.24observe.com/api/v1/ingest/sources/{key}/infer-mapping","parameters":{"type":"object","properties":{"key":{"type":"string"},"body":{"type":"object","properties":{"sample":{},"hint":{"type":"string","maxLength":200}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["key"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_ingest_by_sourcekey","description":"Create ingest {sourceKey}\n\nIssue this as: POST https://api.24observe.com/api/v1/ingest/{sourceKey}","parameters":{"type":"object","properties":{"sourceKey":{"type":"string"}},"required":["sourceKey"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_saved_searches","description":"List saved searches for the current org.\n\nIssue this as: GET https://api.24observe.com/api/v1/saved-searches/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_saved_searches","description":"Create a saved log search. Validates the KQL query at save time.\n\nIssue this as: POST https://api.24observe.com/api/v1/saved-searches/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"type":"string","maxLength":2000},"query":{"type":"string","maxLength":2048},"q":{"type":"string","maxLength":1024},"service":{"type":"string","maxLength":255},"level":{"type":"string","maxLength":64},"rangeMinutes":{"type":"integer","minimum":1,"maximum":43200}},"required":["name"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_saved_searches_by_id","description":"Update a saved search. Re-validates KQL query if changed.\n\nIssue this as: PATCH https://api.24observe.com/api/v1/saved-searches/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"anyOf":[{"type":"string","maxLength":2000},{"type":"null"}]},"query":{"anyOf":[{"type":"string","maxLength":2048},{"type":"null"}]},"q":{"anyOf":[{"type":"string","maxLength":1024},{"type":"null"}]},"service":{"anyOf":[{"type":"string","maxLength":255},{"type":"null"}]},"level":{"anyOf":[{"type":"string","maxLength":64},{"type":"null"}]},"rangeMinutes":{"anyOf":[{"type":"integer","minimum":1,"maximum":43200},{"type":"null"}]}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_on_call_schedules","description":"List on-call schedules.\n\nIssue this as: GET https://api.24observe.com/api/v1/on-call/schedules","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_on_call_schedules","description":"Create an on-call schedule. Rotations are added separately.\n\nIssue this as: POST https://api.24observe.com/api/v1/on-call/schedules","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"type":"string","maxLength":2000},"timezone":{"type":"string","minLength":1,"maxLength":64,"default":"UTC"}},"required":["name"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_on_call_schedules_by_id","description":"Read a schedule, its rotations, and the user currently on-call.\n\nIssue this as: GET https://api.24observe.com/api/v1/on-call/schedules/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_on_call_schedules_by_id","description":"Update a schedule.\n\nIssue this as: PATCH https://api.24observe.com/api/v1/on-call/schedules/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"type":"string","maxLength":2000},"timezone":{"type":"string","minLength":1,"maxLength":64,"default":"UTC"}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"create_on_call_schedules_by_id_rotations","description":"Add a rotation to a schedule (one user covers one [starts_at, ends_at) window).\n\nIssue this as: POST https://api.24observe.com/api/v1/on-call/schedules/{id}/rotations","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"userId":{"type":"integer","exclusiveMinimum":0},"startsAt":{"type":"string","format":"date-time"},"endsAt":{"type":"string","format":"date-time"},"overrideUserId":{"anyOf":[{"type":"integer","exclusiveMinimum":0},{"type":"null"}]},"overrideStartsAt":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]},"overrideEndsAt":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}]}},"required":["userId","startsAt","endsAt"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id","body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_escalation_policies","description":"List escalation policies for the current org.\n\nIssue this as: GET https://api.24observe.com/api/v1/escalation-policies/","parameters":{"type":"object","properties":{},"additionalProperties":false}}},{"type":"function","function":{"name":"create_escalation_policies","description":"Create an escalation policy. Steps fire in order on incident.opened.\n\nIssue this as: POST https://api.24observe.com/api/v1/escalation-policies/","parameters":{"type":"object","properties":{"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"type":"string","maxLength":2000},"steps":{"type":"array","items":{"anyOf":[{"type":"object","properties":{"type":{"type":"string","enum":["schedule"]},"delaySec":{"type":"integer","minimum":0,"maximum":604800},"scheduleId":{"type":"integer","exclusiveMinimum":0}},"required":["type","delaySec","scheduleId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["user"]},"delaySec":{"type":"integer","minimum":0,"maximum":604800},"userId":{"type":"integer","exclusiveMinimum":0}},"required":["type","delaySec","userId"],"additionalProperties":false}]},"minItems":1,"maxItems":10}},"required":["name","steps"],"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["body"],"additionalProperties":false}}},{"type":"function","function":{"name":"get_escalation_policies_by_id","description":"Read one escalation policy.\n\nIssue this as: GET https://api.24observe.com/api/v1/escalation-policies/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}}},{"type":"function","function":{"name":"update_escalation_policies_by_id","description":"Update an escalation policy.\n\nIssue this as: PATCH https://api.24observe.com/api/v1/escalation-policies/{id}","parameters":{"type":"object","properties":{"id":{"type":"string"},"body":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":255},"description":{"type":"string","maxLength":2000},"steps":{"type":"array","items":{"anyOf":[{"type":"object","properties":{"type":{"type":"string","enum":["schedule"]},"delaySec":{"type":"integer","minimum":0,"maximum":604800},"scheduleId":{"type":"integer","exclusiveMinimum":0}},"required":["type","delaySec","scheduleId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["user"]},"delaySec":{"type":"integer","minimum":0,"maximum":604800},"userId":{"type":"integer","exclusiveMinimum":0}},"required":["type","delaySec","userId"],"additionalProperties":false}]},"minItems":1,"maxItems":10}},"additionalProperties":false,"description":"JSON request body. Send as-is in the HTTP request body."}},"required":["id"],"additionalProperties":false}}}]}