# MCP Tools

> Every tool the ApiTraffic MCP server exposes to AI assistants, with its arguments.

Source: https://www.apitraffic.io/docs/integrations/mcp-tools

> **Note:** This page is generated from the tool declarations in the MCP server itself,
> so it cannot describe a tool that does not exist or omit one that does.
> **53** tools across **18** groups.

See [MCP Server](https://www.apitraffic.io/docs/integrations/mcp-server) for setup, transports and worked examples.

## All tools

| Tool | What it does |
| --- | --- |
| [`get_workspace_overview`](#tool-get-workspace-overview) | Get workspace overview |
| [`list_buckets`](#tool-list-buckets) | List buckets |
| [`list_environments`](#tool-list-environments) | List environments |
| [`list_redactions`](#tool-list-redactions) | List redaction rules |
| [`list_exclusions`](#tool-list-exclusions) | List exclusion rules |
| [`list_endpoint_rules`](#tool-list-endpoint-rules) | List endpoint rules |
| [`get_usage`](#tool-get-usage) | Get plan usage |
| [`list_endpoints`](#tool-list-endpoints) | List endpoints |
| [`get_endpoint_metrics`](#tool-get-endpoint-metrics) | Get endpoint metrics |
| [`list_attention_signals`](#tool-list-attention-signals) | List attention signals |
| [`diagnose_endpoint`](#tool-diagnose-endpoint) | Diagnose endpoint health |
| [`compare_windows`](#tool-compare-windows) | Compare two time windows |
| [`get_error_clusters`](#tool-get-error-clusters) | Get error clusters |
| [`get_fix_prompt`](#tool-get-fix-prompt) | Get a fix prompt for a failing request |
| [`get_waterfall_prompt`](#tool-get-waterfall-prompt) | Get a performance prompt for a request waterfall |
| [`get_health_digest`](#tool-get-health-digest) | Get the API health digest |
| [`list_drift_findings`](#tool-list-drift-findings) | List API drift findings |
| [`get_drift_finding`](#tool-get-drift-finding) | Get drift finding detail |
| [`get_drift_prompt`](#tool-get-drift-prompt) | Get an investigation prompt for a drift finding |
| [`get_drift_health`](#tool-get-drift-health) | Get drift detection health |
| [`search_requests`](#tool-search-requests) | Search requests |
| [`get_errors`](#tool-get-errors) | Get error requests |
| [`get_request_detail`](#tool-get-request-detail) | Get request detail |
| [`list_collections`](#tool-list-collections) | List collections |
| [`get_collection`](#tool-get-collection) | Get collection |
| [`list_saved_views`](#tool-list-saved-views) | List saved views |
| [`list_workflows`](#tool-list-workflows) | List workflows |
| [`list_dimensions`](#tool-list-dimensions) | List tag dimensions |
| [`get_dimension_values`](#tool-get-dimension-values) | Get tag dimension values |
| [`run_report`](#tool-run-report) | Run a report |
| [`list_saved_reports`](#tool-list-saved-reports) | List saved reports |
| [`run_saved_report`](#tool-run-saved-report) | Run a saved report |
| [`get_metrics`](#tool-get-metrics) | Get summary metrics |
| [`get_throughput`](#tool-get-throughput) | Get throughput |
| [`get_response_times`](#tool-get-response-times) | Get response times |
| [`slow_operations`](#tool-slow-operations) | Slow operations |
| [`operation_trend`](#tool-operation-trend) | Operation latency trend |
| [`regressions_since_deploy`](#tool-regressions-since-deploy) | Regressions since deploy |
| [`get_time_breakdown`](#tool-get-time-breakdown) | Get request time breakdown |
| [`get_trace`](#tool-get-trace) | Get distributed trace |
| [`list_hosts`](#tool-list-hosts) | List hosts |
| [`get_waf_overview`](#tool-get-waf-overview) | Get firewall overview |
| [`list_waf_matches`](#tool-list-waf-matches) | List firewall matches |
| [`list_waf_policies`](#tool-list-waf-policies) | List firewall policies |
| [`get_waf_policy`](#tool-get-waf-policy) | Get firewall policy |
| [`get_waf_rule`](#tool-get-waf-rule) | Get firewall rule |
| [`replay_request`](#tool-replay-request) | Prepare a request replay |
| [`list_events`](#tool-list-events) | List events |
| [`create_event`](#tool-create-event) | Create event |
| [`get_deployed_code`](#tool-get-deployed-code) | Get deployed code |
| [`search_docs`](#tool-search-docs) | Search documentation |
| [`get_doc_page`](#tool-get-doc-page) | Get documentation page |
| [`list_doc_pages`](#tool-list-doc-pages) | List documentation pages |

## Orientation & configuration

Start here: what exists, and how it is configured.

### get_workspace_overview
Start here. One call returns the buckets and environments this token can read, their recent traffic and error rates, and any recent deployments or incidents - enough to pick a bucket and a window for everything else.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `window` | `string` | no | Window used for the activity figures: "1h", "24h", "7d". Defaults to "24h". |

### list_buckets
List the buckets this MCP token can read. Use get_workspace_overview instead when you also want recent traffic and error rates.

Read-only.

Takes no arguments.

### list_environments
List the environments configured for the account (e.g. production, staging, development). Traffic is separated by environment.

Read-only.

Takes no arguments.

### list_redactions
List the redaction rules that mask sensitive data (API keys, passwords, PII) before capture. Check these when a body or header you expected is masked.

Read-only.

Takes no arguments.

### list_exclusions
List the exclusion rules. A rule with action `exclude` stops matching requests from being captured (health checks, probes): check these when traffic you expected is missing entirely. A rule with an `omit_*` action keeps the request but does not log its request body, response body or both (the size is still recorded): check these when a body you expected is missing.

Read-only.

Takes no arguments.

### list_endpoint_rules
List the endpoint rules that decide how raw request paths are grouped into normalized endpoints (a match pattern on the path, and the endpoint name it becomes), in the order they are evaluated, with their priority, direction, hosts, whether each was written by hand or suggested, and whether it marks the requests it matches as long-lived connections (stream: left out of response-time metrics). Check these when an endpoint name in list_endpoints, drift or APM looks wrong or two endpoints should be one.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `includeDisabled` | `boolean` | no | Also return rules that are switched off. Defaults to `false`. |

### get_usage
The account's metered usage for the current billing period against its plan allowances - captured requests (inbound and outbound), host samples, MCP calls and the like - with whether each limit is a hard cap, plus counts of limited resources (workflows, WAF policies, tokens). Check this when traffic seems to be missing: a hard-capped allowance that is used up stops capture.

Read-only.

Takes no arguments.

## Endpoints

The endpoints an API serves and calls, and how each one is behaving.

### list_endpoints
List the normalized endpoints a bucket serves ("in") or calls ("out"), with request count, error count, error rate and average latency for the window. Use it to learn the shape of an API before diving in, or to find the noisiest or slowest endpoints. The endpoint strings are the same ones drift, WAF and APM tools filter on.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to read. Required when the token is scoped to more than one bucket. |
| `window` | `string` | no | Relative window ending now: "1h", "24h", "7d". Ignored when startTime and endTime are supplied. Defaults to "24h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `direction` | `"in" \| "out"` | no | "in" (default) for endpoints your API serves, "out" for upstream APIs your service calls (each keyed by host). Defaults to `"in"`. |
| `orderBy` | `"requests" \| "errors" \| "error_rate" \| "latency"` | no | "requests" (default), "errors", "error_rate" or "latency" (average). Defaults to `"requests"`. |
| `pathLike` | `string` | no | Only endpoints containing this text, e.g. "/orders". |
| `limit` | `number` | no | Maximum endpoints returned (default 50, max 200). Defaults to `50`. |

### get_endpoint_metrics
Detailed metrics for one normalized endpoint: request count, p50/p95/p99/max latency, error rate, status-class mix, throughput and a per-interval timeseries. Prefer diagnose_endpoint for a health verdict against the previous window; use this for the raw shape of one endpoint.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `endpoint` | `string` | yes | The normalized endpoint, e.g. "/v1/orders/\{id\}", from list_endpoints. |
| `bucketSid` | `string` | no | Bucket to read. Required when the token is scoped to more than one bucket. |
| `window` | `string` | no | Relative window ending now: "1h", "24h", "7d". Ignored when startTime and endTime are supplied. Defaults to "24h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `direction` | `"in" \| "out"` | no | "in" (default) for an endpoint your API serves, "out" for an upstream call. Defaults to `"in"`. |
| `host` | `string` | no | For outbound endpoints: the upstream host. The same path on two hosts is two endpoints. |
| `includeTimeseries` | `boolean` | no | Include the per-interval series (thinned to at most 60 points). Defaults to `true`. |

## Attention signals

What ApiTraffic has already flagged as needing attention.

### list_attention_signals
List what ApiTraffic currently thinks needs attention on a bucket - error-rate spikes, error hotspots, latency and error regressions, slow endpoints, firewall blocks and open drift - most severe first. A good first call when asked "is anything wrong?". By default only signals that are still visible (open, acknowledged, or with an expired snooze) are returned.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to read. Required when the token is scoped to more than one bucket. |
| `severity` | `"critical" \| "warning" \| "info"` | no | Only signals of this severity. |
| `status` | `"open" \| "acknowledged" \| "snoozed" \| "dismissed" \| "resolved"` | no | Only signals in exactly this triage state (overrides the visible-only default). |
| `signalType` | `"error_rate" \| "error_hotspot" \| "latency_regression" \| "error_regression" \| "client_error_spike" \| "consumer_errors" \| "slow_endpoint" \| "waf_blocked" \| "waf_would_block" \| "drift_breaking" \| "drift_high" \| "drift_open"` | no | Only this signal type. |
| `limit` | `number` | no | Maximum results (default 25, max 100). Defaults to `25`. |
| `verbosity` | `"summary" \| "full"` | no | "full" adds the detail text and the evaluator context behind each signal. Defaults to `"summary"`. |

## Diagnosis

Task-shaped tools that answer a question rather than returning rows.

### diagnose_endpoint
One-call health verdict for a bucket or a specific endpoint: status-code breakdown, latency percentiles, comparison against the preceding window, the failure clusters driving errors, correlated deployment/incident markers, and sample request sids to inspect. Use this before reaching for the individual metrics tools.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to diagnose. Required when the token is scoped to more than one bucket. |
| `endpoint` | `string` | no | Narrow to a path or wildcard, e.g. "/v1/orders" or "/v1/orders*". Omit to diagnose the whole bucket. |
| `method` | `string` | no | Narrow to one HTTP method. |
| `direction` | `"in" \| "out"` | no | "in" for traffic your API received, "out" for calls your service made to third parties. |
| `window` | `string` | no | Relative window ending now: "15m", "1h", "24h". Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `compareToPrevious` | `boolean` | no | Compare against the equally sized preceding window (this is what makes regressions visible). Defaults to `true`. |
| `includeTimeline` | `boolean` | no | Include a bucketed request/error/p95 series. Defaults to `true`. |
| `maxClusters` | `number` | no | How many failure clusters to return (default 5). Defaults to `5`. |
| `verbosity` | `"summary" \| "full"` | no | "full" adds the endpoint breakdown and the raw status-class counts per cluster. Defaults to `"summary"`. |

### compare_windows
Before/after comparison - the regression primitive. Give it a pivotTime (e.g. a deploy timestamp from list_events) or two explicit windows, and it returns metric deltas, which failure clusters were introduced or resolved, and the endpoints that moved most.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to compare. Required when the token is scoped to more than one bucket. |
| `endpoint` | `string` | no | Narrow to a path or wildcard, e.g. "/v1/orders" or "/v1/orders*". Omit to diagnose the whole bucket. |
| `method` | `string` | no | Narrow to one HTTP method. |
| `direction` | `"in" \| "out"` | no | "in" for traffic your API received, "out" for calls your service made to third parties. |
| `pivotTime` | `string` | no | ISO 8601 instant to compare around (e.g. a deployment startedAt). Baseline is the window before it, current is the window after it. |
| `window` | `string` | no | Length of each side when using pivotTime, or the current window length otherwise: "15m", "1h", "24h". Defaults to "1h". |
| `baselineStartTime` | `string` | no | ISO 8601 start of an explicit baseline window. |
| `baselineEndTime` | `string` | no | ISO 8601 end of an explicit baseline window. |
| `currentStartTime` | `string` | no | ISO 8601 start of an explicit current window. |
| `currentEndTime` | `string` | no | ISO 8601 end of an explicit current window. |
| `maxMovers` | `number` | no | How many endpoint movers to return (default 5). Defaults to `5`. |

### get_error_clusters
Group failing requests into distinct problems instead of a flat list. Requests are clustered by normalized endpoint pattern, method and status, so /orders/1/refund and /orders/2/refund count as one issue. Each cluster carries occurrence counts, first/last seen, sample request sids and optionally the error message behind it.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to inspect. Required when the token is scoped to more than one bucket. |
| `endpoint` | `string` | no | Narrow to a path or wildcard, e.g. "/v1/orders" or "/v1/orders*". Omit to diagnose the whole bucket. |
| `method` | `string` | no | Narrow to one HTTP method. |
| `direction` | `"in" \| "out"` | no | "in" for traffic your API received, "out" for calls your service made to third parties. |
| `window` | `string` | no | Relative window ending now: "1h", "24h", "7d". Defaults to "24h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `statusMin` | `number` | no | Lowest status code to include (500 for server errors only). Defaults to `400`. |
| `statusMax` | `number` | no | Highest status code to include. |
| `limit` | `number` | no | Maximum clusters to return (default 20, max 100). Defaults to `20`. |
| `includeErrorSignatures` | `boolean` | no | Read up to 5 sample response bodies and attach a normalized error message per cluster. Slower, so off by default. Defaults to `false`. |
| `verbosity` | `"summary" \| "full"` | no | "full" adds example paths and host per cluster. Defaults to `"summary"`. |

### get_fix_prompt
Generate a paste-ready prompt for an AI coding agent (Cursor, Claude Code, Copilot) to root-cause and fix a failing API request in the customer's own code. It combines the request/response, a normalized error signature, and the git deploys/commits that landed just before the failure (when a repo is connected). Provide either a requestSid, or an endpoint/time window to pick the most recent failure from.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `requestSid` | `string` | no | The sid of a failing request to build the prompt from. Preferred input - e.g. a sampleSids entry from get_error_clusters. |
| `bucketSid` | `string` | no | Bucket to search when no requestSid is given. Required when the token is scoped to more than one bucket. |
| `endpoint` | `string` | no | Optional path prefix to target when searching for a failing request, e.g. "/v1/orders". |
| `window` | `string` | no | Relative window to search for a failing request: "15m", "1h", "24h". Defaults to "1h". Ignored when requestSid is given. |
| `startTime` | `string` | no | ISO 8601 start of an absolute search range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute search range. |
| `lookbackMinutes` | `number` | no | How far back before the failure to look for correlated deploys (default 180). Defaults to `180`. |

### get_waterfall_prompt
Generate a paste-ready prompt for an AI coding agent about where one request spent its time and how to make it faster. It carries every span (database, cache, outbound HTTP, queue) in start order with its offset, duration, share of the request, code location and call stack, the commit that was deployed, and precomputed facts: time per dependency, idle gaps, and repeated operations with whether they ran sequentially (candidates to parallelize, batch or cache). Captured parameter values are never included. Find a slow request with search_requests (minDurationMs) or get_trace.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `requestSid` | `string` | yes | The sid of the request to explain, e.g. a slow one from search_requests with minDurationMs. |
| `question` | `string` | no | What to ask, e.g. "Can these outbound calls run in parallel?". Defaults to "How can I optimize this request?". |
| `focusSpanId` | `string` | no | A span id to mark as the one being investigated. |

## Health digest

How a day or a week went: the numbers and the news the daily and weekly digest email is built from.

### get_health_digest
The daily or weekly API health summary the digest email is built from: per environment and bucket, requests, latency (avg, p95, p99), error rates and availability against the previous period, a status (incident, attention, healthy, no_traffic, not_stored, retention_cut, unavailable), and what was new: incidents, drifts, slow endpoints, new error types, deploys and new endpoints. Same numbers as the email for the same timezone and period. At most 25 buckets are read at once: with more, the busiest are shown (in the period, or the last 7 days for a period older than 30 days; past retention, those with a stored digest first) and `truncated` gives the counts, the ranking window and storedFirst. Use it to answer "how did last week go?".

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `cadence` | `"daily" \| "weekly"` | yes | "daily" (the previous local day, compared to the same weekday a week earlier) or "weekly" (the 7 local days before periodEnd, compared to the week before). |
| `bucketSid` | `string` | no | One bucket. Omit for every bucket the token can read in the environment. |
| `environmentSid` | `string` | no | The environment. Defaults to the token's environment. |
| `timezone` | `string` | no | IANA timezone the period is computed in. Defaults to the user's digest or profile timezone, then the account owner's. |
| `periodEnd` | `string` | no | The local date the period ends at (YYYY-MM-DD; a weekly period ending 2026-10-19 covers Oct 12–18), or an ISO 8601 instant whose local date it is. Within the last 90 days. Defaults to the most recent complete period. |
| `verbosity` | `"summary" \| "full"` | no | "full" adds the hourly (daily) or daily (weekly) chart series. Defaults to `"summary"`. |

## Drift

Changes between an endpoint's learned baseline and its current traffic.

### list_drift_findings
List changes ApiTraffic detected between an endpoint's learned baseline and its current traffic - removed or retyped response fields, new error rates, latency shifts, new downstream dependencies, endpoints appearing or going quiet. Use this to answer "what changed in this API?" - including silent changes that never produced an error.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to list drift for. Required when the token is scoped to more than one bucket. |
| `status` | `"open" \| "expected" \| "acknowledged" \| "resolved"` | no | Filter by triage status. "open" is untriaged - usually what you want. |
| `changeType` | `"breaking_request" \| "breaking_response" \| "additive" \| "behavioral" \| "dependency" \| "new_endpoint" \| "disappeared_endpoint" \| "response_body_missing"` | no | Filter to one kind of change. |
| `endpoint` | `string` | no | Filter to one normalized endpoint pattern, e.g. "/v1/orders/\{id\}". |
| `method` | `string` | no | Filter to one HTTP method. Drift identity is (endpoint, method). |
| `limit` | `number` | no | Maximum findings to return (default 25, max 100). Defaults to `25`. |
| `verbosity` | `"summary" \| "full"` | no | "full" adds the structured diff for each finding. Defaults to `"summary"`. |

### get_drift_finding
Full detail for one drift finding: the structured before/after diff, the baseline it was measured against, and the sids of the captured requests that evidence it. Pass those sids to get_request_detail to read the actual payloads.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `driftSid` | `string` | yes | The drift finding sid, from list_drift_findings. |

### get_drift_prompt
Generate a grounded, paste-ready prompt for investigating one drift finding in the customer's own code. It combines the finding diff, the learned baseline, the evidencing request sids and the git deploys/commits that landed just before the drift began (when a repo is connected). Returns the prompt text - the same one the ApiTraffic UI shows on the finding.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `driftSid` | `string` | yes | The drift finding sid, from list_drift_findings. |
| `lookbackMinutes` | `number` | no | How far back before the drift onset to look for correlated deploys (default 180). Defaults to `180`. |

### get_drift_health
Whether drift detection is actually watching a bucket, and why the finding list looks the way it does: the scan state with a one-line explanation, when it last ran and runs next, how many endpoints it discovered and diffed, how many baselines are active versus still learning, and how many findings are open. Call this before reading an empty list_drift_findings as "nothing changed".

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to check. Required when the token is scoped to more than one bucket. |

## Requests

Individual captured requests and responses.

### search_requests
Search captured HTTP requests using the ApiTraffic criteria DSL plus common shortcuts. Returns compact one-line summaries; call get_request_detail for headers and bodies. Read the apitraffic://criteria-dsl resource for the full grammar.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `query` | `string` | no | Criteria DSL, e.g. 'status_code \>= 500 AND url_path like "/v1/orders*"'. Combined with the other filters using AND. |
| `bucketSid` | `string` | no | Bucket to search. Required when the token is scoped to more than one bucket. |
| `window` | `string` | no | Relative window ending now: "15m", "6h", "7d". Ignored when startTime and endTime are supplied. Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `method` | `string` | no | HTTP method filter (GET, POST, ...). |
| `statusCode` | `number` | no | Exact HTTP status code. |
| `statusMin` | `number` | no | Minimum HTTP status code (inclusive). |
| `statusMax` | `number` | no | Maximum HTTP status code (inclusive). |
| `pathLike` | `string` | no | Path wildcard match, e.g. "/v1/orders*". |
| `minDurationMs` | `number` | no | Only requests at or above this duration in milliseconds. |
| `direction` | `"in" \| "out"` | no | "in" for traffic received by your API, "out" for outbound calls your service made. |
| `limit` | `number` | no | Maximum results (default 25, max 100). Defaults to `25`. |
| `cursor` | `string` | no | Pass the "nextCursor" value from a previous call to page further back. |
| `verbosity` | `"summary" \| "full"` | no | "summary" (default) returns one compact line per request; "full" adds host, sizes, tags and environment. Defaults to `"summary"`. |

### get_errors
List individual failing requests (status \>= 400) in a window. Prefer get_error_clusters when you want to know what is broken; use this when you need specific request sids to inspect.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to search. Required when the token is scoped to more than one bucket. |
| `window` | `string` | no | Relative window ending now: "15m", "6h", "7d". Ignored when startTime and endTime are supplied. Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `statusMin` | `number` | no | Minimum status code to treat as an error (use 500 for server errors only). Defaults to `400`. |
| `pathLike` | `string` | no | Path wildcard match, e.g. "/v1/orders*". |
| `limit` | `number` | no | Maximum results (default 25, max 100). Defaults to `25`. |
| `cursor` | `string` | no | Pass the "nextCursor" value from a previous call to page further back. |
| `verbosity` | `"summary" \| "full"` | no | Level of detail per request. Defaults to `"summary"`. |

### get_request_detail
Full detail for one request: headers, query params, request/response bodies and timings. Bodies are truncated to maxBodyBytes so a large payload cannot flood your context.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `requestSid` | `string` | yes | The request sid, e.g. from search_requests or a cluster sample. |
| `includeBody` | `boolean` | no | Set false to omit request/response bodies entirely. Defaults to `true`. |
| `maxBodyBytes` | `number` | no | Per-body byte budget before truncation (default 4096, max 65536). Defaults to `4096`. |
| `verbosity` | `"summary" \| "full"` | no | "summary" returns the metadata only, no headers or bodies. Defaults to `"full"`. |

## Collections

Named sets of requests your team saved while debugging.

### list_collections
List the request collections your team has saved in a bucket - named sets of captured requests kept as evidence while debugging - with how many requests each holds. Read these before starting an investigation from scratch; get_collection returns the requests in one.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to read. Required when the token is scoped to more than one bucket. |

### get_collection
One saved collection with its requests: each request sid with the name it was saved under and, while the request is still retained, its method, path and status (looked up for the newest 25). Pass a sid to get_request_detail or replay_request to work with it.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `collectionSid` | `string` | yes | The collection sid, from list_collections. |
| `bucketSid` | `string` | no | Bucket the collection is in. Required when the token is scoped to more than one bucket. |

## Saved views & workflows

The team's named request filters, and the automations they trigger.

### list_saved_views
List the saved views (named request filters) your team built in a bucket, each with its criteria DSL string and whether a workflow is attached. Pass a view's criteria as the query to search_requests to read exactly the traffic the team means by that name.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to read. Required when the token is scoped to more than one bucket. |

### list_workflows
List the workflows (automations such as alerts or tickets) configured in a bucket: name, whether enabled, the external system that runs them, the environments they run in and how many saved views trigger them. Use it to explain why an alert fired, or to check what happens when matching traffic arrives.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to read. Required when the token is scoped to more than one bucket. |

## Tag dimensions

The tag keys requests carry (such as a customer id), and the catalogue that names their values.

### list_dimensions
List the tag keys the account's SDKs send (such as customerId or plan): share of requests carrying each, distinct values, classification (none, pseudonymous, personal, secret), which key identifies customers, and which keys are promoted to fast reports, plus suggestedToPromote: unpromoted keys the account's saved reports and dashboards would read from pre-aggregated data once promoted, with how many of each (pass includeSuggestions false to skip that when only the keys are needed). Use it to learn what context requests carry before grouping or filtering by a tag.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `includeHidden` | `boolean` | no | Include keys the team hid (default false). |
| `includeSuggestions` | `boolean` | no | Work out suggestedToPromote from the saved reports and dashboards (default true). False skips reading them; suggestedToPromote is then left out. |

### get_dimension_values
Look up the customer catalogue of a tag key: each value's readable label and attributes (for example org_8f2a is "Acme Corp", plan enterprise, region eu). Search by value or label to resolve a customer name to its id, or an id to its name.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `key` | `string` | yes | The tag key, as list_dimensions returns it. |
| `search` | `string` | no | Only values or labels containing this text (case-insensitive). |
| `limit` | `number` | no | At most this many entries (default 25). |

## Reports

Custom reports: traffic grouped by any field, tag or customer attribute, and the team's saved reports.

### run_report
Run a custom report: group requests by up to two dimensions (a request field such as endpoint or host, tag:\<key\> such as tag:customerId, attr:\<key\>:\<attribute\> from the customer catalogue, the firewall decision: waf_action, waf_policy, waf_rule, waf_matched, or the client: ip_address, country), compute metrics per group (count, error_rate, p95, distinct:tag:\<key\>, sum:ai_input_tokens, waf_blocked_count, ...), optionally as a series and against an earlier period. Answers "which customers call us most", "error rate by plan", "LLM tokens by customer", "which customers does the firewall block", "which IPs does it block", "traffic by country". With source "spans" it counts APM operations inside requests instead (needs APM; at most 7 days; no tags, firewall or client dimensions): group by type, fingerprint (operation), name, op, target, system, db, host (peer), out_target, out_status_class, error_class, error_type, endpoint, call_site, service_version, instance_sid; metrics count (calls, weighted by sampling), error_count, error_rate, total_time, avg, p50-p99, max, requests, calls_per_request (N+1), out_client_error_count, out_server_error_count, out_no_response_count, sum:rows, avg:rows. Answers "slowest database queries", "outbound time by vendor", "N+1 queries by endpoint". Results say whether they are exact or approximate (meta.dataset says which source); for a request report, meta.promotable names a tag key whose promotion would make it read fast pre-aggregated data (also given when it is refused for reading over 31 days of stored requests; never for firewall or client reports, which only stored requests can answer).

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `source` | `"requests" \| "spans"` | no | requests (default) or spans (APM operations: database queries, cache, outbound HTTP, queue, RPC). Span reports take span dimensions, metrics and filter fields. |
| `timeRange` | `object \| object` | yes | \{relative: last_1h\|last_24h\|last_7d\|last_30d\|last_90d\|today\|yesterday\|this_month\|previous_month\} or \{start, end\} ISO 8601. |
| `groupBy` | `string[]` | no | Up to 2 dimensions: endpoint, host, method, status_code, status_class (1xx-5xx, or unknown), direction, ai_model, ..., tag:\<key\>, attr:\<key\>:\<attribute\>, or a firewall dimension: waf_action (tag\|would-block\|block), waf_policy (policy sid), waf_rule (deciding rule id), waf_matched (yes\|no). Requests the firewall did not match have no firewall value. Or a client dimension: ip_address (the client IP address; personal data, masked to its /24 or /48 without permission to view personal values) or country (ISO 3166-1 code, labelled with its name; "" (none) without a located IP address). Filter with country == "DE". Span reports: the span fields only. |
| `metrics` | `string[]` | no | count (default), error_count, server_error_count, error_rate, avg, p50, p90, p95, p99, max, request_bytes, response_bytes, distinct:\<dimension\> (e.g. distinct:ip_address, distinct:country), sum:\, avg:\; firewall: waf_matched_count, waf_blocked_count, waf_would_block_count, avg:waf_score, waf_score_max. |
| `filter` | `string` | no | Criteria in the request search language, e.g. endpoint == "/v1/orders" AND tag:plan == "enterprise", or waf_action == "block". For spans, the same grammar over span fields, e.g. type == "db.query" AND duration_ms \> 100 AND ok == false. |
| `scope` | `object` | no | Limit to a bucket, an environment, or inbound/outbound traffic. |
| `interval` | `"auto" \| "1m" \| "5m" \| "15m" \| "1h" \| "6h" \| "1d"` | no | Return a series per row at this step; omit for a table. |
| `compareTo` | `"previous_period" \| "same_period_last_week" \| "same_period_last_month"` | no | Compare against an earlier period (delta and delta_pct per metric). |
| `orderBy` | `object` | no | Sort rows by one of the metrics (default count, descending). |
| `limit` | `number` | no | Top values of the first dimension (default 25); the rest are one Other row. |
| `secondaryLimit` | `number` | no | Top values of the second dimension per first (default 10). |
| `includeOther` | `boolean` | no | Include the Other row (default true). |
| `precision` | `"fast" \| "exact"` | no | exact reads raw rows and computes exact percentiles (slower). |

### list_saved_reports
List the reports the team saved (shared with the account, and the connected person's own private ones): name, description, how each is drawn, its folder and its definition. Run one with run_saved_report.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `folder` | `string` | no | Only reports in this folder. |
| `pinned` | `boolean` | no | Only pinned reports. |

### run_saved_report
Run one of the team's saved reports, optionally over another time range or with an extra filter (ANDed with the report's own, e.g. one customer: tag:customerId == "org_8f2a").

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `reportSid` | `string` | yes | The report, as list_saved_reports returns it. |
| `timeRange` | `object \| object` | no | Replaces the report's own time range. |
| `filter` | `string` | no | ANDed with the report's own filter (for a span report, in the span filter language: e.g. type == "db.query"). |

## Metrics

Raw series and summary numbers.

### get_metrics
Totals for a window: request count, average response time, error count and blocked count.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to measure. Required when the token is scoped to more than one bucket. |
| `window` | `string` | no | Relative window ending now: "15m", "6h", "7d". Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |

### get_throughput
Request throughput over time, broken down by status class (2xx/3xx/4xx/5xx).

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to measure. Required when the token is scoped to more than one bucket. |
| `window` | `string` | no | Relative window ending now: "15m", "6h", "7d". Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `resolution` | `"1min" \| "10min" \| "1hr" \| "2hr" \| "1d" \| "1mo"` | no | Time bucket size. Defaults to a resolution that keeps the series small for the window. |

### get_response_times
Response time percentiles (p50/p95/p99) and averages over time.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Bucket to measure. Required when the token is scoped to more than one bucket. |
| `window` | `string` | no | Relative window ending now: "15m", "6h", "7d". Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `resolution` | `"1min" \| "10min" \| "1hr" \| "2hr" \| "1d" \| "1mo"` | no | Time bucket size. Defaults to a resolution that keeps the series small for the window. |

## APM

Inside the service: slow queries and calls, their latency over time, what got slower after a deploy, where request time goes, and distributed traces.

### slow_operations
Rank the operations inside the service - database queries, cache and Redis calls, outbound HTTP, queue and RPC calls - by total time, p95/p99 latency, call count, calls per request (N+1 detection) or error rate. Each operation carries its fingerprint (use it with operation_trend), latency in ms and the share of the window that was read. Statement text is omitted unless includeStatementText is set and the account has it enabled.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only this bucket. Omit for every bucket the token can read. |
| `window` | `string` | no | Relative window ending now: "15m", "6h", "24h". Defaults to "1h". Only recent (hot) data is read; `coverage` says how much of the window was. |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `orderBy` | `"total" \| "p95" \| "p99" \| "calls" \| "calls_per_request" \| "error_rate"` | no | "total" (time spent, the default), "p95", "p99", "calls", "calls_per_request" (N+1 suspects) or "error_rate". Defaults to `"total"`. |
| `limit` | `number` | no | How many operations (default 10, max 50). Defaults to `10`. |
| `types` | `"db.query" \| "redis" \| "cache" \| "http.out" \| "queue" \| "rpc" \| "graphql" \| "custom"[]` | no | Only these operation types. |
| `endpoint` | `string` | no | Only operations run by this normalized inbound endpoint, e.g. "/v1/orders/\{id\}". |
| `minCalls` | `number` | no | Ignore operations with fewer estimated calls (applies to error_rate and calls_per_request ranking; default 20). |
| `includeStatementText` | `boolean` | no | Include the normalized statement (truncated). Only honoured when the account has statement text enabled. Defaults to `false`. |

### operation_trend
p50/p95/p99 latency, calls and errors over time for ONE operation (fingerprint + fpVersion from slow_operations) or ONE endpoint (endpoint + method). Use it to see when a slowdown started and whether it lines up with a deploy.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only this bucket. Omit for every bucket the token can read. |
| `window` | `string` | no | Relative window ending now: "15m", "6h", "24h". Defaults to "1h". Only recent (hot) data is read; `coverage` says how much of the window was. |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `fingerprint` | `string` | no | Operation fingerprint ("fpr_…") from slow_operations. Pass this OR endpoint + method. |
| `fpVersion` | `number` | no | The operation's fpVersion from slow_operations (default 1). |
| `endpoint` | `string` | no | Normalized endpoint, e.g. "/v1/orders/\{id\}". With fingerprint: only that operation as run by this endpoint. Without: the endpoint's own trend (needs method). |
| `method` | `string` | no | HTTP method of the endpoint trend. |
| `direction` | `"in" \| "out"` | no | Endpoint trend only: "in" (default) for the service's own endpoints, "out" for its outbound calls. |
| `maxPoints` | `number` | no | At most this many time buckets (max 120). Default 30, or enough for one-minute buckets on a window of an hour or less. |

### regressions_since_deploy
What got slower after a deploy: operations (default) or endpoints ranked by how much their p95 shift costs (p95 delta x calls after), comparing an equal span before and after the deploy time. The deploy is pivotTime, or the newest deployment event (matching version when given). Each row has before/after p95 in ms and a regressed verdict; rows with too little data say so.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only this bucket. Omit for every bucket the token can read. |
| `kind` | `"operation" \| "endpoint"` | no | "operation" (queries and calls inside the service, the default) or "endpoint". Defaults to `"operation"`. |
| `pivotTime` | `string` | no | Deploy time, ISO 8601. Omit to use the newest deployment event. |
| `version` | `string` | no | Pick the newest deployment event whose name or metadata mentions this version; operations also report whether their latest version is this one. |
| `span` | `string` | no | How long each side is: "30m", "1h" (default), "6h". The after side ends at now when the deploy is more recent. Defaults to `"1h"`. |
| `limit` | `number` | no | How many rows (default 10, max 50). Defaults to `10`. |
| `minCalls` | `number` | no | Minimum estimated calls on each side for a verdict (default 20). |
| `minRelativeIncrease` | `number` | no | Minimum relative p95 increase to count as regressed (0.1 = +10%, the default). |
| `types` | `"db.query" \| "redis" \| "cache" \| "http.out" \| "queue" \| "rpc" \| "graphql" \| "custom"[]` | no | Operations only: only these types. |
| `includeStatementText` | `boolean` | no | Operations only: include the normalized statement (truncated), when the account has statement text enabled. Defaults to `false`. |

### get_time_breakdown
Where request time goes - database, cache, outbound HTTP, queue and the app itself - as milliseconds and a share of total, with request count, errors and p50/p95/p99. groupBy "none" (default) gives the bucket or one endpoint; groupBy "endpoint" ranks endpoints by the total time they consume, each with its own split. Use it to decide whether a slow API is waiting on the database, a third party, or its own code, before slow_operations narrows it to one query.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only this bucket. Omit for every bucket the token can read. |
| `window` | `string` | no | Relative window ending now: "1h", "24h", "7d". Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `groupBy` | `"none" \| "endpoint"` | no | "none" (default) for one split, "endpoint" to rank endpoints by time consumed. Defaults to `"none"`. |
| `endpoint` | `string` | no | With groupBy "none": only this normalized inbound endpoint, e.g. "/v1/orders/\{id\}". |
| `limit` | `number` | no | With groupBy "endpoint": how many endpoints (default 10, max 50). Defaults to `10`. |

### get_trace
Every captured request that belongs to one distributed trace, in time order - the inbound call that started it and each downstream and upstream call it made across your services - with endpoint, status, duration and span count. Pass a requestSid (the trace id is read off it and the hour either side is searched) or a traceId with a window. Use it to find which hop in a chain failed or was slow.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `requestSid` | `string` | no | A request in the trace, e.g. from search_requests or get_errors. |
| `traceId` | `string` | no | The trace id, when you already have it. |
| `window` | `string` | no | With a bare traceId: relative window ending now to search, e.g. "6h". Defaults to "24h". Not needed with a requestSid. |
| `startTime` | `string` | no | ISO 8601 start of an absolute range to search instead. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range to search instead. |

## Hosts

The servers behind your API and how loaded they are.

### list_hosts
The servers (SDK processes) reporting host telemetry in a window, with each one's latest CPU, event-loop delay, heap and memory use, in-flight requests, service version and git sha - including servers that stopped reporting, with when they went quiet - plus fleet-wide averages and peaks. Use it to tell a capacity or runtime problem from a code problem when latency rises.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only this bucket. Omit for every bucket the token can read. |
| `window` | `string` | no | Relative window ending now: "15m", "1h", "24h". Defaults to "1h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `orderBy` | `"cpu" \| "eventLoop" \| "memory" \| "lastSeen"` | no | "cpu" (default), "eventLoop" (delay p99), "memory" (heap) or "lastSeen". Defaults to `"cpu"`. |
| `limit` | `number` | no | Maximum hosts returned (default 25, max 100). Defaults to `25`. |

## Firewall

What the WAF inspected, matched and blocked, and the requests behind it.

### get_waf_overview
Firewall (WAF) activity for a window: requests inspected, matched, blocked and would-block (monitor mode), match and enforcement rates, anomaly-score stats, and the busiest rules with their message and category. Use it to answer "is the firewall blocking legitimate traffic?" or "are we under attack?", then list_waf_matches for the requests themselves.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only this bucket. Omit for every bucket the token can read. |
| `policySid` | `string` | no | Only detections attributed to this WAF policy. |
| `ruleId` | `string` | no | Only detections this rule contributed to. |
| `category` | `string` | no | Only detections whose deciding rule is in this category, e.g. "sqli" or "xss". |
| `action` | `"tag" \| "would-block" \| "block"` | no | "block", "would-block" (monitor mode) or "tag". |
| `endpoint` | `string` | no | Only detections on this normalized endpoint, e.g. "/v1/orders/\{id\}". |
| `window` | `string` | no | Relative window ending now: "1h", "24h", "7d". Ignored when startTime and endTime are supplied. Defaults to "24h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `ruleLimit` | `number` | no | How many of the busiest rules to include (default 10, max 50). Defaults to `10`. |

### list_waf_matches
The requests the firewall (WAF) matched, newest first: method, path, normalized endpoint, status, anomaly score, action taken (block / would-block / tag), the deciding rule and every contributing rule id. Filter by rule, category, action, policy or endpoint; pass a sid to get_request_detail to see the payload that tripped it.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only this bucket. Omit for every bucket the token can read. |
| `policySid` | `string` | no | Only detections attributed to this WAF policy. |
| `ruleId` | `string` | no | Only detections this rule contributed to. |
| `category` | `string` | no | Only detections whose deciding rule is in this category, e.g. "sqli" or "xss". |
| `action` | `"tag" \| "would-block" \| "block"` | no | "block", "would-block" (monitor mode) or "tag". |
| `endpoint` | `string` | no | Only detections on this normalized endpoint, e.g. "/v1/orders/\{id\}". |
| `window` | `string` | no | Relative window ending now: "1h", "24h", "7d". Ignored when startTime and endTime are supplied. Defaults to "24h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `limit` | `number` | no | Maximum results (default 25, max 100). Defaults to `25`. |

### list_waf_policies
List the WAF policies that apply to this token's buckets: mode (block / monitor), paranoia level, anomaly threshold, managed ruleset, the buckets and environments each covers, and how many custom rules, disabled rules and exclusions it carries. get_waf_policy returns the full configuration.

Read-only.

Takes no arguments.

### get_waf_policy
The full configuration of one WAF policy: mode, thresholds, managed ruleset, disabled rules, rule exclusions (paths a rule is switched off for), custom rules, IP/geo lists, rate limits, egress and behaviour settings, and any warnings about how SDKs enforce it. Use it to explain why a request was or was not blocked.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `policySid` | `string` | yes | The policy sid, from list_waf_policies or a match's policy. |

### get_waf_rule
What one WAF rule id means: its message, category, severity, anomaly score, paranoia level, the parts of the request it inspects, its operator and transforms, the ruleset versions that carry it, and for managed rules a plain-language explanation of what it catches and what legitimate traffic it can match, plus an overview of the attack category, its impact and how to fix it in the application. With a policySid, also whether that policy disables it or excludes it for some paths, and custom rules defined in that policy, with whether such a rule runs (enabled: false for a rule turned off, or a stored criteria rule sent to your servers turned off) and the policy's warnings about it. Use it on the ruleId from list_waf_matches or get_waf_overview.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `ruleId` | `string` | yes | The rule id, e.g. "942100" or "AT-SCAN-001". |
| `policySid` | `string` | no | Also report how this policy treats the rule. |

## Replay

Turn a captured request into something you can run yourself.

### replay_request
Turn a captured request into a runnable replay you execute yourself - curl, raw HTTP, or fetch - optionally retargeted at localhost or staging. ApiTraffic does not re-send the request for you, so a replayed write cannot duplicate a production side effect. Credential headers are emitted as $ENV_VAR placeholders, never live values.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `requestSid` | `string` | yes | The request sid to replay (from search_requests, get_errors, or a cluster sample). |
| `targetBaseUrl` | `string` | no | Retarget the replay, e.g. "http://localhost:3000". Omit to replay against the original URL. |
| `format` | `"curl" \| "http" \| "fetch" \| "json"` | no | Output format for the replay artifact. Defaults to `"curl"`. |
| `includeHeaders` | `"safe" \| "all"` | no | "safe" (default) keeps standard headers only; "all" keeps every header. Credential values are placeholders in both modes. Defaults to `"safe"`. |
| `includeBody` | `boolean` | no | Include the original request body. Defaults to `true`. |
| `maxBodyBytes` | `number` | no | Body byte budget before truncation (default 4096, max 65536). A truncated body will not replay faithfully. Defaults to `4096`. |

## Events & deploys

Deployment and incident markers, to correlate with traffic changes, and the code that was deployed.

### list_events
List event markers (deployments, incidents, config changes, scale events) so you can correlate them with traffic changes.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `bucketSid` | `string` | no | Only events that apply to this bucket. |
| `window` | `string` | no | Relative window ending now: "6h", "24h", "7d". Defaults to "24h". |
| `startTime` | `string` | no | ISO 8601 start of an absolute range. |
| `endTime` | `string` | no | ISO 8601 end of an absolute range. |
| `type` | `string` | no | Filter by type (deployment, incident, config_change, scale, custom). |
| `limit` | `number` | no | Maximum results (default 25, max 100). Defaults to `25`. |

### create_event
Record an event marker (deployment, incident, config change) so later traffic changes can be correlated with it. This writes to the account.

**Writes to your account.**

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `type` | `string` | yes | Event type (deployment, incident, config_change, scale, custom). |
| `name` | `string` | yes | Human-readable name, e.g. "v2.3.1 production release". |
| `description` | `string` | no | Longer description. |
| `source` | `string` | no | Where the event came from (github_actions, gitlab_ci, jenkins, manual, agent). |
| `metadata` | `object` | no | Freeform key/value metadata (commitSha, branch, imageTag). |
| `bucketSids` | `string[]` | no | Buckets this event applies to. Defaults to ["*"] (all). |
| `environmentSids` | `string[]` | no | Environments this event applies to. Defaults to ["*"] (all). |
| `startedAt` | `string` | no | ISO 8601 start. Defaults to now. |
| `endedAt` | `string` | no | ISO 8601 end. Omit for point-in-time events. |

### get_deployed_code
Which repository, branch and commit was running at a moment - or when a given request was captured - taken from the deploy markers the git integration or your CI wrote, with a URL template for linking to files at that exact commit, plus the deploys (and their commits) that landed in the day before. Use it to read the code that actually served a failing request rather than whatever is on main now.

Read-only.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `requestSid` | `string` | no | A captured request; its received time is used. |
| `at` | `string` | no | ISO 8601 moment to ask about, when you have no request. Defaults to now. |
| `bucketSid` | `string` | no | Only deploys that apply to this bucket. Required when the token is scoped to more than one bucket. |
| `historyMinutes` | `number` | no | How far back before the moment to list deploys (default 1440). Defaults to `1440`. |

## Documentation

Search these docs. The only tools not scoped to your account.

### search_docs
Search the ApiTraffic documentation and return the matching sections with their text, so you can answer setup, configuration and API questions from the real docs instead of guessing. Covers the quickstart, SDK integration guides and configuration, the request log and search syntax, APM, the firewall, redaction and exclusions, collections and sharing, workflows, MCP, git integrations, account administration, account activity webhooks and the full REST API reference.

Read-only. Reads the public documentation site, not your account data.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `query` | `string` | yes | What you want to know, in natural language or keywords: "enable APM on fastify", "redaction rules", "bucket sid format". |
| `limit` | `number` | no | Maximum sections to return (default 5, max 25). Defaults to `5`. |
| `section` | `string` | no | Restrict to one area of the docs: a tab ("Guides", "API reference") or a sidebar group such as "Get started", "Connect your app", "Explore traffic", "Performance", "Security and data controls", "Account and administration". Omit to search everything. |

### get_doc_page
Return the full text of one documentation page, plus its headings. Use after search_docs when a section excerpt is not enough context.

Read-only. Reads the public documentation site, not your account data.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `path` | `string` | yes | Page path as returned by search_docs, e.g. "/docs/apm/setup". A bare slug ("apm/setup") or a full docs URL also works. |

### list_doc_pages
List every documentation page with its title, path and area. Cheap orientation when you do not yet know what to search for.

Read-only. Reads the public documentation site, not your account data.

Takes no arguments.