Skip to main content

​
Response format

Every successful response has the same outer shape: 
{
  "data": {
    "dataPoints": [
      {
        "startTimestamp": "2026-04-29T12:00:00.000Z",
        "endTimestamp": "2026-04-29T13:00:00.000Z",
        "total": 1234,
        "<aggregationKey>": 0,
        "<groupByKey>": "value-or-null"
      }
    ]
  }
}
  • total: implicit COUNT(*) for the row. Always present.
  • <aggregationKey>: one key per requested aggregation. The key is <type><Column> in camelCase (e.g. countGuardrailName, p99LatencyMs).
  • <groupByKey>: one key per groupBy entry. The key is the lowerCamelCase form of the underlying column. Two special mappings:
    • userEmail and virtualaccount both map to createdBySubjectSlug in the response.
    • team maps to team (the value is a single unnested scalar, not an array). All other groupBy keys preserve their lowerCamelCase name.
  • startTimestamp: present only for timeseries responses. Bucket start as an ISO 8601 timestamp string (e.g. "2026-04-29T12:00:00.000Z"). Distribution responses omit it.
  • endTimestamp: present only for timeseries responses. Bucket end as an ISO 8601 timestamp string, equal to the next bucket’s startTimestamp (e.g. "2026-04-29T13:00:00.000Z"). Distribution responses omit it.

​
Distribution response example

{
  "data": {
    "dataPoints": [
      {
        "guardrailName": "pii-detector",
        "guardrailResult": "pass",
        "total": 980,
        "countGuardrailName": 980,
        "p50LatencyMs": 42.0,
        "p99LatencyMs": 215.5
      },
      {
        "guardrailName": "pii-detector",
        "guardrailResult": "fail",
        "total": 60,
        "countGuardrailName": 60,
        "p50LatencyMs": 48.5,
        "p99LatencyMs": 240.0
      },
      {
        "guardrailName": "toxicity-filter",
        "guardrailResult": "pass",
        "total": 720,
        "countGuardrailName": 720,
        "p50LatencyMs": 80.2,
        "p99LatencyMs": 410.0
      }
    ]
  }
}

​
Timeseries response example

{
  "data": {
    "dataPoints": [
      {
        "startTimestamp": "2026-04-21T00:00:00.000Z",
        "endTimestamp": "2026-04-21T01:00:00.000Z",
        "guardrailName": "pii-detector",
        "total": 42,
        "countGuardrailName": 42,
        "p99LatencyMs": 220.0
      },
      {
        "startTimestamp": "2026-04-21T01:00:00.000Z",
        "endTimestamp": "2026-04-21T02:00:00.000Z",
        "guardrailName": "pii-detector",
        "total": 58,
        "countGuardrailName": 58,
        "p99LatencyMs": 245.5
      }
    ]
  }
}
If groupBy is empty or omitted, the response collapses to a single row (or one row per timeseries bucket) summarising every guardrail evaluation inside the window.

​
Error responses

A malformed query returns 400 Bad Request: 
{
  "statusCode": 400,
  "message": "Invalid query",
  "details": ["..."]
}
Common causes:
  • Operator not allowed on this field, for example, EQUAL on guardrailName (it supports only IN, NOT_IN, and STRING_* operators).
  • Missing required value (or wrong shape, e.g. scalar where array is expected for IN / BETWEEN).
  • Unknown field name for the datasource.
  • Invalid interval format (compound expressions, unrecognised unit, non-positive integer).
  • Missing required interval for a timeseries query.
Other status codes:
  • 401 Unauthorized: missing or invalid bearer token.
  • 403 Forbidden: caller does not have permission for the requested scope.
  • 500 Internal Server Error: unexpected server error while executing the query.