Skip to main content

​
Response format

Every successful response has the same outer shape: 
{
  "data": {
    "dataPoints": [
      {
        "startTimestamp": "2026-04-29T12:00:00.000Z",
        "endTimestamp": "2026-04-29T13:00:00.000Z",
        "total": 1234,
        "<aggregationKey>": 0,
        "<groupByKey>": "value-or-null"
      }
    ]
  }
}
  • total: implicit COUNT(*) for the row. Always present.
  • <aggregationKey>: one key per requested aggregation. The key is <type><Column> in camelCase (e.g. countToolName, p99LatencyMs, countDistinctMcpServerName).
  • <groupByKey>: one key per groupBy entry. The key is the lowerCamelCase form of the underlying column. Two special mappings:
    • userEmail and virtualaccount both map to createdBySubjectSlug in the response.
    • team maps to team (the value is a single unnested scalar, not an array). All other groupBy keys preserve their lowerCamelCase name.
  • startTimestamp: present only for timeseries responses. Bucket start as an ISO 8601 timestamp string (e.g. "2026-04-29T12:00:00.000Z"). Distribution responses omit it.
  • endTimestamp: present only for timeseries responses. Bucket end as an ISO 8601 timestamp string, equal to the next bucket’s startTimestamp (e.g. "2026-04-29T13:00:00.000Z"). Distribution responses omit it.

​
Distribution response example

{
  "data": {
    "dataPoints": [
      {
        "mcpServerName": "github-mcp",
        "total": 4200,
        "countMcpServerName": 4200,
        "avgLatencyMs": 142.3,
        "p99LatencyMs": 612.0
      },
      {
        "mcpServerName": "atlassian-mcp",
        "total": 1850,
        "countMcpServerName": 1850,
        "avgLatencyMs": 98.7,
        "p99LatencyMs": 411.5
      }
    ]
  }
}

​
Timeseries response example

{
  "data": {
    "dataPoints": [
      {
        "startTimestamp": "2026-04-21T00:00:00.000Z",
        "endTimestamp": "2026-04-21T01:00:00.000Z",
        "toolName": "create_issue",
        "total": 18,
        "countToolName": 18,
        "p99LatencyMs": 380.0
      },
      {
        "startTimestamp": "2026-04-21T01:00:00.000Z",
        "endTimestamp": "2026-04-21T02:00:00.000Z",
        "toolName": "create_issue",
        "total": 22,
        "countToolName": 22,
        "p99LatencyMs": 410.0
      }
    ]
  }
}
If groupBy is empty or omitted, the response collapses to a single row (or one row per timeseries bucket) summarising every MCP request inside the window.
toolName rows are populated only for method = "tools/call"; rows for other methods will surface toolName: null in the response when grouped by it.

​
Error responses

A malformed query returns 400 Bad Request: 
{
  "statusCode": 400,
  "message": "Invalid query",
  "details": ["..."]
}
Common causes:
  • Operator not allowed on this field, for example, EQUAL on mcpServerName (it supports only IN, NOT_IN, and STRING_* operators).
  • Missing required value (or wrong shape, e.g. scalar where array is expected for IN / BETWEEN).
  • Unknown field name for the datasource (e.g. inputTokens on mcpMetrics).
  • Invalid interval format (compound expressions, unrecognised unit, non-positive integer).
  • Missing required interval for a timeseries query.
Other status codes:
  • 401 Unauthorized: missing or invalid bearer token.
  • 403 Forbidden: caller does not have permission for the requested scope.
  • 500 Internal Server Error: unexpected server error while executing the query.