API reference Resources
Overview
The workspace's posture at a glance: counts and names, never content.
1 operation
Workspace overview
The workspace's posture over the trailing window: totals, a per-day series, the services and tools that carried AI traffic, and the issue mix. Counts and names only, never content: no prompt text, preview or attachment name. Needs the same permission as reading machines and interactions.
Query parameters
Trailing window, in UTC days. Default 30, clamped to 1..=90.
Response200
The workspace's posture over the window
Oldest first, zero-filled, exactly window_days long.
YYYY-MM-DD.
Interactions observed that day.
At most 100.
Issues whose status is open.
Largest first.
Open issues by severity. Every key is always present.
Every issue in the workspace, whatever its status.
Largest first by interactions, then by name; at most 20.
Interactions with at least one blocked decision, each once.
Whether an enabled catalogue entry matches: its service_id equals service, or one of its patterns covers it (hook and proxy rows record a host). False is Shadow AI.
Distinct machines that talked to it.
The AI service, as interactions record it, e.g. claude.ai.
Largest first; at most 20.
The client's declared name; its client_kind word when it declared none; other when neither — the machine map's naming.
The commonest declared client kind among its interactions.
Distinct services before the cap.
Distinct tools before the cap.
Interactions with at least one blocked decision, each counted once.
Interactions observed in the window.
Distinct machines among the interactions. Connection-ingested interactions have no machine and are not counted here.
Bytes sent to AI services in the window.
Distinct AI services.
Distinct AI services no enabled catalogue entry matches, by id or by pattern: Shadow AI. Counted over every service, not only the listed.
The window actually used, after clamping.
Errors
- 401
No valid session
- 403
Caller lacks machines:read in this workspace