Insights

Runs a KQL query over the tenant's analytics data and returns the rows.

post

/api/{tenantId}/insights/query

Parameters are referenced by name in the query, for example {"query": "Events | where Name == eventName | take 100", "parameters": {"eventName": "Pass:Installed"}}. A query that runs too long returns 504; aggregate or narrow it.

Required scopes

This endpoint requires the following scopes:

Authorizations

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Body

A KQL query to run over the tenant's analytics data.

querystringRequired

KQL query text. Only tables and columns of the analytics schema are accepted, and results only cover the tenant's own data; an empty query, invalid KQL or an unknown table or column returns 400 with a diagnostic.

Responses

200

Query executed.

Tabular result of a query.

columnsstring[]Optional

Column names, in the order the query projects them.

400

Empty or invalid query, unknown table or column, invalid or reserved parameter name, options.maxRows out of range, or more matching rows than options.maxRows.

401

The caller is not authenticated.

application/problem+json

403

The caller lacks the tenant.insights:read scope, or the endpoint is not enabled for the tenant.

application/problem+json

429

Over 60 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.

application/problem+json

504

The query ran too long and was cancelled; aggregate or narrow it.

post/api/{tenantId}/insights/query

POST /api/{tenantId}/insights/query HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 88

{
  "query": "text",
  "parameters": {
    "ANY_ADDITIONAL_PROPERTY": "text"
  },
  "options": {
    "maxRows": 1
  }
}

{
  "columns": [
    "text"
  ],
  "rows": [
    []
  ]
}