POST /v1/investigate

Root-cause an incident for one or more services over a time window. Returns a triage summary — NOT raw telemetry: a ranked findings array (read this first), per-operation anomaly flags, and bounded samples of spans/logs. Every lead carries a ready-to-run SQL string (drill_down_sql on findings, operations, spans, and log patterns; drill_all_sql on the spans/logs sections) that you paste VERBATIM into POST /v1/query to fetch the underlying rows and go deeper. Typical agent loop: GET /v1/services → POST /v1/investigate → for any finding or anomalous operation, run its drill_down_sql via /v1/query. Timestamps are microseconds since the Unix epoch. The response is a map {results: {service: block}, errors: {service: message}} — partial results survive a single failing service.

curl -X POST "/v1/investigate" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "from_ts": 1780000000000000,
  "service": "worldpol-pipeline-worker",
  "services": [
    "string"
  ],
  "to_ts": 1780001800000000
}'

const response = await fetch("/v1/investigate", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
  "from_ts": 1780000000000000,
  "service": "worldpol-pipeline-worker",
  "services": [
    "string"
  ],
  "to_ts": 1780001800000000
})
});

import requests

response = requests.post(
    "/v1/investigate",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    json={
  "from_ts": 1780000000000000,
  "service": "worldpol-pipeline-worker",
  "services": [
    "string"
  ],
  "to_ts": 1780001800000000
},
)

{
  "errors": {},
  "results": {}
}