{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Shared queries store the results of a previously run query, allowing you to share the results with others.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string","description":"Your Cloudflare account ID."}},"required":["account_id"],"additionalProperties":false},"body":{"type":"object","properties":{"chart":{"description":"When true, includes time-series data in the response.","type":"boolean"},"chartType":{"description":"Controls the SQL shape and response payload for the 'calculations' view. Omitted or 'timeseries_and_aggregate': current behaviour — both the time-series and aggregate queries. 'timeseries': time-series only. 'aggregate': aggregate only. 'distribution': a bucketed 2D histogram (time × value buckets) returned in 'distribution' instead of 'calculations'. 'distribution' is not compatible with 'compare' — combining them returns a 400.","type":"string","enum":["timeseries_and_aggregate","timeseries","aggregate","distribution"]},"compare":{"description":"When true, includes a comparison dataset from the previous time period of equal length.","type":"boolean"},"distributionScale":{"description":"Value-axis bucketing for chartType 'distribution'. Omitted or 'log': geometric buckets, best for heavy-tailed latency. 'linear': fixed-width buckets, clearer for narrow or additive ranges. Ignored for other chartTypes. The response echoes the scheme used in distribution.bucketMode.","type":"string","enum":["log","linear"]},"dry":{"description":"When true, executes the query without persisting the results. Useful for validation or previewing.","type":"boolean","default":false},"granularity":{"description":"Number of time-series buckets. Only used when view is 'calculations'. Omit to let the system auto-detect an appropriate granularity.","type":"number"},"ignoreSeries":{"description":"When true, omits time-series data from the response and returns only aggregated values. Reduces response size when series are not needed.","type":"boolean","default":false},"limit":{"description":"Maximum number of events to return when view is 'events'. Also controls the number of group-by rows when view is 'calculations'.","type":"number","default":50,"maximum":2000},"offset":{"description":"Cursor for pagination in event, trace, invocation, and agent views. Pass the $metadata.id of the last event, the trace cursor, or AgentRun.id to fetch the next page.","type":"string"},"offsetBy":{"description":"Numeric offset for paginating grouped/pattern results (top-N lists). Use together with limit. Not used by cursor-based pagination.","type":"number"},"offsetDirection":{"description":"Pagination direction: 'next' for forward, 'prev' for backward.","type":"string"},"parameters":{"description":"Query parameters defining what data to retrieve — filters, calculations, group-bys, and ordering. In practice this should always be provided for ad-hoc queries. Only omit when executing a previously saved query by queryId. Use the keys and values endpoints to discover available fields before building filters.","properties":{"calculations":{"description":"Aggregation calculations to compute (e.g. count, avg, p99). Each calculation produces aggregate values and optional time-series data.","type":"array","items":{"oneOf":[{"properties":{"alias":{"description":"Custom label for this calculation in the results. Useful for distinguishing multiple calculations.","type":"string"},"key":{"description":"Field name to calculate over. Must exist in the data. Verify with the keys endpoint. Required for every operator except `count`, which aggregates whole rows and may omit it.","type":"string"},"keyType":{"description":"Data type of the key. Required when key is provided to ensure correct aggregation.","type":"string","enum":["string","number","boolean"]},"operator":{"description":"Aggregation operator to apply. Examples: count, avg, sum, min, max, median, p90, p95, p99, uniq, stddev, variance.","type":"string","enum":["count","COUNT"]}},"required":["operator"],"type":"object"},{"properties":{"alias":{"description":"Custom label for this calculation in the results. Useful for distinguishing multiple calculations.","type":"string"},"key":{"description":"Field name to calculate over. Must exist in the data. Verify with the keys endpoint. Required for every operator except `count`, which aggregates whole rows and may omit it.","type":"string","pattern":"\\S"},"keyType":{"description":"Data type of the key. Required when key is provided to ensure correct aggregation.","type":"string","enum":["string","number","boolean"]},"operator":{"description":"Aggregation operator to apply. Examples: count, avg, sum, min, max, median, p90, p95, p99, uniq, stddev, variance.","type":"string","enum":["uniq","max","min","sum","avg","median","p001","p01","p05","p10","p25","p75","p90","p95","p99","p999","stddev","variance","COUNT_DISTINCT","MAX","MIN","SUM","AVG","MEDIAN","P001","P01","P05","P10","P25","P75","P90","P95","P99","P999","STDDEV","VARIANCE"]}},"required":["key","operator"],"type":"object"}]}},"datasets":{"description":"Datasets to query. Leave empty to query all available datasets.","type":"array","items":{"type":"string"},"examples":[[]]},"filterCombination":{"description":"Logical operator for combining top-level filters: 'and' (all must match) or 'or' (any must match). Defaults to 'and'.","type":"string","enum":["and","or","AND","OR"]},"filters":{"description":"Filters to narrow query results. Use the keys and values endpoints to discover available fields before building filters. Supports nested groups via kind: 'group'. Maximum nesting depth is 4.","type":"array","items":{"allOf":[{"$ref":"#/definitions/workers-observability_filter_node"},{"anyOf":[{"description":"A group node that nests child filters combined with a logical operator.","properties":{"filterCombination":{"description":"Logical operator for combining child filters: 'and' (all must match) or 'or' (any must match).","type":"string","enum":["and","or","AND","OR"]},"filters":{"description":"Child filter nodes. Each can be a leaf filter or another nested group.","type":"array","items":{"$ref":"#/definitions/workers-observability_filter_node"},"minItems":1},"kind":{"description":"Discriminator indicating this is a nested filter group.","type":"string","enum":["group"]}},"required":["kind","filterCombination","filters"],"type":"object"},{"$ref":"#/definitions/workers-observability_filter_leaf"}],"description":"Supports nested groups via kind: 'group'. Maximum nesting depth is 4."}]}},"groupBys":{"description":"Fields to group calculation results by. Only applicable when the query view is 'calculations'. Produces per-group aggregate values.","type":"array","items":{"properties":{"type":{"description":"Data type of the group-by field.","type":"string","enum":["string","number","boolean"]},"value":{"description":"Field name to group results by (e.g. $metadata.service, $metadata.statusCode).","type":"string"}},"required":["type","value"],"type":"object"}},"havings":{"description":"Post-aggregation filters applied to calculation results. Use to filter groups after aggregation (e.g. only groups where count > 100).","type":"array","items":{"properties":{"key":{"description":"Calculation alias or operator to filter on after aggregation.","type":"string"},"operation":{"description":"Numeric comparison operator: eq, neq, gt, gte, lt, lte.","type":"string","enum":["eq","neq","gt","gte","lt","lte"]},"value":{"description":"Threshold value to compare the calculation result against.","type":"number"}},"required":["key","operation","value"],"type":"object"}},"limit":{"description":"Maximum number of group-by rows to return in calculation results. A value of 10 is a sensible default for most use cases.","type":"integer","maximum":2000,"minimum":0},"needle":{"description":"Full-text search expression applied across all event fields. Matches events containing the specified text.","type":"object","properties":{"isRegex":{"description":"When true, treats the value as a regular expression (RE2 syntax).","type":"boolean"},"matchCase":{"description":"When true, performs a case-sensitive search. Defaults to case-insensitive.","type":"boolean"},"value":{"description":"The text or pattern to search for.","allOf":[{"anyOf":[{"type":"string"},{"type":"number"},{"type":"boolean"}]},{"maxLength":1000,"type":"string"}]}},"required":["value"]},"orderBy":{"description":"Ordering for grouped calculation results. Only effective when a group-by is present.","type":"object","properties":{"order":{"description":"Sort direction: 'asc' for ascending, 'desc' for descending.","type":"string","enum":["asc","desc"]},"value":{"description":"Alias of the calculation to order results by. Must match the alias (or operator) of a calculation in the query.","type":"string"}},"required":["value"]}},"type":"object"},"queryId":{"description":"Identifier for the query. When parameters are omitted, this ID is used to load a previously saved query's parameters. When providing parameters inline, pass any identifier (e.g. an ad-hoc ID).","type":"string"},"timeframe":{"description":"Timeframe for the query using Unix timestamps in milliseconds. 'from' must be earlier than 'to'. Narrower timeframes produce faster responses and more specific results.","type":"object","properties":{"from":{"description":"Start timestamp for the query timeframe. Unix timestamp in milliseconds","type":"integer","maximum":253402300799999,"minimum":0},"to":{"description":"End timestamp for the query timeframe. Unix timestamp in milliseconds","type":"integer","maximum":253402300799999,"minimum":0}},"required":["to","from"]},"view":{"description":"Controls the shape of the response. 'events': individual log lines matching the query. 'calculations': aggregated metrics (count, avg, p99, etc.) with optional group-by breakdowns and time-series. 'invocations': events grouped by request ID. 'traces': distributed trace summaries. 'agents': agent-specific trace summaries.","type":"string","default":"calculations","enum":["traces","events","calculations","invocations","requests","agents"]}},"required":["queryId","timeframe"]}},"required":["path","body"],"additionalProperties":false,"definitions":{"workers-observability_filter_node":{"description":"Supports nested groups via kind: 'group'.","type":"object","anyOf":[{"properties":{"filterCombination":{"type":"string","enum":["and","or","AND","OR"]},"filters":{"type":"array","items":{"$ref":"#/definitions/workers-observability_filter_node"},"minItems":1},"kind":{"type":"string","enum":["group"]}},"required":["kind","filterCombination","filters"],"type":"object"},{"$ref":"#/definitions/workers-observability_filter_leaf"}]},"workers-observability_filter_leaf":{"description":"A filter condition applied to query results. Use the keys and values endpoints to discover available fields and their values before constructing filters.","type":"object","properties":{"key":{"description":"Filter field name. Use verified keys from previous query results or the keys endpoint. Common keys include $metadata.service, $metadata.origin, $metadata.trigger, $metadata.message, and $metadata.error.","type":"string"},"kind":{"description":"Discriminator for leaf filter nodes. Always 'filter' when present; may be omitted.","type":"string","enum":["filter"]},"operation":{"description":"Comparison operator. String operators: includes, not_includes, starts_with, ends_with, regex. Existence: exists, is_null. Set membership: in, not_in (comma-separated values). Numeric: eq, neq, gt, gte, lt, lte.","type":"string","enum":["includes","not_includes","starts_with","ends_with","regex","exists","is_null","in","not_in","eq","neq","gt","gte","lt","lte","=","!=",">",">=","<","<=","INCLUDES","DOES_NOT_INCLUDE","MATCH_REGEX","EXISTS","DOES_NOT_EXIST","IN","NOT_IN","STARTS_WITH","ENDS_WITH"]},"type":{"description":"Data type of the filter field. Must match the actual type of the key being filtered.","type":"string","enum":["string","number","boolean"]},"value":{"description":"Comparison value. Must match actual values in your data — verify with the values endpoint. Ensure the value type (string/number/boolean) matches the field type. String comparisons are case-sensitive. Regex uses RE2 syntax (no lookaheads/lookbehinds).","anyOf":[{"type":"string"},{"type":"number"},{"type":"boolean"}]}},"required":["key","operation","type"]}}},"name":"Create a sharable link to a query result","id":"cloudflare.shared.query.post","example":{"path":{"account_id":"example"},"body":{"queryId":"example","timeframe":{"to":1,"from":1}}},"maxRequests":1,"summary":false}}