> ## Documentation Index > Fetch the complete documentation index at: https://test-8ad8522e-feat-ai-sre.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Create datasource > Create a new monitoring data source. The `payload` must include the type-specific configuration block. Supports diagnostic types redis_node, redis_sentinel, mongodb_mongod, mongodb_mongos and kafka; enabled and alerting_enabled are independent. ## Restrictions | Aspect | Value | | ----------- | ------------------------------------------------------------- | | Rate limits | **1,000 requests/minute**; **50 requests/second** per account | | Permissions | **Datasources Manage** (`monit`) | ## Usage * `type_ident` must be one of: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`. * `edge_cluster_name` specifies which Monitors edge cluster evaluates rules using this datasource. * For `elasticsearch`, set `payload.elasticsearch.deployment` to `cloud` or `self-managed`. * Every call is recorded in the account audit log. Use credential fields only for connection credentials. See the request/response schemas for all supported types and credential handling. Diagnostic-only types cannot enable alerting. On create omitted enabled defaults to true; on update omission preserves the current value. Explicit null for enabled or alerting\_enabled is invalid. Diagnostic passwords and Kafka private keys are omitted from responses unless they are environment references; omit these secrets on update to preserve them, or send an empty string to clear. Other datasource credentials may be returned and must be handled as sensitive. ## OpenAPI ````yaml /api-reference/monitors.openapi.en.json post /monit/datasource/create openapi: 3.1.0 info: title: Flashduty Open API description: >- Public HTTP API for the Flashduty incident management platform — incidents, notification templates, channels, schedules, monitors, RUM, and platform administration. Every operation is authenticated with an `app_key` query parameter issued from the Flashduty console under Account → APP Keys. Responses follow a uniform envelope: `{ request_id, data }` on success, `{ request_id, error }` on failure. version: 1.0.0 servers: - url: https://api.flashcat.cloud description: Flashduty Open API security: - AppKeyAuth: [] tags: - name: Monitors/Alert rules description: >- Create, manage, and export monitor alert rules. Query rule counters and audit history. - name: Monitors/Data sources description: Manage monitoring data sources used by alert rules to query metrics. - name: Monitors/Diagnostics description: >- Diagnostic and query endpoints used by Flashduty AI SRE — ad-hoc data source queries, log/metric diagnostics, and target-side tool invocation. - name: Monitors/Monitor utilities description: Monitors service activation and data preview utilities. paths: /monit/datasource/create: post: tags: - Monitors/Data sources summary: Create datasource description: >- Create a new monitoring data source. The `payload` must include the type-specific configuration block. Supports diagnostic types redis_node, redis_sentinel, mongodb_mongod, mongodb_mongos and kafka; enabled and alerting_enabled are independent. operationId: monit-datasource-write-create requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DataSourceUpsertRequest' example: type_ident: prometheus name: Prometheus Prod note: Production Prometheus address: http://prometheus.example.com:9090 edge_cluster_name: default payload: prometheus: basic_auth_enabled: false responses: '200': description: Success content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - type: object properties: data: $ref: '#/components/schemas/DataSourceItem' example: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: id: 10 type_ident: prometheus name: Prometheus Prod enabled: true edge_cluster_name: default updated_at: 1712000000 alerting_enabled: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' components: schemas: DataSourceUpsertRequest: type: object description: >- Request body for creating or updating a datasource. `id` is required only for update. `address` is required for all types except Elasticsearch with `deployment=cloud`. required: - type_ident - name - edge_cluster_name - payload properties: id: type: integer format: uint64 description: Datasource ID. Required for update; omit for create. type_ident: type: string description: >- Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。 name: type: string description: >- Datasource display name. This is the name referenced as `ds_name` in query APIs. note: type: string description: Optional description. address: type: string description: >- Connection address. Required for every type except `elasticsearch` with `deployment: cloud`. Prometheus/Loki/VictoriaLogs: HTTP URL; MySQL/Oracle/Postgres/ClickHouse: `host:port`; SLS: endpoint without the `http(s)://` prefix; `tencent_cls`: must be `cls.tencentcloudapi.com` or `cls.internal.tencentcloudapi.com` (requires Monitors edge >= v0.66.0). Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. maxLength: 4096 payload: $ref: '#/components/schemas/DSPayload' description: >- Type-specific configuration block. Must include the key matching `type_ident`. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior. edge_cluster_name: type: string description: >- Monitors edge cluster name responsible for evaluating rules using this datasource. enabled: type: boolean description: >- Whether business execution is enabled. Omitted on create: true; omitted on update: preserve the current value. Explicit false disables execution; null is invalid. Does not change alerting_enabled. x-flashduty-preserve-absence: true alerting_enabled: description: >- Whether this datasource may evaluate alerts. Omitted on create: true for alerting types, false for diagnostic-only types; omitted on update: preserve current value. null is invalid. redis_node, redis_sentinel, mongodb_mongod, mongodb_mongos and kafka reject true. Disabling is rejected with conflict when enabled rules reference the datasource. type: boolean x-flashduty-preserve-absence: true SuccessEnvelope: type: object description: >- Success response envelope. On every 2xx response, `request_id` identifies the call (also mirrored in the `Flashcat-Request-Id` header) and `data` holds the endpoint-specific payload. Failure responses use a different shape — see `ErrorResponse`. properties: request_id: type: string description: >- Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: description: Endpoint-specific payload. See each operation's 200 response schema. required: - request_id - data DataSourceItem: type: object description: A monitoring datasource. required: - id - account_id - type_ident - name - enabled - note - address - edge_cluster_name - updated_at - payload - alerting_enabled properties: id: type: integer format: uint64 description: Unique datasource ID. account_id: type: integer format: uint64 description: Account ID. type_ident: type: string description: >- Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。 name: type: string description: Datasource display name. enabled: type: boolean description: >- Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled. note: type: string description: Optional description. address: type: string description: >- Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. maxLength: 4096 payload: anyOf: - $ref: '#/components/schemas/DSPayload' - type: 'null' description: >- Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior. edge_cluster_name: type: string description: >- Monitors edge cluster name responsible for evaluating rules using this datasource. updated_at: type: integer format: int64 description: Last update timestamp, Unix epoch seconds. alerting_enabled: description: >- Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools. type: boolean DSPayload: type: object description: >- Type-specific datasource configuration. Include only the block matching `type_ident`. properties: prometheus: $ref: '#/components/schemas/DSPrometheusConfig' loki: $ref: '#/components/schemas/DSLokiConfig' mysql: $ref: '#/components/schemas/DSMySQLConfig' oracle: $ref: '#/components/schemas/DSOracleConfig' postgres: $ref: '#/components/schemas/DSPostgresConfig' clickhouse: $ref: '#/components/schemas/DSClickHouseConfig' elasticsearch: $ref: '#/components/schemas/DSElasticSearchConfig' sls: $ref: '#/components/schemas/DSSLSConfig' victorialogs: $ref: '#/components/schemas/DSVictoriaLogsConfig' tencent_cls: $ref: '#/components/schemas/DSTencentCLSConfig' description: >- Tencent CLS credentials. Required when `type_ident` is `tencent_cls`. kafka: $ref: '#/components/schemas/DSKafkaConfig' x-flashduty-preserve-absence: true mongodb_mongod: $ref: '#/components/schemas/DSMongoDBConfig' x-flashduty-preserve-absence: true mongodb_mongos: $ref: '#/components/schemas/DSMongoDBConfig' x-flashduty-preserve-absence: true redis_node: $ref: '#/components/schemas/DSRedisNodeConfig' x-flashduty-preserve-absence: true redis_sentinel: $ref: '#/components/schemas/DSRedisSentinelConfig' x-flashduty-preserve-absence: true ErrorResponse: type: object description: Response envelope for errors. `error` is required; `data` is absent. properties: request_id: type: string example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 description: >- Unique trace ID of this request; include it when reporting issues so logs can be located. error: $ref: '#/components/schemas/DutyError' required: - request_id - error DSPrometheusConfig: type: object description: >- Prometheus datasource configuration. TLS fields are inherited from TLSClientConfig. properties: basic_auth_enabled: type: boolean description: Enable HTTP Basic Auth. basic_auth_username: type: string description: Basic auth username. basic_auth_password: type: string description: Basic auth password. headers: type: array items: type: string description: 'Custom HTTP headers in `Key: Value` format.' params: type: array items: type: string description: Custom query parameters in `key=value` format. tls_ca: type: string description: PEM-encoded CA certificate used to verify the server certificate. tls_cert: type: string description: >- PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`. tls_key: type: string description: >- PEM-encoded client private key; must be configured together with `tls_cert`. tls_skip_verify: type: boolean description: >- Whether to skip server certificate verification (insecure, for self-signed setups only). tls_server_name: type: string description: >- Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty. tls_min_version: type: string description: >- Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`. tls_max_version: type: string description: >- Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint. DSLokiConfig: type: object description: >- Loki datasource configuration. TLS fields are inherited from TLSClientConfig. properties: basic_auth_enabled: type: boolean description: >- Whether HTTP Basic Auth is enabled; when `false`, `basic_auth_username`/`basic_auth_password` are ignored. basic_auth_username: type: string description: Basic Auth username, effective when `basic_auth_enabled` is `true`. basic_auth_password: type: string description: Basic Auth password, effective when `basic_auth_enabled` is `true`. headers: type: array items: type: string description: >- Custom HTTP headers added to every request, each entry formatted as `Key: Value`; usable for tenancy headers such as `X-Scope-OrgID`. params: type: array items: type: string description: >- Custom query parameters appended to every request URL, each entry formatted as `key=value`. tls_ca: type: string description: PEM-encoded CA certificate used to verify the server certificate. tls_cert: type: string description: >- PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`. tls_key: type: string description: >- PEM-encoded client private key; must be configured together with `tls_cert`. tls_skip_verify: type: boolean description: >- Whether to skip server certificate verification (insecure, for self-signed setups only). tls_server_name: type: string description: >- Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty. tls_min_version: type: string description: >- Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`. tls_max_version: type: string description: >- Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint. DSMySQLConfig: type: object description: >- MySQL datasource configuration. TLS fields are inherited from TLSClientConfig. properties: username: type: string description: MySQL authentication username. password: type: string description: MySQL authentication password. open_conns: type: integer description: Maximum open connections. idle_conns: type: integer description: Maximum idle connections. lifetime_seconds: type: integer format: int64 description: Connection maximum lifetime in seconds. timeout_mills: type: integer format: int64 description: Query timeout in milliseconds. tls_mode: type: string enum: - disable - require - verify-full description: >- TLS mode for the MySQL connection. Empty keeps the legacy per-field TLS behavior. `disable` = no TLS (all `tls_*` fields are cleared on save); `require` = TLS without server certificate verification; `verify-full` = TLS with full server verification (CA chain and hostname). MySQL has no `verify-ca` — verifying the CA implies verifying the hostname. tls_ca: type: string description: >- PEM-encoded CA certificate used to verify the server certificate; only allowed when `tls_mode` is `verify-full` (or empty legacy mode). tls_cert: type: string description: >- PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`. tls_key: type: string description: >- PEM-encoded client private key; must be configured together with `tls_cert`. tls_skip_verify: type: boolean description: >- Whether to skip server certificate verification; derived from `tls_mode` when set (`require` → `true`, `verify-full` → `false`) — only manually effective under legacy empty `tls_mode`. tls_server_name: type: string description: >- Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty. tls_min_version: type: string description: >- Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`. tls_max_version: type: string description: >- Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint. DSOracleConfig: type: object description: Oracle datasource configuration. properties: username: type: string description: Oracle authentication username. password: type: string description: Oracle authentication password. options: type: object additionalProperties: type: string description: Extra connection options as key-value pairs. open_conns: type: integer description: >- Maximum number of open connections in the pool; `0` or omitted uses the default of 32. idle_conns: type: integer description: >- Maximum number of idle connections in the pool; `0` or omitted uses the default of 4. lifetime_seconds: type: integer format: int64 description: >- Maximum connection lifetime in seconds; `0` or omitted uses the default of 600 (10 minutes). timeout_mills: type: integer format: int64 description: >- Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds). DSPostgresConfig: type: object description: PostgreSQL datasource configuration. properties: username: type: string description: PostgreSQL authentication username. password: type: string description: PostgreSQL authentication password. open_conns: type: integer description: >- Maximum number of open connections in the pool; `0` or omitted uses the default of 32. idle_conns: type: integer description: >- Maximum number of idle connections in the pool; `0` or omitted uses the default of 4. lifetime_seconds: type: integer format: int64 description: >- Maximum connection lifetime in seconds; `0` or omitted uses the default of 600 (10 minutes). timeout_mills: type: integer format: int64 description: >- Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds). ssl_mode: type: string enum: - disable - require - verify-ca - verify-full description: >- SSL mode for the PostgreSQL connection. Empty keeps the legacy behavior inferred from `tls_ca`. `disable` = no TLS (all `tls_*` fields are cleared on save); `require` = TLS without server certificate verification (`tls_ca` not allowed); `verify-ca` = verify the server certificate CA chain but not the hostname; `verify-full` = verify both CA chain and hostname. tls_ca: type: string description: >- PEM-encoded CA certificate used to verify the server certificate; used with `ssl_mode` `verify-ca`/`verify-full` and rejected under `require`. tls_cert: type: string description: >- PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`. tls_key: type: string description: >- PEM-encoded client private key; must be configured together with `tls_cert`. DSClickHouseConfig: type: object description: >- ClickHouse datasource configuration. TLS fields are inherited from TLSClientConfig. properties: database: type: string description: Default database for authentication. username: type: string description: ClickHouse authentication username. password: type: string description: ClickHouse authentication password. open_conns: type: integer description: >- Maximum number of open connections in the pool; `0` or omitted uses the default of 32. idle_conns: type: integer description: >- Maximum number of idle connections in the pool; `0` or omitted uses the default of 4. lifetime_seconds: type: integer format: int64 description: >- Maximum connection lifetime in seconds; `0` or omitted uses the default of 600 (10 minutes). timeout_mills: type: integer format: int64 description: >- Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds). max_execution_seconds: type: integer format: int64 description: Max query execution time in seconds. dial_timeout_mills: type: integer format: int64 description: Dial timeout in milliseconds. tls_enabled: type: boolean description: >- Whether TLS is enabled; when `false`, all `tls_*` fields are cleared before saving. tls_ca: type: string description: PEM-encoded CA certificate used to verify the server certificate. tls_cert: type: string description: >- PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`. tls_key: type: string description: >- PEM-encoded client private key; must be configured together with `tls_cert`. tls_skip_verify: type: boolean description: >- Whether to skip server certificate verification (insecure, for self-signed setups only). tls_server_name: type: string description: >- Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty. tls_min_version: type: string description: >- Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`. tls_max_version: type: string description: >- Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint. DSElasticSearchConfig: type: object description: Elasticsearch datasource configuration. properties: deployment: type: string enum: - cloud - self-managed description: >- Deployment type. `cloud` uses Elastic Cloud; `self-managed` uses a self-hosted cluster. timeout_mills: type: integer format: int64 description: >- Per-query timeout in milliseconds; `0` or omitted uses the default of 10000 (10 seconds). cloud_id: type: string description: Elastic Cloud deployment ID. Only for `cloud` deployment. api_key: type: string description: Elastic Cloud API key. Only for `cloud` deployment. username: type: string description: Username for `self-managed` deployment. password: type: string description: >- Authentication password for self-managed clusters; ignored when `service_token` is set. service_token: type: string description: Service token; overrides username/password if set. tls_ca: type: string description: >- PEM-encoded CA certificate used to verify the Elasticsearch server certificate. certificate_fingerprint: type: string description: >- SHA-256 fingerprint of the Elasticsearch CA certificate, used to verify the server chain (the recommended check for ES 8 default security). headers: type: array items: type: string description: >- Custom HTTP headers added to every request, each entry formatted as `Key: Value`. DSSLSConfig: type: object description: Alibaba Cloud SLS datasource configuration. properties: access_key_id: type: string description: Alibaba Cloud Access Key ID. access_key_secret: type: string description: Alibaba Cloud Access Key Secret. headers: type: array items: type: string description: Custom HTTP headers. DSVictoriaLogsConfig: type: object description: >- VictoriaLogs datasource configuration. TLS fields are inherited from TLSClientConfig. properties: basic_auth_enabled: type: boolean description: >- Whether HTTP Basic Auth is enabled; when `false`, `basic_auth_username`/`basic_auth_password` are ignored. basic_auth_username: type: string description: Basic Auth username, effective when `basic_auth_enabled` is `true`. basic_auth_password: type: string description: Basic Auth password, effective when `basic_auth_enabled` is `true`. headers: type: array items: type: string description: >- Custom HTTP headers added to every request, each entry formatted as `Key: Value`; usable for tenancy headers such as `AccountID`/`ProjectID`. params: type: array items: type: string description: >- Custom query parameters appended to every request URL, each entry formatted as `key=value`. tls_ca: type: string description: PEM-encoded CA certificate used to verify the server certificate. tls_cert: type: string description: >- PEM-encoded client certificate for mutual TLS; must be configured together with `tls_key`. tls_key: type: string description: >- PEM-encoded client private key; must be configured together with `tls_cert`. tls_skip_verify: type: boolean description: >- Whether to skip server certificate verification (insecure, for self-signed setups only). tls_server_name: type: string description: >- Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty. tls_min_version: type: string description: >- Minimum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint and it must not exceed `tls_max_version`. tls_max_version: type: string description: >- Maximum TLS version, one of `1.0`, `1.1`, `1.2`, `1.3`; empty means no constraint. DSTencentCLSConfig: type: object description: Tencent CLS (Cloud Log Service) credential configuration. required: - secret_id properties: secret_id: type: string description: >- Tencent Cloud API SecretId. Always required (create and update). Supports `${env:VAR}` references resolved on the edge. secret_key: type: string description: >- Tencent Cloud API SecretKey. Required on create; on update, omit to keep the stored key. Supports `${env:VAR}` references. Never returned by read APIs: responses carry an empty string unless the stored value is an `${env:...}` reference. DSKafkaConfig: description: Diagnostic datasource connection configuration. properties: password: description: >- Authentication password; supports ${env:NAME}. Omit on update to preserve; explicitly send an empty string to clear. Literal passwords are omitted from responses. type: string x-flashduty-preserve-absence: true sasl_mechanism: default: none description: >- SASL mechanism: none (default, no credentials), plain, scram-sha-256, scram-sha-512 (require username and password). enum: - none - plain - scram-sha-256 - scram-sha-512 type: string timeout_ms: default: 5000 description: Connection timeout in milliseconds; defaults to 5000 when omitted. maximum: 10000 minimum: 1000 type: integer tls_ca: description: PEM CA certificates or an ${env:NAME} reference. type: string tls_cert: description: >- PEM client certificate or ${env:NAME}; configure both tls_cert and tls_key. type: string tls_enabled: default: false description: Whether TLS is enabled; defaults to false. type: boolean tls_key: description: >- PEM client private key or ${env:NAME}; configure both tls_cert and tls_key. Omit on update to preserve; an empty string clears it. Literal keys are omitted from responses. type: string x-flashduty-preserve-absence: true tls_max_version: description: >- Maximum TLS version: 1.2 or 1.3; empty means no constraint. Must not be below the minimum. type: string tls_min_version: description: 'Minimum TLS version: 1.2 (default) or 1.3.' type: string tls_server_name: type: string description: >- Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty. tls_skip_verify: description: Skip server certificate verification when TLS is enabled. type: boolean username: description: Authentication username; an ${env:NAME} reference is supported. type: string type: object DSMongoDBConfig: description: Diagnostic datasource connection configuration. properties: auth_source: default: admin description: >- Authentication database; defaults to admin. Username and password must be configured together. Client certificates are unsupported. type: string password: description: >- Authentication password; supports ${env:NAME}. Omit on update to preserve; explicitly send an empty string to clear. Literal passwords are omitted from responses. type: string x-flashduty-preserve-absence: true timeout_ms: default: 3000 description: Connection timeout in milliseconds; defaults to 3000 when omitted. maximum: 10000 minimum: 1000 type: integer tls_ca: description: PEM CA certificates or an ${env:NAME} reference. type: string tls_enabled: default: false description: Whether TLS is enabled; defaults to false. type: boolean tls_max_version: description: >- Maximum TLS version: 1.2 or 1.3; empty means no constraint. Must not be below the minimum. type: string tls_min_version: description: 'Minimum TLS version: 1.2 (default) or 1.3.' type: string tls_server_name: type: string description: >- Server name used for TLS SNI and certificate verification; defaults to the host from the connection address when empty. tls_skip_verify: description: Skip server certificate verification when TLS is enabled. type: boolean username: description: Authentication username; an ${env:NAME} reference is supported. type: string type: object DSRedisNodeConfig: description: Diagnostic datasource connection configuration. properties: database: default: 0 description: Redis database number; defaults to 0. minimum: 0 type: integer password: description: >- Authentication password; supports ${env:NAME}. Omit on update to preserve; explicitly send an empty string to clear. Literal passwords are omitted from responses. type: string x-flashduty-preserve-absence: true timeout_ms: default: 3000 description: Connection timeout in milliseconds; defaults to 3000 when omitted. maximum: 10000 minimum: 1000 type: integer username: description: Authentication username; an ${env:NAME} reference is supported. type: string type: object DSRedisSentinelConfig: description: Diagnostic datasource connection configuration. properties: password: description: >- Authentication password; supports ${env:NAME}. Omit on update to preserve; explicitly send an empty string to clear. Literal passwords are omitted from responses. type: string x-flashduty-preserve-absence: true timeout_ms: default: 3000 description: Connection timeout in milliseconds; defaults to 3000 when omitted. maximum: 10000 minimum: 1000 type: integer username: description: Authentication username; an ${env:NAME} reference is supported. type: string type: object DutyError: type: object description: >- Error payload inside the response envelope. Present only on non-2xx responses. properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string description: >- Human-readable error message, localized by the caller's Accept-Language. May contain field names, IDs, or other context from the failing request. example: The specified parameter template_id is not valid. reason: description: >- Optional machine-readable rejection reason, including datasource tool failures. Inspect alongside HTTP status and code. type: string x-flashduty-preserve-absence: true required: - code - message ErrorCode: type: string description: >- Flashduty error code enum. Every failed API response sets `error.code` to one of these stable wire strings. HTTP status is informational — the authoritative signal is the enum value. | Code | HTTP | Meaning | |---|---|---| | `OK` | 200 | Reserved — not returned on real errors. | | `InvalidParameter` | 400 | A required parameter is missing or failed validation. | | `BadRequest` | 400 | Generic 400 used when no more specific code fits. | | `InvalidContentType` | 400 | The `Content-Type` header is not `application/json`. | | `ResourceNotFound` | 400 | The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). | | `NoLicense` | 400 | The feature is license-gated and no active license was found. | | `ReferenceExist` | 400 | Deletion blocked — other entities still reference this resource. | | `Unauthorized` | 401 | `app_key` is missing, invalid, or expired. | | `BalanceNotEnough` | 402 | Billing-gated operation with insufficient account balance. | | `AccessDenied` | 403 | Authenticated but lacking the permission required for this operation. | | `RouteNotFound` | 404 | The request URL path is not a known route. | | `MethodNotAllowed` | 405 | The HTTP method is not allowed on this otherwise-known path. | | `UndonedOrderExist` | 409 | An outstanding billing order blocks this new one. Wait and retry. | | `RequestLocked` | 423 | Operation temporarily locked due to repeated failures. | | `EntityTooLarge` | 413 | Request body exceeds the configured max size. | | `RequestTooFrequently` | 429 | Rate limit hit — API-global, per-account, or per-integration. | | `RequestVerifyRequired` | 428 | Second-factor verification required but not supplied. | | `DangerousOperation` | 428 | High-risk operation requires MFA verification. | | `InternalError` | 500 | Unhandled server-side error. Include `request_id` in the bug report. | | `ServiceUnavailable` | 503 | A backend dependency is unavailable. Try again later. | enum: - OK - InvalidParameter - BadRequest - InvalidContentType - ResourceNotFound - NoLicense - ReferenceExist - Unauthorized - BalanceNotEnough - AccessDenied - RouteNotFound - MethodNotAllowed - UndonedOrderExist - RequestLocked - EntityTooLarge - RequestTooFrequently - RequestVerifyRequired - DangerousOperation - InternalError - ServiceUnavailable x-enumDescriptions: OK: Reserved — not returned on real errors. InvalidParameter: A required parameter is missing or failed validation. BadRequest: Generic 400 used when no more specific code fits. InvalidContentType: The `Content-Type` header is not `application/json`. ResourceNotFound: >- The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). NoLicense: The feature is license-gated and no active license was found. ReferenceExist: Deletion blocked — other entities still reference this resource. Unauthorized: '`app_key` is missing, invalid, or expired.' BalanceNotEnough: Billing-gated operation with insufficient account balance. AccessDenied: Authenticated but lacking the permission required for this operation. RouteNotFound: The request URL path is not a known route. MethodNotAllowed: The HTTP method is not allowed on this otherwise-known path. UndonedOrderExist: An outstanding billing order blocks this new one. Wait and retry. RequestLocked: Operation temporarily locked due to repeated failures. EntityTooLarge: Request body exceeds the configured max size. RequestTooFrequently: Rate limit hit — API-global, per-account, or per-integration. RequestVerifyRequired: Second-factor verification required but not supplied. DangerousOperation: High-risk operation requires MFA verification. InternalError: Unhandled server-side error. Include `request_id` in the bug report. ServiceUnavailable: A backend dependency is unavailable. Try again later. example: InvalidParameter responses: BadRequest: description: Invalid request — usually a missing or malformed parameter. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingParameter: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InvalidParameter message: The specified parameter is not valid. Unauthorized: description: Missing or invalid app_key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingAppKey: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: Unauthorized message: You are unauthorized. TooManyRequests: description: >- Rate limit hit. Either the global API limit, a per-account limit, or a per-integration limit. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: rateLimited: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: RequestTooFrequently message: Request too frequently. ServerError: description: Unexpected server-side error. Include the request_id when reporting. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InternalError message: >- We encountered an internal error, and it has been reported. Please try again later. securitySchemes: AppKeyAuth: type: apiKey in: query name: app_key description: >- App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account. ````