API reference: Monitoring

Correlated incident timelines: firing/resolved alerts plus change events, newest first — reading the same metric series the alert evaluation uses.

{ "incidents": [ { "id": "…", "title": "…", "events": [ … ] } ], "alerts": [ … ] }

Per-resource metric series (?nativeId= required): cpu, memory, network_in/out, latency_p99, error_rate. Real polled samples come from a configured per-resource metrics endpoint; a resource without one returns an honest empty.

{ "nativeId": "i-0a1b2c3d4e5f60001",
  "series": [ { "metric": "cpu", "unit": "percent",
      "points": [ { "ts": "2026-08-21T09:00:00.000Z", "value": 18.4 } ] } ] }

List alert rules (default rules are seeded on first connect). POST creates one (mutate_infra).

{ "rules": [ { "id": 1, "name": "High CPU", "metric": "cpu", "comparator": "gt",
  "threshold": 85, "durationMinutes": 5, "severity": "warn", "enabled": true } ] }

Evaluate all rules now (also fired by the connect-kick): opens firing alerts (deduplicated per rule+resource) and auto-resolves recovered ones. Audited monitoring.alert_fired/alert_resolved.

{}  // no body — evaluates every enabled rule for the caller's org

{ "ok": true, "evaluated": 4, "opened": 1, "resolved": 2 }

Per-employee activity view over the audit trail: your own always; another member's (?userId=) requires manage_users_sso; cross-org 404.

{ "events": [ { "id": 918, "action": "terraform.applied", "detail": "bh-tokyo-vpc #151 v2",
  "createdAt": "2026-08-21T09:05:00.000Z", "userId": 8 } ] }