--- title: "ListAgenticAggregates returns aggregate records matching the given filters." method: GET path: "/v1/namespaces/{tenant_meta.namespace}/agentic-aggregates" tags: ["AgenticAggregateService"] --- # ListAgenticAggregates returns aggregate records matching the given filters. `GET /v1/namespaces/{tenant_meta.namespace}/agentic-aggregates` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/agentic-aggregates` - Auth: none declared ## Path parameters - `tenant_meta.namespace` string, required ## Query parameters - `list_parameters.filter` string - `list_parameters.page_token` integer - `list_parameters.page_size` integer - `list_parameters.action` string - `list_parameters.mask` string - `list_parameters.traverse` boolean - `list_parameters.sort.path` string - `list_parameters.sort.order` 'SORT_ENTRY_ORDER_UNSPECIFIED' | 'SORT_ENTRY_ORDER_ASC' | 'SORT_ENTRY_ORDER_DESC' - `list_parameters.count` boolean - `list_parameters.group.aggregation_paths` string - `list_parameters.group.show_aggregation_uuids` boolean - `list_parameters.group.unique_count_paths` string - `list_parameters.group.unique_value_paths` string - `list_parameters.ci_run_uuid` string - `list_parameters.page_id` string - `list_parameters.group_by_time.aggregation_paths` string - `list_parameters.group_by_time.show_aggregation_uuids` boolean - `list_parameters.group_by_time.interval` 'GROUP_BY_TIME_INTERVAL_UNSPECIFIED' | 'GROUP_BY_TIME_INTERVAL_YEAR' | 'GROUP_BY_TIME_INTERVAL_QUARTER' | 'GROUP_BY_TIME_INTERVAL_MONTH' | 'GROUP_BY_TIME_INTERVAL_WEEK' | 'GROUP_BY_TIME_INTERVAL_DAY' | 'GROUP_BY_TIME_INTERVAL_HOUR' | 'GROUP_BY_TIME_INTERVAL_MINUTE' | 'GROUP_BY_TIME_INTERVAL_SECOND' - `list_parameters.group_by_time.group_size` integer - `list_parameters.group_by_time.start_time` string, date-time - `list_parameters.group_by_time.end_time` string, date-time - `list_parameters.group_by_time.mode` string - `list_parameters.group_by_time.aggregation_value_field` string - `list_parameters.group_by_time.aggregation_operator` string - `list_parameters.disable_pagination` boolean ## Response `200` A successful response. - V1ListAgenticAggregateResponse: ListAgenticAggregateResponse wraps the result of a list operation. - `count_response` V1CountResponse: Response to a list count request. - `count` integer: Number of objects matching the given list parameters. - `group_response` V1GroupResponse: Response to a list group request. - `groups` object: Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. - `list` V1ListAgenticAggregateResponseList - `objects` V1AgenticAggregate[] - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1AgenticAggregateSpec - `aggregate_bucket` string, date-time, required: Time bucket (UTC, truncated to the granularity). - `bucket_granularity` 'BUCKET_GRANULARITY_UNSPECIFIED' | 'BUCKET_GRANULARITY_HOURLY' | 'BUCKET_GRANULARITY_DAILY', required: BucketGranularity identifies the time granularity of an aggregate bucket. - BUCKET_GRANULARITY_DAILY: Bucket spans a full UTC calendar day (truncated to 00:00:00Z). - `calls_denied_by_policy` string, int64: Commands that an enforced policy denied before execution. These calls have a settled posture but did not execute. - `calls_with_policy_alert` string, int64: Commands with at least one Alert policy match. - `calls_with_policy_block_or_ask` string, int64: Commands with at least one Block or Ask policy match. A command can also increment the alert counter. - `delete_operations` string, int64: Number of delete operations (e.g. files, records). - `dimension_key` 'DIMENSION_KEY_UNSPECIFIED' | 'DIMENSION_KEY_SUMMARY' | 'DIMENSION_KEY_AGENT' | 'DIMENSION_KEY_MODEL' | 'DIMENSION_KEY_MCP_SERVER' | 'DIMENSION_KEY_COMMAND' | 'DIMENSION_KEY_CATEGORY' | 'DIMENSION_KEY_TOOL' | 'DIMENSION_KEY_SKILL' | 'DIMENSION_KEY_AI_TOOL' | 'DIMENSION_KEY_COMMAND_RISK' | 'DIMENSION_KEY_SANDBOX_REASON', required: DimensionKey identifies the aggregation dimension. - DIMENSION_KEY_SKILL: Skills discovered in agent sessions. Written in daily buckets only. - DIMENSION_KEY_AI_TOOL: AI tools detected on developer workstations. Written in daily buckets only. - DIMENSION_KEY_COMMAND_RISK: Rows keyed by command risk category. A synthetic "any" row counts each risky command once across categories. - DIMENSION_KEY_SANDBOX_REASON: Rows keyed by the reason a command ran without a sandbox. - `dimension_value` string, required: Value within the dimension (e.g. agent name, model name, command binary). - `edit_operations` string, int64: Number of file or entity edit operations. - `errors` string, int64: Number of error events encountered in this bucket. - `executions` string, int64: Total number of command executions within this bucket. - `executions_blocked` string, int64: Commands that a sandbox refused. - `executions_in_sandbox` string, int64: Commands that ran inside an agent or harness sandbox. Counted once per command on the event that settles its runtime posture. - `executions_no_sandbox` string, int64: Commands that ran outside every sandbox. - `executions_sandbox_unknown` string, int64: Commands whose runtime sandbox state could not be determined. - `executions_success` string, int64: Total number of successful executions. - `file_access_events` string, int64: Number of events where files were accessed (read, write, edit, etc). - `interrupted` string, int64: Number of events where operations were interrupted or cancelled. - `read_operations` string, int64: Number of read-type operations (e.g. file reads, data retrieval). - `repositories` string, int64: Number of distinct repositories seen in events for this bucket. - `sessions` string, int64: Total number of session events within the aggregate bucket. - `tool_calls` string, int64: Number of tool invocations (e.g. agent tool calls). - `user_prompts` string, int64: Total number of user prompts or messages handled. - `users` string, int64: Number of distinct users who generated events in this bucket. - `write_operations` string, int64: Number of write-type operations (e.g. file writes, data modification). - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the aggregate record. - `response` V1ListResponse: Response to a list request. - `next_page_id` string: The UUID of last message retrieved. - `next_page_token` integer: Pagination token that can be used to retrieve the next page of results. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/agentic-aggregates/get.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)