The runs (individual program invocations) behind a machine's events

Returns a machine's runs, newest first: one entry per invocation of an instrumented program, with what was run, when it was first and last seen reporting, how many distinct events it produced and how many occurrences those add up to. Values that look like passwords, tokens or keys are masked in the command line. Use run_uid with the events query's advanced builder - {"field":"run","op":"is","value":"<run_uid>"} on the python view - to narrow the events list, an export or the map to that one run; under that filter the count on each event is that run's own occurrences rather than the event's all-time total. A run_uid is empty on runs reported by agents that predate run ids, which are grouped by command line and environment instead: several invocations then share one entry. Ownership is a predicate in the query, so a machine secret belonging to another account returns an empty list, never that account's runs. Page with next_before: pass it back as before until it comes back empty.

This is a read: a read-only API key may call it.