The signed observation token + the executed spec to re-run. The server recomputes the query hash from spec and rejects any mismatch with the token.
Input spec for run_widget_query.
ACL context (PR3, all optional/additive — the "then required" tightening is a later frontend migration): dashboard_id + widget_id identify a placed widget so the endpoint authorizes can_view against that dashboard's category; category_id is the target tab for a live preview, authorized against can_edit. When none are set the spec is a free-form query with no category ACL (documented limitation — see access.py).
Successful Response
What identifies one observation: a metric, where it sits, and which node.
coordinates place the observation inside the widget — {"label": "2026-05-01"} for a series point, {"row": ..., "column": ...} for a matrix cell, {"interaction_id": ...} for a record row, {} for a lone scalar. node_path addresses a node inside a composed expression (/numerator), or is the whole result otherwise.