diff --git a/go.mod b/go.mod
index 0db0f08..0fcad0f 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli
 go 1.26.0
 
 require (
-	github.com/flashcatcloud/go-flashduty v0.15.14
+	github.com/flashcatcloud/go-flashduty v0.15.15
 	github.com/mattn/go-runewidth v0.0.30
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
diff --git a/go.sum b/go.sum
index 11bf3d1..335edc9 100644
--- a/go.sum
+++ b/go.sum
@@ -1,8 +1,8 @@
 github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY=
 github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/flashcatcloud/go-flashduty v0.15.14 h1:185WAkgahlRnLBk3jI6kYL2t8IoH5YtQ9Pd4ckEPRWM=
-github.com/flashcatcloud/go-flashduty v0.15.14/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
+github.com/flashcatcloud/go-flashduty v0.15.15 h1:jMgWfpuXqdyHArSvUtf9ATwFFB7s49hgN7Rv+c9PxAY=
+github.com/flashcatcloud/go-flashduty v0.15.15/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk=
diff --git a/internal/cli/alert_event.go b/internal/cli/alert_event.go
index dc4325c..ea58a63 100644
--- a/internal/cli/alert_event.go
+++ b/internal/cli/alert_event.go
@@ -24,7 +24,7 @@ func newAlertEventListCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "list",
 		Short: "List alert events globally",
-		Long:  curatedLong("List alert events across all alerts within a time window, optionally filtered by severity, channel, or integration type. In json/toon mode, output defaults to compact event fields; use --fields to choose a different projection.", "Alerts", "EventReadList"),
+		Long:  curatedLong("List alert events across all alerts within a time window, optionally filtered by severity, channel, or integration type. --since/--until window must be < 31 days. In json/toon mode, output defaults to compact event fields; use --fields to choose a different projection.", "Alerts", "EventReadList"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				if ctx.Structured() && cmd.Flags().Changed("fields") && len(parseStringSlice(fields)) == 0 {
@@ -37,8 +37,8 @@ func newAlertEventListCmd() *cobra.Command {
 				}
 
 				input := &flashduty.AlertEventGlobalListRequest{
-					StartTime: flashduty.Int64(startTime),
-					EndTime:   flashduty.Int64(endTime),
+					StartTime: startTime,
+					EndTime:   endTime,
 				}
 				input.Limit = limit
 				input.Page = page
diff --git a/internal/cli/zz_generated_alert_rules.go b/internal/cli/zz_generated_alert_rules.go
index 9135d6f..4ce8a87 100644
--- a/internal/cli/zz_generated_alert_rules.go
+++ b/internal/cli/zz_generated_alert_rules.go
@@ -231,8 +231,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
       - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
     - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)
     - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
-      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)
       - query (object) (required) — Query payload.
         - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
         - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
@@ -477,8 +478,9 @@ Request fields:
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
       - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
     - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)
     - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
-      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)
       - query (object) (required) — Query payload.
         - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
         - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
@@ -562,8 +564,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
       - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
     - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)
     - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
-      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)
       - query (object) (required) — Query payload.
         - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
         - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
@@ -1112,8 +1115,9 @@ Request fields:
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
       - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
     - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)
     - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
-      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)
       - query (object) (required) — Query payload.
         - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
         - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
@@ -1197,8 +1201,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.
       - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through '{{ }}' templates; defaults to an empty object.
     - kind (string) (required) — Entry kind: 'dashboard' opens a dashboard panel, 'query' opens an Explore query. It decides whether 'dashboard' or 'query' must be supplied; supplying the other one is rejected. [dashboard, query]
+    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)
     - query (object) — Configuration for the 'query' kind; required when 'kind' is 'query', and rejected when 'kind' is 'dashboard'.
-      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)
+      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)
       - query (object) (required) — Query payload.
         - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain '{{ }}' templates.
         - expr (string) (required) — Query expression in the target data source's language. May reference event labels through '{{ }}' templates.
diff --git a/internal/cli/zz_generated_alerts.go b/internal/cli/zz_generated_alerts.go
index b4be0f0..9647bab 100644
--- a/internal/cli/zz_generated_alerts.go
+++ b/internal/cli/zz_generated_alerts.go
@@ -38,12 +38,12 @@ Request fields:
   --search-after-ctx string — Pagination cursor: leave empty for the first page, then pass the 'search_after_ctx' returned by the previous response.
   --asc bool — Sort ascending when 'true'.
   --channel-ids []int — Filter by channel IDs. At most 100 entries.
-  --end-time string — End of the search window, Unix epoch seconds. Must be greater than 'start_time' when provided. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+  --end-time string (required) — End of the search window, Unix epoch seconds. Must be greater than 'start_time'; the span must not exceed 31 days. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
   --integration-ids []int — Filter by integration IDs.
   --integration-types []string — Filter by integration types (plugin keys).
   --orderby string — Sort field; only 'event_time' is supported. [event_time]
   --severities string — Comma-separated severity filter, e.g. 'Critical,Warning'. Accepted values: 'Critical', 'Warning', 'Info', 'Ok'.
-  --start-time string — Start of the search window, Unix epoch seconds. Must be greater than 0 when provided. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
+  --start-time string (required) — Start of the search window, Unix epoch seconds. Must be greater than 0. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.
 
 Response fields ('data' envelope is unwrapped — rows are nested under items[]; pipe 'jq '.items[]'', NOT '.data.items[]'):
   - has_next_page (boolean) — Whether a next page exists (probed by fetching limit+1 rows).
@@ -141,13 +141,13 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
 	cmd.Flags().StringVar(&fSearchAfterCtx, "search-after-ctx", "", "Pagination cursor: leave empty for the first page, then pass the 'search_after_ctx' returned by the previous response.")
 	cmd.Flags().BoolVar(&fAsc, "asc", false, "Sort ascending when 'true'.")
 	cmd.Flags().IntSliceVar(&fChannelIDs, "channel-ids", nil, "Filter by channel IDs. At most 100 entries.")
-	cmd.Flags().StringVar(&fEndTime, "end-time", "", "End of the search window, Unix epoch seconds. Must be greater than 'start_time' when provided. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds. (alias: --until)")
+	cmd.Flags().StringVar(&fEndTime, "end-time", "", "End of the search window, Unix epoch seconds. Must be greater than 'start_time'; the span must not exceed 31 days. (required) Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds. (alias: --until)")
 	cmd.Flags().StringVar(&fUntil, "until", "", "Alias for --end-time. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
 	cmd.Flags().IntSliceVar(&fIntegrationIDs, "integration-ids", nil, "Filter by integration IDs.")
 	cmd.Flags().StringSliceVar(&fIntegrationTypes, "integration-types", nil, "Filter by integration types (plugin keys).")
 	cmd.Flags().StringVar(&fOrderby, "orderby", "", "Sort field; only 'event_time' is supported. [event_time]")
 	cmd.Flags().StringVar(&fSeverities, "severities", "", "Comma-separated severity filter, e.g. 'Critical,Warning'. Accepted values: 'Critical', 'Warning', 'Info', 'Ok'.")
-	cmd.Flags().StringVar(&fStartTime, "start-time", "", "Start of the search window, Unix epoch seconds. Must be greater than 0 when provided. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds. (alias: --since)")
+	cmd.Flags().StringVar(&fStartTime, "start-time", "", "Start of the search window, Unix epoch seconds. Must be greater than 0. (required) Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds. (alias: --since)")
 	cmd.Flags().StringVar(&fSince, "since", "", "Alias for --start-time. Accepts a duration (7d, 24h), '+7d' for the future, 'now', a date, or Unix seconds.")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
diff --git a/internal/cli/zz_generated_dashboards.go b/internal/cli/zz_generated_dashboards.go
index 8600675..7b6f801 100644
--- a/internal/cli/zz_generated_dashboards.go
+++ b/internal/cli/zz_generated_dashboards.go
@@ -95,7 +95,7 @@ Request fields:
     - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
     - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
     - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-    - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+    - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
     - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
     - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
       - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -107,7 +107,7 @@ Request fields:
     - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
       - args (object) — Named query arguments; defaults to an empty object.
       - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-      - field (string) — Log field whose values become candidates. (≥1 chars)
+      - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
       - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
       - label (string) — Label whose values become candidates.
       - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -316,7 +316,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 func genDashboardsQueryReadResolveCmd() *cobra.Command {
 	var dataJSON string
 	var fDashboardID string
+	var fMaxDataPoints int64
 	var fPanelIDs []string
+	var fPreserveBuiltinVariables bool
 	cmd := &cobra.Command{
 		Use:   "dashboard-runtime-queries-resolve <panel-id> [<id2>...]",
 		Short: "Resolve panel queries",
@@ -328,7 +330,9 @@ API: POST /monit/dashboard/runtime/queries/resolve (monit-dashboard-query-read-r
 
 Request fields:
   --dashboard-id string (required) — Canonical UUIDv7 of the dashboard.
+  --max-data-points int — Downsampling target used to compute the step and render the built-in time variables, 2–5000 points; omit or send null for the server default of 100. (2-5000)
   --panel-ids []string (required) — Panels to resolve, 1–100 unique IDs. A panel that does not exist yields an 'error' arm rather than failing the call.
+  --preserve-builtin-variables bool — Keep built-in time variables verbatim in the resolved expressions so a caller with its own execution window can render them; user variables are still resolved.
   time (object, via --data) (required) — Absolute evaluation window. Both bounds are Unix timestamps in milliseconds, 'from_ms' must be less than 'to_ms', and neither may exceed the JavaScript safe integer limit.
     - from_ms (integer) (required) — Unix timestamp in milliseconds. (min 0)
     - to_ms (integer) (required) — Unix timestamp in milliseconds. (min 1)
@@ -369,9 +373,15 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 					if cmd.Flags().Changed("dashboard-id") {
 						body["dashboard_id"] = fDashboardID
 					}
+					if cmd.Flags().Changed("max-data-points") {
+						body["max_data_points"] = fMaxDataPoints
+					}
 					if cmd.Flags().Changed("panel-ids") {
 						body["panel_ids"] = fPanelIDs
 					}
+					if cmd.Flags().Changed("preserve-builtin-variables") {
+						body["preserve_builtin_variables"] = fPreserveBuiltinVariables
+					}
 					return nil
 				})
 				if err != nil {
@@ -390,7 +400,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 		},
 	}
 	cmd.Flags().StringVar(&fDashboardID, "dashboard-id", "", "Canonical UUIDv7 of the dashboard. (required)")
+	cmd.Flags().Int64Var(&fMaxDataPoints, "max-data-points", 0, "Downsampling target used to compute the step and render the built-in time variables, 2–5000 points; omit or send null for the server default of 100. (2-5000)")
 	cmd.Flags().StringSliceVar(&fPanelIDs, "panel-ids", nil, "Panels to resolve, 1–100 unique IDs. A panel that does not exist yields an 'error' arm rather than failing the call. (required)")
+	cmd.Flags().BoolVar(&fPreserveBuiltinVariables, "preserve-builtin-variables", false, "Keep built-in time variables verbatim in the resolved expressions so a caller with its own execution window can render them; user variables are still resolved.")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
 }
@@ -454,7 +466,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
       - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
       - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
       - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
       - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -466,7 +478,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
         - args (object) — Named query arguments; defaults to an empty object.
         - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-        - field (string) — Log field whose values become candidates. (≥1 chars)
+        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
         - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
         - label (string) — Label whose values become candidates.
         - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -841,7 +853,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
       - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
       - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
       - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
       - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -853,7 +865,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
         - args (object) — Named query arguments; defaults to an empty object.
         - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-        - field (string) — Log field whose values become candidates. (≥1 chars)
+        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
         - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
         - label (string) — Label whose values become candidates.
         - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -1067,7 +1079,7 @@ Request fields:
     - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
     - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
     - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-    - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+    - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
     - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
     - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
       - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -1079,7 +1091,7 @@ Request fields:
     - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
       - args (object) — Named query arguments; defaults to an empty object.
       - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-      - field (string) — Log field whose values become candidates. (≥1 chars)
+      - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
       - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
       - label (string) — Label whose values become candidates.
       - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -1263,7 +1275,7 @@ Request fields:
       - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
       - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
       - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
       - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
       - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -1275,7 +1287,7 @@ Request fields:
       - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
         - args (object) — Named query arguments; defaults to an empty object.
         - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-        - field (string) — Log field whose values become candidates. (≥1 chars)
+        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
         - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
         - label (string) — Label whose values become candidates.
         - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -1327,7 +1339,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
       - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
       - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
       - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
       - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -1339,7 +1351,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
         - args (object) — Named query arguments; defaults to an empty object.
         - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-        - field (string) — Log field whose values become candidates. (≥1 chars)
+        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
         - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
         - label (string) — Label whose values become candidates.
         - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -1497,7 +1509,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
         - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
         - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
         - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-        - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+        - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
         - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
         - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - refresh (string) — When the candidates are recomputed: 'on_dashboard_load' = once when the dashboard loads; 'on_time_range_change' = every time the time range changes. [on_dashboard_load, on_time_range_change]
@@ -1612,7 +1624,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
       - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
       - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
       - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
       - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -1624,7 +1636,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
       - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
         - args (object) — Named query arguments; defaults to an empty object.
         - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-        - field (string) — Log field whose values become candidates. (≥1 chars)
+        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
         - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
         - label (string) — Label whose values become candidates.
         - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -1739,7 +1751,7 @@ Request fields:
       - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
       - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
       - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+      - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
       - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
       - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - text (string) (required) — Label shown in the picker. (1-1024 chars)
@@ -1751,7 +1763,7 @@ Request fields:
       - variable_query (object) — Variable query. Pick the arm with 'kind'; the arm must match the referenced datasource type.
         - args (object) — Named query arguments; defaults to an empty object.
         - expr (string) — SQL statement; may reference other variables through '{{ }}'.
-        - field (string) — Log field whose values become candidates. (≥1 chars)
+        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)
         - kind (string) (required) — Query kind discriminator; always 'prometheus', a label-values query against Prometheus. [prometheus, sql, logs]
         - label (string) — Label whose values become candidates.
         - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.
@@ -1787,7 +1799,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
         - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.
         - kind (string) (required) — Variable kind discriminator; always 'datasource', selecting a datasource. [datasource, custom, query]
         - label (string) — Optional display label; falls back to 'name'. (≤189 chars)
-        - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters.
+        - name (string) (required) — Variable name used in '{{ }}' templates, at most 64 characters. Names starting with '__' are reserved for built-in time variables.
         - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.
         - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be '$__all'.
         - refresh (string) — When the candidates are recomputed: 'on_dashboard_load' = once when the dashboard loads; 'on_time_range_change' = every time the time range changes. [on_dashboard_load, on_time_range_change]
diff --git a/internal/cli/zz_generated_incidents.go b/internal/cli/zz_generated_incidents.go
index 5dee996..9cfe932 100644
--- a/internal/cli/zz_generated_incidents.go
+++ b/internal/cli/zz_generated_incidents.go
@@ -1170,11 +1170,17 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
     - account_id (integer) (required) — Account ID.
     - created_at (string) (required) — Creation timestamp in milliseconds. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - creator_id (integer) (required) — User ID of the actor. '0' means system-generated.
-    - deleted_at (string) — Soft-delete timestamp (ms). Zero if not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - deleted_at (string) — Soft-delete timestamp in milliseconds. Zero if not deleted. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - detail (object) (required) — Type-specific payload. The concrete shape is determined by 'type'; 'null' when the entry has no structured detail.
       - added_assignee_ids (array<integer>) — Member IDs added as assignees.
+      - added_assignees (array<object>) — Assignees added by this change, in submitted order. 'added_assignee_ids' is the person-only subset. Omitted when nothing was added.
+        - id (integer) — Member ID. Required when 'type' is 'person'. Omitted when 'type' is 'ai_sre'.
+        - type (string) (required) — Assignee kind: 'person' (a member) or 'ai_sre' (the account AI SRE). [person, ai_sre]
       - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.
       - assignee_ids (array<integer>) — Assignee member IDs.
+      - assignees (array<object>) — Assignees of the work item. Each entry is '{type, id?}'; an 'ai_sre' entry omits 'id'. Omitted when there is no assignee.
+        - id (integer) — Member ID. Required when 'type' is 'person'. Omitted when 'type' is 'ai_sre'.
+        - type (string) (required) — Assignee kind: 'person' (a member) or 'ai_sre' (the account AI SRE). [person, ai_sre]
       - by (string) — Delivery channel or method label.
       - chat_id (string) — Chat group identifier.
       - chat_name (string) — Chat group display name.
@@ -1231,6 +1237,9 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
       - reason (string) — Reason why the incident was reopened.
       - remove_source_incidents (boolean) — True if the source incidents were removed after merging.
       - removed_assignee_ids (array<integer>) — Member IDs removed from assignees.
+      - removed_assignees (array<object>) — Assignees removed by this change. 'removed_assignee_ids' is the person-only subset. Omitted when nothing was removed.
+        - id (integer) — Member ID. Required when 'type' is 'person'. Omitted when 'type' is 'ai_sre'.
+        - type (string) (required) — Assignee kind: 'person' (a member) or 'ai_sre' (the account AI SRE). [person, ai_sre]
       - reporter_email (string) — Email of the reporter when the incident was created externally.
       - rid (string) — Notification record ID.
       - robots (array<object>) — Per-robot delivery records.
diff --git a/internal/cli/zz_generated_integrations.go b/internal/cli/zz_generated_integrations.go
index ac8b856..f675504 100644
--- a/internal/cli/zz_generated_integrations.go
+++ b/internal/cli/zz_generated_integrations.go
@@ -67,7 +67,7 @@ func genIntegrationsIntegrationAPIReadInfoCmd() *cobra.Command {
 		Short: "Get integration detail",
 		Long: `Get integration detail.
 
-Return one integration, including its settings with sensitive values masked.
+Get a public integration with its stored settings and decrypted integration key.
 
 API: POST /integration/info (integration-api-read-info)
 
@@ -75,19 +75,28 @@ Request fields:
   --integration-id int (required) — Integration ID. (min 1)
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
-  - category (any) (required)
-  - created_at (any) (required)
-  - description (any) (required)
-  - integration_id (any) (required)
-  - last_time (any) (required)
-  - name (any) (required)
-  - plugin_type (any) (required)
-  - plugin_type_name (any) (required)
-  - ref_id (any) (required)
-  - settings (object) (required) — Type-specific configuration. Sensitive values (endpoint, headers, secrets, passwords) are returned masked as '******'.
-  - status (any) (required)
-  - team_id (any) (required)
-  - updated_at (any) (required)
+  - category (string) (required) — Category the integration belongs to: 'event.alert' alert events, 'event.change' change events, 'im' IM bots, 'webhook' custom webhooks. [event.alert, event.change, im, webhook]
+  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - creator_id (integer) (required) — ID of the member who created the integration.
+  - description (string) (required) — Free-form description.
+  - editable (boolean) (required) — Whether the current caller passes the integration object-permission check; write calls also require Integrations Manage.
+  - integration_id (integer) (required) — Integration ID.
+  - integration_key (string) (required) — Decrypted integration key for inbound pushes. Empty when no key is stored; distinct from the account 'app_key'.
+  - last_time (string) (required) — Unix timestamp in seconds of the most recent event received. '0' when no event has arrived yet. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - name (string) (required) — Integration name.
+  - no_editable (boolean) (required) — Read-only flag. When true, the public APIs do not allow changes to this integration.
+  - plugin_id (integer) (required) — Internal integration type ID; use 'plugin_type', not this ID, when creating an integration.
+  - plugin_type (string) (required) — Integration type, for example 'standard.alert' or 'zabbix.alert'.
+  - plugin_type_name (string) (required) — Display name of the integration type, in the language of the request.
+  - ref_id (string) (required) — Source reference ID, normally 'a_<account_id>' for an account-level integration; legacy 'w_' references may also exist. Channel-owned 'c_' integrations are excluded.
+  - settings (object) (required) — Stored type-specific configuration, including credential values without masking; matches the legacy '/datasource/*' response behavior.
+  - status (string) (required) — Lifecycle status: 'enabled' while the integration accepts events, 'disabled' when it is paused. [enabled, disabled]
+  - team_id (integer) (required) — ID of the team that owns the integration. '0' when it is not assigned to a team.
+  - test (object) — Plugin test result, returned only when a test is performed.
+    - message (string) (required) — Test failure message; empty on success.
+    - success (boolean) (required) — Whether the plugin test succeeded.
+  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - updated_by (integer) (required) — ID of the member who last updated the integration.
 `,
 		Args:    requireBodyFieldOrExactArg("integration_id", "integration-id"),
 		Example: `  flashduty integration info --data '{"integration_id":6113996590131}'`,
@@ -142,7 +151,7 @@ func genIntegrationsIntegrationAPIReadListCmd() *cobra.Command {
 		Short: "List integrations",
 		Long: `List integrations.
 
-List the account's alert-source and change-source integrations.
+List public integrations with their stored settings, decrypted keys, and edit permissions.
 
 API: POST /integration/list (integration-api-read-list)
 
@@ -163,18 +172,28 @@ Request fields:
 
 Response fields ('data' envelope is unwrapped — rows are nested under items[]; pipe 'jq '.items[]'', NOT '.data.items[]'):
   - items (array<object>) (required) — Integrations on the current page.
+    - account_id (integer) (required) — ID of the account that owns the integration.
     - category (string) (required) — Category the integration belongs to: 'event.alert' alert events, 'event.change' change events, 'im' IM bots, 'webhook' custom webhooks. [event.alert, event.change, im, webhook]
     - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - creator_id (integer) (required) — ID of the member who created the integration.
+    - data_source_id (integer) (required) — Legacy datasource ID, equal to 'integration_id'.
     - description (string) (required) — Free-form description.
+    - editable (boolean) (required) — Whether the current caller passes the integration object-permission check; write calls also require Integrations Manage.
+    - exclusive_data_source_id (integer) (required) — Legacy compatibility field; '0' for items returned by this public-integration list.
     - integration_id (integer) (required) — Integration ID.
+    - integration_key (string) (required) — Decrypted integration key for inbound pushes. Empty when no key is stored; distinct from the account 'app_key'.
     - last_time (string) (required) — Unix timestamp in seconds of the most recent event received. '0' when no event has arrived yet. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
     - name (string) (required) — Integration name.
+    - no_editable (boolean) (required) — Read-only flag. When true, the public APIs do not allow changes to this integration.
+    - plugin_id (integer) (required) — Internal integration type ID; use 'plugin_type', not this ID, when creating an integration.
     - plugin_type (string) (required) — Integration type, for example 'standard.alert' or 'zabbix.alert'.
     - plugin_type_name (string) (required) — Display name of the integration type, in the language of the request.
-    - ref_id (string) (required) — Source reference ID: 'a_'-prefixed for an account-scoped integration, 'c_'-prefixed when it is shared into a channel, 'w_'-prefixed on legacy workspace-scoped integrations.
+    - ref_id (string) (required) — Source reference ID, normally 'a_<account_id>' for an account-level integration; legacy 'w_' references may also exist. Channel-owned 'c_' integrations are excluded.
+    - settings (object) (required) — Stored type-specific configuration, including credential values without masking; matches the legacy '/datasource/*' response behavior.
     - status (string) (required) — Lifecycle status: 'enabled' while the integration accepts events, 'disabled' when it is paused. [enabled, disabled]
     - team_id (integer) (required) — ID of the team that owns the integration. '0' when it is not assigned to a team.
     - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+    - updated_by (integer) (required) — ID of the member who last updated the integration.
   - limit (integer) (required) — Page size echoed back.
   - p (integer) (required) — Page number echoed back.
   - total (integer) (required) — Total number of matching integrations.
@@ -345,6 +364,8 @@ Response fields ('data' envelope is unwrapped — rows are nested under items[];
 func genIntegrationsIntegrationAPIWriteCreateCmd() *cobra.Command {
 	var dataJSON string
 	var fDescription string
+	var fIntegrationKey string
+	var fIsTest bool
 	var fName string
 	var fPluginType string
 	var fTeamID int64
@@ -353,28 +374,39 @@ func genIntegrationsIntegrationAPIWriteCreateCmd() *cobra.Command {
 		Short: "Create integration",
 		Long: `Create integration.
 
-Create an integration for an alert source or change source.
+Create a public integration for a supported alert, change, IM, or webhook type.
 
 API: POST /integration/create (integration-api-write-create)
 
 Request fields:
   --description string — Free-form description, at most 499 characters. (≤499 chars)
-  --name string — Integration name. 2–49 characters. (2-49 chars)
+  --integration-key string — Optional pre-generated key: 35 characters, ending with the account ID modulo 1000 padded to three digits; it must not already be in use. Omit to generate a key. (35-35 chars)
+  --is-test bool — Run the plugin test during creation; false when omitted. Inspect the returned 'test.success' for the test outcome.
+  --name string — Integration name, 2–49 characters when nonempty; defaults to the integration type name when omitted or empty. (2-49 chars)
   --plugin-type string (required) — Integration type. Must be one listed by 'POST /integration/type/list' with 'supports_api_create: true'.
-  --team-id int — Owning team ID. (min 1)
+  --team-id int — Owning team ID; omit or use '0' for no team. A nonzero ID must belong to the current account. (min 0)
   settings (object, via --data) — Type-specific configuration; the accepted keys depend on 'plugin_type'.
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
   - integration_id (integer) (required) — ID of the new integration.
-  - integration_key (string) (required) — Key used to authenticate inbound pushes to this integration. Returned here only; fetch a new one with 'POST /integration/key/rotate'.
+  - integration_key (string) (required) — Integration key for inbound pushes; also readable from '/integration/list' and '/integration/info'.
+  - test (object) — Plugin test result, returned only when a test is performed.
+    - message (string) (required) — Test failure message; empty on success.
+    - success (boolean) (required) — Whether the plugin test succeeded.
 `,
-		Example: `  flashduty integration create --data '{"description":"Alerts pushed by the production Prometheus stack","name":"Prod metrics alerts","plugin_type":"standard.alert","settings":{"severity_mapping":[{"P1":"Critical"}]},"team_id":1467226103121}'`,
+		Example: `  flashduty integration create --data '{"description":"Alerts pushed by the production Prometheus stack","is_test":true,"name":"Prod metrics alerts","plugin_type":"standard.alert","settings":{"field_mapping":{},"value_mapping":{}},"team_id":1467226103121}'`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
 					if cmd.Flags().Changed("description") {
 						body["description"] = fDescription
 					}
+					if cmd.Flags().Changed("integration-key") {
+						body["integration_key"] = fIntegrationKey
+					}
+					if cmd.Flags().Changed("is-test") {
+						body["is_test"] = fIsTest
+					}
 					if cmd.Flags().Changed("name") {
 						body["name"] = fName
 					}
@@ -402,9 +434,11 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 		},
 	}
 	cmd.Flags().StringVar(&fDescription, "description", "", "Free-form description, at most 499 characters. (≤499 chars)")
-	cmd.Flags().StringVar(&fName, "name", "", "Integration name. 2–49 characters. (2-49 chars)")
+	cmd.Flags().StringVar(&fIntegrationKey, "integration-key", "", "Optional pre-generated key: 35 characters, ending with the account ID modulo 1000 padded to three digits; it must not already be in use. Omit to generate a key. (35-35 chars)")
+	cmd.Flags().BoolVar(&fIsTest, "is-test", false, "Run the plugin test during creation; false when omitted. Inspect the returned 'test.success' for the test outcome.")
+	cmd.Flags().StringVar(&fName, "name", "", "Integration name, 2–49 characters when nonempty; defaults to the integration type name when omitted or empty. (2-49 chars)")
 	cmd.Flags().StringVar(&fPluginType, "plugin-type", "", "Integration type. Must be one listed by 'POST /integration/type/list' with 'supports_api_create: true'. (required)")
-	cmd.Flags().Int64Var(&fTeamID, "team-id", 0, "Owning team ID. (min 1)")
+	cmd.Flags().Int64Var(&fTeamID, "team-id", 0, "Owning team ID; omit or use '0' for no team. A nonzero ID must belong to the current account. (min 0)")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
 	return cmd
 }
@@ -581,7 +615,7 @@ Request fields:
   --integration-id int (required) — Integration ID. (min 1)
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
-  - integration_key (string) (required) — The new key. The previous key stops working immediately; this value cannot be read again later.
+  - integration_key (string) (required) — New integration key; the previous key stops working immediately. Also readable from '/integration/list' and '/integration/info'.
 `,
 		Args:    requireBodyFieldOrExactArg("integration_id", "integration-id"),
 		Example: `  flashduty integration key-rotate --data '{"integration_id":6113996590131}'`,
@@ -620,6 +654,7 @@ func genIntegrationsIntegrationAPIWriteUpdateCmd() *cobra.Command {
 	var dataJSON string
 	var fDescription string
 	var fIntegrationID int64
+	var fIsTest bool
 	var fName string
 	var fTeamID int64
 	cmd := &cobra.Command{
@@ -634,27 +669,37 @@ API: POST /integration/update (integration-api-write-update)
 Request fields:
   --description string — New description, at most 499 characters. (≤499 chars)
   --integration-id int (required) — Integration ID. (min 1)
+  --is-test bool — Run the plugin test when submitting 'settings'; no test is performed for a metadata-only update.
   --name string — New name, 2–49 characters. (2-49 chars)
   --team-id int — New owning team ID; '0' clears the team assignment. (min 0)
-  settings (object, via --data) — Replacement configuration for the integration type. Sensitive entries left out, or sent back as the masked '******', keep their stored value.
+  settings (object, via --data) — Replacement type-specific configuration. Known sensitive fields omitted or sent as '******' keep their stored value; an explicit empty headers object clears headers.
 
 Response fields ('data' envelope is unwrapped — these fields are at the top level):
-  - category (any) (required)
-  - created_at (any) (required)
-  - description (any) (required)
-  - integration_id (any) (required)
-  - last_time (any) (required)
-  - name (any) (required)
-  - plugin_type (any) (required)
-  - plugin_type_name (any) (required)
-  - ref_id (any) (required)
-  - settings (object) (required) — Type-specific configuration. Sensitive values (endpoint, headers, secrets, passwords) are returned masked as '******'.
-  - status (any) (required)
-  - team_id (any) (required)
-  - updated_at (any) (required)
+  - category (string) (required) — Category the integration belongs to: 'event.alert' alert events, 'event.change' change events, 'im' IM bots, 'webhook' custom webhooks. [event.alert, event.change, im, webhook]
+  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - creator_id (integer) (required) — ID of the member who created the integration.
+  - description (string) (required) — Free-form description.
+  - editable (boolean) (required) — Whether the current caller passes the integration object-permission check; write calls also require Integrations Manage.
+  - integration_id (integer) (required) — Integration ID.
+  - integration_key (string) (required) — Decrypted integration key for inbound pushes. Empty when no key is stored; distinct from the account 'app_key'.
+  - last_time (string) (required) — Unix timestamp in seconds of the most recent event received. '0' when no event has arrived yet. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - name (string) (required) — Integration name.
+  - no_editable (boolean) (required) — Read-only flag. When true, the public APIs do not allow changes to this integration.
+  - plugin_id (integer) (required) — Internal integration type ID; use 'plugin_type', not this ID, when creating an integration.
+  - plugin_type (string) (required) — Integration type, for example 'standard.alert' or 'zabbix.alert'.
+  - plugin_type_name (string) (required) — Display name of the integration type, in the language of the request.
+  - ref_id (string) (required) — Source reference ID, normally 'a_<account_id>' for an account-level integration; legacy 'w_' references may also exist. Channel-owned 'c_' integrations are excluded.
+  - settings (object) (required) — Stored type-specific configuration, including credential values without masking; matches the legacy '/datasource/*' response behavior.
+  - status (string) (required) — Lifecycle status: 'enabled' while the integration accepts events, 'disabled' when it is paused. [enabled, disabled]
+  - team_id (integer) (required) — ID of the team that owns the integration. '0' when it is not assigned to a team.
+  - test (object) — Plugin test result, returned only when a test is performed.
+    - message (string) (required) — Test failure message; empty on success.
+    - success (boolean) (required) — Whether the plugin test succeeded.
+  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI '--json' renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.
+  - updated_by (integer) (required) — ID of the member who last updated the integration.
 `,
 		Args:    requireBodyFieldOrExactArg("integration_id", "integration-id"),
-		Example: `  flashduty integration update --data '{"integration_id":6113996590131,"name":"Prod metrics alerts (primary)","team_id":1467226103121}'`,
+		Example: `  flashduty integration update --data '{"integration_id":6113996590131,"is_test":true,"name":"Prod metrics alerts (primary)","settings":{"field_mapping":{},"value_mapping":{}},"team_id":1467226103121}'`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runCommand(cmd, args, func(ctx *RunContext) error {
 				body, err := genAssembleBody(dataJSON, func(body map[string]any) error {
@@ -667,6 +712,9 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 					if cmd.Flags().Changed("integration-id") {
 						body["integration_id"] = fIntegrationID
 					}
+					if cmd.Flags().Changed("is-test") {
+						body["is_test"] = fIsTest
+					}
 					if cmd.Flags().Changed("name") {
 						body["name"] = fName
 					}
@@ -692,6 +740,7 @@ Response fields ('data' envelope is unwrapped — these fields are at the top le
 	}
 	cmd.Flags().StringVar(&fDescription, "description", "", "New description, at most 499 characters. (≤499 chars)")
 	cmd.Flags().Int64Var(&fIntegrationID, "integration-id", 0, "Integration ID. (required) (min 1)")
+	cmd.Flags().BoolVar(&fIsTest, "is-test", false, "Run the plugin test when submitting 'settings'; no test is performed for a metadata-only update.")
 	cmd.Flags().StringVar(&fName, "name", "", "New name, 2–49 characters. (2-49 chars)")
 	cmd.Flags().Int64Var(&fTeamID, "team-id", 0, "New owning team ID; '0' clears the team assignment. (min 0)")
 	cmd.Flags().StringVar(&dataJSON, "data", "", "Full request body as JSON; positional arguments and typed flags override its fields. Accepts inline JSON, or - to read stdin.")
diff --git a/internal/cli/zz_generated_response_help.go b/internal/cli/zz_generated_response_help.go
index db2e961..3da5463 100644
--- a/internal/cli/zz_generated_response_help.go
+++ b/internal/cli/zz_generated_response_help.go
@@ -26,12 +26,12 @@ var responseHelpBySDKMethod = map[string]string{
 	"AlertRules.ReadAuditDetail":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
 	"AlertRules.ReadAudits":                       "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account that owns the rule.\n  - action (string) (required) — Action performed: `create` = rule created; `update` = rule updated (covers full updates, field-batch updates, imports and moves). [create, update]\n  - alert_rule_id (integer) (required) — ID of the alert rule this record belongs to.\n  - content (string) — JSON string of the full rule snapshot at audit time. Populated on `/monit/rule/audit/detail`, omitted on list responses.\n  - created_at (string) (required) — When this audit record was produced, as a Unix timestamp in seconds; equals the rule's `updated_at` at change time. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who made this change (taken from the rule's `updater_id` at change time).\n  - creator_name (string) (required) — Name of the user who made this change (taken from the rule's `updater_name` at change time).\n  - id (integer) (required) — Audit record ID.\n",
 	"AlertRules.ReadCounterTotal":                 "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account this snapshot belongs to.\n  - clock (string) (required) — Sample timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - id (integer) (required) — ID of this snapshot record.\n  - num (integer) (required) — Rule count at the sample time.\n",
-	"AlertRules.ReadInfoV2":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.ReadInfoV2":                       "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
 	"AlertRules.ReadList":                         "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - active_alert_count (integer) (required) — Number of currently active (unrecovered) alerts fired by this rule. `triggered` equals `active_alert_count > 0`.\n  - created_at (string) (required) — Creation time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who created the rule.\n  - creator_name (string) (required) — Name of the user who created the rule.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron with seconds, e.g. `0 * * * * *`, or an `@every 30s` interval descriptor. Must not start with `CRON_TZ=` or `TZ=`; use the `timezone` field instead.\n  - debug_log_enabled (boolean) (required) — Whether debug logging is enabled.\n  - delay_seconds (integer) (required) — Evaluation delay in seconds.\n  - ds_type (string) (required) — Data source type, e.g. `prometheus`.\n  - enabled (boolean) (required) — Whether the rule is enabled.\n  - folder_id (integer) (required) — Folder ID.\n  - id (integer) (required) — Unique rule ID.\n  - labels (object) (required) — Custom labels.\n  - name (string) (required) — Rule name.\n  - runtime_state (string) — Runtime evaluation state, derived from edge heartbeats and the edge-reported rule status. Omitted when the state is unavailable. | Value | Meaning | |---|---| | `disabled` | The rule is disabled. | | `offline` | The edge instance or cluster owning this rule is offline. | | `abnormal` | The edge reports evaluation errors. | | `stale` | The edge's runtime status report is outdated. | | `no_datasource` | No datasource currently matches the rule's `ds_list` / `ds_ids`. | | `config_pending` | The latest rule config has not been delivered to the edge yet. | | `waiting` | Enabled, but the edge has not reported runtime status yet. | | `normal` | Evaluating normally. | [disabled, offline, abnormal, stale, no_datasource, config_pending, waiting, normal]\n  - timezone (string) (required) — Timezone in which the rule executes. Determines how the cron schedule and effective time windows are interpreted. Only IANA timezone names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); shortcuts and offsets such as `Local`, `UTC+8`, or `CST` are rejected. Treated as `Asia/Shanghai` if empty.\n  - triggered (boolean) (required) — True if the rule currently has active alerts.\n  - updated_at (string) (required) — Last modification time, as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updater_id (integer) (required) — ID of the user who last modified the rule.\n  - updater_name (string) (required) — Name of the user who last modified the rule.\n",
-	"AlertRules.WriteCreateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.WriteCreateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
 	"AlertRules.WriteFieldsUpdate":                "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
 	"AlertRules.WriteMove":                        "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - message (string) (required) — Empty on success, error message on failure.\n  - name (string) (required) — Rule name.\n",
-	"AlertRules.WriteUpdateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) (required) — Data source the query runs against. (1-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
+	"AlertRules.WriteUpdateV2":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) — Account ID, filled by the server from the authentication context; any client-supplied value is ignored.\n  - annotations (object) — Extra annotation key-value pairs delivered with alert events; keys must not start with `$` (reserved for query fields).\n  - channel_ids (array<integer>) — Collaboration space IDs alerts are sent to. May be empty; alerts then route through the global integration.\n  - created_at (integer) — Creation time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - creator_id (integer) — Creator member ID, filled by the server from the current user; any client-supplied value is ignored.\n  - creator_name (string) — Creator name, filled by the server; any client-supplied value is ignored.\n  - cron_pattern (string) (required) — Schedule expression: a 6-field cron (with seconds) or an `@every 30s` interval. Must not start with `CRON_TZ=` or `TZ=`; set the timezone in the `timezone` field instead.\n  - debug_log_enabled (boolean) — Enable debug logging; the edge then emits detailed evaluation logs for this rule, useful when the rule does not trigger as expected.\n  - delay_seconds (integer) — Seconds the evaluation query window is shifted back, compensating for data ingestion latency.\n  - description (string) — Rule description, Markdown format.\n  - description_type (string) — Format of the description content. Empty or omitted defaults to `text`. `text` = plain text; `markdown` = Markdown, rendered as such in alert details. [text, markdown]\n  - ds_ids (array<integer>) — Datasource ID list, merged with `ds_list` to decide the monitored datasources; IDs survive datasource renames. At least one of `ds_list` / `ds_ids` must be provided.\n  - ds_list (array<string>) — Datasource name match patterns (wildcards supported). At least one of `ds_list` / `ds_ids` must be non-empty; both are merged to decide which datasources the rule monitors.\n  - ds_type (string) (required) — Datasource type identifier (e.g. `prometheus`, `elasticsearch`).\n  - enabled (boolean) (required) — Whether the rule is enabled. Required — the server enforces an explicit value (including `false`) while decoding. Setting it to `false` on update clears the rule's active alerts.\n  - enabled_times (array<object>) — Time windows during which the rule is in effect. When omitted or empty, the rule is active 00:00–23:59 every day.\n    - days (array<integer>) — Days of week (0=Sunday).\n    - etime (string) — End time, e.g. `18:00`.\n    - stime (string) — Start time, e.g. `09:00`.\n  - folder_id (integer) (required) — ID of the folder the rule belongs to; list folders via `POST /monit/folder/list`. Cannot be changed through the update API — use `/monit/rule/move` instead.\n  - id (integer) — Rule ID. Required on update; omit on create (assigned by the server).\n  - investigation_targets (array<object>) — Drill-down entries linked from the alert event detail page; at most 20 items, duplicates rejected. On update the field is presence-based: omit it to keep the current value, pass `[]` to clear.\n    - dashboard (object) — Configuration for the `dashboard` kind; required when `kind` is `dashboard`.\n      - dashboard_id (string) (required) — Target dashboard ID; must be a canonical UUIDv7.\n      - target_id (string) — Panel ID inside the dashboard; must be a canonical UUIDv7. Optional.\n      - variables (object) (required) — Dashboard variable values, keyed by variable name. Values may reference event labels through `{{ }}` templates; defaults to an empty object.\n    - kind (string) (required) — Entry kind: `dashboard` opens a dashboard panel, `query` opens an Explore query. It decides whether `dashboard` or `query` must be supplied; supplying the other one is rejected. [dashboard, query]\n    - purpose (string) — One-sentence plain text explaining what this entry helps confirm during investigation. Literal text, not a template, and not part of the alert identity. At most 512 bytes; control characters are rejected. (≤512 chars)\n    - query (object) — Configuration for the `query` kind; required when `kind` is `query`, and rejected when `kind` is `dashboard`.\n      - datasource_id (integer) — Data source the query runs against. Omit (or set 0) to run on the alert event's own datasource. (0-9007199254740991)\n      - query (object) (required) — Query payload.\n        - args (object) (required) — Named query arguments; defaults to an empty object. Values are passed through verbatim and must not contain `{{ }}` templates.\n        - expr (string) (required) — Query expression in the target data source's language. May reference event labels through `{{ }}` templates.\n        - min_step_seconds (integer) — Minimum step, in seconds. Only accepted when `mode` is `range`, and must be greater than zero; omit or pass null to let the server decide. (1-9007199254740)\n        - mode (string) (required) — Evaluation mode: `instant` evaluates at a single timestamp, `range` evaluates a stepped series, `window` returns raw rows inside a time window. [instant, range, window]\n    - time_range (object) (required) — Window around the event time, required on every saved entry. A zero-length window is rejected; defaults belong to the editor.\n      - after_seconds (integer) (required) — Seconds to look forward from the event time, so behaviour after the event stays visible. (0-9007199254740)\n      - before_seconds (integer) (required) — Seconds to look back from the event time. (0-9007199254740)\n  - labels (object) — Custom labels.\n  - name (string) (required) — Rule name. Must be unique within the folder and at most 128 characters.\n  - repeat_interval (integer) — Notification repeat interval in seconds. Values below 1 fall back to the default 3600.\n  - repeat_total (integer) — Maximum number of repeat notifications. Values below 1 fall back to the default 3.\n  - rule_configs (object) (required) — Detection configuration: query list plus trigger/recovery conditions. See `AlertRuleConfigsV2`.\n    - check_anydata (object) — Any-data check configuration: fires when a query returns any data row. See `AlertRuleAnyDataV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - enabled (boolean) — Whether the any-data check is enabled: any returned data row triggers an alert.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `data_absent` = recover when the query returns no data; `recovery` is not allowed. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true; only a single query (`name=A`) is allowed. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [data_absent, recovery_query_match, manual]\n      - severity (string) — Severity of any-data alerts, case-sensitive; required when enabled. [Critical, Warning, Info]\n    - check_nodata (object) — No-data check configuration. See `AlertRuleNoDataV2`.\n      - alert_on_empty_result (boolean) — Whether to alert when all queries return empty results (global empty-result check).\n      - alert_on_empty_result_severity (string) — Severity of empty-result alerts, case-sensitive; only takes effect and is required when `alert_on_empty_result` is on. [Critical, Warning, Info]\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode. Must satisfy `alerting_check_times` <= M <= 10000.\n      - auto_close_after_seconds (integer) — Seconds to wait before auto-closing. Allowed and required to be positive only when `end_mode` is `data_reappears_or_timeout`; must be 0 for the other modes.\n      - enabled (boolean) — Whether the per-series no-data check is enabled: series that previously reported data trigger an alert when data disappears.\n      - end_mode (string) — How a no-data alert ends (lifecycle v2); required when enabled. `data_reappears` = recover when data reappears. `data_reappears_or_timeout` = end when data reappears or after `auto_close_after_seconds` seconds, whichever comes first; requires the per-series no-data check and a positive `auto_close_after_seconds`. `manual` = never end automatically; alerts need manual handling and no recovery event is pushed. For `data_reappears` and `manual`, `auto_close_after_seconds` must be 0. [data_reappears, data_reappears_or_timeout, manual]\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - severity (string) — Severity of no-data alerts, case-sensitive; required when the per-series check is enabled. [Critical, Warning, Info]\n    - check_threshold (object) — Threshold check configuration. See `AlertRuleThresholdV2`.\n      - alerting_check_times (integer) — Fire after the alert condition is met this many times; when enabled, minimum 1 and maximum 10000. Combined with `alerting_window_size` it means at least N hits within the last M evaluations.\n      - alerting_window_size (integer) — Optional sliding window size M: fire only when the condition is met at least `alerting_check_times` times within the last M evaluations. Omit for consecutive mode (N consecutive hits). Must satisfy `alerting_check_times` <= M <= 10000.\n      - critical (string) — Critical threshold expression referencing query results as `$<query>` or `$<query>.<value_field>`, e.g. `$A > 90`; when enabled at least one of the three severities must be set.\n      - enabled (boolean) — Whether the threshold check is enabled.\n      - info (string) — Info threshold expression; same syntax as `critical`.\n      - recovery (object) — Recovery evaluation config. Required (with non-empty `recovery.expr`) only when `recovery_mode` is `expression_match` or `recovery_query_match`; must be omitted for the other modes.\n        - args (object) — Datasource-specific parameters for the recovery query; keys follow the same `<datasource>.<param>` convention as a query's `args`. Not returned when empty.\n        - expr (string) — Recovery condition expression: a threshold expression (e.g. `$A < 90`) in `expression_match` mode, a query expression in `recovery_query_match` mode. Required and non-empty when the corresponding mode is enabled.\n        - value_fields (array<string>) — Numeric result fields the recovery expression references as `$A.<field>`; same semantics as a query's `value_fields`. Not returned when empty.\n      - recovery_check_times (integer) — Recover after the recovery condition is met this many times; minimum 1 when enabled.\n      - recovery_mode (string) — How recovery is decided (lifecycle v2); required when enabled. `condition_clear` = recover once the alert expression no longer holds; `recovery` is not allowed. `expression_match` = recover when the `recovery.expr` threshold expression holds. `recovery_query_match` = recover when the `recovery.expr` query expression evaluates true. `manual` = never recover automatically; alerts need manual handling, no recovery event is pushed, and `recovery` is not allowed. [condition_clear, expression_match, recovery_query_match, manual]\n      - warning (string) — Warning threshold expression; same syntax as `critical`.\n    - queries (array<object>) (required) — Query list with at least one entry; each needs a unique `name` (`R` and `__all__` are reserved) and a non-empty, non-duplicated `expr`.\n      - args (object) — Datasource-specific query parameters; keys follow the `<datasource>.<param>` convention (e.g. `es.type`, `tencent_cls.limit`). Most datasources need none.\n      - expr (string) — Query expression.\n      - label_fields (array<string>) — Result fields used as alert event labels; rows with the same label set form one alert. Must not overlap `value_fields`; applies to tabular results (SQL/ES-like datasources).\n      - name (string) — Query identifier (e.g. `A`), must match `[A-Za-z][A-Za-z0-9_]*`; `R` and `__all__` are reserved and cannot be used.\n      - value_fields (array<string>) — Numeric result fields evaluated by threshold expressions (referenced as `$A.<field>`); required for threshold checks when the datasource is not `prometheus`/`loki`/`victorialogs`. Field names must not contain `.`.\n    - relate_queries (array<object>) — Optional auxiliary queries whose results attach to alert events as context. Each entry needs a unique `name` (not colliding with any query name) and a non-empty `expr`.\n      - args (object) — Datasource-specific parameters for the auxiliary query; same convention as `queries[].args`.\n      - expr (string) — Query expression.\n      - name (string) — Auxiliary query identifier.\n  - timezone (string) — Timezone the rule runs in; it decides how the cron schedule and enabled time windows are interpreted. Only IANA names are accepted (e.g. `Asia/Shanghai`, `UTC`, `Europe/London`); abbreviations or offsets like `Local`, `UTC+8`, `CST` are rejected. Empty falls back to `Asia/Shanghai`.\n  - updated_at (integer) — Last update time as a Unix timestamp in seconds, generated by the server; any client-supplied value is ignored.\n  - updater_id (integer) — ID of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n  - updater_name (string) — Name of the member who last updated the rule, filled by the server; any client-supplied value is ignored.\n",
 	"Alerts.EventReadList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Alerts.ReadEventList":                        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) — Account ID.\n  - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n  - alert_key (string) — Deduplication key used to merge events into an alert.\n  - channel_id (integer) — Channel ID the event is routed to.\n  - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) — Event description.\n  - event_id (string) — Event ID (MongoDB ObjectID).\n  - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n  - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n  - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - images (array<object>) — Images attached to the event.\n    - alt (string) — Alt text.\n    - href (string) — Optional link URL when the image is clicked.\n    - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n  - integration_id (integer) — Integration that produced this event.\n  - integration_type (string) — Type/plugin key of the integration that produced this event.\n  - labels (object) — Label key-value pairs.\n  - title (string) — Event title.\n  - title_rule (string) — Title template used to derive `title` from labels.\n  - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Alerts.ReadFeed":                             "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - agent_session_id (string) — AI SRE session that produced the entry. Omitted when no agent wrote it.\n  - created_at (string) (required) — Creation timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — Member ID of the creator. 0 for system-generated entries.\n  - deleted_at (string) — Soft-delete time, Unix epoch milliseconds. Omitted when not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload; the concrete shape is determined by `type`. May be `null` for entries stored without detail.\n    - comment (string) — Comment body.\n    - in_secs (integer) — Window in seconds over which the state changes were counted. Omitted when zero.\n    - max_changes (integer) — State-change count threshold that triggered flapping detection. Omitted when zero.\n    - mute_secs (integer) — Mute duration in seconds. Omitted when zero.\n    - owner_id (integer) — New owner member ID set on the target incident. Omitted when unchanged.\n    - rule_id (string) — Silence rule ID that muted the alert. Omitted when empty.\n    - rule_name (string) — Silence rule name, resolved at read time. Omitted when empty.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - source_alert_id (string) — ID of the source alert that triggered the inhibition. Omitted when empty.\n    - source_alert_title (string) — Title of the source alert, resolved at read time. Omitted when empty.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - status (string) — Severity level. [Ok, Critical, Warning, Info]\n    - target_incident (object) — Incident the alerts were merged into. Omitted when not recorded.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - title (string) — New title set on the target incident. Omitted when unchanged.\n  - ref_id (string) (required) — ObjectID of the alert this entry references.\n  - type (string) (required) — Alert activity feed entry type. Each value identifies one alert lifecycle event; the matching `detail` payload shape is determined by this field. | Type | Meaning | |---|---| | `a_new` | Alert triggered by an incoming event. | | `a_update` | Alert severity or status changed on an incoming event. | | `a_comm` | Comment added on the alert. | | `a_merge` | Alert merged into an incident. | | `a_m_silence` | Alert muted by a silence rule. | | `a_m_inhibit` | Alert muted by an inhibit rule. | | `a_m_flapping` | Alert muted by flapping detection (historical data only; no longer produced). | | `a_ack` | Alert acknowledged (historical data only; alert-level acknowledgement has been removed). | | `a_unack` | Alert acknowledgement revoked (historical data only). | | `a_close` | Alert closed (historical data only; no longer produced). | [a_new, a_update, a_comm, a_merge, a_m_silence, a_m_inhibit, a_m_flapping, a_ack, a_unack, a_close]\n  - updated_at (string) (required) — Last update timestamp in Unix epoch milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - via (string) — Surface that wrote the entry on a user's behalf; currently only `ai_sre`. Omitted when a user created the entry directly.\n",
@@ -98,20 +98,20 @@ var responseHelpBySDKMethod = map[string]string{
 	"Dashboards.PanelReadPreview":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - budget (object) (required) — Execution accounting for a panel run.\n    - execution_count (integer) (required) — Number of queries launched. (min 0)\n    - max_concurrency (integer) (required) — Concurrency cap applied to the panel's queries. (min 1)\n  - display (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - category_field (string) — Field supplying the category axis.\n    - column_options (object) — Per-column display overrides keyed by field name, at most 100 entries.\n    - data_link (object) — Drill-down link from a table column or bar panel into another dashboard. The target dashboard must exist and the mapping sources must match the source panel's shape.\n      - dashboard_id (string) (required) — Target dashboard ID.\n      - pass_time (boolean) (required) — When true the current time range is forwarded to the target.\n      - target_id (string) — Optional tab, section or panel ID to focus in the target dashboard.\n      - variable_mappings (object) (required) — Maps target variable names to a source value such as a column or a source variable.\n    - decimals (integer) — Fixed decimal places; omit or send null to let the renderer decide. (min 0)\n    - display_fields (array<string>) — Log fields rendered for each row.\n    - kind (string) (required) — Visualization kind discriminator; always `time_series`. [time_series, table, stat, bar, gauge, logs, text]\n    - link_columns (array<object>) — Drill-down links rendered as table columns. Together with per-column links a table allows at most 5.\n      - dashboard_id (string) (required) — Target dashboard ID.\n      - pass_time (boolean) (required) — When true the current time range is forwarded to the target.\n      - target_id (string) — Optional tab, section or panel ID to focus in the target dashboard.\n      - variable_mappings (object) (required) — Maps target variable names to a source value such as a column or a source variable.\n    - markdown (string) — Markdown body, at most 64 KiB. Only a restricted node set (headings, lists, tables, links, code) survives validation. (≤65536 chars)\n    - max (number) — Scale upper bound; must exceed `min` when both are set.\n    - min (number) — Scale lower bound.\n    - options (object) (required) — Open options object for the chosen visualization kind; the only part of the definition that round-trips losslessly. Missing or null normalizes to `{}`.\n    - reducer (string) — Reduction applied across the returned rows: `last_non_null` = most recent non-null value; `min` = minimum; `max` = maximum; `mean` = average; `sum` = sum. [last_non_null, min, max, mean, sum]\n    - sort (array<object>) — Initial sort keys; fields must be unique.\n      - direction (string) (required) — Sort direction: `asc` = ascending; `desc` = descending. [asc, desc]\n      - field (string) (required) — Field name to sort by. (≥1 chars)\n    - threshold (object) — Colour threshold for a numeric value. At least one of `warning`/`critical` is required, and with both set the pair must be ordered according to `mode`.\n      - critical (number) — Critical bound; must be finite.\n      - mode (string) (required) — Direction of the comparison: `higher_is_worse` = values at or above the bound breach it; `lower_is_worse` = values at or below the bound breach it. [higher_is_worse, lower_is_worse]\n      - warning (number) — Warning bound; must be finite.\n    - unit (string) — Display unit for the panel's numeric values: `unitless` = raw number; `ratio` = fraction of 1; `percent` = percentage; `milliseconds` = duration in milliseconds; `seconds` = duration in seconds; `bytes` = size in bytes; `bits` = size in bits; `count_per_second` = per-second count; `bytes_per_second` = bytes per second; `bits_per_second` = bits per second. [unitless, ratio, percent, milliseconds, seconds, bytes, bits, count_per_second, bytes_per_second, bits_per_second]\n    - value_fields (array<string>) — Fields reduced to the displayed values.\n  - panel_id (string) (required) — Panel ID.\n  - refs (array<object>) (required) — One entry per query in the panel.\n    - child_request_id (string) — Request ID of the underlying datasource execution; use it when tracing a single query.\n    - error (object) — Per-variable or per-query failure. A failed arm does not fail the whole call.\n      - message (string) (required) — Human-readable detail for the failure.\n      - reason (string) (required) — Machine-readable failure reason. Observed values include `invalid_request`, `variable_invalid`, `panel_missing`, `field_missing`, `datasource_permission_denied`, `timeout`, `panel_deadline`, `panel_canceled`, `canceled`, `overloaded`, `source_too_large`, `edge_unavailable`, `edge_upgrade_required`, `edge_version_unknown`, `mixed_edge_versions` and `internal`.\n    - execution (object) — Datasource-specific execution payload, passed through unmodified.\n    - ref_id (string) (required) — Panel-local query reference.\n    - state (string) (required) — Per-query execution state: `success` = the query executed; `error` = the query failed; `incompatible` = the datasource accepted the call but the query mode or field selection does not fit the datasource type. [success, error, incompatible]\n  - run_state (string) (required) — Aggregate state of the run: `success` = all queries succeeded; `partial` = some succeeded; `incompatible` = at least one query is incompatible with its datasource; `cancelled` = the run was cancelled; `error` = all queries failed. [success, partial, incompatible, cancelled, error]\n  - time (object) (required) — Absolute evaluation window. Both bounds are Unix timestamps in milliseconds, `from_ms` must be less than `to_ms`, and neither may exceed the JavaScript safe integer limit.\n    - from_ms (integer) (required) — Unix timestamp in milliseconds. (min 0)\n    - to_ms (integer) (required) — Unix timestamp in milliseconds. (min 1)\n  - variables (object) (required) — Selections that resolved successfully.\n",
 	"Dashboards.PanelReadRun":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - budget (object) (required) — Execution accounting for a panel run.\n    - execution_count (integer) (required) — Number of queries launched. (min 0)\n    - max_concurrency (integer) (required) — Concurrency cap applied to the panel's queries. (min 1)\n  - dashboard_id (string) (required) — Dashboard ID.\n  - display (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - category_field (string) — Field supplying the category axis.\n    - column_options (object) — Per-column display overrides keyed by field name, at most 100 entries.\n    - data_link (object) — Drill-down link from a table column or bar panel into another dashboard. The target dashboard must exist and the mapping sources must match the source panel's shape.\n      - dashboard_id (string) (required) — Target dashboard ID.\n      - pass_time (boolean) (required) — When true the current time range is forwarded to the target.\n      - target_id (string) — Optional tab, section or panel ID to focus in the target dashboard.\n      - variable_mappings (object) (required) — Maps target variable names to a source value such as a column or a source variable.\n    - decimals (integer) — Fixed decimal places; omit or send null to let the renderer decide. (min 0)\n    - display_fields (array<string>) — Log fields rendered for each row.\n    - kind (string) (required) — Visualization kind discriminator; always `time_series`. [time_series, table, stat, bar, gauge, logs, text]\n    - link_columns (array<object>) — Drill-down links rendered as table columns. Together with per-column links a table allows at most 5.\n      - dashboard_id (string) (required) — Target dashboard ID.\n      - pass_time (boolean) (required) — When true the current time range is forwarded to the target.\n      - target_id (string) — Optional tab, section or panel ID to focus in the target dashboard.\n      - variable_mappings (object) (required) — Maps target variable names to a source value such as a column or a source variable.\n    - markdown (string) — Markdown body, at most 64 KiB. Only a restricted node set (headings, lists, tables, links, code) survives validation. (≤65536 chars)\n    - max (number) — Scale upper bound; must exceed `min` when both are set.\n    - min (number) — Scale lower bound.\n    - options (object) (required) — Open options object for the chosen visualization kind; the only part of the definition that round-trips losslessly. Missing or null normalizes to `{}`.\n    - reducer (string) — Reduction applied across the returned rows: `last_non_null` = most recent non-null value; `min` = minimum; `max` = maximum; `mean` = average; `sum` = sum. [last_non_null, min, max, mean, sum]\n    - sort (array<object>) — Initial sort keys; fields must be unique.\n      - direction (string) (required) — Sort direction: `asc` = ascending; `desc` = descending. [asc, desc]\n      - field (string) (required) — Field name to sort by. (≥1 chars)\n    - threshold (object) — Colour threshold for a numeric value. At least one of `warning`/`critical` is required, and with both set the pair must be ordered according to `mode`.\n      - critical (number) — Critical bound; must be finite.\n      - mode (string) (required) — Direction of the comparison: `higher_is_worse` = values at or above the bound breach it; `lower_is_worse` = values at or below the bound breach it. [higher_is_worse, lower_is_worse]\n      - warning (number) — Warning bound; must be finite.\n    - unit (string) — Display unit for the panel's numeric values: `unitless` = raw number; `ratio` = fraction of 1; `percent` = percentage; `milliseconds` = duration in milliseconds; `seconds` = duration in seconds; `bytes` = size in bytes; `bits` = size in bits; `count_per_second` = per-second count; `bytes_per_second` = bytes per second; `bits_per_second` = bits per second. [unitless, ratio, percent, milliseconds, seconds, bytes, bits, count_per_second, bytes_per_second, bits_per_second]\n    - value_fields (array<string>) — Fields reduced to the displayed values.\n  - panel_id (string) (required) — Panel ID.\n  - refs (array<object>) (required) — One entry per query in the panel.\n    - child_request_id (string) — Request ID of the underlying datasource execution; use it when tracing a single query.\n    - error (object) — Per-variable or per-query failure. A failed arm does not fail the whole call.\n      - message (string) (required) — Human-readable detail for the failure.\n      - reason (string) (required) — Machine-readable failure reason. Observed values include `invalid_request`, `variable_invalid`, `panel_missing`, `field_missing`, `datasource_permission_denied`, `timeout`, `panel_deadline`, `panel_canceled`, `canceled`, `overloaded`, `source_too_large`, `edge_unavailable`, `edge_upgrade_required`, `edge_version_unknown`, `mixed_edge_versions` and `internal`.\n    - execution (object) — Datasource-specific execution payload, passed through unmodified.\n    - ref_id (string) (required) — Panel-local query reference.\n    - state (string) (required) — Per-query execution state: `success` = the query executed; `error` = the query failed; `incompatible` = the datasource accepted the call but the query mode or field selection does not fit the datasource type. [success, error, incompatible]\n  - revision (integer) (required) — Revision the run executed against. (min 1)\n  - run_state (string) (required) — Aggregate state of the run: `success` = all queries succeeded; `partial` = some succeeded; `incompatible` = at least one query is incompatible with its datasource; `cancelled` = the run was cancelled; `error` = all queries failed. [success, partial, incompatible, cancelled, error]\n  - time (object) (required) — Absolute evaluation window. Both bounds are Unix timestamps in milliseconds, `from_ms` must be less than `to_ms`, and neither may exceed the JavaScript safe integer limit.\n    - from_ms (integer) (required) — Unix timestamp in milliseconds. (min 0)\n    - to_ms (integer) (required) — Unix timestamp in milliseconds. (min 1)\n  - variables (object) (required) — Selections that resolved successfully.\n",
 	"Dashboards.QueryReadResolve":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - dashboard_id (string) (required) — Dashboard ID.\n  - panels (array<object>) (required) — Per-panel results.\n    - error (object) — Per-variable or per-query failure. A failed arm does not fail the whole call.\n      - message (string) (required) — Human-readable detail for the failure.\n      - reason (string) (required) — Machine-readable failure reason. Observed values include `invalid_request`, `variable_invalid`, `panel_missing`, `field_missing`, `datasource_permission_denied`, `timeout`, `panel_deadline`, `panel_canceled`, `canceled`, `overloaded`, `source_too_large`, `edge_unavailable`, `edge_upgrade_required`, `edge_version_unknown`, `mixed_edge_versions` and `internal`.\n    - panel_id (string) (required) — Panel ID.\n    - queries (array<object>) (required) — Successfully resolved queries.\n      - args (object) (required) — Query arguments; empty object when none.\n      - datasource (object) (required) — The datasource a runtime query was bound to.\n        - id (integer) (required) — Datasource ID. (min 1)\n        - name (string) (required) — Datasource name.\n        - type (string) (required) — Datasource type identifier.\n      - expr (string) (required) — Expression with variable templates substituted.\n      - min_step_seconds (integer) — Minimum step in seconds; null when unset. (min 1)\n      - mode (string) (required) — Evaluation mode: `range` = a stepped time series; `instant` = a single point in time; `window` = raw rows inside a bounded time window. [range, instant, window]\n      - ref_id (string) (required) — Panel-local query reference.\n    - state (string) (required) — Aggregate state of the panel's queries: `success` = every query resolved; `partial` = some resolved; `error` = none resolved. [success, partial, error]\n  - revision (integer) (required) — Revision the resolution ran against. (min 1)\n  - time (object) (required) — Absolute evaluation window. Both bounds are Unix timestamps in milliseconds, `from_ms` must be less than `to_ms`, and neither may exceed the JavaScript safe integer limit.\n    - from_ms (integer) (required) — Unix timestamp in milliseconds. (min 0)\n    - to_ms (integer) (required) — Unix timestamp in milliseconds. (min 1)\n  - variables (object) (required) — Selections that resolved successfully.\n",
-	"Dashboards.ReadGet":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n  - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
+	"Dashboards.ReadGet":                          "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters. Names starting with `__` are reserved for built-in time variables.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n  - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
 	"Dashboards.ReadList":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - dashboard_id (string) (required) — Dashboard ID.\n  - description (string) — Dashboard description; empty when unset.\n  - folder_breadcrumb (array<string>) (required) — Folder path from the root.\n  - folder_id (integer) (required) — Folder ID. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - title (string) (required) — Dashboard title.\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
 	"Dashboards.ReadOutline":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - dashboard (object) (required) — Dashboard-level outline entry.\n    - dashboard_id (string) (required) — Dashboard ID.\n    - description (string) — Dashboard description; empty when unset.\n    - revision (integer) (required) — Current revision number. (min 1)\n    - title (string) (required) — Dashboard title.\n    - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - folder (object) (required) — Folder placement in an outline.\n    - breadcrumb (array<string>) (required) — Folder names from the root.\n    - folder_id (integer) (required) — Folder ID. (min 1)\n  - tabs (array<object>) (required) — Tabs, narrowed by `target_id` when supplied.\n    - breadcrumb (array<string>) (required) — Dashboard title followed by the tab title.\n    - description (string) — Tab description; empty when unset.\n    - id (string) (required) — Tab ID.\n    - sections (array<object>) (required) — Sections on the tab.\n      - breadcrumb (array<string>) (required) — Dashboard, tab and section titles.\n      - description (string) — Section description; empty when unset.\n      - id (string) (required) — Section ID.\n      - panels (array<object>) (required) — Panels in the section.\n        - breadcrumb (array<string>) (required) — Full path of titles from the dashboard down to the panel.\n        - datasource_type (string) — Datasource type the panel queries; empty when the panel has no datasource (text panels).\n        - description (string) — Panel description; empty when unset.\n        - id (string) (required) — Panel ID.\n        - title (string) (required) — Panel title.\n        - viz_config (object) (required) — Visualization kind of an outlined panel.\n      - title (string) (required) — Section title.\n    - title (string) (required) — Tab title.\n    - top_panels (array<object>) (required) — Panels placed directly on the tab.\n      - breadcrumb (array<string>) (required) — Full path of titles from the dashboard down to the panel.\n      - datasource_type (string) — Datasource type the panel queries; empty when the panel has no datasource (text panels).\n      - description (string) — Panel description; empty when unset.\n      - id (string) (required) — Panel ID.\n      - title (string) (required) — Panel title.\n      - viz_config (object) (required) — Visualization kind of an outlined panel.\n        - kind (string) (required) — Visualization kind: `time_series` = time series; `table` = table; `stat` = single value; `bar` = bar chart; `gauge` = gauge; `logs` = log stream; `text` = Markdown text. [time_series, table, stat, bar, gauge, logs, text]\n  - variables (array<object>) (required) — Variable summaries.\n    - kind (string) (required) — Variable kind: `datasource` = selects a datasource; `custom` = fixed inline list; `query` = resolved by running a query. [datasource, custom, query]\n    - label (string) — Display label; empty when unset.\n    - name (string) (required) — Variable name.\n    - selection (object) — Selection cardinality for a variable.\n      - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n      - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n",
 	"Dashboards.ReadSearch":                       "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - dashboard_id (string) (required) — Dashboard ID.\n  - description (string) — Dashboard description; empty when unset.\n  - folder_breadcrumb (array<string>) (required) — Folder path from the root.\n  - folder_id (integer) (required) — Folder ID. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - title (string) (required) — Dashboard title.\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
-	"Dashboards.RevisionReadGet":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - actor (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - dashboard_id (string) (required) — Dashboard ID.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_id (integer) (required) — Folder the dashboard sat in at that revision. (min 1)\n  - message (string) — Optional commit message. (≤1024 chars)\n  - revision (integer) (required) — Revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n",
+	"Dashboards.RevisionReadGet":                  "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - actor (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - dashboard_id (string) (required) — Dashboard ID.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters. Names starting with `__` are reserved for built-in time variables.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_id (integer) (required) — Folder the dashboard sat in at that revision. (min 1)\n  - message (string) — Optional commit message. (≤1024 chars)\n  - revision (integer) (required) — Revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n",
 	"Dashboards.RevisionReadList":                 "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - actor (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - dashboard_id (string) (required) — Dashboard ID.\n  - folder_id (integer) (required) — Folder the dashboard sat in at that revision. (min 1)\n  - message (string) — Optional commit message; at most 1024 Unicode code points. (≤1024 chars)\n  - revision (integer) (required) — Revision number. (min 1)\n",
 	"Dashboards.TrashReadList":                    "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - dashboard_id (string) (required) — Dashboard ID.\n  - deleted_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - deleted_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - description (string) — Dashboard description; empty when unset.\n  - folder_breadcrumb (array<string>) (required) — Folder path from the root.\n  - folder_id (integer) (required) — Folder the dashboard sat in when deleted. (min 1)\n  - revision (integer) (required) — Revision the dashboard had when deleted. (min 1)\n  - title (string) (required) — Dashboard title.\n",
 	"Dashboards.VariableReadPreview":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - selections (object) (required) — Effective selections keyed by variable name.\n  - variables (array<object>) (required) — Resolved variables.\n    - candidates (array<object>) (required) — Resolved candidates, at most 1000.\n      - text (string) (required) — Label shown in the picker. (1-1024 chars)\n      - value (string) (required) — Value substituted into templates. (1-1024 chars)\n    - datasource (object) — The datasource a runtime query was bound to.\n      - id (integer) (required) — Datasource ID. (min 1)\n      - name (string) (required) — Datasource name.\n      - type (string) (required) — Datasource type identifier.\n    - error (object) — Per-variable or per-query failure. A failed arm does not fail the whole call.\n      - message (string) (required) — Human-readable detail for the failure.\n      - reason (string) (required) — Machine-readable failure reason. Observed values include `invalid_request`, `variable_invalid`, `panel_missing`, `field_missing`, `datasource_permission_denied`, `timeout`, `panel_deadline`, `panel_canceled`, `canceled`, `overloaded`, `source_too_large`, `edge_unavailable`, `edge_upgrade_required`, `edge_version_unknown`, `mixed_edge_versions` and `internal`.\n    - kind (string) (required) — Variable kind: `datasource` = selects a datasource; `custom` = fixed inline list; `query` = resolved by running a query. [datasource, custom, query]\n    - name (string) (required) — Variable name.\n    - selection (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n      - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n      - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n",
 	"Dashboards.VariableReadResolve":              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - dashboard_id (string) (required) — Dashboard ID.\n  - revision (integer) (required) — Revision the resolution ran against. (min 1)\n  - selections (object) (required) — Effective selections keyed by variable name; only variables that resolved successfully appear.\n  - variables (array<object>) (required) — Resolved variables, in definition order.\n    - candidates (array<object>) (required) — Resolved candidates, at most 1000.\n      - text (string) (required) — Label shown in the picker. (1-1024 chars)\n      - value (string) (required) — Value substituted into templates. (1-1024 chars)\n    - datasource (object) — The datasource a runtime query was bound to.\n      - id (integer) (required) — Datasource ID. (min 1)\n      - name (string) (required) — Datasource name.\n      - type (string) (required) — Datasource type identifier.\n    - error (object) — Per-variable or per-query failure. A failed arm does not fail the whole call.\n      - message (string) (required) — Human-readable detail for the failure.\n      - reason (string) (required) — Machine-readable failure reason. Observed values include `invalid_request`, `variable_invalid`, `panel_missing`, `field_missing`, `datasource_permission_denied`, `timeout`, `panel_deadline`, `panel_canceled`, `canceled`, `overloaded`, `source_too_large`, `edge_unavailable`, `edge_upgrade_required`, `edge_version_unknown`, `mixed_edge_versions` and `internal`.\n    - kind (string) (required) — Variable kind: `datasource` = selects a datasource; `custom` = fixed inline list; `query` = resolved by running a query. [datasource, custom, query]\n    - name (string) (required) — Variable name.\n    - selection (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n      - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n      - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n",
-	"Dashboards.WriteCreate":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n  - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
+	"Dashboards.WriteCreate":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters. Names starting with `__` are reserved for built-in time variables.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n  - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
 	"Dashboards.WriteDelete":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - dashboard_id (string) (required) — Dashboard ID.\n  - revision (integer) (required) — Revision recorded for the deletion. (min 1)\n",
-	"Dashboards.WriteMove":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - changed (boolean) (required) — Whether the stored dashboard actually changed.\n  - resource (object) (required) — A stored dashboard: its identity, revision counter, placement and full definition. `revision` increments on every accepted write and must be echoed back as `expected_revision` for the next mutation.\n    - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n    - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n    - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n      - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n        - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n        - to (string) (required) — End of the window; only `now` is accepted. [now]\n      - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n      - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n      - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n        - description (string) — Optional tab description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n        - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n        - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n      - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n      - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_type (string) — Datasource type the candidates are drawn from.\n        - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n        - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n        - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n        - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters.\n        - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n        - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n        - selection (object) — Selection cardinality for a variable.\n        - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n    - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n    - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n    - revision (integer) (required) — Current revision number. (min 1)\n    - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n    - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n",
-	"Dashboards.WriteRestore":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n  - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
-	"Dashboards.WriteUpdate":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - changed (boolean) (required) — Whether the stored dashboard actually changed.\n  - resource (object) (required) — A stored dashboard: its identity, revision counter, placement and full definition. `revision` increments on every accepted write and must be echoed back as `expected_revision` for the next mutation.\n    - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n    - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n    - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n      - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n        - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n        - to (string) (required) — End of the window; only `now` is accepted. [now]\n      - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n      - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n      - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n        - description (string) — Optional tab description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n        - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n        - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n      - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n      - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_type (string) — Datasource type the candidates are drawn from.\n        - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n        - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n        - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n        - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters.\n        - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n        - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n        - selection (object) — Selection cardinality for a variable.\n        - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n    - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n    - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n    - revision (integer) (required) — Current revision number. (min 1)\n    - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n    - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n",
+	"Dashboards.WriteMove":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - changed (boolean) (required) — Whether the stored dashboard actually changed.\n  - resource (object) (required) — A stored dashboard: its identity, revision counter, placement and full definition. `revision` increments on every accepted write and must be echoed back as `expected_revision` for the next mutation.\n    - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n    - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n    - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n      - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n        - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n        - to (string) (required) — End of the window; only `now` is accepted. [now]\n      - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n      - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n      - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n        - description (string) — Optional tab description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n        - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n        - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n      - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n      - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_type (string) — Datasource type the candidates are drawn from.\n        - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n        - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n        - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n        - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters. Names starting with `__` are reserved for built-in time variables.\n        - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n        - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n        - selection (object) — Selection cardinality for a variable.\n        - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n    - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n    - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n    - revision (integer) (required) — Current revision number. (min 1)\n    - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n    - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n",
+	"Dashboards.WriteRestore":                     "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n  - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n  - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n    - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n      - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n      - to (string) (required) — End of the window; only `now` is accepted. [now]\n    - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n    - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n    - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n      - description (string) — Optional tab description. (≤1024 chars)\n      - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n      - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - collapsed (boolean) (required) — Whether the section renders collapsed by default.\n        - description (string) — Optional section description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the section; unique across the definition.\n        - panels (array<object>) (required) — Panels in the section, at most 30.\n        - title (string) (required) — Section title. (1-189 chars)\n      - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n      - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - description (string) — Optional panel description. (≤1024 chars)\n        - grid (object) (required) — 24-column grid placement. `x` and `y` are zero-based; `x + w` must not exceed 24.\n        - id (string) (required) — Canonical UUIDv7 identifying the panel; unique across the definition.\n        - queries (array<object>) (required) — Queries in the panel. `time_series` accepts 1–26, `text` accepts none, every other kind accepts exactly one.\n        - title (string) (required) — Panel title. (1-189 chars)\n        - viz_config (object) (required) — Visualization configuration. `kind` selects the arm and therefore which sibling config object is required; `time_series` also carries the shared numeric options.\n    - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n    - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n      - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_id (integer) — Datasource ID. Required when `kind` is `fixed`, forbidden when `kind` is `variable`. (min 1)\n        - datasource_type (string) (required) — Datasource type identifier, e.g. `prometheus` or `victorialogs`.\n        - kind (string) (required) — `fixed` uses `datasource_id`; `variable` resolves `name` against a datasource variable. [fixed, variable]\n        - name (string) — Datasource variable name. Required when `kind` is `variable`, forbidden when `kind` is `fixed`.\n      - datasource_type (string) — Datasource type the candidates are drawn from.\n      - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - kind (string) (required) — `values` selects the listed entries, `all` selects everything (only allowed when `include_all` is true). [values, all]\n        - values (array<string>) — Selected values, unique and never `$__all`. Must be empty when `kind` is `all`.\n      - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n      - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n      - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n      - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters. Names starting with `__` are reserved for built-in time variables.\n      - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n      - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - text (string) (required) — Label shown in the picker. (1-1024 chars)\n        - value (string) (required) — Value substituted into templates. (1-1024 chars)\n      - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n      - selection (object) — Selection cardinality for a variable.\n        - include_all (boolean) (required) — When true the variable also offers an `all` selection.\n        - mode (string) (required) — Selection cardinality: `single` makes the resolved selection hold exactly one value; `multi` allows multiple values. [single, multi]\n      - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n        - args (object) — Named query arguments; defaults to an empty object.\n        - expr (string) — SQL statement; may reference other variables through `{{ }}`.\n        - field (string) — Log field whose values become candidates. For a Loki datasource it must be a bare stream label name (letters, digits and underscores). (≥1 chars)\n        - kind (string) (required) — Query kind discriminator; always `prometheus`, a label-values query against Prometheus. [prometheus, sql, logs]\n        - label (string) — Label whose values become candidates.\n        - label_filters (array<object>) — Optional matchers narrowing the series before label values are read.\n        - metric (string) — Optional metric used to restrict the series considered.\n        - text_field (string) — Column used as the candidate label; defaults to the value column.\n        - value_field (string) — Column used as the candidate value. (≥1 chars)\n  - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n  - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n  - revision (integer) (required) — Current revision number. (min 1)\n  - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n  - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n    - id (integer) (required) — Member ID.\n    - name (string) (required) — Member display name.\n",
+	"Dashboards.WriteUpdate":                      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - changed (boolean) (required) — Whether the stored dashboard actually changed.\n  - resource (object) (required) — A stored dashboard: its identity, revision counter, placement and full definition. `revision` increments on every accepted write and must be echoed back as `expected_revision` for the next mutation.\n    - created_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n    - dashboard_id (string) (required) — Canonical UUIDv7 assigned by the caller at creation time.\n    - definition (object) (required) — Complete dashboard payload stored as a portable `dashboard.v1` document. Unknown keys, duplicate keys, NaN/Inf, over-range numbers and trailing values are rejected; the serialized form must stay within 1 MiB.\n      - default_time_range (object) (required) — Relative time window. `from` is one of the fixed presets the validator accepts; `to` is always the literal string `now`.\n        - from (string) (required) — Start offset relative to `to`: `now-15m` = 15 minutes ago; `now-30m` = 30 minutes ago; `now-1h` = 1 hour ago; `now-3h` = 3 hours ago; `now-6h` = 6 hours ago; `now-12h` = 12 hours ago; `now-24h` = 24 hours ago; `now-7d` = 7 days ago. [now-15m, now-30m, now-1h, now-3h, now-6h, now-12h, now-24h, now-7d]\n        - to (string) (required) — End of the window; only `now` is accepted. [now]\n      - description (string) — Optional description, at most 1024 Unicode code points. (≤1024 chars)\n      - refresh_interval (string) (required) — Auto-refresh cadence applied by the console: `off` disables auto-refresh; `30s` = every 30 seconds; `1m` = every minute; `5m` = every 5 minutes. [off, 30s, 1m, 5m]\n      - tabs (array<object>) (required) — Tabs, 1–10. Every tab title is unique and every tab or section ID must be a canonical UUIDv7 used only once across the definition.\n        - description (string) — Optional tab description. (≤1024 chars)\n        - id (string) (required) — Canonical UUIDv7 identifying the tab; unique across the definition.\n        - sections (array<object>) (required) — Sections on the tab, at most 10.\n        - title (string) (required) — Tab title, 1–189 Unicode code points. Unique among tabs. (1-189 chars)\n        - top_panels (array<object>) (required) — Panels placed directly on the tab, at most 30.\n      - title (string) (required) — Dashboard title, 1–189 Unicode code points after trimming. (1-189 chars)\n      - variables (array<object>) (required) — Dashboard variables, at most 20. Names must be unique within the definition and match the variable-name pattern.\n        - datasource_ref (object) — Points a panel or query variable at a datasource — either a fixed ID or a datasource variable evaluated at render time.\n        - datasource_type (string) — Datasource type the candidates are drawn from.\n        - default (object) — A concrete selection of variable values. An empty `values` array is valid wire input and means unresolved — the server never substitutes a default for it.\n        - default_datasource_id (integer) — Default datasource ID. Without a usable default the runtime picks the first candidate by name, then ID.\n        - kind (string) (required) — Variable kind discriminator; always `datasource`, selecting a datasource. [datasource, custom, query]\n        - label (string) — Optional display label; falls back to `name`. (≤189 chars)\n        - name (string) (required) — Variable name used in `{{ }}` templates, at most 64 characters. Names starting with `__` are reserved for built-in time variables.\n        - name_patterns (array<string>) — Wildcard patterns narrowing the candidates; empty means every datasource of the type.\n        - options (array<object>) — Candidate list, 1–1000 entries. Values must be non-empty, unique and must not be `$__all`.\n        - refresh (string) — When the candidates are recomputed: `on_dashboard_load` = once when the dashboard loads; `on_time_range_change` = every time the time range changes. [on_dashboard_load, on_time_range_change]\n        - selection (object) — Selection cardinality for a variable.\n        - variable_query (object) — Variable query. Pick the arm with `kind`; the arm must match the referenced datasource type.\n    - folder_breadcrumb (array<string>) (required) — Folder names from the root down to `folder_id`.\n    - folder_id (integer) (required) — ID of the dashboard's folder. (min 1)\n    - revision (integer) (required) — Current revision number. (min 1)\n    - schema_version (string) (required) — Wire schema version of `definition`; only `dashboard.v1` is accepted. [dashboard.v1]\n    - updated_at (string) (required) — Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (object) (required) — Account member recorded as the creator, updater or revision author.\n      - id (integer) (required) — Member ID.\n      - name (string) (required) — Member display name.\n",
 	"DataSources.ReadInfo":                        "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"DataSources.ReadList":                        "Response fields (`data` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - address (string) (required) — Connection address. For Prometheus/Loki/VictoriaLogs: HTTP URL. For MySQL/Oracle/Postgres/ClickHouse: `host:port`. For SLS: endpoint without http/https prefix. Redis/MongoDB diagnostic types: one host:port, bracket IPv6; no URI, userinfo or query. Kafka: 1–32 unique comma-separated host:port bootstrap addresses; payload has no broker list. At most 4096 characters after normalization. (≤4096 chars)\n  - alerting_enabled (boolean) (required) — Whether alert evaluation is allowed. Alerting also requires enabled=true and an alerting-capable type. Always false for diagnostic-only types; false does not block non-alerting queries or tools.\n  - edge_cluster_name (string) (required) — Monitors edge cluster name responsible for evaluating rules using this datasource.\n  - enabled (boolean) (required) — Whether business execution is enabled. Disabled datasources reject business queries and tools; enabling does not change alerting_enabled.\n  - id (integer) (required) — Unique datasource ID.\n  - name (string) (required) — Datasource display name.\n  - note (string) (required) — Optional description.\n  - payload (any) (required) — Type-specific configuration block; must contain the key matching `type_ident`. Always `null` in `/monit/datasource/list` responses (the list query does not read the payload column); populated in create/update/info responses. For `tencent_cls`, `secret_key` is masked to an empty string unless it is an `${env:...}` reference. For diagnostic types, password and Kafka tls_key are omitted from responses unless they are ${env:...} references. On update, omit those fields to preserve stored secrets; explicitly send an empty string to clear. Other configuration fields retain their existing behavior.\n  - type_ident (string) (required) — Datasource type identifier. Allowed: `prometheus`, `loki`, `mysql`, `oracle`, `postgres`, `clickhouse`, `elasticsearch`, `sls`, `tencent_cls`, `victorialogs`, `redis_node`, `redis_sentinel`, `mongodb_mongod`, `mongodb_mongos`, `kafka`。\n  - updated_at (string) (required) — Last update timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"DataSources.ReadSLSProjects":                 "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - count (integer) (required) — Number of projects in this page.\n  - projects (array<object>) (required) — Projects in the current page.\n    - createTime (string) (required) — Creation time, Unix seconds rendered as a string, e.g. `\"1524539357\"`.\n    - dataRedundancyType (string) — Data redundancy type: `LRS` = locally redundant storage, `ZRS` = zone-redundant storage. Omitted when not set. [LRS, ZRS]\n    - description (string) (required) — Project description.\n    - lastModifyTime (string) (required) — Last modification time, Unix seconds rendered as a string.\n    - location (string) — Storage location, e.g. `cn-beijing-b`. Omitted when not set.\n    - owner (string) (required) — Owner Aliyun account ID; empty when not returned by SLS.\n    - projectName (string) (required) — Project name.\n    - region (string) (required) — Region ID, e.g. `cn-shanghai`.\n    - status (string) (required) — Project status, e.g. `Normal`.\n  - total (integer) (required) — Total number of projects matching `query`, independent of pagination.\n",
@@ -131,7 +131,7 @@ var responseHelpBySDKMethod = map[string]string{
 	"Incidents.CommentTypeList":                   "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the comment type.\n  - color (string) (required) — Label color as a hex value in #RRGGBB format (stored uppercase).\n  - comment_type_id (string) (required) — Comment type ID (24-character hex ObjectID).\n  - created_at (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the user who created the comment type.\n  - name (string) (required) — Display name of the comment type. Unique within the account (case-insensitive, trimmed). (≤40 chars)\n  - position (integer) (required) — 1-based display position of the comment type.\n  - updated_at (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the user who last updated the comment type.\n",
 	"Incidents.Create":                            "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - incident_id (string) (required) — Newly created incident ID (MongoDB ObjectID).\n  - title (string) (required) — Echoes the incident title from the request.\n",
 	"Incidents.CustomActionDo":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - message (string) — Error message if the action's HTTP call failed; omitted on success.\n",
-	"Incidents.Feed":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - created_at (string) (required) — Creation timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — User ID of the actor. `0` means system-generated.\n  - deleted_at (string) — Soft-delete timestamp (ms). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload. The concrete shape is determined by `type`; `null` when the entry has no structured detail.\n    - added_assignee_ids (array<integer>) — Member IDs added as assignees.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - assignee_ids (array<integer>) — Assignee member IDs.\n    - by (string) — Delivery channel or method label.\n    - chat_id (string) — Chat group identifier.\n    - chat_name (string) — Chat group display name.\n    - chats (array<object>) — Per-chat delivery records.\n      - chat_id (string) — Chat group identifier.\n      - chat_name (string) — Chat group display name.\n      - data_source_id (integer) — Integration data source ID used to send the notification.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n    - comment (string) — Form summary recorded as a timeline comment. Omitted when no acknowledgement form summary was submitted.\n    - comment_type (object) — Resolved display of an account-level comment type, populated at read time from the current type definition.\n      - color (string) (required) — Badge color in #RRGGBB format.\n      - id (string) (required) — Comment type ID (MongoDB ObjectID).\n      - name (string) (required) — Display name of the comment type. (≤40 chars)\n    - comment_type_id (string) — ObjectID of the account-level comment type attached to the comment.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - field_name (string) — Name of the custom field that was updated.\n    - fire_type (string) — Whether this is the first fire or a refire. `fire`: the first notification for this escalation layer; `refire`: a repeat notification to the same layer when the incident remains unhandled, sent at the layer's notify interval and capped by the layer's maximum refire count. [fire, refire]\n    - from (string) — Source that triggered the resolve. | Value | Meaning | |---|---| | `voice` | Phone-call (voice DTMF) action. | | `console` | Console (Web UI) action. | | `card` | IM notification card button (DingTalk/Feishu/Slack/Teams). | | `wcard` | WeCom notification card button. | | `event` | Event-driven: auto-close when all related alerts recover to Ok, or a close synced from an external ITSM system. | | `autorslv` | Auto-resolve: closed by the system after no new alerts within the channel's auto-resolve timeout. | | `autorefresh` | Card auto-refresh (reserved; never appears on resolve feeds). | | `escalation` | Escalation flow (reserved; never appears on resolve feeds). | [voice, console, card, wcard, event, autorslv, autorefresh, escalation]\n    - from_description (string) — Description before the update.\n    - from_priority (string) — Priority label before the update.\n    - from_status (string) — Status label before the update.\n    - from_title (string) — Title before the update.\n    - from_type (string) — Work item type before the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `from_type` is always `action` in this event. [action, follow_up]\n    - id (string) — Opaque assignment ID generated by the server.\n    - images (array<object>) — Images from the acknowledgement form, recorded on the timeline entry only. Omitted when none were submitted.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - in_mins (integer) — Window length in minutes.\n    - integration_id (integer) — Integration ID that executed the action.\n    - integration_name (string) — Integration display name.\n    - item_type (string) — Work item type. `action`: an action item anchored to the incident itself, convertible to `follow_up` later; `follow_up`: an improvement item anchored to a post-mortem, requiring the incident to be linked to that post-mortem at creation. [action, follow_up]\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - max_changes (integer) — Maximum state changes allowed within the window.\n    - minutes (integer) — Snooze duration in minutes.\n    - msg_id (string) — Upstream message ID returned by the delivery channel.\n    - mute_mins (integer) — Mute duration in minutes once flapping is detected.\n    - mute_reply (boolean) — Whether replies to this comment are muted.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - owner_id (integer) — Member ID that performed the merge.\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - persons (array<object>) — Per-person delivery records.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - person_id (integer) — Recipient member ID.\n      - sms_content (string) — SMS text delivered to the recipient; present on SMS deliveries.\n    - plugin_type (string) — Chat integration plugin type.\n    - post_mortem_id (string) — ID of the post-mortem the work item is bound to.\n    - progress (string) — Progress note entered at acknowledgement.\n    - reason (string) — Reason why the incident was reopened.\n    - remove_source_incidents (boolean) — True if the source incidents were removed after merging.\n    - removed_assignee_ids (array<integer>) — Member IDs removed from assignees.\n    - reporter_email (string) — Email of the reporter when the incident was created externally.\n    - rid (string) — Notification record ID.\n    - robots (array<object>) — Per-robot delivery records.\n      - alias (string) — Robot alias.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - token (string) — Robot token or identifier.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - share_link (string) — Shareable join link for the war room.\n    - snoozedBefore (integer) — Unix timestamp at which the prior snooze was scheduled to end.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - source_incidents (array<object>) — Source incidents that were merged.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - source_responders (array<integer>) — Responder member IDs carried over from the source incidents.\n    - status (string) — Work item status label (e.g. `open`, `done`).\n    - target_incident (object) — Brief incident reference embedded in an alert.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - threshold (integer) — Storm threshold that was reached.\n    - title (string) — Initial incident title.\n    - to (array<integer>) — Member IDs that received the assignment.\n    - to_description (string) — Description after the update.\n    - to_priority (string) — Priority label after the update.\n    - to_status (string) — Status label after the update.\n    - to_type (string) — Work item type after the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `to_type` is always `follow_up` in this event, and a successful conversion immediately tries to bind the incident's post-mortem. [action, follow_up]\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n    - work_item_id (string) — Work item ID.\n  - ref_id (string) (required) — ObjectID of the source alert or incident this entry references.\n  - type (string) (required) — Incident timeline entry type. Each value identifies one lifecycle event; the matching `detail` payload shape is determined by this field. Incident types are prefixed with `i_`. | Type | Meaning | |---|---| | `i_new` | Incident Created: A new incident was created automatically or manually. | | `i_assign` | Assigned: Incident was assigned to responders. | | `i_a_rspd` | Responder Added: Additional responders joined the incident. | | `i_notify` | Notification dispatched through a channel at a specific escalation level. | | `i_storm` | Alert storm threshold reached on the incident. | | `i_snooze` | Notifications snoozed for a given duration. | | `i_wake` | Snooze cancelled and notifications resumed. | | `i_ack` | Acknowledged: Responder confirmed they are working on the incident. | | `i_unack` | Acknowledgement removed. | | `i_comm` | Comment: Responder logged progress or key information. | | `i_rslv` | Resolved: Incident was marked as resolved. | | `i_reopen` | Reopened: Resolved incident was reopened, possibly due to recurrence. | | `i_merge` | Merged: Multiple related incidents were merged into one. | | `i_r_title` | Title updated. | | `i_r_desc` | Description updated. | | `i_r_impact` | Impact updated. | | `i_r_rc` | Root cause updated. | | `i_r_rsltn` | Resolution updated. | | `i_r_severity` | Severity Changed: Incident severity level was adjusted. | | `i_r_field` | Custom field value updated. | | `i_m_flapping` | Incident muted by flapping detection. | | `i_m_reply` | Mute reply marker on a comment. | | `i_custom` | Action: Automated action or script was triggered. | | `i_wr_create` | War Room Created: Chat group was created for collaborative response. | | `i_wr_delete` | War room chat group deleted. | | `i_auto_refresh` | Card auto-refresh event posted back to the timeline. | | `i_wi_created` | Work Item Created: An Action or Follow-up was created. | | `i_wi_updated` | Work Item Updated: Title, description, status, or priority was changed. | | `i_wi_assignees` | Work Item Assignees Changed: Assignees were updated. | | `i_wi_completed` | Work Item Completed: An assignee marked the work item complete. | | `i_wi_converted` | Work Item Converted: An Action was converted to a Follow-up. | | `i_wi_bound` | Work Item Bound: A converted Follow-up was bound to a post-mortem. | | `i_wi_deleted` | Work Item Deleted: An Action or Follow-up was soft-deleted. | | `a_merge` | Alert Merged: An alert was merged into an existing incident. | [i_new, i_assign, i_a_rspd, i_notify, i_storm, i_snooze, i_wake, i_ack, i_unack, i_comm, i_rslv, i_reopen, i_merge, i_r_title, i_r_desc, i_r_impact, i_r_rc, i_r_rsltn, i_r_severity, i_r_field, i_m_flapping, i_m_reply, i_custom, i_wr_create, i_wr_delete, i_auto_refresh, i_wi_created, i_wi_updated, i_wi_assignees, i_wi_completed, i_wi_converted, i_wi_bound, i_wi_deleted, a_merge]\n  - updated_at (string) (required) — Last update timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Incidents.Feed":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID.\n  - created_at (string) (required) — Creation timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — User ID of the actor. `0` means system-generated.\n  - deleted_at (string) — Soft-delete timestamp in milliseconds. Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - detail (object) (required) — Type-specific payload. The concrete shape is determined by `type`; `null` when the entry has no structured detail.\n    - added_assignee_ids (array<integer>) — Member IDs added as assignees.\n    - added_assignees (array<object>) — Assignees added by this change, in submitted order. `added_assignee_ids` is the person-only subset. Omitted when nothing was added.\n      - id (integer) — Member ID. Required when `type` is `person`. Omitted when `type` is `ai_sre`.\n      - type (string) (required) — Assignee kind: `person` (a member) or `ai_sre` (the account AI SRE). [person, ai_sre]\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - assignee_ids (array<integer>) — Assignee member IDs.\n    - assignees (array<object>) — Assignees of the work item. Each entry is `{type, id?}`; an `ai_sre` entry omits `id`. Omitted when there is no assignee.\n      - id (integer) — Member ID. Required when `type` is `person`. Omitted when `type` is `ai_sre`.\n      - type (string) (required) — Assignee kind: `person` (a member) or `ai_sre` (the account AI SRE). [person, ai_sre]\n    - by (string) — Delivery channel or method label.\n    - chat_id (string) — Chat group identifier.\n    - chat_name (string) — Chat group display name.\n    - chats (array<object>) — Per-chat delivery records.\n      - chat_id (string) — Chat group identifier.\n      - chat_name (string) — Chat group display name.\n      - data_source_id (integer) — Integration data source ID used to send the notification.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n    - comment (string) — Form summary recorded as a timeline comment. Omitted when no acknowledgement form summary was submitted.\n    - comment_type (object) — Resolved display of an account-level comment type, populated at read time from the current type definition.\n      - color (string) (required) — Badge color in #RRGGBB format.\n      - id (string) (required) — Comment type ID (MongoDB ObjectID).\n      - name (string) (required) — Display name of the comment type. (≤40 chars)\n    - comment_type_id (string) — ObjectID of the account-level comment type attached to the comment.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - field_name (string) — Name of the custom field that was updated.\n    - fire_type (string) — Whether this is the first fire or a refire. `fire`: the first notification for this escalation layer; `refire`: a repeat notification to the same layer when the incident remains unhandled, sent at the layer's notify interval and capped by the layer's maximum refire count. [fire, refire]\n    - from (string) — Source that triggered the resolve. | Value | Meaning | |---|---| | `voice` | Phone-call (voice DTMF) action. | | `console` | Console (Web UI) action. | | `card` | IM notification card button (DingTalk/Feishu/Slack/Teams). | | `wcard` | WeCom notification card button. | | `event` | Event-driven: auto-close when all related alerts recover to Ok, or a close synced from an external ITSM system. | | `autorslv` | Auto-resolve: closed by the system after no new alerts within the channel's auto-resolve timeout. | | `autorefresh` | Card auto-refresh (reserved; never appears on resolve feeds). | | `escalation` | Escalation flow (reserved; never appears on resolve feeds). | [voice, console, card, wcard, event, autorslv, autorefresh, escalation]\n    - from_description (string) — Description before the update.\n    - from_priority (string) — Priority label before the update.\n    - from_status (string) — Status label before the update.\n    - from_title (string) — Title before the update.\n    - from_type (string) — Work item type before the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `from_type` is always `action` in this event. [action, follow_up]\n    - id (string) — Opaque assignment ID generated by the server.\n    - images (array<object>) — Images from the acknowledgement form, recorded on the timeline entry only. Omitted when none were submitted.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - in_mins (integer) — Window length in minutes.\n    - integration_id (integer) — Integration ID that executed the action.\n    - integration_name (string) — Integration display name.\n    - item_type (string) — Work item type. `action`: an action item anchored to the incident itself, convertible to `follow_up` later; `follow_up`: an improvement item anchored to a post-mortem, requiring the incident to be linked to that post-mortem at creation. [action, follow_up]\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - max_changes (integer) — Maximum state changes allowed within the window.\n    - minutes (integer) — Snooze duration in minutes.\n    - msg_id (string) — Upstream message ID returned by the delivery channel.\n    - mute_mins (integer) — Mute duration in minutes once flapping is detected.\n    - mute_reply (boolean) — Whether replies to this comment are muted.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - owner_id (integer) — Member ID that performed the merge.\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - persons (array<object>) — Per-person delivery records.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - person_id (integer) — Recipient member ID.\n      - sms_content (string) — SMS text delivered to the recipient; present on SMS deliveries.\n    - plugin_type (string) — Chat integration plugin type.\n    - post_mortem_id (string) — ID of the post-mortem the work item is bound to.\n    - progress (string) — Progress note entered at acknowledgement.\n    - reason (string) — Reason why the incident was reopened.\n    - remove_source_incidents (boolean) — True if the source incidents were removed after merging.\n    - removed_assignee_ids (array<integer>) — Member IDs removed from assignees.\n    - removed_assignees (array<object>) — Assignees removed by this change. `removed_assignee_ids` is the person-only subset. Omitted when nothing was removed.\n      - id (integer) — Member ID. Required when `type` is `person`. Omitted when `type` is `ai_sre`.\n      - type (string) (required) — Assignee kind: `person` (a member) or `ai_sre` (the account AI SRE). [person, ai_sre]\n    - reporter_email (string) — Email of the reporter when the incident was created externally.\n    - rid (string) — Notification record ID.\n    - robots (array<object>) — Per-robot delivery records.\n      - alias (string) — Robot alias.\n      - failed_reason (string) — Failure reason if delivery did not succeed.\n      - token (string) — Robot token or identifier.\n    - severity (string) — Severity level. [Ok, Critical, Warning, Info]\n    - share_link (string) — Shareable join link for the war room.\n    - snoozedBefore (integer) — Unix timestamp at which the prior snooze was scheduled to end.\n    - source_alerts (array<object>) — Source alerts merged into the target incident. Omitted when empty.\n      - alert_id (string) — Alert ID (ObjectID hex string).\n      - title (string) — Alert title, resolved at read time. Omitted when empty.\n    - source_incidents (array<object>) — Source incidents that were merged.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - source_responders (array<integer>) — Responder member IDs carried over from the source incidents.\n    - status (string) — Work item status label (e.g. `open`, `done`).\n    - target_incident (object) — Brief incident reference embedded in an alert.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - threshold (integer) — Storm threshold that was reached.\n    - title (string) — Initial incident title.\n    - to (array<integer>) — Member IDs that received the assignment.\n    - to_description (string) — Description after the update.\n    - to_priority (string) — Priority label after the update.\n    - to_status (string) — Status label after the update.\n    - to_type (string) — Work item type after the conversion. `action`: an action item anchored to the incident itself; `follow_up`: an improvement item anchored to a post-mortem. Conversion currently only supports `action` → `follow_up`, so `to_type` is always `follow_up` in this event, and a successful conversion immediately tries to bind the incident's post-mortem. [action, follow_up]\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n    - work_item_id (string) — Work item ID.\n  - ref_id (string) (required) — ObjectID of the source alert or incident this entry references.\n  - type (string) (required) — Incident timeline entry type. Each value identifies one lifecycle event; the matching `detail` payload shape is determined by this field. Incident types are prefixed with `i_`. | Type | Meaning | |---|---| | `i_new` | Incident Created: A new incident was created automatically or manually. | | `i_assign` | Assigned: Incident was assigned to responders. | | `i_a_rspd` | Responder Added: Additional responders joined the incident. | | `i_notify` | Notification dispatched through a channel at a specific escalation level. | | `i_storm` | Alert storm threshold reached on the incident. | | `i_snooze` | Notifications snoozed for a given duration. | | `i_wake` | Snooze cancelled and notifications resumed. | | `i_ack` | Acknowledged: Responder confirmed they are working on the incident. | | `i_unack` | Acknowledgement removed. | | `i_comm` | Comment: Responder logged progress or key information. | | `i_rslv` | Resolved: Incident was marked as resolved. | | `i_reopen` | Reopened: Resolved incident was reopened, possibly due to recurrence. | | `i_merge` | Merged: Multiple related incidents were merged into one. | | `i_r_title` | Title updated. | | `i_r_desc` | Description updated. | | `i_r_impact` | Impact updated. | | `i_r_rc` | Root cause updated. | | `i_r_rsltn` | Resolution updated. | | `i_r_severity` | Severity Changed: Incident severity level was adjusted. | | `i_r_field` | Custom field value updated. | | `i_m_flapping` | Incident muted by flapping detection. | | `i_m_reply` | Mute reply marker on a comment. | | `i_custom` | Action: Automated action or script was triggered. | | `i_wr_create` | War Room Created: Chat group was created for collaborative response. | | `i_wr_delete` | War room chat group deleted. | | `i_auto_refresh` | Card auto-refresh event posted back to the timeline. | | `i_wi_created` | Work Item Created: An Action or Follow-up was created. | | `i_wi_updated` | Work Item Updated: Title, description, status, or priority was changed. | | `i_wi_assignees` | Work Item Assignees Changed: Assignees were updated. | | `i_wi_completed` | Work Item Completed: An assignee marked the work item complete. | | `i_wi_converted` | Work Item Converted: An Action was converted to a Follow-up. | | `i_wi_bound` | Work Item Bound: A converted Follow-up was bound to a post-mortem. | | `i_wi_deleted` | Work Item Deleted: An Action or Follow-up was soft-deleted. | | `a_merge` | Alert Merged: An alert was merged into an existing incident. | [i_new, i_assign, i_a_rspd, i_notify, i_storm, i_snooze, i_wake, i_ack, i_unack, i_comm, i_rslv, i_reopen, i_merge, i_r_title, i_r_desc, i_r_impact, i_r_rc, i_r_rsltn, i_r_severity, i_r_field, i_m_flapping, i_m_reply, i_custom, i_wr_create, i_wr_delete, i_auto_refresh, i_wi_created, i_wi_updated, i_wi_assignees, i_wi_completed, i_wi_converted, i_wi_bound, i_wi_deleted, a_merge]\n  - updated_at (string) (required) — Last update timestamp in milliseconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Incidents.Info":                              "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n        - alt (string) — Alt text.\n        - href (string) — Optional link URL when the image is clicked.\n        - src (string) (required) — Image source URL or internal image reference (starts with `img_` or `http`).\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Incidents.List":                              "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
 	"Incidents.ListByIDs":                         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — Account ID that owns the incident.\n  - account_locale (string) (required) — Account locale.\n  - account_name (string) (required) — Account name.\n  - account_time_zone (string) (required) — Account time zone.\n  - ack_time (string) (required) — Unix timestamp (seconds) when the incident was first acknowledged. 0 if unacknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - active_alert_cnt (integer) (required) — Count of alerts currently in Critical/Warning/Info state.\n  - ai_summary (string) (required) — AI-generated summary of the incident.\n  - alert_cnt (integer) (required) — Total count of alerts merged into this incident.\n  - alert_event_cnt (integer) (required) — Total raw alert event count across all merged alerts.\n  - alerts (array<object>) — Embedded alerts, only populated for notification templates and custom actions.\n    - account_id (integer) (required) — Account ID.\n    - alert_id (string) (required) — Alert ID (MongoDB ObjectID).\n    - alert_key (string) (required) — Deduplication key used to merge events into the alert.\n    - alert_severity (string) (required) — Current severity. [Critical, Warning, Info, Ok]\n    - alert_status (string) (required) — Current status. [Critical, Warning, Info, Ok]\n    - channel_id (integer) (required) — Channel ID.\n    - channel_name (string) (required) — Channel display name.\n    - channel_status (string) (required) — Channel status.\n    - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - data_source_id (integer) (required) — Deprecated. Use `integration_id` instead.\n    - data_source_name (string) (required) — Deprecated. Use `integration_name`.\n    - data_source_ref_id (string) (required) — Deprecated. Use `integration_ref_id`.\n    - data_source_type (string) — Deprecated. Use `integration_type`.\n    - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Alert description.\n    - detail_url (string) — Console URL of this alert (`{console}/alert/detail/{alert_id}`). Empty when the deployment has no console base configured.\n    - end_time (string) (required) — Unix timestamp (seconds) when the alert recovered. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - event_cnt (integer) (required) — Total number of raw events merged into this alert.\n    - events (array<object>) — Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert.\n      - account_id (integer) — Account ID.\n      - alert_id (string) — Parent alert ID (MongoDB ObjectID).\n      - alert_key (string) — Deduplication key used to merge events into an alert.\n      - channel_id (integer) — Channel ID the event is routed to.\n      - created_at (string) — Record creation time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n      - deleted_at (string) — Soft-delete time, Unix epoch seconds. Omitted when the event is not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - description (string) — Event description.\n      - event_id (string) — Event ID (MongoDB ObjectID).\n      - event_severity (string) — Severity of this event: `Critical`, `Warning`, or `Info`. An event never carries `Ok` as severity — `Ok` appears only as `event_status`. [Critical, Warning, Info]\n      - event_status (string) — Status carried by this event: `Critical`/`Warning`/`Info` for a firing event, `Ok` for a recovery event. [Critical, Warning, Info, Ok]\n      - event_time (string) — Event timestamp, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n      - images (array<object>) — Images attached to the event.\n      - integration_id (integer) — Integration that produced this event.\n      - integration_type (string) — Type/plugin key of the integration that produced this event.\n      - labels (object) — Label key-value pairs.\n      - title (string) — Event title.\n      - title_rule (string) — Title template used to derive `title` from labels.\n      - updated_at (string) — Record update time, Unix epoch seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - ever_muted (boolean) (required) — Whether this alert has ever been silenced.\n    - images (array<object>) (required) — Attached images.\n      - alt (string) — Alt text.\n      - href (string) — Optional link the image points to.\n      - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n    - incident (object) — Parent incident reference, if the alert has been merged into one.\n      - incident_id (string) — Incident ID (ObjectID hex string).\n      - progress (string) — Incident progress — one of `Triggered`, `Processing`, `Closed`.\n      - title (string) — Incident title.\n    - integration_id (integer) (required) — Integration ID that produced the alert.\n    - integration_name (string) (required) — Integration display name.\n    - integration_ref_id (string) (required) — Integration reference ID.\n    - integration_type (string) (required) — Integration type string.\n    - labels (object) (required) — Alert labels.\n    - last_time (string) (required) — Unix timestamp (seconds) of the most recent event. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - responder_email (string) (required) — Primary responder email, if any.\n    - responder_name (string) (required) — Primary responder name, if any.\n    - start_time (string) (required) — Unix timestamp (seconds) when the alert first fired. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - title (string) (required) — Alert title.\n    - title_rule (string) (required) — Title rendering rule.\n    - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - assigned_to (object) (required) — Current assignment target for the incident.\n    - assigned_at (integer) — Unix timestamp (seconds) when the assignment was made.\n    - emails (array<string>) — Email recipients, used by integrations such as ServiceNow.\n    - escalate_rule_id (string) — Escalation rule ID (MongoDB ObjectID) to drive assignment.\n    - escalate_rule_name (string) — Escalation rule display name, filled by the server.\n    - id (string) — Opaque assignment ID generated by the server.\n    - layer_idx (integer) — Current level index within the escalation rule.\n    - notify (object) — Override the notification channels used for this assignment.\n      - follow_preference (boolean) — When false, use `personal_channels`; when true or omitted, use each responder's personal preference.\n      - personal_channels (array<string>) — Channels to use (e.g. `voice`, `sms`, `email`).\n      - template_id (string) — Notification template ID (MongoDB ObjectID).\n    - person_ids (array<integer>) — Member IDs to assign directly.\n    - type (string) — Assignment type: `assign` direct assignment, `reassign` reassignment, `escalate` escalation-rule driven, `reopen` automatic reassignment on reopen. [assign, reassign, escalate, reopen]\n  - channel_id (integer) (required) — Channel ID. 0 for standalone incidents.\n  - channel_name (string) (required) — Channel display name.\n  - channel_status (string) (required) — Channel status.\n  - close_time (string) (required) — Unix timestamp (seconds) when the incident was closed. 0 if still open. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - closer (object) — Closer member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - closer_id (integer) (required) — Member ID that closed the incident. 0 if auto-closed.\n  - created_at (string) (required) — Creation timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator (object) — Creator member info.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - creator_id (integer) (required) — Member ID that created the incident. 0 if auto-created by the system.\n  - data_source_id (integer) — Deprecated. Use `integration_id` instead.\n  - data_source_ids (array<integer>) — Deprecated. Use `integration_ids` instead.\n  - data_source_type (string) — Deprecated. Use `integration_type` instead.\n  - data_source_types (array<string>) — Deprecated. Use `integration_types` instead.\n  - dedup_key (string) (required) — Deduplication key used to coalesce alerts.\n  - deleted_at (string) — Soft-delete timestamp (seconds). Zero if not deleted. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Incident description.\n  - detail_url (string) (required) — Web console URL for the incident.\n  - end_time (string) (required) — Unix timestamp (seconds) when the incident ended. 0 if still active. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - equals_md5 (string) (required) — MD5 hash used for content-equality checks.\n  - ever_muted (boolean) (required) — Whether the incident has ever been silenced.\n  - fields (object) (required) — Custom field values keyed by field name.\n  - frequency (string) — Frequency bucket for recurrence analysis: `frequent` or `rare`. [frequent, rare]\n  - group_method (string) (required) — Alert grouping method: `i` intelligent, `p` pattern, `n` none. [i, p, n]\n  - images (array<object>) (required) — Attached images.\n    - alt (string) — Alt text.\n    - href (string) — Optional link the image points to.\n    - src (string) (required) — Image source. Either an `img_` upload token or an `http(s)` URL.\n  - impact (string) (required) — Impact description.\n  - incident_id (string) (required) — Incident ID (MongoDB ObjectID).\n  - incident_severity (string) (required) — Configured incident severity. [Critical, Warning, Info, Ok]\n  - incident_status (string) (required) — Current incident status, derived from alert statuses. [Critical, Warning, Info, Ok]\n  - integration_id (integer) (required) — First integration associated with the incident.\n  - integration_ids (array<integer>) (required) — All integration IDs contributing alerts to this incident.\n  - integration_type (string) — First alert's integration type string, used by the detail page for label mappings.\n  - integration_types (array<string>) (required) — Integration type strings for all contributing integrations.\n  - labels (object) (required) — Labels propagated from alerts.\n  - last_time (string) (required) — Unix timestamp (seconds) of the most recent update. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - links (array<object>) — Channel-level link integrations rendered for this incident.\n    - endpoint (string) (required) — Rendered URL for the link.\n    - name (string) (required) — Display name of the link.\n    - open_type (string) (required) — How the link opens. `popup` opens it in a popup within the incident detail page; `tab` opens it in a new browser tab. [popup, tab]\n  - manual_overrides (array<string>) (required) — Fields that were manually overridden after auto-population.\n  - num (string) (required) — Short display identifier; not guaranteed unique.\n  - owner (object) — Owner member info. May be deprecated.\n    - as (string) — Role label for this member in the context of the current object.\n    - email (string) — Member email address.\n    - person_id (integer) — Member ID.\n    - person_name (string) — Member display name.\n  - owner_id (integer) (required) — Primary owner member ID. 0 if none.\n  - post_mortem_id (string) (required) — Associated post-mortem ID, if any. One incident can only link to a single post-mortem.\n  - progress (string) (required) — Incident progress. `Triggered` means fired and unacknowledged; `Processing` means acknowledged and being handled (un-acknowledging moves it back to `Triggered`); `Closed` means resolved. [Triggered, Processing, Closed]\n  - reporter_email (string) — Reporter email for manually created incidents.\n  - resolution (string) (required) — Resolution notes.\n  - responders (array<object>) (required) — Current responders with assignment/acknowledgement state.\n    - acknowledged_at (string) (required) — Unix timestamp (seconds) when the member acknowledged. 0 if not yet acknowledged. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - as (string) — Role label of this responder.\n    - assigned_at (string) (required) — Unix timestamp (seconds) when the member was assigned. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - email (string) — Member email, filled by the server.\n    - person_id (integer) (required) — Responder member ID.\n    - person_name (string) — Member display name, filled by the server.\n  - root_cause (string) (required) — Root cause analysis.\n  - silence_url (string) (required) — Quick-silence URL for this incident.\n  - snoozed_before (string) (required) — Unix timestamp (seconds) until which notifications are snoozed. 0 if not snoozed. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - start_time (string) (required) — Unix timestamp (seconds) when the incident started. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - team_id (integer) (required) — ID of the team that owns the incident's channel. 0 when the channel has no team.\n  - title (string) (required) — Incident title.\n  - updated_at (string) (required) — Last update timestamp (seconds). CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
@@ -158,12 +158,12 @@ var responseHelpBySDKMethod = map[string]string{
 	"Incidents.WorkItemUpdate":                    "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - added_assignee_ids (array<integer>) — Assignee member IDs that were newly added (and notified).\n  - idempotent_replay (boolean) — True when the call replayed an earlier request with the same idempotency key.\n  - item (object) — A structured incident work item (action or post-mortem follow-up) with its assignees.\n    - agent_session_id (string) — ID of the AI SRE session executing this item. Omitted when no session is recorded.\n    - agent_session_venue (string) — Where that AI SRE session runs: `web` or `im`. Omitted when no session is recorded. [web, im]\n    - assignee_ids (array<integer>) (required) — Member IDs of the current person assignees. AI SRE is not included. Never null; an empty array means no person assignee.\n    - assignees (array<object>) (required) — Current assignees. Each entry is `{type, id?}`. `type` is `person` or `ai_sre`; an `ai_sre` entry omits `id`. Never null; an empty array means unassigned. `assignee_ids` is the person-only subset of this list.\n      - id (integer) — Member ID. Required when `type` is `person`. Omitted when `type` is `ai_sre`.\n      - type (string) (required) — Assignee kind: `person` (a member) or `ai_sre` (the account AI SRE). [person, ai_sre]\n    - converted_at_seconds (string) — Conversion time as a Unix timestamp in seconds. Present only after conversion. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - converted_by (integer) — Member ID of the operator who converted the action into a follow-up. Present only after conversion.\n    - created_at_seconds (string) (required) — Creation time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID of the creator.\n    - description (string) — Optional longer description (max 65,535 characters). (≤65535 chars)\n    - incident_id (string) (required) — Incident ID (MongoDB ObjectID) the item is anchored to.\n    - item_type (string) (required) — `action` for an item anchored to an active incident; `follow_up` for a post-mortem follow-up. [action, follow_up]\n    - legacy_source_id (string) — Original identifier of the legacy follow-up this item was migrated from. Present only when `source_kind` is `legacy_follow_up`.\n    - post_mortem_id (string) — Post-mortem ID (32-character hex string). Present on follow-up items once bound to a post-mortem.\n    - priority (string) — Optional client-defined priority (max 64 characters). (≤64 chars)\n    - source_kind (string) (required) — `native` for items created through this API; `legacy_follow_up` for items migrated from legacy post-mortem follow-ups. [native, legacy_follow_up]\n    - status (string) (required) — Client-defined status (max 64 characters). There is no fixed state machine. (≤64 chars)\n    - title (string) (required) — Item title (max 512 characters). (≤512 chars)\n    - updated_at_seconds (string) (required) — Last update time as a Unix timestamp in seconds. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID of the last updater.\n    - version (integer) (required) — Optimistic-locking version, incremented on every mutation.\n    - work_item_id (string) (required) — Work item ID (opaque string, max 128 characters). (≤128 chars)\n  - removed_assignee_ids (array<integer>) — Assignee member IDs that were removed (never notified).\n",
 	"Integrations.DatasourceImPersonTryLink":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - new_linked_person_ids (array<integer>) (required) — Person IDs newly linked during this call.\n",
 	"Integrations.Detail":                         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - attempt (integer) (required) — Attempt sequence number.\n  - channel_id (integer) — Channel ID when applicable.\n  - channel_name (string) — Name of the associated channel, resolved at query time.\n  - duration (integer) (required) — Total elapsed time of the attempt in milliseconds.\n  - endpoint (string) (required) — Destination URL.\n  - error_message (string) — Error message when delivery failed.\n  - event_id (string) (required) — Event ID.\n  - event_time (string) (required) — Event time formatted as `YYYY-MM-DD HH:MM:SS.ffffff`.\n  - event_type (string) (required) — Event type code. `i_*` values are incident events (for example `i_new` = incident created); `a_*` values are alert events (for example `a_new` = alert triggered).\n  - integration_id (integer) (required) — Integration ID.\n  - ref_id (string) — Source object ID.\n  - ref_title (string) — Title of the source incident or alert, resolved at query time.\n  - request_body (string) — Outbound request body payload.\n  - request_headers (string) — Serialized outbound request headers.\n  - response_body (string) — Response body.\n  - response_headers (string) — Serialized response headers.\n  - status (string) (required) — Delivery outcome. [success, failed]\n  - status_code (integer) (required) — HTTP status code.\n  - webhook_type (string) (required) — Source object kind: `incident` or `alert`. [incident, alert]\n",
-	"Integrations.IntegrationAPIReadInfo":         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - category (any) (required)\n  - created_at (any) (required)\n  - description (any) (required)\n  - integration_id (any) (required)\n  - last_time (any) (required)\n  - name (any) (required)\n  - plugin_type (any) (required)\n  - plugin_type_name (any) (required)\n  - ref_id (any) (required)\n  - settings (object) (required) — Type-specific configuration. Sensitive values (endpoint, headers, secrets, passwords) are returned masked as `******`.\n  - status (any) (required)\n  - team_id (any) (required)\n  - updated_at (any) (required)\n",
-	"Integrations.IntegrationAPIReadList":         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - category (string) (required) — Category the integration belongs to: `event.alert` alert events, `event.change` change events, `im` IM bots, `webhook` custom webhooks. [event.alert, event.change, im, webhook]\n  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - description (string) (required) — Free-form description.\n  - integration_id (integer) (required) — Integration ID.\n  - last_time (string) (required) — Unix timestamp in seconds of the most recent event received. `0` when no event has arrived yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - name (string) (required) — Integration name.\n  - plugin_type (string) (required) — Integration type, for example `standard.alert` or `zabbix.alert`.\n  - plugin_type_name (string) (required) — Display name of the integration type, in the language of the request.\n  - ref_id (string) (required) — Source reference ID: `a_`-prefixed for an account-scoped integration, `c_`-prefixed when it is shared into a channel, `w_`-prefixed on legacy workspace-scoped integrations.\n  - status (string) (required) — Lifecycle status: `enabled` while the integration accepts events, `disabled` when it is paused. [enabled, disabled]\n  - team_id (integer) (required) — ID of the team that owns the integration. `0` when it is not assigned to a team.\n  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n",
+	"Integrations.IntegrationAPIReadInfo":         "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - category (string) (required) — Category the integration belongs to: `event.alert` alert events, `event.change` change events, `im` IM bots, `webhook` custom webhooks. [event.alert, event.change, im, webhook]\n  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the member who created the integration.\n  - description (string) (required) — Free-form description.\n  - editable (boolean) (required) — Whether the current caller passes the integration object-permission check; write calls also require Integrations Manage.\n  - integration_id (integer) (required) — Integration ID.\n  - integration_key (string) (required) — Decrypted integration key for inbound pushes. Empty when no key is stored; distinct from the account `app_key`.\n  - last_time (string) (required) — Unix timestamp in seconds of the most recent event received. `0` when no event has arrived yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - name (string) (required) — Integration name.\n  - no_editable (boolean) (required) — Read-only flag. When true, the public APIs do not allow changes to this integration.\n  - plugin_id (integer) (required) — Internal integration type ID; use `plugin_type`, not this ID, when creating an integration.\n  - plugin_type (string) (required) — Integration type, for example `standard.alert` or `zabbix.alert`.\n  - plugin_type_name (string) (required) — Display name of the integration type, in the language of the request.\n  - ref_id (string) (required) — Source reference ID, normally `a_<account_id>` for an account-level integration; legacy `w_` references may also exist. Channel-owned `c_` integrations are excluded.\n  - settings (object) (required) — Stored type-specific configuration, including credential values without masking; matches the legacy `/datasource/*` response behavior.\n  - status (string) (required) — Lifecycle status: `enabled` while the integration accepts events, `disabled` when it is paused. [enabled, disabled]\n  - team_id (integer) (required) — ID of the team that owns the integration. `0` when it is not assigned to a team.\n  - test (object) — Plugin test result, returned only when a test is performed.\n    - message (string) (required) — Test failure message; empty on success.\n    - success (boolean) (required) — Whether the plugin test succeeded.\n  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the member who last updated the integration.\n",
+	"Integrations.IntegrationAPIReadList":         "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - account_id (integer) (required) — ID of the account that owns the integration.\n  - category (string) (required) — Category the integration belongs to: `event.alert` alert events, `event.change` change events, `im` IM bots, `webhook` custom webhooks. [event.alert, event.change, im, webhook]\n  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the member who created the integration.\n  - data_source_id (integer) (required) — Legacy datasource ID, equal to `integration_id`.\n  - description (string) (required) — Free-form description.\n  - editable (boolean) (required) — Whether the current caller passes the integration object-permission check; write calls also require Integrations Manage.\n  - exclusive_data_source_id (integer) (required) — Legacy compatibility field; `0` for items returned by this public-integration list.\n  - integration_id (integer) (required) — Integration ID.\n  - integration_key (string) (required) — Decrypted integration key for inbound pushes. Empty when no key is stored; distinct from the account `app_key`.\n  - last_time (string) (required) — Unix timestamp in seconds of the most recent event received. `0` when no event has arrived yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - name (string) (required) — Integration name.\n  - no_editable (boolean) (required) — Read-only flag. When true, the public APIs do not allow changes to this integration.\n  - plugin_id (integer) (required) — Internal integration type ID; use `plugin_type`, not this ID, when creating an integration.\n  - plugin_type (string) (required) — Integration type, for example `standard.alert` or `zabbix.alert`.\n  - plugin_type_name (string) (required) — Display name of the integration type, in the language of the request.\n  - ref_id (string) (required) — Source reference ID, normally `a_<account_id>` for an account-level integration; legacy `w_` references may also exist. Channel-owned `c_` integrations are excluded.\n  - settings (object) (required) — Stored type-specific configuration, including credential values without masking; matches the legacy `/datasource/*` response behavior.\n  - status (string) (required) — Lifecycle status: `enabled` while the integration accepts events, `disabled` when it is paused. [enabled, disabled]\n  - team_id (integer) (required) — ID of the team that owns the integration. `0` when it is not assigned to a team.\n  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the member who last updated the integration.\n",
 	"Integrations.IntegrationAPIReadTypeList":     "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - category (string) (required) — Category the type belongs to: `event.alert` alert events, `event.change` change events, `im` IM bots, `webhook` custom webhooks. [event.alert, event.change, im, webhook]\n  - plugin_type (string) (required) — Type identifier to pass as `plugin_type` when creating an integration.\n  - plugin_type_logo_url (string) (required) — Logo URL of the type.\n  - plugin_type_name (string) (required) — Display name of the type.\n  - status (string) (required) — Platform status of the type.\n  - supports_api_create (boolean) (required) — Whether `POST /integration/create` accepts this type.\n",
-	"Integrations.IntegrationAPIWriteCreate":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - integration_id (integer) (required) — ID of the new integration.\n  - integration_key (string) (required) — Key used to authenticate inbound pushes to this integration. Returned here only; fetch a new one with `POST /integration/key/rotate`.\n",
-	"Integrations.IntegrationAPIWriteRotateKey":   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - integration_key (string) (required) — The new key. The previous key stops working immediately; this value cannot be read again later.\n",
-	"Integrations.IntegrationAPIWriteUpdate":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - category (any) (required)\n  - created_at (any) (required)\n  - description (any) (required)\n  - integration_id (any) (required)\n  - last_time (any) (required)\n  - name (any) (required)\n  - plugin_type (any) (required)\n  - plugin_type_name (any) (required)\n  - ref_id (any) (required)\n  - settings (object) (required) — Type-specific configuration. Sensitive values (endpoint, headers, secrets, passwords) are returned masked as `******`.\n  - status (any) (required)\n  - team_id (any) (required)\n  - updated_at (any) (required)\n",
+	"Integrations.IntegrationAPIWriteCreate":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - integration_id (integer) (required) — ID of the new integration.\n  - integration_key (string) (required) — Integration key for inbound pushes; also readable from `/integration/list` and `/integration/info`.\n  - test (object) — Plugin test result, returned only when a test is performed.\n    - message (string) (required) — Test failure message; empty on success.\n    - success (boolean) (required) — Whether the plugin test succeeded.\n",
+	"Integrations.IntegrationAPIWriteRotateKey":   "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - integration_key (string) (required) — New integration key; the previous key stops working immediately. Also readable from `/integration/list` and `/integration/info`.\n",
+	"Integrations.IntegrationAPIWriteUpdate":      "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - category (string) (required) — Category the integration belongs to: `event.alert` alert events, `event.change` change events, `im` IM bots, `webhook` custom webhooks. [event.alert, event.change, im, webhook]\n  - created_at (string) (required) — Unix timestamp in seconds when the integration was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - creator_id (integer) (required) — ID of the member who created the integration.\n  - description (string) (required) — Free-form description.\n  - editable (boolean) (required) — Whether the current caller passes the integration object-permission check; write calls also require Integrations Manage.\n  - integration_id (integer) (required) — Integration ID.\n  - integration_key (string) (required) — Decrypted integration key for inbound pushes. Empty when no key is stored; distinct from the account `app_key`.\n  - last_time (string) (required) — Unix timestamp in seconds of the most recent event received. `0` when no event has arrived yet. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - name (string) (required) — Integration name.\n  - no_editable (boolean) (required) — Read-only flag. When true, the public APIs do not allow changes to this integration.\n  - plugin_id (integer) (required) — Internal integration type ID; use `plugin_type`, not this ID, when creating an integration.\n  - plugin_type (string) (required) — Integration type, for example `standard.alert` or `zabbix.alert`.\n  - plugin_type_name (string) (required) — Display name of the integration type, in the language of the request.\n  - ref_id (string) (required) — Source reference ID, normally `a_<account_id>` for an account-level integration; legacy `w_` references may also exist. Channel-owned `c_` integrations are excluded.\n  - settings (object) (required) — Stored type-specific configuration, including credential values without masking; matches the legacy `/datasource/*` response behavior.\n  - status (string) (required) — Lifecycle status: `enabled` while the integration accepts events, `disabled` when it is paused. [enabled, disabled]\n  - team_id (integer) (required) — ID of the team that owns the integration. `0` when it is not assigned to a team.\n  - test (object) — Plugin test result, returned only when a test is performed.\n    - message (string) (required) — Test failure message; empty on success.\n    - success (boolean) (required) — Whether the plugin test succeeded.\n  - updated_at (string) (required) — Unix timestamp in seconds when the integration was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — ID of the member who last updated the integration.\n",
 	"Integrations.List":                           "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - attempt (integer) (required) — Attempt sequence number.\n  - channel_id (integer) — Channel ID associated with the event, when applicable.\n  - duration (integer) (required) — Total elapsed time of the attempt in milliseconds.\n  - endpoint (string) (required) — Destination URL.\n  - error_message (string) — Error message when delivery failed.\n  - event_id (string) (required) — Unique event identifier for the delivery attempt.\n  - event_time (string) (required) — Event time formatted as `YYYY-MM-DD HH:MM:SS.ffffff`.\n  - event_type (string) (required) — Event type code. `i_*` values are incident events (for example `i_new` = incident created); `a_*` values are alert events (for example `a_new` = alert triggered).\n  - integration_id (integer) (required) — Integration ID that triggered the webhook.\n  - ref_id (string) — Source object ID (incident ID or alert ID).\n  - request_body (string) — Outbound request body payload.\n  - request_headers (string) — Serialized outbound request headers.\n  - response_body (string) — Response body returned by the destination.\n  - response_headers (string) — Serialized response headers from the destination.\n  - status (string) (required) — Delivery outcome. [success, failed]\n  - status_code (integer) (required) — HTTP status code returned by the destination.\n  - webhook_type (string) (required) — Source object kind: `incident` or `alert`. [incident, alert]\n",
 	"IssuePresetSeverityRules.Create":             "Response fields (`data` envelope is unwrapped — these fields are at the top level):\n  - priority (integer) (required) — Evaluation order assigned to the new rule (always the current lowest precedence, i.e. current max + 1).\n  - rule_id (string) (required) — ID of the newly created rule.\n  - rule_name (string) (required) — Echo of the rule's display name.\n",
 	"IssuePresetSeverityRules.HistoryList":        "Response fields (this command's `--json` is a TOP-LEVEL array of these row objects — pipe `jq '.[]'`, NOT `.items[]`):\n  - rules (array<object>) (required) — Full rule set captured immediately before the mutation that produced this snapshot. Empty for the very first snapshot.\n    - account_id (integer) (required) — Account ID the rule belongs to.\n    - application_id (string) (required) — RUM application ID the rule belongs to.\n    - created_at (string) (required) — Unix timestamp in milliseconds when the rule was created. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - created_by (integer) (required) — Member ID who originally created the rule.\n    - deleted_at (string) (required) — Unix timestamp in milliseconds the rule was soft-deleted; `0` means not deleted. Always `0` in practice, since deleted rules are excluded before a snapshot is taken. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - description (string) (required) — Rule description. May be empty.\n    - filters (array<array<object>>) (required) — OR-of-ANDs filter structure: the outer array is OR'd, each inner array is AND'd. A rule matches an error when at least one inner AND-group fully matches.\n      - key (string) (required) — Filter attribute key. Only these Error-level attributes are supported for preset severity rules. | Value | Meaning | |---|---| | `error.usr_id` | User ID | | `error.usr_email` | User email | | `error.view_url` | Full URL of the page where the error occurred | | `error.view_url_path` | URL path of the page where the error occurred | | `error.error_type` | Error type | | `error.error_message` | Error message | | `error.env` | Environment (e.g. production/staging) | | `error.service` | Service name | | `error.device_type` | Device type | | `error.os_name` | Operating system name | | `error.browser_name` | Browser name | | `error.is_crash` | Whether the error is a crash (boolean) | [error.usr_id, error.usr_email, error.view_url, error.view_url_path, error.error_type, error.error_message, error.env, error.service, error.device_type, error.os_name, error.browser_name, error.is_crash]\n      - oper (string) (required) — Match semantics: `IN` matches when the field's value matches any of `vals`; `NOTIN` matches when it matches none of them (and matches when the field is absent). [IN, NOTIN]\n      - vals (array<string>) (required) — Values to match against. Each entry supports exact string match, wildcard (`*`/`?`), regex (wrap in `/.../`), CIDR (`cidr:10.0.0.0/8`) for IP-shaped values, or numeric comparison (`num:gt:100`, `num:le:50`, etc.).\n    - id (integer) (required) — Internal auto-increment row ID. Not stable across a history revert — reverting reinserts rows with new IDs.\n    - priority (integer) (required) — Evaluation order at snapshot time; `1` is highest precedence.\n    - rule_id (string) (required) — Unique rule ID.\n    - rule_name (string) (required) — Rule display name.\n    - severity (string) (required) — Severity assigned to errors matching this rule. [Critical, Warning, Info]\n    - status (string) (required) — Rule status at snapshot time. [enabled, disabled]\n    - updated_at (string) (required) — Unix timestamp in milliseconds when the rule was last updated. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n    - updated_by (integer) (required) — Member ID who last updated the rule as of snapshot time.\n  - updated_at (string) (required) — Unix timestamp in milliseconds when the snapshot was written. CLI `--json` renders this as an RFC3339 string in the process's local timezone (NOT UTC, and NOT the wire integer); an unset value renders as null.\n  - updated_by (integer) (required) — Member ID who triggered the mutation this snapshot precedes.\n  - updated_by_name (string) (required) — Display name of `updated_by` at the time of the change.\n  - version (integer) (required) — Monotonically increasing snapshot version number, starting at 1.\n",
diff --git a/skills/flashduty/reference/monit.md b/skills/flashduty/reference/monit.md
index 86d691a..900f476 100644
--- a/skills/flashduty/reference/monit.md
+++ b/skills/flashduty/reference/monit.md
@@ -98,7 +98,9 @@ List dashboard revisions
 ### dashboard-runtime-queries-resolve <panel-id> [<id2>...]
 Resolve panel queries
 - `--dashboard-id` string (required) — Canonical UUIDv7 of the dashboard.
+- `--max-data-points` int64 — Downsampling target used to compute the step and render the built-in time variables, 2–5000 points; omit or send null for the server default of 100. (2-5000)
 - `<panel-ids>` (positional, required) stringSlice — Panels to resolve, 1–100 unique IDs. A panel that does not exist yields an 'error' arm rather than failing the call.
+- `--preserve-builtin-variables` bool — Keep built-in time variables verbatim in the resolved expressions so a caller with its own execution window can render them; user variables are still resolved.
 - body-only (`--data`): time (object) (required); variables (object) (required)
 - response: single object (`data` unwrapped to the top level) — fields: dashboard_id (string); panels (array<object>); revision (integer); time (object); variables (object)