Eden REST API
Analytics And Observability APIs
/api/v1These APIs expose fleet analytics, endpoint analytics, live streams, and telemetry exports used by operational dashboards and migration validation runs.
Route Map
Fleet Analytics
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/analytics/status | Return analytics pipeline status. |
| GET | /api/v1/analytics/overview | Return organization analytics overview. |
| POST | /api/v1/analytics/enable | Enable analytics capture. |
| POST | /api/v1/analytics/disable | Disable analytics capture. |
| GET | /api/v1/analytics/dashboard | Return dashboard summary data. |
| GET | /api/v1/analytics/connections | Return active connection metrics. |
| GET | /api/v1/analytics/connections/stream | Stream active connection metrics. |
| GET | /api/v1/analytics/anomalies/status | Return current anomaly detector states. |
| GET | /api/v1/analytics/anomalies/transitions | Return anomaly state transitions. |
| GET | /api/v1/analytics/fleet/signals | Return fleet health signals. |
Streams And Query Capture
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/analytics/stream | Open the main analytics SSE stream. |
| GET | /api/v1/analytics/stream/queries | Open the live query SSE stream. |
| GET | /api/v1/analytics/stream/queries/capture | Return query-capture status. |
| POST | /api/v1/analytics/stream/queries/capture | Enable capture-all query streaming. |
| DELETE | /api/v1/analytics/stream/queries/capture | Disable capture-all query streaming. |
Telemetry Export
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/analytics/telemetry | Export telemetry rows by query parameters. |
| GET | /api/v1/analytics/telemetry/{signal} | Export one telemetry signal. |
| GET | /api/v1/analytics/clickhouse | Alias-compatible ClickHouse telemetry export. |
| GET | /api/v1/analytics/clickhouse/{signal} | Alias-compatible single-signal export. |
| GET | /api/v1/analytics/series | Return compressed columnar time-series data. |
Telemetry rows include telemetry_plane and data_class. The service binds queries to its configured private or public_marketplace plane; clients cannot request or override that isolation dimension. Series cache entries use the same plane binding. The data class is signal-owned: operational_metric, operational_log, or operational_trace.
Infrastructure Snapshots
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/analytics/infrastructure/snapshots | List captured infrastructure snapshots. |
| GET | /api/v1/analytics/infrastructure/snapshots/stats | Return snapshot aggregate stats. |
| GET | /api/v1/analytics/infrastructure/snapshots/{snapshot_uuid} | Return a single infrastructure snapshot. |
Endpoint Analytics
| Method | Route | Purpose |
|---|---|---|
| GET | /api/v1/endpoints/{endpoint}/analytics/commands/rollups | Return command rollups. |
| GET | /api/v1/endpoints/{endpoint}/analytics/metrics | Return endpoint metric snapshots. |
| GET | /api/v1/endpoints/{endpoint}/analytics/anti-patterns | Return anti-pattern findings. |
| GET | /api/v1/endpoints/{endpoint}/analytics/blocked-commands | Return blocked command history. |
| GET | /api/v1/endpoints/{endpoint}/analytics/pii | Return PII detection findings. |
| GET | /api/v1/endpoints/{endpoint}/analytics/audit-trail | Return audit trail entries. |
| GET | /api/v1/endpoints/{endpoint}/analytics/patterns | Return discovered query patterns. |
| GET | /api/v1/endpoints/{endpoint}/analytics/users | Return per-user rollups. |
| GET | /api/v1/endpoints/{endpoint}/analytics/recommendations | Return generic endpoint recommendations. |
| GET | /api/v1/endpoints/{endpoint}/analytics/mongo/recommendations | Return MongoDB recommendations. |
| GET | /api/v1/endpoints/{endpoint}/analytics/postgres/recommendations | Return PostgreSQL recommendations. |
Audit Trail Pagination And Scope
GET /api/v1/endpoints/{endpoint}/analytics/audit-trail accepts range, command, success, min_latency_us, and limit filters. limit defaults to 500 and must be between 1 and 1,000.
Pagination is a stable keyset over (event_time, event_id). Pass both cursor_time and cursor_id from the previous response's next_cursor; supplying only one is rejected. total_count covers every matching event in the requested range, not only the current page.
The query always combines the authenticated organization UUID with the endpoint UUID. A caller cannot override the tenant scope with query parameters, and the route requires the endpoint audit permission.
Notes
- Stream routes require clients to keep the HTTP connection open and handle reconnects.
- Some analytics routes require the service to be built with analytics and stream features enabled.
- Migration dashboards consume both aggregate analytics and endpoint analytics during live runs.