Edge Delta ServedByMCP API
The ServedByMCP API from Edge Delta — 8 operation(s) for servedbymcp.
OpenAPI Specification
swagger: '2.0'
info:
description: 'Edge Delta API provides endpoints to manage your configs/integrations/rehydrations and more. Generate an API token to get started: https://app.edgedelta.com/admin/organization#api-tokens'
title: Edge Delta Access ServedByMCP API
contact:
name: API Support
email: support@edgedelta.com
version: '1.0'
host: api.edgedelta.com
basePath: ''
schemes:
- https
tags:
- name: ServedByMCP
paths:
/v1/orgs/{org_id}/clustering/stats:
get:
security:
- ApiKeyAuth: []
description: Returns top log patterns (signatures of log messages) and their stats; count, proportion, sentiment and delta.
consumes:
- application/json
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Edge Delta Common Query Language expression
name: query
in: query
- type: boolean
description: If summary true call returns up to 50 interesting clusters with 10 top anomaly, top/bottom delta, top/bottom count. Param size is ignored
name: summary
in: query
- type: string
description: Max number of clusters in response. For AI search, limit should be 20.
name: limit
in: query
- type: string
description: Lookback period in golang duration format. e.g. '1h'. Either provide from/to or provide lookback/to or just lookback
name: lookback
in: query
- type: string
description: From datetime in ISO format 2006-01-02T15:04:05.000Z
name: from
in: query
- type: string
description: To datetime in ISO format 2006-01-02T15:04:05.000Z
name: to
in: query
- type: string
description: Comma separated fields to group by
name: groupby
in: query
- type: string
description: Valatility can be new, existing, gone, all. Default is all
name: volatility
in: query
- type: string
description: Comma separated offsets for delta stat calculation. Each offset is in golang duration format and order of offsets determines order of offset_ fields in cluster stat response. Default value is lookback duration. e.g. '24h'.
name: offset
in: query
- type: string
description: Window for on demand anomaly calculation histogram series. e.g. '5m', '1h', '2d'. Combined values like '5m3s' are NOT supported.
name: window
in: query
- type: boolean
description: Negative param is used to get negative sentiments.
name: negative
in: query
responses:
'200':
description: OK
schema:
$ref: '#/definitions/core.ClusterStatResponse'
/v1/orgs/{org_id}/dashboards:
get:
security:
- ApiKeyAuth: []
description: Returns all dashboards of users in the org.
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: boolean
description: Include definitions in the response
name: include_definitions
in: query
responses:
'200':
description: OK
schema:
type: array
items:
$ref: '#/definitions/dashboard.Dashboard'
/v1/orgs/{org_id}/dashboards/{dashboard_id}:
get:
security:
- ApiKeyAuth: []
description: Returns the dashboard for the given ID.
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Dashboard ID
name: dashboard_id
in: path
required: true
responses:
'200':
description: OK
schema:
type: array
items:
$ref: '#/definitions/dashboard.Dashboard'
/v1/orgs/{org_id}/events/search:
get:
security:
- ApiKeyAuth: []
description: Search query using Edge Delta events search syntax, for anomaly search query should include event.type:pattern_anomaly
consumes:
- application/json
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Lookback period in golang duration format. e.g. '1h'. Either provide from/to or provide lookback/to or just lookback
name: lookback
in: query
- type: string
description: From datetime in ISO format 2006-01-02T15:04:05.000Z
name: from
in: query
- type: string
description: To datetime in ISO format 2006-01-02T15:04:05.000Z
name: to
in: query
- type: string
description: Edge Delta Common Query Language expression
name: query
in: query
- type: integer
description: Limits the number of logs in the response. Default is 1000. It can be negative to move the cursor prev direction. Wraps to end if the cursor position is 0. For AI search, limit should be 20.
name: limit
in: query
- type: string
description: Cursor provided from previous response, pass it to next request so that we can move the cursor with given limit.
name: cursor
in: query
- type: string
description: Order of the logs in the response, either 'ASC', 'asc', 'DESC' or 'desc'
name: order
in: query
responses:
'200':
description: OK
schema:
$ref: '#/definitions/core.EventResponse'
/v1/orgs/{org_id}/logs/log_search/search:
get:
security:
- ApiKeyAuth: []
description: Returns time series log data for given query
consumes:
- application/json
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Lookback period in golang duration format. e.g. '1h'. Either provide from/to or provide lookback/to or just lookback
name: lookback
in: query
- type: string
description: From datetime in ISO format 2006-01-02T15:04:05.000Z
name: from
in: query
- type: string
description: To datetime in ISO format 2006-01-02T15:04:05.000Z
name: to
in: query
- type: string
description: Edge Delta Common Query Language expression
name: query
in: query
- type: integer
description: Limits the number of logs in the response. Default is 1000. It can be negative to move the cursor prev direction. Wraps to end if the cursor position is 0. For AI search, limit should be 20.
name: limit
in: query
- type: string
description: Scope can be audit or log
name: scope
in: query
- type: string
description: Cursor provided from previous response, pass it to next request so that we can move the cursor with given limit.
name: cursor
in: query
- type: string
description: Comma separated list of custom columns to include in the recent search queries
name: custom_columns
in: query
- type: string
description: Order of the logs in the response, either 'ASC', 'asc', 'DESC' or 'desc'
name: order
in: query
- type: string
description: Minimum log length to filter for
name: length
in: query
- type: string
description: Session ID to track the search session
name: sessionId
in: query
- type: string
description: Page ID to track the pagination state
name: pageId
in: query
- type: string
description: The boolean to decide whether to save the query in history
name: save
in: query
- type: string
description: Disable routing for the search
name: disable_routing
in: query
responses:
'200':
description: OK
schema:
$ref: '#/definitions/core.ArchiveResponseV1'
/v1/orgs/{org_id}/pipelines/{conf_id}/add_source:
post:
description: 'Adds the given source node configuration to the pipeline and connect it to Edgedelta Destination. Saves the updated pipeline configuration without deploying changes.
Example request body for file_input node:
{
"node": {
"name": "my_file_input",
"type": "file_input",
"path": "path/to/my_logs/logs.txt",
"separate_source": true,
"description": "A user-defined description of the Node. Users may add any additional comments describing the function of their node.\nThis is useful to put some notes into the config file since YAML comment lines (\"#\") are not persisted due to automated marshal/unmarshal of YAML. It should be human readable and not too long."
}
}
Example request body for kubernetes_input node:
{
"node": {
"name": "my_k8s_input",
"type": "kubernetes_input",
"include": [
"k8s.pod.name=^apache.*$,k8s.namespace.name=.*web*"
],
"exclude": [
"k8s.namespace.name=^kube-nginx$",
"k8s.pod.name=.*nginx*,k8s.container.name=testing"
],
"auto_detect_line_pattern": true,
"boost_stacktrace_detection": true,
"enable_persisting_cursor": true,
"description": "A user-defined description of the Node. Users may add any additional comments describing the function of their node.\nThis is useful to put some notes into the config file since YAML comment lines (\"#\") are not persisted due to automated marshal/unmarshal of YAML. It should be human readable and not too long."
}
}
Example request body for demo_input node:
{
"node": {
"name": "my_demo_input",
"type": "demo_input",
"events_per_sec": 1,
"log_type": "apache_common",
"description": "A user-defined description of the Node. Users may add any additional comments describing the function of their node.\nThis is useful to put some notes into the config file since YAML comment lines (\"#\") are not persisted due to automated marshal/unmarshal of YAML. It should be human readable and not too long."
}
}'
consumes:
- application/json
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Conf ID
name: conf_id
in: path
required: true
- description: Source node configuration to add
name: request
in: body
required: true
schema:
$ref: '#/definitions/pipeline.AddSourceRequest'
responses:
'200':
description: OK
schema:
$ref: '#/definitions/configv3.Config'
/v1/orgs/{org_id}/pipelines/{conf_id}/deploy/{version}:
post:
description: Deploys the pipeline configuration. Version is the timestamp of the Pipeline history. Pipeline history should be called to get the version.
consumes:
- application/json
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Config ID
name: conf_id
in: path
required: true
- type: string
description: 'Version use lastUpdated field from pipeline in milliseconds timestamp format. Example: 1752190141312. This is the timestamp field of the most recent element in the result of pipeline history. So, pipeline_history should be called before this tool to get the latest version of the pipeline.'
name: version
in: path
required: true
responses:
'200':
description: OK
schema:
$ref: '#/definitions/pipeline.GetVisualPipelineResponse'
/v1/orgs/{org_id}/pipelines/{conf_id}/history:
get:
description: Returns the history of a Pipeline configuration. Timestamp of the Pipeline history is used as version when deploying the Pipeline.
consumes:
- application/json
produces:
- application/json
tags:
- ServedByMCP
parameters:
- type: string
description: Org ID
name: org_id
in: path
required: true
- type: string
description: Config ID
name: conf_id
in: path
required: true
- type: boolean
description: If true only retrieve latest history
name: only_latest
in: query
responses:
'200':
description: OK
schema:
type: array
items:
$ref: '#/definitions/core.ConfigHistory'
definitions:
core.FleetType:
type: string
enum:
- Edge
- Cloud
- IngestionPipeline
- Edge-extended
- Cloud-extended
x-enum-varnames:
- EdgeFleetType
- CloudFleetType
- IngestionPipelineFleetType
- EdgeExtendedFleetType
- CloudExtendedFleetType
core.ConfigHistoryStatus:
type: string
enum:
- Not Deployed
- Deployed
x-enum-varnames:
- ConfigHistoryNotDeployed
- ConfigHistoryDeployed
configv3.Authorization:
type: object
properties:
client_credentials:
$ref: '#/definitions/configv3.AuthorizationClientCredentials'
strategy:
type: string
configv3.MetricConfig:
type: object
properties:
aggregation:
description: Aggregation is required for "sum" and can be cumulative or delta
type: string
column_oids:
type: array
items:
$ref: '#/definitions/configv3.OID'
description:
description: Description is optional and describes what this metric represents
type: string
metric_type:
description: Type is required and can be either "gauge" or "sum".
type: string
monotonic:
description: Monotonic is required for "sum" and can be true or false
type: boolean
name:
description: 'Name is the name of the metric as it will be reported in the OpenTelemetry Collector.
It is required and must be unique across all metrics.'
type: string
scalar_oids:
description: 'Either ScalarOIDs or ColumnOIDs is required.
ScalarOIDs is used if one or more scalar OID values is used for this metric.
ColumnOIDs is used if one or more column OID indexed set of values is used for this metric.'
type: array
items:
$ref: '#/definitions/configv3.OID'
unit:
description: Unit is required
type: string
value_type:
description: ValueType is required and can be either int or double
type: string
configv3.ResourceFields:
type: object
properties:
namespace_labels:
description: NamespaceLabels is for K8s
type: array
items:
type: string
node_labels:
description: NodeLabels is for K8s
type: array
items:
type: string
pod_annotations:
description: PodAnnotations is for K8s
type: array
items:
type: string
pod_labels:
description: PodLabels is for K8s
type: array
items:
type: string
configv3.ResilienceConfig:
type: object
properties:
circuit_breaker:
description: Circuit breaker configuration
allOf:
- $ref: '#/definitions/configv3.CircuitBreakerConfig'
configv3.CustomLabels:
type: object
properties:
keep_overridden_path:
type: boolean
name:
type: string
path:
type: string
configv3.Link:
type: object
properties:
from:
type: string
path:
type: string
to:
type: string
core.HostedEnvState:
type: string
enum:
- startState
- createNamespace
- createSecret
- createServiceAccount
- createRoleAndBinding
- createPersistentVolumeClaim
- createIngress
- createDeployment
- createHorizontalPodAutoscaler
- createServiceAndBinding
- createExternalService
- createIngressRule
- deleteNamespace
- deleteExternalService
- deleteIngressRule
x-enum-varnames:
- HostedEnvStartState
- HostedEnvCreateNamespace
- HostedEnvCreateSecret
- HostedEnvCreateServiceAccount
- HostedEnvCreateRoleAndBinding
- HostedEnvCreatePersistentVolumeClaim
- HostedEnvCreateIngress
- HostedEnvCreateDeployment
- HostedEnvCreateHorizontalPodAutoscaler
- HostedEnvCreateServiceAndBinding
- HostedEnvCreateExternalService
- HostedEnvCreateIngressRule
- HostedEnvDeleteNamespace
- HostedEnvDeleteExternalService
- HostedEnvDeleteIngressRule
configv3.Key:
type: object
properties:
value:
type: string
configv3.OID:
type: object
properties:
attributes:
type: array
items:
$ref: '#/definitions/configv3.Attribute'
oid:
type: string
resource_attributes:
type: array
items:
type: string
core.CloudProviderType:
type: string
enum:
- aws
- gcp
- minio
- dos
- ibmos
- zenko
- azure
x-enum-varnames:
- AWS
- GCP
- Minio
- DigitalOceanSpaces
- IBMObjectStorage
- ZenkoCloudserver
- Azure
configv3.ExtractMetricSum:
type: object
properties:
aggregation_temporality:
type: string
is_monotonic:
type: boolean
value:
type: string
core.HostedAgentEnv:
type: object
properties:
agent_version:
type: string
cloud:
description: Cloud is the cloud provider name. By default it's AWS
allOf:
- $ref: '#/definitions/core.CloudProviderType'
compute_unit:
type: number
conf_id:
type: string
created:
description: Created & Updated are timestamps in core.StorageTimeFormat
type: string
creator:
type: string
enabled_endpoints:
description: EnabledEndpoints is a user supplied list of endpoints desired with respect to type
type: array
items:
type: string
endpoints:
description: Endpoints is map of URLs that can be used for accessing agent
type: object
additionalProperties:
type: string
env_id:
type: string
error:
type: string
has_auto_gen_config:
description: HasAutoGenConfig indicates this env has auto generated config (Generate one for me at the UI)
type: boolean
has_https_endpoint:
description: 'DEPRECATED
HasHTTPSEndpoint indicates this env has an HTTPS endpoint.'
type: boolean
https_endpoint:
description: 'DEPRECATED
HTTPSEndpoint is the URL of the HTTPS endpoint if provisioned.
It''s format is https://{region}.{cloud}.ingress.edgedelta.com/listen/{env_id}'
type: string
is_suspended:
description: IsSuspended indicates agents should scale down to zero or not
type: boolean
name:
type: string
orgID:
type: string
purpose:
description: Purpose denotes the reason for creating this cloud fleet
allOf:
- $ref: '#/definitions/core.HostedEnvPurpose'
region:
description: 'Region in the cloud provider. By default it''s us-west2.
We have to pre-provision hosted clusters in multiple regions so not all regions are applicable.'
type: string
state:
description: 'Last successful create resource step for this env to prevent duplicate resource creation
Default is StartState'
allOf:
- $ref: '#/definitions/core.HostedEnvState'
status:
$ref: '#/definitions/core.HostedEnvStatus'
updated:
type: string
updater:
type: string
version:
description: Version is the hosted agent version
type: string
pipeline.AddSourceRequest:
type: object
required:
- node
properties:
node:
description: Configuration of the source node to be added
allOf:
- $ref: '#/definitions/pipeline.Node'
dashboard.Screenshot:
type: object
properties:
dark_url:
type: string
last_triggered_at:
type: string
last_updated_at:
type: string
light_url:
type: string
status:
$ref: '#/definitions/dashboard.ScreenshotStatus'
configv3.LiveTailSettings:
type: object
properties:
enabled:
type: boolean
item_max_body_size:
$ref: '#/definitions/datasize.Size'
item_truncation_size:
$ref: '#/definitions/datasize.Size'
lower_threshold_size:
description: 'Deprecated: These fields are retained for backward compatibility with existing configs.
They are parsed but ignored at runtime. Use ItemTruncationSize and ItemMaxBodySize instead.'
allOf:
- $ref: '#/definitions/datasize.Size'
max_items:
type: integer
polling_interval:
type: string
retention:
type: string
upper_threshold_size:
$ref: '#/definitions/datasize.Size'
configv3.FieldMapping:
type: object
properties:
enabled:
description: Enabled controls whether this field mapping is active.
type: boolean
keep_in_item:
description: KeepInItem controls whether to keep the field in item data after extraction.
type: boolean
path:
description: 'Path is the OTTL expression to extract value from OTEL item.
Example: ''attributes["ed.gcl.name"]'', ''resource["host.name"]'', "severity_text"'
type: string
configv3.FieldMappings:
type: object
properties:
field_name:
type: string
override_if_exists:
type: boolean
value:
type: string
value_hint:
type: string
configv3.InputDiscovery:
type: object
properties:
file_path:
description: 'FilePath is used for globbing files for. For K8s, we will use this glob path
instead of well-known ones to handle non-stdout cases'
type: string
parsing_pattern:
description: 'ParsingPattern is used for extracting information out of literal file paths.
For K8s, it will be used for extracting pod UID (required) and container name (optional).'
type: string
configv3.LookupField:
type: object
properties:
append_mode:
type: boolean
default_value:
type: string
event_field:
type: string
lookup_field:
type: string
pipeline.GetVisualPipelineResponse:
type: object
properties:
clusterName:
type: string
content:
type: string
createdAt:
type: string
createdBy:
type: string
environment:
$ref: '#/definitions/core.EnvironmentType'
fleetSubtype:
$ref: '#/definitions/core.FleetSubtype'
fleetType:
$ref: '#/definitions/core.FleetType'
hostedEnv:
$ref: '#/definitions/core.HostedAgentEnv'
id:
type: string
lastUpdated:
type: string
orgID:
type: string
pipeline:
$ref: '#/definitions/pipeline.Pipeline'
pipelineNodes:
description: 'Deprecated: 6-2-23 This field will be removed in a future release. Please use Pipeline.Nodes instead'
type: array
items:
$ref: '#/definitions/pipeline.VisualizerNode'
rollout_task_id:
type: string
state:
$ref: '#/definitions/core.PipelineStateSummary'
updatedBy:
type: string
nodetype.NodeCategory:
type: string
enum:
- input
- output
- processor
- '*'
- invalid
x-enum-varnames:
- InputNodeCategory
- OutputNodeCategory
- ProcessorNodeCategory
- AnyNodeCategory
- InvalidNodeCategory
configv3.Node:
type: object
required:
- command
- run_interval
properties:
access_key:
description: '#nosec G117 -- AWS access key in config'
type: string
account_key:
type: string
account_name:
description: Azure Blob specific
type: string
active_gate_domain:
type: string
active_gate_port:
type: integer
active_request_limit:
type: integer
add_attributes:
type: boolean
add_ingestion_time:
type: boolean
address:
type: array
items:
type: string
aggregate_metric_rules:
type: array
items:
$ref: '#/definitions/configv3.AggregateMetricRule'
alert_as_log:
description: Alert as log is used to send alerts as log instead of events by default for some destinations
type: boolean
allow_skip_pri_header:
type: boolean
anomaly_coefficient:
type: number
anomaly_confidence_period:
type: string
anomaly_tolerance:
type: number
api_key:
description: '#nosec G117 -- API key in config'
type: string
api_version:
type: string
async:
type: boolean
attributes_from_header:
type: array
items:
type: string
auth_password:
description: 'AuthPassword is the authentication password used for this SNMP connection.
Only valid for version "v3" and if "no_auth_no_priv" is not selected for SecurityLevel'
type: string
auth_type:
description: 'AuthType is the type of authentication protocol to use for this SNMP connection.
Only valid for version “v3” and if “no_auth_no_priv” is not selected for SecurityLevel
Valid options: “md5”, “sha”, “sha224”, “sha256”, “sha384”, “sha512”
Default: "md5"'
type: string
authentication:
description: Since both inputs and outputs have these in common, this field is shared here
allOf:
- $ref: '#/definitions/configv3.AuthenticationConf'
authorization:
description: Authorization is used by HTTP pull and HTTP output node
allOf:
- $ref: '#/definitions/configv3.Authorization'
auto_create_container:
type: boolean
auto_detect_line_pattern:
description: For the next 3 bool, should these functionalities stay at the input level?
type: boolean
aws_key_id:
description: AWS related fields
type: string
aws_sec_key:
type: string
batch_bytes:
type: integer
batch_size:
description: Kafka + Port output specific
type: integer
batch_timeout:
type: string
body_mapping:
description: 'BodyMapping controls what gets sent as the payload body to destination.
When enabled, only the mapped OTTL path is sent as body.
When disabled, entire OTEL item is sent as body.'
allOf:
- $ref: '#/definitions/configv3.BodyMapping'
boost_stacktrace_detection:
type: boolean
brokers:
type: array
items:
type: string
bucket:
description: Archive specific (S3 + GCS)
type: string
bucket_expression:
type: string
buffer_length:
type: integer
buffer_max_bytesize:
description: DEPRECATED
allOf:
- $ref: '#/definitions/datasize.Size'
buffer_path:
description: 'Persistent retry buffer related fields
DEPRECATED'
type: string
buffer_size:
description: DEPRECATED
allOf:
- $ref: '#/definitions/datasize.Size'
buffer_ttl:
description: DEPRECATED
type: string
cache:
$ref: '#/definitions/configv3.SamplingCaches'
capture_group_masks:
description: 'the mapping for capture groups such as "pw: ******" or "pw: ''''" if removal without replacement desired. If ''Mask'' is defined, this feature will be suppressed by it.'
type: array
items:
$ref: '#/definitions/configv3.CaptureGroupMask'
capture_request_headers:
type: boolean
channel:
type: string
channel_size:
type: integer
checkpoint_directory:
type: string
clickhouse_table:
type: string
client_id:
type: string
client_secret:
description: '#nosec G117 -- client secret in config'
type: string
cloud_id:
description: 'Elasticsearch specific
cloudID or address url for endpoint'
type: string
collection_interval:
description: 'CollectionInterval sets how frequently the scraper
should be called and used as the context timeout
to ensure that scrapers don''t exceed the interval.'
type: string
command:
type: string
commit_interval:
type: string
community:
description: 'Community is the SNMP community string to use.
Only valid for versions "v1" and "v2c"
Default: public'
type: string
compression:
type: string
condition:
description: Used by both OTTL filter and threshold
type: string
config:
type: string
connection_string:
type: string
connector_metadata:
description: ConnectorMetadata is used by HTTP input node to denote cloud based HTTP connectors
allOf:
- $ref: '#/definitions/configv3.ConnectorMetadata'
consecutive:
type: integer
consumer_group:
type: string
container:
type: string
count_field_path:
type: string
create_missing_group_and_stream:
type: boolean
credentials_path:
description: CredentialsPath is a path to a file containing credentials. In the case of GCL output, it is a service account credentials JSON file
type: string
current_boot_only:
type: boolean
custom_api_version_response:
type: string
custom_pattern:
type: string
custom_resources:
description: CustomResources configures custom CRDs to watch for events
type: array
items:
$ref: '#/definitions/configv3.K8sCustomResourceConfig'
custom_tags:
description: CustomTags are here for backwards compatibility reasons
type: array
items:
$ref: '#/definitions/configv3.CustomTag'
customer_id:
description: Following fields are for Google SecOps (Chronicle) output node
type: string
data_collection_endpoint:
type: string
data_collection_rule_id:
type: string
data_type:
description: DEPRECATED
type: string
database:
description: ClickHouse configuration
type: string
dataset:
description: BigQuery configuration
type: string
dd_datatype:
type: string
dd_host:
type: string
dd_hostname:
type: string
dd_level:
type: string
dd_message:
type: string
dd_service:
type: string
dd_source:
type: string
dd_source_name:
type: string
dd_tags:
type: string
decision_interval:
description: For tail sampling
type: string
delimiter:
description: 'Following fields apply to split with delimiter filter type
Delimiter is the specified delimiting character used to split a single log to multiple logs'
# --- truncated at 32 KB (147 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/edge-delta/refs/heads/main/openapi/edge-delta-servedbymcp-api-openapi.yml