[{"name":"Cortex.Api.AssetGroups","comment":" Cortex asset-group listings.\n\n@docs AssetGroupsResponse\n@docs list\n\n","unions":[],"aliases":[{"name":"AssetGroupsResponse","comment":" Asset-group records use XDM.ASSET\\_GROUP.\\* uppercase dotted field names\nand include complex filter/membership structures that vary per group. We\npreserve each group as raw JSON to capture every field verbatim.\n","args":[],"type":"{ data : List.List Json.Encode.Value, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"list","comment":" POST /public\\_api/v1/asset-groups\n","type":"Cortex.Request.Request Cortex.Api.AssetGroups.AssetGroupsResponse"}],"binops":[]},{"name":"Cortex.Api.Assets","comment":" Cortex asset inventory and external attack-surface views.\n\n@docs AssetsResponse, CountedResponse, LastAssessment, SchemaEntry, WebsitesLastAssessment\n@docs list, getSchema\n@docs getExternalIpRanges, getExternalServices, getExternalWebsites, getInternetExposures, getVulnerabilityTests, getWebsitesLastAssessment\n\n","unions":[],"aliases":[{"name":"AssetsResponse","comment":" Response shape for POST /public\\_api/v1/assets — the asset inventory list.\nThe top-level envelope contains metadata; each asset's xdm.asset.\\* fields are\npreserved as raw JSON.\n","args":[],"type":"{ data : List.List Json.Encode.Value, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"CountedResponse","comment":" Generic paginated response shape shared by several asset endpoints. The\ninner items vary so widely (external services, internet exposures, IP ranges,\nvulnerability tests, websites) that each item is decoded as raw JSON to\npreserve every field.\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, items : List.List Json.Encode.Value }"},{"name":"LastAssessment","comment":" Status + timestamp pair used inside [`WebsitesLastAssessment`](#WebsitesLastAssessment).\n","args":[],"type":"{ status : Maybe.Maybe Basics.Bool, time : Maybe.Maybe Basics.Int }"},{"name":"SchemaEntry","comment":" One row of the asset inventory schema returned by [`getSchema`](#getSchema).\n","args":[],"type":"{ fieldName : Maybe.Maybe String.String, fieldPrettyName : Maybe.Maybe String.String, dataType : Maybe.Maybe String.String }"},{"name":"WebsitesLastAssessment","comment":" Wrapper for [`getWebsitesLastAssessment`](#getWebsitesLastAssessment)'s\nsingle `last_external_assessment` field.\n","args":[],"type":"{ lastExternalAssessment : Cortex.Api.Assets.LastAssessment }"}],"values":[{"name":"getExternalIpRanges","comment":" POST /public\\_api/v1/assets/get\\_external\\_ip\\_address\\_ranges — discovered external IP ranges.\n","type":"Cortex.Request.Request Cortex.Api.Assets.CountedResponse"},{"name":"getExternalServices","comment":" POST /public\\_api/v1/assets/get\\_external\\_services — externally reachable services.\n","type":"Cortex.Request.Request Cortex.Api.Assets.CountedResponse"},{"name":"getExternalWebsites","comment":" POST /public\\_api/v1/assets/get\\_external\\_websites — externally reachable websites.\n","type":"Cortex.Request.Request Cortex.Api.Assets.CountedResponse"},{"name":"getInternetExposures","comment":" POST /public\\_api/v1/assets/get\\_assets\\_internet\\_exposure — assets exposed to the public internet.\n","type":"Cortex.Request.Request Cortex.Api.Assets.CountedResponse"},{"name":"getSchema","comment":" GET /public\\_api/v1/assets/schema — list the tenant's asset schema.\n","type":"Cortex.Request.Request (List.List Cortex.Api.Assets.SchemaEntry)"},{"name":"getVulnerabilityTests","comment":" POST /public\\_api/v1/assets/get\\_vulnerability\\_tests — vulnerability scanner results.\n","type":"Cortex.Request.Request Cortex.Api.Assets.CountedResponse"},{"name":"getWebsitesLastAssessment","comment":" POST /public\\_api/v1/assets/get\\_external\\_websites/last\\_external\\_assessment —\nstatus + timestamp of the most recent websites scan.\n","type":"Cortex.Request.Request Cortex.Api.Assets.WebsitesLastAssessment"},{"name":"list","comment":" POST /public\\_api/v1/assets — the asset inventory list.\n","type":"Cortex.Request.Request Cortex.Api.Assets.AssetsResponse"}],"binops":[]},{"name":"Cortex.Api.AttackSurface","comment":" Cortex ASM (attack-surface management) rule configuration.\n\n@docs AttackSurfaceRule, RulesResponse\n@docs getRules\n\n","unions":[],"aliases":[{"name":"AttackSurfaceRule","comment":" A single ASM rule row.\n","args":[],"type":"{ attackSurfaceRuleName : Maybe.Maybe String.String, enabledStatus : Maybe.Maybe String.String, priority : Maybe.Maybe String.String, description : Maybe.Maybe String.String, category : Maybe.Maybe String.String, attackSurfaceRuleId : Maybe.Maybe String.String, asmAlertCategories : List.List Json.Encode.Value, created : Maybe.Maybe Basics.Int }"},{"name":"RulesResponse","comment":" Paginated envelope returned by [`getRules`](#getRules).\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, attackSurfaceRules : List.List Cortex.Api.AttackSurface.AttackSurfaceRule }"}],"values":[{"name":"getRules","comment":" POST /public\\_api/v1/get\\_attack\\_surface\\_rules\n","type":"Cortex.Request.Request Cortex.Api.AttackSurface.RulesResponse"}],"binops":[]},{"name":"Cortex.Api.AuditLogs","comment":" Cortex tenant audit-log queries (management events and agent reports).\n\n@docs AuditLog, SearchResponse, AgentsReportsResponse\n@docs search, agentsReports\n\n","unions":[],"aliases":[{"name":"AgentsReportsResponse","comment":" Agent reports have uppercase field names (TIMESTAMP, ENDPOINTID, DOMAIN,\nCATEGORY, SUBTYPE, …) and some floating-point timestamps, so the report rows\nare preserved as raw JSON to capture every field without duplicating the agent\nevent schema here.\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, data : List.List Json.Encode.Value }"},{"name":"AuditLog","comment":" A single audit-management event (user action on the tenant).\n","args":[],"type":"{ auditId : Basics.Int, ownerName : Maybe.Maybe String.String, ownerEmail : Maybe.Maybe String.String, entity : Maybe.Maybe String.String, result : Maybe.Maybe String.String, description : Maybe.Maybe String.String, insertTime : Maybe.Maybe Basics.Int }"},{"name":"SearchResponse","comment":" Paginated envelope returned by [`search`](#search).\n","args":[],"type":"{ totalCount : Basics.Int, resultCount : Basics.Int, data : List.List Cortex.Api.AuditLogs.AuditLog }"}],"values":[{"name":"agentsReports","comment":" POST /public\\_api/v1/audits/agents\\_reports\n","type":"Cortex.Request.Request Cortex.Api.AuditLogs.AgentsReportsResponse"},{"name":"search","comment":" POST /public\\_api/v1/audits/management\\_logs\n\nRetrieve audit management logs. Sends an empty request\\_data to get all results.\nResponse uses the `reply` envelope.\n\n","type":"Cortex.Request.Request Cortex.Api.AuditLogs.SearchResponse"}],"binops":[]},{"name":"Cortex.Api.AuthSettings","comment":" Cortex tenant IdP/SSO authentication settings.\n\n@docs get\n\n","unions":[],"aliases":[],"values":[{"name":"get","comment":" POST /public\\_api/v1/authentication-settings/get/settings\n\nReturns a raw list of authentication-settings objects (many nullable fields\nwhose shape varies by IdP configuration). We decode the reply as raw JSON\nso every field is preserved verbatim.\n\n","type":"Cortex.Request.Request (List.List Json.Encode.Value)"}],"binops":[]},{"name":"Cortex.Api.Biocs","comment":" Cortex behavioral indicators of compromise (BIOCs).\n\n@docs BiocsResponse\n@docs get\n\n","unions":[],"aliases":[{"name":"BiocsResponse","comment":" BIOC objects have ~15 variable fields including a nested `indicator` object\nwhose shape depends on the rule type. We decode the BIOC items as raw JSON so\nevery field is preserved without duplicating the whole Cortex BIOC schema here.\n","args":[],"type":"{ objectsCount : Maybe.Maybe Basics.Int, objects : List.List Json.Encode.Value, objectsType : Maybe.Maybe String.String }"}],"values":[{"name":"get","comment":" POST /public\\_api/v1/bioc/get\n\nResponse is top-level `{objects_count, objects, objects_type}` — NOT wrapped\nin the usual `reply` envelope.\n\n","type":"Cortex.Request.Request Cortex.Api.Biocs.BiocsResponse"}],"binops":[]},{"name":"Cortex.Api.Cli","comment":" Latest Cortex CLI version announced by the tenant.\n\n@docs VersionResponse\n@docs getVersion\n\n","unions":[],"aliases":[{"name":"VersionResponse","comment":" Latest published CLI version string returned by [`getVersion`](#getVersion).\n","args":[],"type":"{ version : String.String }"}],"values":[{"name":"getVersion","comment":" GET /public\\_api/v1/cli/releases/version\n\nGet the latest version of the Cortex CLI.\n\n","type":"Cortex.Request.Request Cortex.Api.Cli.VersionResponse"}],"binops":[]},{"name":"Cortex.Api.Correlations","comment":" Cortex correlation rules.\n\n@docs CorrelationsResponse\n@docs get\n\n","unions":[],"aliases":[{"name":"CorrelationsResponse","comment":" Correlation rule objects contain ~20 variable fields including query text\nand complex nested configuration. We decode them as raw JSON to preserve every\nfield without mirroring the whole Cortex correlation-rules schema.\n","args":[],"type":"{ objectsCount : Maybe.Maybe Basics.Int, objects : List.List Json.Encode.Value, objectsType : Maybe.Maybe String.String }"}],"values":[{"name":"get","comment":" POST /public\\_api/v1/correlations/get\n\nResponse is top-level `{objects_count, objects, objects_type}` — NOT wrapped\nin the usual `reply` envelope.\n\n","type":"Cortex.Request.Request Cortex.Api.Correlations.CorrelationsResponse"}],"binops":[]},{"name":"Cortex.Api.DeviceControl","comment":" Cortex device-control policy violations.\n\n@docs ViolationsResponse\n@docs getViolations\n\n","unions":[],"aliases":[{"name":"ViolationsResponse","comment":" Paginated envelope of raw violation rows returned by [`getViolations`](#getViolations).\nViolations have too many variable fields to type exhaustively, so each row is preserved as JSON.\n","args":[],"type":"{ totalCount : Maybe.Maybe Basics.Int, resultCount : Maybe.Maybe Basics.Int, violations : List.List Json.Encode.Value }"}],"values":[{"name":"getViolations","comment":" POST /public\\_api/v1/device\\_control/get\\_violations\n","type":"Cortex.Request.Request Cortex.Api.DeviceControl.ViolationsResponse"}],"binops":[]},{"name":"Cortex.Api.Distributions","comment":" Cortex agent installer distributions and available versions.\n\n@docs Distribution, DistributionsResponse, Versions\n@docs getDistributions, getVersions\n\n","unions":[],"aliases":[{"name":"Distribution","comment":" A single agent installer distribution.\n","args":[],"type":"{ distributionId : Maybe.Maybe String.String, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, packageType : Maybe.Maybe String.String, platform : Maybe.Maybe String.String, agentVersion : Maybe.Maybe String.String, status : Maybe.Maybe String.String, tags : List.List String.String, eolTime : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, creationTime : Maybe.Maybe Basics.Int, modificationTime : Maybe.Maybe Basics.Int, supportedPackages : List.List String.String }"},{"name":"DistributionsResponse","comment":" Paginated envelope returned by [`getDistributions`](#getDistributions).\n","args":[],"type":"{ data : List.List Cortex.Api.Distributions.Distribution, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"Versions","comment":" The OpenAPI spec only documents `windows`, `linux`, and `macos`, but the\nlive tenant also returns `container` and `serverless` arrays. Per CLAUDE.md\nwe capture every field the API returns.\n","args":[],"type":"{ windows : List.List String.String, linux : List.List String.String, macos : List.List String.String, container : List.List String.String, serverless : List.List String.String }"}],"values":[{"name":"getDistributions","comment":" POST /public\\_api/v1/distributions/get\\_distributions\n","type":"Cortex.Request.Request Cortex.Api.Distributions.DistributionsResponse"},{"name":"getVersions","comment":" POST /public\\_api/v1/distributions/get\\_versions\n","type":"Cortex.Request.Request Cortex.Api.Distributions.Versions"}],"binops":[]},{"name":"Cortex.Api.Endpoints","comment":" Cortex endpoint inventory.\n\n@docs Endpoint, ListResponse\n@docs list\n\n","unions":[],"aliases":[{"name":"Endpoint","comment":" A single Cortex endpoint (managed host running an agent).\n","args":[],"type":"{ agentId : String.String, agentStatus : Maybe.Maybe String.String, operationalStatus : Maybe.Maybe String.String, hostName : Maybe.Maybe String.String, agentType : Maybe.Maybe String.String, ip : List.List String.String, lastSeen : Maybe.Maybe Basics.Int, tags : Json.Encode.Value, users : List.List String.String }"},{"name":"ListResponse","comment":" Envelope wrapping the endpoint list returned by [`list`](#list).\n","args":[],"type":"{ endpoints : List.List Cortex.Api.Endpoints.Endpoint }"}],"values":[{"name":"list","comment":" POST /public\\_api/v1/endpoints/get\\_endpoints\n\nRetrieve a list of all endpoints (agents) on the tenant.\nResponse uses the `reply` envelope containing a flat array.\n\n","type":"Cortex.Request.Request Cortex.Api.Endpoints.ListResponse"}],"binops":[]},{"name":"Cortex.Api.Healthcheck","comment":" Lightweight tenant reachability probe.\n\n@docs HealthcheckResponse\n@docs check\n\n","unions":[],"aliases":[{"name":"HealthcheckResponse","comment":" Single-field status response returned by [`check`](#check).\n","args":[],"type":"{ status : String.String }"}],"values":[{"name":"check","comment":" GET /public\\_api/v1/healthcheck\n\nPerform a health check of the Cortex environment.\nReturns a simple status string (e.g. \"available\").\n\n","type":"Cortex.Request.Request Cortex.Api.Healthcheck.HealthcheckResponse"}],"binops":[]},{"name":"Cortex.Api.Indicators","comment":" Cortex threat intelligence indicators (IOCs).\n\n@docs Indicator, IndicatorsResponse\n@docs get\n\n","unions":[],"aliases":[{"name":"Indicator","comment":" A single threat-intelligence indicator (hash, domain, URL, IP, etc.).\nThe `reputation` and `reliability` fields carry per-source sub-objects whose\nshape varies, so they are kept as raw JSON.\n","args":[],"type":"{ ruleId : Maybe.Maybe Basics.Int, indicator : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, severity : Maybe.Maybe String.String, expirationDate : Maybe.Maybe Basics.Int, defaultExpirationEnabled : Maybe.Maybe Basics.Bool, comment : Maybe.Maybe String.String, reputation : Json.Encode.Value, reliability : Json.Encode.Value }"},{"name":"IndicatorsResponse","comment":" Envelope returned by [`get`](#get). Not wrapped in the standard `reply`.\n","args":[],"type":"{ objectsCount : Maybe.Maybe Basics.Int, objects : List.List Cortex.Api.Indicators.Indicator, objectsType : Maybe.Maybe String.String }"}],"values":[{"name":"get","comment":" POST /public\\_api/v1/indicators/get\n\nResponse is top-level `{objects_count, objects, objects_type}` — NOT wrapped\nin the usual `reply` envelope.\n\n","type":"Cortex.Request.Request Cortex.Api.Indicators.IndicatorsResponse"}],"binops":[]},{"name":"Cortex.Api.Issues","comment":" Cortex issue records (alerts/incidents) and their tenant-defined schema.\n\n@docs SearchResponse\n@docs search, schema\n\n","unions":[],"aliases":[{"name":"SearchResponse","comment":" Issue records have ~50 normalized fields plus tenant-specific custom fields,\nso we preserve them as raw JSON and only type the paginated envelope counters.\n","args":[],"type":"{ data : List.List Json.Encode.Value, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"schema","comment":" POST /public\\_api/v1/issue/schema\n\nReturns the issue field schema (field names, types, allowed operators).\nThe schema is a large variable-shape object; surfaced as raw JSON so\ncallers can drill in to whichever parts they need.\n\n","type":"Cortex.Request.Request Json.Encode.Value"},{"name":"search","comment":" POST /public\\_api/v1/issue/search\n","type":"Cortex.Request.Request Cortex.Api.Issues.SearchResponse"}],"binops":[]},{"name":"Cortex.Api.LegacyExceptions","comment":" Legacy policy exception modules and their current rule set.\n\n@docs Module, FetchResponse\n@docs getModules, fetch\n\n","unions":[],"aliases":[{"name":"FetchResponse","comment":" Legacy exception rules have many flexible fields (conditions structure,\nprofile associations, etc.) that vary by module type. We preserve each rule\nas raw JSON and only type the paginated envelope counters.\n","args":[],"type":"{ data : List.List Json.Encode.Value, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"},{"name":"Module","comment":" A single legacy-exception module definition. `conditionsDefinition` is a\nnested JSON tree whose shape depends on module type, so it is preserved as-is.\n","args":[],"type":"{ moduleId : Maybe.Maybe Basics.Int, prettyName : Maybe.Maybe String.String, title : Maybe.Maybe String.String, label : Maybe.Maybe String.String, profileType : Maybe.Maybe String.String, platforms : List.List String.String, conditionsDefinition : Json.Encode.Value }"}],"values":[{"name":"fetch","comment":" POST /public\\_api/v1/legacy\\_exceptions/fetch\n","type":"Cortex.Request.Request Cortex.Api.LegacyExceptions.FetchResponse"},{"name":"getModules","comment":" POST /public\\_api/v1/legacy\\_exceptions/get\\_modules\n\nNo request body required — send empty.\n\n","type":"Cortex.Request.Request (List.List Cortex.Api.LegacyExceptions.Module)"}],"binops":[]},{"name":"Cortex.Api.Rbac","comment":" Cortex role-based access control: users, roles, and user groups.\n\n@docs User, Role, UserGroup\n@docs getUsers, getRoles, getUserGroups\n\n","unions":[],"aliases":[{"name":"Role","comment":" A Cortex RBAC role definition: permission list plus membership.\n","args":[],"type":"{ prettyName : Maybe.Maybe String.String, permissions : List.List String.String, insertTime : Maybe.Maybe Basics.Int, updateTime : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, description : Maybe.Maybe String.String, tags : Json.Encode.Value, groups : List.List String.String, users : List.List String.String }"},{"name":"User","comment":" A Cortex RBAC user record.\n","args":[],"type":"{ userEmail : String.String, userFirstName : Maybe.Maybe String.String, userLastName : Maybe.Maybe String.String, roleName : Maybe.Maybe String.String, lastLoggedIn : Maybe.Maybe Basics.Int, userType : Maybe.Maybe String.String, groups : List.List Json.Encode.Value, scope : List.List Json.Encode.Value }"},{"name":"UserGroup","comment":" A Cortex user-group definition, including member emails.\n","args":[],"type":"{ groupName : Maybe.Maybe String.String, description : Maybe.Maybe String.String, prettyName : Maybe.Maybe String.String, insertTime : Maybe.Maybe Basics.Int, updateTime : Maybe.Maybe Basics.Int, userEmail : List.List String.String, source : Maybe.Maybe String.String }"}],"values":[{"name":"getRoles","comment":" POST /public\\_api/v1/rbac/get\\_roles\n\nThe API requires `role_names` to contain at least one role name; pass them\nvia the record argument. The response is a list-of-lists envelope which is\nflattened into a single `List Role`.\n\n","type":"{ roleNames : List.List String.String } -> Cortex.Request.Request (List.List Cortex.Api.Rbac.Role)"},{"name":"getUserGroups","comment":" POST /public\\_api/v1/rbac/get\\_user\\_group\n\nThe API requires `group_names` to contain at least one group name; pass\nthem via the record argument.\n\n","type":"{ groupNames : List.List String.String } -> Cortex.Request.Request (List.List Cortex.Api.Rbac.UserGroup)"},{"name":"getUsers","comment":" POST /public\\_api/v1/rbac/get\\_users\n","type":"Cortex.Request.Request (List.List Cortex.Api.Rbac.User)"}],"binops":[]},{"name":"Cortex.Api.ScheduledQueries","comment":" Cortex scheduled XQL queries configured on the tenant.\n\n@docs ScheduledQueriesResponse\n@docs list\n\n","unions":[],"aliases":[{"name":"ScheduledQueriesResponse","comment":" Scheduled-query records contain a large, flexible set of fields (XQL text,\ntimeframe, tenants, trigger config, etc.) that vary by query type. We preserve\neach record as raw JSON and only type the top-level envelope counters.\n","args":[],"type":"{ data : List.List Json.Encode.Value, filterCount : Maybe.Maybe Basics.Int, totalCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"list","comment":" POST /public\\_api/v1/scheduled\\_queries/list\n","type":"Cortex.Request.Request Cortex.Api.ScheduledQueries.ScheduledQueriesResponse"}],"binops":[]},{"name":"Cortex.Api.TenantInfo","comment":" Cortex tenant license, SKU, and region metadata.\n\n@docs TenantInfo\n@docs get\n\n","unions":[],"aliases":[{"name":"TenantInfo","comment":" The tenant info response contains many optional license fields whose\npresence varies by tenant configuration. We decode the full reply object\nas raw JSON so the CLI can output it verbatim without losing any fields.\n","args":[],"type":"{ raw : Json.Encode.Value }"}],"values":[{"name":"get","comment":" POST /public\\_api/v1/system/get\\_tenant\\_info\n\nRetrieve license and configuration info for the tenant.\nResponse uses the `reply` envelope.\n\n","type":"Cortex.Request.Request Cortex.Api.TenantInfo.TenantInfo"}],"binops":[]},{"name":"Cortex.Api.Xql","comment":" XQL: saved queries, available datasets, and tenant quota counters.\n\n@docs Dataset, DatasetRange, Library, LibraryQuery, Quota\n@docs getDatasets, getLibrary, getQuota\n\n","unions":[],"aliases":[{"name":"Dataset","comment":" A dataset available to XQL queries, with its retention ranges and size stats.\n","args":[],"type":"{ datasetName : Maybe.Maybe String.String, type_ : Maybe.Maybe String.String, logUpdateType : Maybe.Maybe String.String, lastUpdated : Maybe.Maybe Basics.Int, totalDaysStored : Maybe.Maybe Basics.Int, hotRange : Maybe.Maybe Cortex.Api.Xql.DatasetRange, coldRange : Maybe.Maybe Cortex.Api.Xql.DatasetRange, totalSizeStored : Maybe.Maybe Basics.Int, averageDailySize : Maybe.Maybe Basics.Int, totalEvents : Maybe.Maybe Basics.Int, averageEventSize : Maybe.Maybe Basics.Int, ttl : Maybe.Maybe Basics.Int, defaultQueryTarget : Maybe.Maybe Basics.Bool }"},{"name":"DatasetRange","comment":" Epoch-millisecond `from`/`to` range inside [`Dataset`](#Dataset).\n","args":[],"type":"{ from : Maybe.Maybe Basics.Int, to : Maybe.Maybe Basics.Int }"},{"name":"Library","comment":" Saved-query library returned by [`getLibrary`](#getLibrary).\n","args":[],"type":"{ queriesCount : Maybe.Maybe Basics.Int, xqlQueries : List.List Cortex.Api.Xql.LibraryQuery }"},{"name":"LibraryQuery","comment":" A single saved XQL query inside the [`Library`](#Library).\n","args":[],"type":"{ id : Maybe.Maybe Basics.Int, name : Maybe.Maybe String.String, description : Maybe.Maybe String.String, queryText : Maybe.Maybe String.String, createdAt : Maybe.Maybe Basics.Int, createdBy : Maybe.Maybe String.String, createdByPretty : Maybe.Maybe String.String, modifiedAt : Maybe.Maybe Basics.Int, modifiedBy : Maybe.Maybe String.String, modifiedByPretty : Maybe.Maybe String.String, queryMetadata : Json.Encode.Value, isPrivate : Maybe.Maybe Basics.Bool, labels : List.List String.String }"},{"name":"Quota","comment":" The Cortex tenant returns quota counters as JSON numbers that may carry a\ndecimal component (e.g. `4015.0`), even though the OpenAPI schema documents\nthem as integers. We decode every quota field as Float so the values survive\nroundtripping through the typed decoder without integer coercion dropping the\nfractional part.\n\n`dailyUsedQuota` is not listed in the OpenAPI schema but is returned by the\nAPI in practice — per CLAUDE.md we capture every field the response contains.\n\n","args":[],"type":"{ licenseQuota : Maybe.Maybe Basics.Float, additionalPurchasedQuota : Maybe.Maybe Basics.Float, usedQuota : Maybe.Maybe Basics.Float, dailyUsedQuota : Maybe.Maybe Basics.Float, evalQuota : Maybe.Maybe Basics.Float, totalDailyRunningQueries : Maybe.Maybe Basics.Int, totalDailyConcurrentRejectedQueries : Maybe.Maybe Basics.Int, currentConcurrentActiveQueries : Json.Encode.Value, currentConcurrentActiveQueriesCount : Maybe.Maybe Basics.Int, maxDailyConcurrentActiveQueryCount : Maybe.Maybe Basics.Int }"}],"values":[{"name":"getDatasets","comment":" POST /public\\_api/v1/xql/get\\_datasets\n","type":"Cortex.Request.Request (List.List Cortex.Api.Xql.Dataset)"},{"name":"getLibrary","comment":" POST /public\\_api/xql\\_library/get\n","type":"Cortex.Request.Request Cortex.Api.Xql.Library"},{"name":"getQuota","comment":" POST /public\\_api/v1/xql/get\\_quota\n","type":"Cortex.Request.Request Cortex.Api.Xql.Quota"}],"binops":[]},{"name":"Cortex.Auth","comment":" Advanced-API Auth signing for Cortex. Each authenticated request carries\na SHA-256 hash of `apiKey ++ nonce ++ timestamp` plus three sidecar headers.\n\n@docs Credentials, Stamp\n@docs credentials, stamp\n@docs sign, nonceGenerator\n\n","unions":[{"name":"Credentials","comment":" Opaque container for an Advanced API key pair. Construct via\n[`credentials`](#credentials); the raw `apiKey` is kept inaccessible to\nprevent accidental logging.\n","args":[],"cases":[]},{"name":"Stamp","comment":" Opaque container for the timestamp + nonce pair that signs a single\nrequest. The timestamp is milliseconds since epoch; the nonce is a random\nstring of at least 32 characters per the Cortex Advanced Auth spec.\n","args":[],"cases":[]}],"aliases":[],"values":[{"name":"credentials","comment":" Build a `Credentials` from the raw API Key ID and API Key strings\n(typically sourced from `CORTEX_API_KEY_ID` / `CORTEX_API_KEY`).\n","type":"{ apiKeyId : String.String, apiKey : String.String } -> Cortex.Auth.Credentials"},{"name":"nonceGenerator","comment":" Generate a 64-character random nonce from [A-Za-z0-9].\nSuitable for browser use where crypto.randomBytes is unavailable.\nThe CLI uses Node's crypto.randomBytes instead.\n","type":"Random.Generator String.String"},{"name":"sign","comment":" Produce the four Advanced API Auth headers.\n\n    hash =\n        SHA256.toHex (SHA256.fromString (apiKey ++ nonce ++ String.fromInt timestamp))\n\nHeaders sent:\n\n  - Authorization: the hex SHA-256 hash\n  - x-xdr-auth-id: the API key ID\n  - x-xdr-timestamp: millis since epoch (as string)\n  - x-xdr-nonce: the nonce string\n\n","type":"Cortex.Auth.Credentials -> Cortex.Auth.Stamp -> List.List Http.Header"},{"name":"stamp","comment":" Build a `Stamp` from a millis-since-epoch timestamp and a random nonce.\n","type":"{ timestamp : Basics.Int, nonce : String.String } -> Cortex.Auth.Stamp"}],"binops":[]},{"name":"Cortex.Client","comment":" Drives HTTP for the SDK. This is the only module with effects — every\n`Cortex.Api.*` module produces a pure [`Request`](Cortex-Request#Request) that\nis dispatched through `send` / `sendWith`.\n\n@docs Config, config, withTimeout\n@docs send, sendWith\n@docs toRequestRecord\n\n","unions":[{"name":"Config","comment":" Opaque HTTP client configuration. Holds the tenant base URL, the API\ncredentials, and the per-request timeout. Construct via [`config`](#config)\nand tweak with [`withTimeout`](#withTimeout).\n","args":[],"cases":[]}],"aliases":[],"values":[{"name":"config","comment":" Build a `Config` from the tenant base URL and credentials. The timeout\ndefaults to 30 seconds; change it with [`withTimeout`](#withTimeout).\n","type":"{ tenant : String.String, credentials : Cortex.Auth.Credentials } -> Cortex.Client.Config"},{"name":"send","comment":" Send a request using Time.now for the timestamp and elm/random for the nonce.\nSuitable for browser apps.\n","type":"Cortex.Client.Config -> (Result.Result Cortex.Error.Error a -> msg) -> Cortex.Request.Request a -> Platform.Cmd.Cmd msg"},{"name":"sendWith","comment":" Send a request with a caller-supplied stamp. The CLI uses this so the nonce\ncomes from Node's crypto.randomBytes rather than Elm's PRNG.\n","type":"Cortex.Auth.Stamp -> Cortex.Client.Config -> (Result.Result Cortex.Error.Error a -> msg) -> Cortex.Request.Request a -> Platform.Cmd.Cmd msg"},{"name":"toRequestRecord","comment":" Build a pure record from a Config, Stamp, and Request.\nUseful for consumers who want to drive Http themselves.\n","type":"Cortex.Client.Config -> Cortex.Auth.Stamp -> Cortex.Request.Request a -> { method : String.String, headers : List.List Http.Header, url : String.String, body : Http.Body, decoder : Json.Decode.Decoder a }"},{"name":"withTimeout","comment":" Set a new per-request timeout, in milliseconds.\n","type":"Basics.Float -> Cortex.Client.Config -> Cortex.Client.Config"}],"binops":[]},{"name":"Cortex.Decode","comment":" Decoder helpers shared across `Cortex.Api.*` modules.\n\nThe Cortex Advanced API consistently wraps responses in a `{\"reply\": ...}`\nenvelope, several response shapes return lists that may be omitted when\nempty, and pipeline-style decoders need an `andMap` once `Json.Decode.map8`\nruns out of slots. Centralising these three primitives here keeps the\nper-API modules focused on their own shapes.\n\n@docs reply, optionalList, andMap\n\n","unions":[],"aliases":[],"values":[{"name":"andMap","comment":" Pipeline-style helper to apply an additional decoder when `Decode.mapN`\nruns out of positional slots.\n","type":"Json.Decode.Decoder a -> Json.Decode.Decoder (a -> b) -> Json.Decode.Decoder b"},{"name":"optionalList","comment":" Decode a list field, defaulting to the empty list when the field is absent.\n","type":"String.String -> Json.Decode.Decoder a -> Json.Decode.Decoder (List.List a)"},{"name":"reply","comment":" Unwrap the `reply` envelope that Cortex wraps around every success response.\n","type":"Json.Decode.Decoder a -> Json.Decode.Decoder a"}],"binops":[]},{"name":"Cortex.Error","comment":" Errors produced by [`Cortex.Client.send`](Cortex-Client#send). Wraps the\nfour standard `elm/http` failure modes and adds a normalized decoding of the\nfour different error envelopes the Cortex API returns.\n\n@docs Error, ApiError\n@docs decodeApiError\n\n","unions":[{"name":"Error","comment":" What can go wrong when sending a request.\n\n  - `NetworkError` — the request never reached the server.\n  - `Timeout` — no response within the configured timeout.\n  - `BadStatus code maybeApiError` — the server responded with a 4xx/5xx.\n    The payload is parsed into an [`ApiError`](#ApiError) if it matches one\n    of the known envelope shapes; otherwise it's `Nothing`.\n  - `BadBody detail` — a 2xx response whose body did not match the decoder.\n  - `BadUrl url` — the URL was rejected by `elm/http` before dispatch.\n\n","args":[],"cases":[["NetworkError",[]],["Timeout",[]],["BadStatus",["Basics.Int","Maybe.Maybe Cortex.Error.ApiError"]],["BadBody",["String.String"]],["BadUrl",["String.String"]]]}],"aliases":[{"name":"ApiError","comment":" A server-reported error, normalized across the four envelope shapes the\nCortex API is known to return. `errCode` and `errExtra` are optional because\nnot every envelope includes them.\n","args":[],"type":"{ errCode : Maybe.Maybe String.String, errMsg : String.String, errExtra : Maybe.Maybe Json.Encode.Value }"}],"values":[{"name":"decodeApiError","comment":" Try multiple known error envelope shapes, in priority order.\nReturns the first successful parse as an ApiError.\n\nThe body is parsed to a `Decode.Value` once up-front; each candidate decoder\nis then attempted against that parsed value rather than re-parsing the\noriginal string. Matters on large error bodies.\n\n","type":"String.String -> Maybe.Maybe Cortex.Error.ApiError"}],"binops":[]},{"name":"Cortex.Request","comment":" Opaque request descriptor. Each `Cortex.Api.*` module builds a\n`Request a` describing the endpoint to hit and how to decode its response;\n[`Cortex.Client.send`](Cortex-Client#send) is what actually dispatches it.\n\nOnly `GET` and `POST` are provided — the Cortex Advanced API does not use\n`PUT`, `PATCH`, or `DELETE`, so adding those verbs would be dead code.\n\n@docs Request\n@docs get, post, postEmpty\n@docs map, withDecoder\n@docs toInternal\n\n","unions":[{"name":"Request","comment":" A pending HTTP request paired with its response decoder. Opaque so the\nwire format stays an implementation detail of the SDK.\n","args":["a"],"cases":[]}],"aliases":[],"values":[{"name":"get","comment":" Build a GET request from a path (as a list of segments) and a response\ndecoder.\n","type":"List.List String.String -> Json.Decode.Decoder a -> Cortex.Request.Request a"},{"name":"map","comment":" Transform the decoded response value. Useful for wrapping a typed result\ninto a different shape before it reaches your `update`.\n","type":"(a -> b) -> Cortex.Request.Request a -> Cortex.Request.Request b"},{"name":"post","comment":" Build a POST request from a path, a JSON body, and a response decoder.\n","type":"List.List String.String -> Json.Encode.Value -> Json.Decode.Decoder a -> Cortex.Request.Request a"},{"name":"postEmpty","comment":" POST with the empty advanced-API envelope `{\"request_data\": {}}` as the\nbody. Used by endpoints that take no filters or paging arguments.\n","type":"List.List String.String -> Json.Decode.Decoder a -> Cortex.Request.Request a"},{"name":"toInternal","comment":" Extract the raw method/path/query/body/decoder record. Intended as an\nescape hatch for [`Cortex.Client.toRequestRecord`](Cortex-Client#toRequestRecord)\nand custom dispatchers; most consumers should not need this.\n","type":"Cortex.Request.Request a -> { method : String.String, path : List.List String.String, query : List.List ( String.String, String.String ), body : Json.Encode.Value, decoder : Json.Decode.Decoder a }"},{"name":"withDecoder","comment":" Replace the response decoder entirely. Useful when a caller wants the\nraw JSON (for logging, cache, or piping to another tool) instead of the\ntyped shape the endpoint module provides: `Request.withDecoder Decode.value\nreq` turns any `Request a` into a `Request Value`.\n","type":"Json.Decode.Decoder b -> Cortex.Request.Request a -> Cortex.Request.Request b"}],"binops":[]}]