Preview - Per-command breakdown of metrics for one AI tool

get

https://{region}.api.jamfcloud.com/ai/governance/visibility/v1/tools/{tool_id}/commands

Preview: This endpoint is currently in a preview state and is subject to breaking changes without warning.

Preview endpoint. This endpoint is in preview: its request and response shapes may change without a version increment. A v2 of this API is planned to supersede it, targeting 2026-11.

For a single tool, returns event_count and device_count per distinct command within the time range, ordered by the optional metric parameter (defaults to event_count). Each row is annotated with the highest observed severity for that command in the window.
A tool with no command activity in the window returns 200 with an empty results array; this endpoint does not distinguish an unknown tool_id.
Backed by device_tool_command_hourly (separate from the launcher-grain table), so per-command totals are computed independently of the per-launcher and per-tool views.
Note: device_count here is per command and remains a distinct count, so the per-command values do not sum to the tool's overall device_count - a device that issued more than one command is counted under each.
The optional, mutually exclusive min_severity (floor) and severity (exact match) query parameters filter the underlying hourly rows before aggregation, so the returned counts and per-command severity reflect only that activity. When both are omitted the filter defaults to 0 (informational), which keeps every row.

Required Permissions: ai-visibility:read

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

tool_id

string

required

Query Params

start

date-time

Absolute inclusive UTC start timestamp (RFC3339). Must be paired with end; cannot be combined with range.

end

date-time

Absolute exclusive UTC end timestamp (RFC3339). Must be paired with start; cannot be combined with range.

range

string

^\s*(?:\d+w)?\s*(?:\d+d)?\s*(?:\d+h)?\s*$

Relative look-back duration composed of optional weeks (w), days (d), and hours (h) segments, in that order (e.g. 24h, 7d, 1w, 1w2d3h). Resolved server-side to [now-range, now). Mutually exclusive with start/end. Defaults to 24h when no time parameters are supplied.

string

Defaults to UTC

IANA timezone name (e.g. America/New_York, Europe/Paris) used to express the resolved range. For the stats endpoints it aligns day and week bin boundaries to that timezone's local midnight / start-of-week before the window is normalized to UTC for querying. Has no effect on endpoints that do not bucket by time. Defaults to UTC when omitted.

metric

string

enum

Defaults to event_count

Single metric to order the grouped results by. Allowed values: event_count, device_count. Defaults to event_count. Both metrics are always returned on each row regardless of this value.

Allowed:

limit

integer

≥ 1

Defaults to 50

Max number of grouped rows to return (top-N by the ordering metric). Defaults to 50 when omitted.

page

integer

≥ 1

Defaults to 1

1-indexed page number used together with limit to page through results. The row offset is computed as (page - 1) * limit. Defaults to 1 when omitted. A page past the end of the result set returns an empty list.

order

string

enum

Defaults to desc

Sort direction for grouped results by the metric.

Allowed:

min_severity

integer

enum

Keep only command rows whose own severity is at least this value before aggregation (0=informational, 1=low, 2=medium, 3=high). The filter is applied to the underlying hourly rows, so the reported severity (MAX over the surviving rows) and the event_count / device_count totals reflect only activity at or above this level. Mutually exclusive with severity.

Allowed:

severity

integer

enum

Keep only command rows whose own severity is exactly this value before aggregation (0=informational, 1=low, 2=medium, 3=high). Unlike min_severity, this is an equality match rather than a floor. The filter is applied to the underlying hourly rows, so the reported severity and the event_count / device_count totals reflect only activity at exactly this level. Mutually exclusive with min_severity.

Allowed:

Headers

X-Environment-Id

uuid

required

^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

The environment UUID identifier.

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

OAuth2

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

200Per-command metric values for the tool

400Missing or invalid parameter - e.g. unparseable start/end/range, range combined with start+end, invalid metric, out-of-range limit/order, invalid bin/fill, an analytic UUID or severity integer that doesn't parse, or a malformed cursor.

401Missing, malformed, expired, or otherwise invalid JWT bearer token. Returned by the auth middleware before the handler runs.

403The token is valid but its tenant claim could not be resolved into a usable tenant schema (e.g. the tenantId is missing or malformed).

500Unexpected error querying the backing store.