API Reference

Open the interactive OpenAPI reference:

GET /powerpacks/{powerpack_identifier}

Get PowerPack

Parameters:

powerpack_identifier (string) –
PowerPack identifier. May be one of:
- PowerPack ID (integer)
  Ex: 12345
- PowerPack GUID (32-character uppercase hex string)
  Ex: A1B2C3D4E5F6789012345678901234AB
- PowerPack name (string)
  Ex: my-powerpack

Query Parameters:

pretty (boolean) – When true, enums are returned as strings (e.g., ENABLED). When false, enums are returned as integers.
fields (string) –
Optional response field allowlist (Pydantic-style include behavior).

When provided, only the specified fields are included in the response.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (e.g., dynamic_applications.guid,dynamic_applications.*.id)
- Wildcards (dynamic_applications.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
exclude (string) –
Optional response field blocklist (Pydantic-style exclude behavior).

When provided, all response fields are returned except those excluded.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (e.g., dynamic_applications.release_notes)
- Wildcards (dynamic_applications.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.

Status Codes:

200 OK – PowerPack definition
400 Bad Request – Invalid request or validation error
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – PowerPack Not found
422 Unprocessable Entity – Unprocessable entity. Stored data does not cause this: Dynamic Applications that cannot be read are listed in errors, and stored values that fail validation are returned with validation_errors.
500 Internal Server Error – Internal server error

Request JSON Object:

dynamic_applications[].abandon_collection_limit (integer) – This is how many collection objects must be unavailable before the Dynamic Application should stop trying to collect data and wait until the next scheduled collection session.
dynamic_applications[].alert_objects[].formula (string) – Python expression to transform this Alert Object’s value.
dynamic_applications[].alert_objects[].guid (any) – A unique identifier for this Alert Object.
dynamic_applications[].alert_objects[].id (integer) – The unique numeric identifier for this Alert Object.
dynamic_applications[].alert_objects[].log_message (string) – The message to appear in logs when this Alert Object is triggered.
dynamic_applications[].alert_objects[].maintain_state (string) – EnabledToggle.
dynamic_applications[].alert_objects[].name (string) – Human-readable name for this Alert Object.
dynamic_applications[].alert_objects[].reference (any) – The reference label for this Alert Object. Used to distinguish between different instances.
dynamic_applications[].alert_objects[].state (string) – EnabledToggle.
dynamic_applications[].alert_objects[].triggered_alert_id (integer) – ID of the Alert Object to trigger when this Alert Object is triggered.
dynamic_applications[].alert_objects[].triggered_alert_reference (any) – The reference label for identifying which Alert Object to trigger when it has not yet been created and only has a reference. Cannot be null (HTTP 422); omit it to keep the stored triggered_alert_id.
dynamic_applications[].alert_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].alert_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].collection_objects[].alignment_condition (string) – Discovery alignment condition.
dynamic_applications[].collection_objects[].asset_link (string) – AssetLink values that can be set when the Dynamic Application is configuration-type (SNIPPET_CONFIGURATION or BULK_SNIPPET_CONFIGURATION).
dynamic_applications[].collection_objects[].asset_link_precedence (integer) – The asset link precedence value to use for this Collection Object. Must be in increments of 10.
dynamic_applications[].collection_objects[].change_alerting (string) – EnabledToggle.
dynamic_applications[].collection_objects[].class_type (string) – Type of data collected by a Collection Object.
dynamic_applications[].collection_objects[].component_identifiers[] (string) – Component identifier type used for component mapping.
dynamic_applications[].collection_objects[].description (string) – Description of what data this object gathers.
dynamic_applications[].collection_objects[].disable_maintenance (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].enable_deviation_alerting (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].enum_values (string) – The enum values to use if this Collection Object is CONFIG_ENUM type.
dynamic_applications[].collection_objects[].formula (string) – Python expression to transform collected value.
dynamic_applications[].collection_objects[].group (integer) – Numerical group for related objects.
dynamic_applications[].collection_objects[].guid (any) – A unique identifier for this Collection Object.
dynamic_applications[].collection_objects[].hide_object (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].id (integer) – The unique numeric identifier for this Collection Object.
dynamic_applications[].collection_objects[].max_weeks_data (integer) – The maximum number of weeks to store data for this Collection Object.
dynamic_applications[].collection_objects[].min_weeks_data (integer) – The minimum number of weeks to store data for this Collection Object.
dynamic_applications[].collection_objects[].name (string) – Human-readable name for the data point.
dynamic_applications[].collection_objects[].reference (any) – The reference label for this Collection Object. Used to distinguish between different instances.
dynamic_applications[].collection_objects[].snippet_argument (string) – Snippet Framework arguments for collection.
dynamic_applications[].collection_objects[].snippet_id (integer) – ID of the associated Snippet. A value of 0 means default / unset.
dynamic_applications[].collection_objects[].snippet_reference (any) – The reference label for identifying which Snippet to link to when one has not been created yet (e.g., snip_123). Cannot be null (HTTP 422); omit it to keep the stored snippet_id.
dynamic_applications[].collection_objects[].string_type (string) – String encoding/display type for configuration collection objects.
dynamic_applications[].collection_objects[].table_alignment (string) – Table alignment for UI display.
dynamic_applications[].collection_objects[].tabular (string) – EnabledToggle.
dynamic_applications[].collection_objects[].usage_type (string) – Collection Object usage type.
dynamic_applications[].collection_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].collection_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].collection_objects[].validity_check_operator (string) – Discovery validity-check operator.
dynamic_applications[].collection_objects[].validity_check_pattern (string) – The pattern to use in the Discovery validity check.
dynamic_applications[].component_mapping (string) – EnabledToggle.
dynamic_applications[].component_mapping_dynamic_applications[] (string) – Request-scoped unique label for linking new entities.
dynamic_applications[].cu_affinity (string) – Collector affinity for a Dynamic Application.
dynamic_applications[].description (string) – Detailed description of purpose for this Dynamic Application.
dynamic_applications[].disable_rollup_of_data (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
dynamic_applications[].event_policies[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
dynamic_applications[].event_policies[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
dynamic_applications[].event_policies[].component_type (string) – Component type associated with the Event Policy.
dynamic_applications[].event_policies[].description (string) – The description of this Event Policy.
dynamic_applications[].event_policies[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
dynamic_applications[].event_policies[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
dynamic_applications[].event_policies[].external_category (string) – Optional category used when sending this event to an external system.
dynamic_applications[].event_policies[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
dynamic_applications[].event_policies[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
dynamic_applications[].event_policies[].guid (any) – A unique identifier for this Event Policy.
dynamic_applications[].event_policies[].id (integer) – The unique numeric identifier for this Event Policy.
dynamic_applications[].event_policies[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
dynamic_applications[].event_policies[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
dynamic_applications[].event_policies[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
dynamic_applications[].event_policies[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
dynamic_applications[].event_policies[].match_logic (string) – Match strategy for event text evaluation.
dynamic_applications[].event_policies[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
dynamic_applications[].event_policies[].name (string) – The name of this Event Policy.
dynamic_applications[].event_policies[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
dynamic_applications[].event_policies[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
dynamic_applications[].event_policies[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
dynamic_applications[].event_policies[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
dynamic_applications[].event_policies[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
dynamic_applications[].event_policies[].second_match_string (string) – A secondary string used to match against the originating log message.
dynamic_applications[].event_policies[].severity (string) – Event severity level.
dynamic_applications[].event_policies[].source (string) – Source type for the Event Policy.
dynamic_applications[].event_policies[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
dynamic_applications[].event_policies[].state (string) – EnabledToggle.
dynamic_applications[].event_policies[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
dynamic_applications[].event_policies[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
dynamic_applications[].event_policies[].topology_suppression (string) – Topology suppression behavior for correlated events.
dynamic_applications[].event_policies[].trap_oid (string) – Trap OID to associate with this Event Policy.
dynamic_applications[].event_policies[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].event_policies[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].execution_environment (string) – The unique GUID identifier of the Execution Environment aligned to this Dynamic Application. Can be an Execution environment GUID or sl1_default_ee
dynamic_applications[].guid (any) – Unique GUID identifier for this Dynamic Application. Required for update; omit or null for create.
dynamic_applications[].id (integer) – The unique numeric identifier for this Dynamic Application.
dynamic_applications[].is_sf_app_type (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].max_devices (integer) – The maximum amount of devices that can be grouped together to execute in a single process without causing collection issues.
dynamic_applications[].name (string) – The human-readable name of this Dynamic Application. Required on create. Optional on update.
dynamic_applications[].null_column_option (string) – Behavior to apply when previously reported table data is missing.
dynamic_applications[].null_row_option (string) – Behavior to apply when previously reported table data is missing.
dynamic_applications[].poll_interval (string) – The frequency at which Skylar One polls devices aligned to the Dynamic Application.
dynamic_applications[].pp_guid (any) – The unique GUID identifier of the PowerPack this Dynamic Application is aligned to (immutable).
dynamic_applications[].presentation_objects[].abbreviation_suffix (string) – The abbreviation or suffix to use for this Presentation Object.
dynamic_applications[].presentation_objects[].data_unit (string) – The units for the data this Presentation Object displays.
dynamic_applications[].presentation_objects[].formula (string) – Python expression to transform this Presentation Object’s value.
dynamic_applications[].presentation_objects[].guid (any) – A unique identifier for this Presentation Object.
dynamic_applications[].presentation_objects[].guide_text (string) – Description of what data this Presentation Object displays.
dynamic_applications[].presentation_objects[].id (integer) – The unique numeric identifier for this Presentation Object.
dynamic_applications[].presentation_objects[].name (string) – Human-readable name for this Presentation Object.
dynamic_applications[].presentation_objects[].reference (any) – The reference label for this Presentation Object. Used to distinguish between different instances.
dynamic_applications[].presentation_objects[].show_as_percent (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].presentation_objects[].summarization_state (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].presentation_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].presentation_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].release_notes (string) – Release notes, changelog and version history for this Dynamic Application.
dynamic_applications[].snippets[].guid (any) – Unique identifier for this Snippet.
dynamic_applications[].snippets[].id (integer) – The unique numeric identifier for this Snippet.
dynamic_applications[].snippets[].name (string) – Human-readable name for this Snippet.
dynamic_applications[].snippets[].reference (any) – The reference label for this Snippet. Used to distinguish between different instances.
dynamic_applications[].snippets[].required (string) – Required toggle.
dynamic_applications[].snippets[].snippet (string) – Python code or reusable script content for this Snippet.
dynamic_applications[].snippets[].state (string) – EnabledToggle.
dynamic_applications[].snippets[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].snippets[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].state (string) – EnabledToggle.
dynamic_applications[].threshold_objects[].guid (any) – A unique identifier for this Threshold Object.
dynamic_applications[].threshold_objects[].id (integer) – The unique numeric identifier for this Threshold Object.
dynamic_applications[].threshold_objects[].name (string) – Human-readable name for this Threshold Object.
dynamic_applications[].threshold_objects[].numeric_range_high (number) – Specifies the high end of the possible values.
dynamic_applications[].threshold_objects[].numeric_range_low (number) – Specifies the low end of the possible values.
dynamic_applications[].threshold_objects[].override_threshold_value (any) – Whether this Threshold Object appears on the Device Thresholds page for each subscriber device.
dynamic_applications[].threshold_objects[].reference (any) – The reference label for this Threshold Object. Used to distinguish between different instances.
dynamic_applications[].threshold_objects[].type (any) – Specifies whether this Threshold Object is numeric or a percentage.
dynamic_applications[].threshold_objects[].unit (string) – The unit for the data this Threshold Object is defined around.
dynamic_applications[].threshold_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].threshold_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].threshold_objects[].value (number) – The default threshold value used if a subscriber device does not override it.
dynamic_applications[].type (string) – The protocol Skylar One uses and the type of data collected by the Dynamic Application.
dynamic_applications[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].version (number) – The version number of this Dynamic Application.
errors[] (string)
guid (string) – Uppercase 32-character hexadecimal GUID.
id (integer) – Unique numeric identifier for this PowerPack.
name (string) – The human-readable name of this PowerPack.
revision (integer) – The modification counter for this PowerPack.
validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
validation_errors[].message (string) – Why the stored value is invalid. (required)

GET /dynamic_applications/{app_identifier}

Get Dynamic Application

Parameters:

app_identifier (string) –
Dynamic Application identifier. May be one of:
- Dynamic Application ID (integer)
  Ex: 12345
- Dynamic Application GUID (32-character uppercase hex string)
  Ex: A1B2C3D4E5F6789012345678901234AB
- Dynamic Application name (string)
  Ex: my-dynamic-application

Query Parameters:

pretty (boolean) – When true, enums are returned as strings (e.g., ENABLED). When false, enums are returned as integers.
fields (string) –
Optional response field allowlist (Pydantic-style include behavior).

When provided, only the specified fields are included in the response.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (e.g., collection_objects.guid,collection_objects.*.id)
- Wildcards (collection_objects.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
exclude (string) –
Optional response field blocklist (Pydantic-style exclude behavior).

When provided, all response fields are returned except those excluded.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (.e.g., snippets.snippet,collection_objects.snippet_argument)
- Wildcards (collection_objects.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.

Status Codes:

200 OK – Dynamic Application definition
400 Bad Request – Invalid request or validation error
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – Dynamic Application Not found
422 Unprocessable Entity – Unprocessable entity: the stored application type (type or is_sf_app_type) of the Dynamic Application is invalid or not a supported Snippet Framework type. Other stored values that fail validation do not cause this; they are returned with validation_errors.
500 Internal Server Error – Internal server error

Request JSON Object:

abandon_collection_limit (integer) – This is how many collection objects must be unavailable before the Dynamic Application should stop trying to collect data and wait until the next scheduled collection session.
alert_objects[].formula (string) – Python expression to transform this Alert Object’s value.
alert_objects[].guid (any) – A unique identifier for this Alert Object.
alert_objects[].id (integer) – The unique numeric identifier for this Alert Object.
alert_objects[].log_message (string) – The message to appear in logs when this Alert Object is triggered.
alert_objects[].maintain_state (string) – EnabledToggle.
alert_objects[].name (string) – Human-readable name for this Alert Object.
alert_objects[].reference (any) – The reference label for this Alert Object. Used to distinguish between different instances.
alert_objects[].state (string) – EnabledToggle.
alert_objects[].triggered_alert_id (integer) – ID of the Alert Object to trigger when this Alert Object is triggered.
alert_objects[].triggered_alert_reference (any) – The reference label for identifying which Alert Object to trigger when it has not yet been created and only has a reference. Cannot be null (HTTP 422); omit it to keep the stored triggered_alert_id.
alert_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
alert_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
collection_objects[].alignment_condition (string) – Discovery alignment condition.
collection_objects[].asset_link (string) – AssetLink values that can be set when the Dynamic Application is configuration-type (SNIPPET_CONFIGURATION or BULK_SNIPPET_CONFIGURATION).
collection_objects[].asset_link_precedence (integer) – The asset link precedence value to use for this Collection Object. Must be in increments of 10.
collection_objects[].change_alerting (string) – EnabledToggle.
collection_objects[].class_type (string) – Type of data collected by a Collection Object.
collection_objects[].component_identifiers[] (string) – Component identifier type used for component mapping.
collection_objects[].description (string) – Description of what data this object gathers.
collection_objects[].disable_maintenance (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
collection_objects[].enable_deviation_alerting (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
collection_objects[].enum_values (string) – The enum values to use if this Collection Object is CONFIG_ENUM type.
collection_objects[].formula (string) – Python expression to transform collected value.
collection_objects[].group (integer) – Numerical group for related objects.
collection_objects[].guid (any) – A unique identifier for this Collection Object.
collection_objects[].hide_object (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
collection_objects[].id (integer) – The unique numeric identifier for this Collection Object.
collection_objects[].max_weeks_data (integer) – The maximum number of weeks to store data for this Collection Object.
collection_objects[].min_weeks_data (integer) – The minimum number of weeks to store data for this Collection Object.
collection_objects[].name (string) – Human-readable name for the data point.
collection_objects[].reference (any) – The reference label for this Collection Object. Used to distinguish between different instances.
collection_objects[].snippet_argument (string) – Snippet Framework arguments for collection.
collection_objects[].snippet_id (integer) – ID of the associated Snippet. A value of 0 means default / unset.
collection_objects[].snippet_reference (any) – The reference label for identifying which Snippet to link to when one has not been created yet (e.g., snip_123). Cannot be null (HTTP 422); omit it to keep the stored snippet_id.
collection_objects[].string_type (string) – String encoding/display type for configuration collection objects.
collection_objects[].table_alignment (string) – Table alignment for UI display.
collection_objects[].tabular (string) – EnabledToggle.
collection_objects[].usage_type (string) – Collection Object usage type.
collection_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
collection_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
collection_objects[].validity_check_operator (string) – Discovery validity-check operator.
collection_objects[].validity_check_pattern (string) – The pattern to use in the Discovery validity check.
component_mapping (string) – EnabledToggle.
component_mapping_dynamic_applications[] (string) – Request-scoped unique label for linking new entities.
cu_affinity (string) – Collector affinity for a Dynamic Application.
description (string) – Detailed description of purpose for this Dynamic Application.
disable_rollup_of_data (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
event_policies[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
event_policies[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
event_policies[].component_type (string) – Component type associated with the Event Policy.
event_policies[].description (string) – The description of this Event Policy.
event_policies[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
event_policies[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
event_policies[].external_category (string) – Optional category used when sending this event to an external system.
event_policies[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
event_policies[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
event_policies[].guid (any) – A unique identifier for this Event Policy.
event_policies[].id (integer) – The unique numeric identifier for this Event Policy.
event_policies[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
event_policies[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
event_policies[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
event_policies[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
event_policies[].match_logic (string) – Match strategy for event text evaluation.
event_policies[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
event_policies[].name (string) – The name of this Event Policy.
event_policies[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
event_policies[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
event_policies[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
event_policies[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
event_policies[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
event_policies[].second_match_string (string) – A secondary string used to match against the originating log message.
event_policies[].severity (string) – Event severity level.
event_policies[].source (string) – Source type for the Event Policy.
event_policies[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
event_policies[].state (string) – EnabledToggle.
event_policies[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
event_policies[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
event_policies[].topology_suppression (string) – Topology suppression behavior for correlated events.
event_policies[].trap_oid (string) – Trap OID to associate with this Event Policy.
event_policies[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
event_policies[].validation_errors[].message (string) – Why the stored value is invalid. (required)
execution_environment (string) – The unique GUID identifier of the Execution Environment aligned to this Dynamic Application. Can be an Execution environment GUID or sl1_default_ee
guid (any) – Unique GUID identifier for this Dynamic Application. Required for update; omit or null for create.
id (integer) – The unique numeric identifier for this Dynamic Application.
is_sf_app_type (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
max_devices (integer) – The maximum amount of devices that can be grouped together to execute in a single process without causing collection issues.
name (string) – The human-readable name of this Dynamic Application. Required on create. Optional on update.
null_column_option (string) – Behavior to apply when previously reported table data is missing.
null_row_option (string) – Behavior to apply when previously reported table data is missing.
poll_interval (string) – The frequency at which Skylar One polls devices aligned to the Dynamic Application.
pp_guid (any) – The unique GUID identifier of the PowerPack this Dynamic Application is aligned to (immutable).
presentation_objects[].abbreviation_suffix (string) – The abbreviation or suffix to use for this Presentation Object.
presentation_objects[].data_unit (string) – The units for the data this Presentation Object displays.
presentation_objects[].formula (string) – Python expression to transform this Presentation Object’s value.
presentation_objects[].guid (any) – A unique identifier for this Presentation Object.
presentation_objects[].guide_text (string) – Description of what data this Presentation Object displays.
presentation_objects[].id (integer) – The unique numeric identifier for this Presentation Object.
presentation_objects[].name (string) – Human-readable name for this Presentation Object.
presentation_objects[].reference (any) – The reference label for this Presentation Object. Used to distinguish between different instances.
presentation_objects[].show_as_percent (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
presentation_objects[].summarization_state (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
presentation_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
presentation_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
release_notes (string) – Release notes, changelog and version history for this Dynamic Application.
snippets[].guid (any) – Unique identifier for this Snippet.
snippets[].id (integer) – The unique numeric identifier for this Snippet.
snippets[].name (string) – Human-readable name for this Snippet.
snippets[].reference (any) – The reference label for this Snippet. Used to distinguish between different instances.
snippets[].required (string) – Required toggle.
snippets[].snippet (string) – Python code or reusable script content for this Snippet.
snippets[].state (string) – EnabledToggle.
snippets[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
snippets[].validation_errors[].message (string) – Why the stored value is invalid. (required)
state (string) – EnabledToggle.
threshold_objects[].guid (any) – A unique identifier for this Threshold Object.
threshold_objects[].id (integer) – The unique numeric identifier for this Threshold Object.
threshold_objects[].name (string) – Human-readable name for this Threshold Object.
threshold_objects[].numeric_range_high (number) – Specifies the high end of the possible values.
threshold_objects[].numeric_range_low (number) – Specifies the low end of the possible values.
threshold_objects[].override_threshold_value (any) – Whether this Threshold Object appears on the Device Thresholds page for each subscriber device.
threshold_objects[].reference (any) – The reference label for this Threshold Object. Used to distinguish between different instances.
threshold_objects[].type (any) – Specifies whether this Threshold Object is numeric or a percentage.
threshold_objects[].unit (string) – The unit for the data this Threshold Object is defined around.
threshold_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
threshold_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
threshold_objects[].value (number) – The default threshold value used if a subscriber device does not override it.
type (string) – The protocol Skylar One uses and the type of data collected by the Dynamic Application.
validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
validation_errors[].message (string) – Why the stored value is invalid. (required)
version (number) – The version number of this Dynamic Application.

GET /dynamic_applications

List Dynamic Applications (filtered)

Query Parameters:

pretty (boolean) – When true, enums are returned as strings (e.g., ENABLED). When false, enums are returned as integers.
fields (string) –
Optional response field allowlist (Pydantic-style include behavior).

When provided, only the specified fields are included in the response.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (e.g., collection_objects.*.guid,collection_objects.*.id)
- Wildcards (collection_objects.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
exclude (string) –
Optional response field blocklist (Pydantic-style exclude behavior).

When provided, all response fields are returned except those excluded.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (e.g., dynamic_applications.release_notes)
- Wildcards (collection_objects.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
require_all_filters (boolean) –
Controls how multiple filter conditions are combined.
- true: all filters must match (AND)
- false: any filter may match (OR)
filter[<field>][<operator>] (string) –
Filter expression in the forms:
- filter[<field>][<operator>]=<value>
- filter[<field>][not][<operator>]=<value>
Multiple filters may be provided. Supported operators:
- is
- contains
- gt (single value only)
- lt (single value only)
- search (single value only, not negatable)
Values may be comma-separated to express multi-value matching.

For is, the special value null (case-insensitive) is treated as a SQL NULL check.

Examples:
- filter[id][is]=1,2,3
- filter[name][contains]=cpu,memory
- filter[description][not][is]=null

Status Codes:

200 OK – Filtered Dynamic Application list
400 Bad Request – Invalid request or validation error (malformed filters, invalid fields/operators, or no filters)
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – Dynamic Applications Not found
500 Internal Server Error – Internal server error

Request JSON Object:

dynamic_applications[].abandon_collection_limit (integer) – This is how many collection objects must be unavailable before the Dynamic Application should stop trying to collect data and wait until the next scheduled collection session.
dynamic_applications[].alert_objects[].formula (string) – Python expression to transform this Alert Object’s value.
dynamic_applications[].alert_objects[].guid (any) – A unique identifier for this Alert Object.
dynamic_applications[].alert_objects[].id (integer) – The unique numeric identifier for this Alert Object.
dynamic_applications[].alert_objects[].log_message (string) – The message to appear in logs when this Alert Object is triggered.
dynamic_applications[].alert_objects[].maintain_state (string) – EnabledToggle.
dynamic_applications[].alert_objects[].name (string) – Human-readable name for this Alert Object.
dynamic_applications[].alert_objects[].reference (any) – The reference label for this Alert Object. Used to distinguish between different instances.
dynamic_applications[].alert_objects[].state (string) – EnabledToggle.
dynamic_applications[].alert_objects[].triggered_alert_id (integer) – ID of the Alert Object to trigger when this Alert Object is triggered.
dynamic_applications[].alert_objects[].triggered_alert_reference (any) – The reference label for identifying which Alert Object to trigger when it has not yet been created and only has a reference. Cannot be null (HTTP 422); omit it to keep the stored triggered_alert_id.
dynamic_applications[].alert_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].alert_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].collection_objects[].alignment_condition (string) – Discovery alignment condition.
dynamic_applications[].collection_objects[].asset_link (string) – AssetLink values that can be set when the Dynamic Application is configuration-type (SNIPPET_CONFIGURATION or BULK_SNIPPET_CONFIGURATION).
dynamic_applications[].collection_objects[].asset_link_precedence (integer) – The asset link precedence value to use for this Collection Object. Must be in increments of 10.
dynamic_applications[].collection_objects[].change_alerting (string) – EnabledToggle.
dynamic_applications[].collection_objects[].class_type (string) – Type of data collected by a Collection Object.
dynamic_applications[].collection_objects[].component_identifiers[] (string) – Component identifier type used for component mapping.
dynamic_applications[].collection_objects[].description (string) – Description of what data this object gathers.
dynamic_applications[].collection_objects[].disable_maintenance (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].enable_deviation_alerting (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].enum_values (string) – The enum values to use if this Collection Object is CONFIG_ENUM type.
dynamic_applications[].collection_objects[].formula (string) – Python expression to transform collected value.
dynamic_applications[].collection_objects[].group (integer) – Numerical group for related objects.
dynamic_applications[].collection_objects[].guid (any) – A unique identifier for this Collection Object.
dynamic_applications[].collection_objects[].hide_object (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].id (integer) – The unique numeric identifier for this Collection Object.
dynamic_applications[].collection_objects[].max_weeks_data (integer) – The maximum number of weeks to store data for this Collection Object.
dynamic_applications[].collection_objects[].min_weeks_data (integer) – The minimum number of weeks to store data for this Collection Object.
dynamic_applications[].collection_objects[].name (string) – Human-readable name for the data point.
dynamic_applications[].collection_objects[].reference (any) – The reference label for this Collection Object. Used to distinguish between different instances.
dynamic_applications[].collection_objects[].snippet_argument (string) – Snippet Framework arguments for collection.
dynamic_applications[].collection_objects[].snippet_id (integer) – ID of the associated Snippet. A value of 0 means default / unset.
dynamic_applications[].collection_objects[].snippet_reference (any) – The reference label for identifying which Snippet to link to when one has not been created yet (e.g., snip_123). Cannot be null (HTTP 422); omit it to keep the stored snippet_id.
dynamic_applications[].collection_objects[].string_type (string) – String encoding/display type for configuration collection objects.
dynamic_applications[].collection_objects[].table_alignment (string) – Table alignment for UI display.
dynamic_applications[].collection_objects[].tabular (string) – EnabledToggle.
dynamic_applications[].collection_objects[].usage_type (string) – Collection Object usage type.
dynamic_applications[].collection_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].collection_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].collection_objects[].validity_check_operator (string) – Discovery validity-check operator.
dynamic_applications[].collection_objects[].validity_check_pattern (string) – The pattern to use in the Discovery validity check.
dynamic_applications[].component_mapping (string) – EnabledToggle.
dynamic_applications[].component_mapping_dynamic_applications[] (string) – Request-scoped unique label for linking new entities.
dynamic_applications[].cu_affinity (string) – Collector affinity for a Dynamic Application.
dynamic_applications[].description (string) – Detailed description of purpose for this Dynamic Application.
dynamic_applications[].disable_rollup_of_data (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
dynamic_applications[].event_policies[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
dynamic_applications[].event_policies[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
dynamic_applications[].event_policies[].component_type (string) – Component type associated with the Event Policy.
dynamic_applications[].event_policies[].description (string) – The description of this Event Policy.
dynamic_applications[].event_policies[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
dynamic_applications[].event_policies[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
dynamic_applications[].event_policies[].external_category (string) – Optional category used when sending this event to an external system.
dynamic_applications[].event_policies[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
dynamic_applications[].event_policies[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
dynamic_applications[].event_policies[].guid (any) – A unique identifier for this Event Policy.
dynamic_applications[].event_policies[].id (integer) – The unique numeric identifier for this Event Policy.
dynamic_applications[].event_policies[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
dynamic_applications[].event_policies[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
dynamic_applications[].event_policies[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
dynamic_applications[].event_policies[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
dynamic_applications[].event_policies[].match_logic (string) – Match strategy for event text evaluation.
dynamic_applications[].event_policies[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
dynamic_applications[].event_policies[].name (string) – The name of this Event Policy.
dynamic_applications[].event_policies[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
dynamic_applications[].event_policies[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
dynamic_applications[].event_policies[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
dynamic_applications[].event_policies[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
dynamic_applications[].event_policies[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
dynamic_applications[].event_policies[].second_match_string (string) – A secondary string used to match against the originating log message.
dynamic_applications[].event_policies[].severity (string) – Event severity level.
dynamic_applications[].event_policies[].source (string) – Source type for the Event Policy.
dynamic_applications[].event_policies[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
dynamic_applications[].event_policies[].state (string) – EnabledToggle.
dynamic_applications[].event_policies[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
dynamic_applications[].event_policies[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
dynamic_applications[].event_policies[].topology_suppression (string) – Topology suppression behavior for correlated events.
dynamic_applications[].event_policies[].trap_oid (string) – Trap OID to associate with this Event Policy.
dynamic_applications[].event_policies[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].event_policies[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].execution_environment (string) – The unique GUID identifier of the Execution Environment aligned to this Dynamic Application. Can be an Execution environment GUID or sl1_default_ee
dynamic_applications[].guid (any) – Unique GUID identifier for this Dynamic Application. Required for update; omit or null for create.
dynamic_applications[].id (integer) – The unique numeric identifier for this Dynamic Application.
dynamic_applications[].is_sf_app_type (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].max_devices (integer) – The maximum amount of devices that can be grouped together to execute in a single process without causing collection issues.
dynamic_applications[].name (string) – The human-readable name of this Dynamic Application. Required on create. Optional on update.
dynamic_applications[].null_column_option (string) – Behavior to apply when previously reported table data is missing.
dynamic_applications[].null_row_option (string) – Behavior to apply when previously reported table data is missing.
dynamic_applications[].poll_interval (string) – The frequency at which Skylar One polls devices aligned to the Dynamic Application.
dynamic_applications[].pp_guid (any) – The unique GUID identifier of the PowerPack this Dynamic Application is aligned to (immutable).
dynamic_applications[].presentation_objects[].abbreviation_suffix (string) – The abbreviation or suffix to use for this Presentation Object.
dynamic_applications[].presentation_objects[].data_unit (string) – The units for the data this Presentation Object displays.
dynamic_applications[].presentation_objects[].formula (string) – Python expression to transform this Presentation Object’s value.
dynamic_applications[].presentation_objects[].guid (any) – A unique identifier for this Presentation Object.
dynamic_applications[].presentation_objects[].guide_text (string) – Description of what data this Presentation Object displays.
dynamic_applications[].presentation_objects[].id (integer) – The unique numeric identifier for this Presentation Object.
dynamic_applications[].presentation_objects[].name (string) – Human-readable name for this Presentation Object.
dynamic_applications[].presentation_objects[].reference (any) – The reference label for this Presentation Object. Used to distinguish between different instances.
dynamic_applications[].presentation_objects[].show_as_percent (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].presentation_objects[].summarization_state (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].presentation_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].presentation_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].release_notes (string) – Release notes, changelog and version history for this Dynamic Application.
dynamic_applications[].snippets[].guid (any) – Unique identifier for this Snippet.
dynamic_applications[].snippets[].id (integer) – The unique numeric identifier for this Snippet.
dynamic_applications[].snippets[].name (string) – Human-readable name for this Snippet.
dynamic_applications[].snippets[].reference (any) – The reference label for this Snippet. Used to distinguish between different instances.
dynamic_applications[].snippets[].required (string) – Required toggle.
dynamic_applications[].snippets[].snippet (string) – Python code or reusable script content for this Snippet.
dynamic_applications[].snippets[].state (string) – EnabledToggle.
dynamic_applications[].snippets[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].snippets[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].state (string) – EnabledToggle.
dynamic_applications[].threshold_objects[].guid (any) – A unique identifier for this Threshold Object.
dynamic_applications[].threshold_objects[].id (integer) – The unique numeric identifier for this Threshold Object.
dynamic_applications[].threshold_objects[].name (string) – Human-readable name for this Threshold Object.
dynamic_applications[].threshold_objects[].numeric_range_high (number) – Specifies the high end of the possible values.
dynamic_applications[].threshold_objects[].numeric_range_low (number) – Specifies the low end of the possible values.
dynamic_applications[].threshold_objects[].override_threshold_value (any) – Whether this Threshold Object appears on the Device Thresholds page for each subscriber device.
dynamic_applications[].threshold_objects[].reference (any) – The reference label for this Threshold Object. Used to distinguish between different instances.
dynamic_applications[].threshold_objects[].type (any) – Specifies whether this Threshold Object is numeric or a percentage.
dynamic_applications[].threshold_objects[].unit (string) – The unit for the data this Threshold Object is defined around.
dynamic_applications[].threshold_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].threshold_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].threshold_objects[].value (number) – The default threshold value used if a subscriber device does not override it.
dynamic_applications[].type (string) – The protocol Skylar One uses and the type of data collected by the Dynamic Application.
dynamic_applications[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].version (number) – The version number of this Dynamic Application.
errors[] (string)

POST /dynamic_applications

Create or update Dynamic Applications

Query Parameters:

retrieve (boolean) – When true, the response includes a fully-expanded entities list containing the normalized stored objects. When false, only results is returned.
pretty (boolean) – Controls enum serialization format in responses. When true, enums are returned as strings; when false, as integers.
commit (boolean) –
Controls whether Dynamic Applications are upserted. Useful for validating changes that would occur using (retrieve=true) or for leveraging testing frameworks without having to handle resource cleanup.

When true, all Dynamic Applications are upserted on the system. When false, no Dynamic Applications are upserted on the system.
fields (string) –
Optional entities field allowlist (Pydantic-style include behavior).

When provided, only the specified fields are included in the response. Only used when retrieve=true.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (e.g., collection_objects.guid,collection_objects.*.id)
- Wildcards (collection_objects.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
exclude (string) –
Optional entities field blocklist (Pydantic-style exclude behavior).

When provided, all response fields are returned except those excluded. Only used when retrieve=true.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Nested paths (.e.g., snippets.snippet,collection_objects.snippet_argument)
- Wildcards (collection_objects.*.id)
If both fields and exclude are provided, fields is applied first, then exclude.

Response JSON Object:

dynamic_applications[].abandon_collection_limit (integer) – This is how many collection objects must be unavailable before the Dynamic Application should stop trying to collect data and wait until the next scheduled collection session.
dynamic_applications[].alert_objects[].formula (string) – Python expression to transform this Alert Object’s value.
dynamic_applications[].alert_objects[].guid (any) – A unique identifier for this Alert Object.
dynamic_applications[].alert_objects[].id (integer) – The unique numeric identifier for this Alert Object.
dynamic_applications[].alert_objects[].log_message (string) – The message to appear in logs when this Alert Object is triggered.
dynamic_applications[].alert_objects[].maintain_state (string) – EnabledToggle.
dynamic_applications[].alert_objects[].name (string) – Human-readable name for this Alert Object.
dynamic_applications[].alert_objects[].reference (any) – The reference label for this Alert Object. Used to distinguish between different instances.
dynamic_applications[].alert_objects[].state (string) – EnabledToggle.
dynamic_applications[].alert_objects[].triggered_alert_id (integer) – ID of the Alert Object to trigger when this Alert Object is triggered.
dynamic_applications[].alert_objects[].triggered_alert_reference (any) – The reference label for identifying which Alert Object to trigger when it has not yet been created and only has a reference. Cannot be null (HTTP 422); omit it to keep the stored triggered_alert_id.
dynamic_applications[].alert_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].alert_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].collection_objects[].alignment_condition (string) – Discovery alignment condition.
dynamic_applications[].collection_objects[].asset_link (string) – AssetLink values that can be set when the Dynamic Application is configuration-type (SNIPPET_CONFIGURATION or BULK_SNIPPET_CONFIGURATION).
dynamic_applications[].collection_objects[].asset_link_precedence (integer) – The asset link precedence value to use for this Collection Object. Must be in increments of 10.
dynamic_applications[].collection_objects[].change_alerting (string) – EnabledToggle.
dynamic_applications[].collection_objects[].class_type (string) – Type of data collected by a Collection Object.
dynamic_applications[].collection_objects[].component_identifiers[] (string) – Component identifier type used for component mapping.
dynamic_applications[].collection_objects[].description (string) – Description of what data this object gathers.
dynamic_applications[].collection_objects[].disable_maintenance (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].enable_deviation_alerting (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].enum_values (string) – The enum values to use if this Collection Object is CONFIG_ENUM type.
dynamic_applications[].collection_objects[].formula (string) – Python expression to transform collected value.
dynamic_applications[].collection_objects[].group (integer) – Numerical group for related objects.
dynamic_applications[].collection_objects[].guid (any) – A unique identifier for this Collection Object.
dynamic_applications[].collection_objects[].hide_object (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].collection_objects[].id (integer) – The unique numeric identifier for this Collection Object.
dynamic_applications[].collection_objects[].max_weeks_data (integer) – The maximum number of weeks to store data for this Collection Object.
dynamic_applications[].collection_objects[].min_weeks_data (integer) – The minimum number of weeks to store data for this Collection Object.
dynamic_applications[].collection_objects[].name (string) – Human-readable name for the data point.
dynamic_applications[].collection_objects[].reference (any) – The reference label for this Collection Object. Used to distinguish between different instances.
dynamic_applications[].collection_objects[].snippet_argument (string) – Snippet Framework arguments for collection.
dynamic_applications[].collection_objects[].snippet_id (integer) – ID of the associated Snippet. A value of 0 means default / unset.
dynamic_applications[].collection_objects[].snippet_reference (any) – The reference label for identifying which Snippet to link to when one has not been created yet (e.g., snip_123). Cannot be null (HTTP 422); omit it to keep the stored snippet_id.
dynamic_applications[].collection_objects[].string_type (string) – String encoding/display type for configuration collection objects.
dynamic_applications[].collection_objects[].table_alignment (string) – Table alignment for UI display.
dynamic_applications[].collection_objects[].tabular (string) – EnabledToggle.
dynamic_applications[].collection_objects[].usage_type (string) – Collection Object usage type.
dynamic_applications[].collection_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].collection_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].collection_objects[].validity_check_operator (string) – Discovery validity-check operator.
dynamic_applications[].collection_objects[].validity_check_pattern (string) – The pattern to use in the Discovery validity check.
dynamic_applications[].component_mapping (string) – EnabledToggle.
dynamic_applications[].component_mapping_dynamic_applications[] (string) – Request-scoped unique label for linking new entities.
dynamic_applications[].cu_affinity (string) – Collector affinity for a Dynamic Application.
dynamic_applications[].description (string) – Detailed description of purpose for this Dynamic Application.
dynamic_applications[].disable_rollup_of_data (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
dynamic_applications[].event_policies[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
dynamic_applications[].event_policies[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
dynamic_applications[].event_policies[].component_type (string) – Component type associated with the Event Policy.
dynamic_applications[].event_policies[].description (string) – The description of this Event Policy.
dynamic_applications[].event_policies[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
dynamic_applications[].event_policies[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
dynamic_applications[].event_policies[].external_category (string) – Optional category used when sending this event to an external system.
dynamic_applications[].event_policies[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
dynamic_applications[].event_policies[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
dynamic_applications[].event_policies[].guid (any) – A unique identifier for this Event Policy.
dynamic_applications[].event_policies[].id (integer) – The unique numeric identifier for this Event Policy.
dynamic_applications[].event_policies[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
dynamic_applications[].event_policies[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
dynamic_applications[].event_policies[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
dynamic_applications[].event_policies[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
dynamic_applications[].event_policies[].match_logic (string) – Match strategy for event text evaluation.
dynamic_applications[].event_policies[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
dynamic_applications[].event_policies[].name (string) – The name of this Event Policy.
dynamic_applications[].event_policies[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
dynamic_applications[].event_policies[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
dynamic_applications[].event_policies[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
dynamic_applications[].event_policies[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
dynamic_applications[].event_policies[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
dynamic_applications[].event_policies[].second_match_string (string) – A secondary string used to match against the originating log message.
dynamic_applications[].event_policies[].severity (string) – Event severity level.
dynamic_applications[].event_policies[].source (string) – Source type for the Event Policy.
dynamic_applications[].event_policies[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
dynamic_applications[].event_policies[].state (string) – EnabledToggle.
dynamic_applications[].event_policies[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
dynamic_applications[].event_policies[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
dynamic_applications[].event_policies[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
dynamic_applications[].event_policies[].topology_suppression (string) – Topology suppression behavior for correlated events.
dynamic_applications[].event_policies[].trap_oid (string) – Trap OID to associate with this Event Policy.
dynamic_applications[].event_policies[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].event_policies[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].event_policies[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].execution_environment (string) – The unique GUID identifier of the Execution Environment aligned to this Dynamic Application. Can be an Execution environment GUID or sl1_default_ee
dynamic_applications[].guid (any) – Unique GUID identifier for this Dynamic Application. Required for update; omit or null for create.
dynamic_applications[].id (integer) – The unique numeric identifier for this Dynamic Application.
dynamic_applications[].is_sf_app_type (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].max_devices (integer) – The maximum amount of devices that can be grouped together to execute in a single process without causing collection issues.
dynamic_applications[].name (string) – The human-readable name of this Dynamic Application. Required on create. Optional on update.
dynamic_applications[].null_column_option (string) – Behavior to apply when previously reported table data is missing.
dynamic_applications[].null_row_option (string) – Behavior to apply when previously reported table data is missing.
dynamic_applications[].poll_interval (string) – The frequency at which Skylar One polls devices aligned to the Dynamic Application.
dynamic_applications[].pp_guid (any) – The unique GUID identifier of the PowerPack this Dynamic Application is aligned to (immutable).
dynamic_applications[].presentation_objects[].abbreviation_suffix (string) – The abbreviation or suffix to use for this Presentation Object.
dynamic_applications[].presentation_objects[].data_unit (string) – The units for the data this Presentation Object displays.
dynamic_applications[].presentation_objects[].formula (string) – Python expression to transform this Presentation Object’s value.
dynamic_applications[].presentation_objects[].guid (any) – A unique identifier for this Presentation Object.
dynamic_applications[].presentation_objects[].guide_text (string) – Description of what data this Presentation Object displays.
dynamic_applications[].presentation_objects[].id (integer) – The unique numeric identifier for this Presentation Object.
dynamic_applications[].presentation_objects[].name (string) – Human-readable name for this Presentation Object.
dynamic_applications[].presentation_objects[].reference (any) – The reference label for this Presentation Object. Used to distinguish between different instances.
dynamic_applications[].presentation_objects[].show_as_percent (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].presentation_objects[].summarization_state (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
dynamic_applications[].presentation_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].presentation_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].release_notes (string) – Release notes, changelog and version history for this Dynamic Application.
dynamic_applications[].snippets[].guid (any) – Unique identifier for this Snippet.
dynamic_applications[].snippets[].id (integer) – The unique numeric identifier for this Snippet.
dynamic_applications[].snippets[].name (string) – Human-readable name for this Snippet.
dynamic_applications[].snippets[].reference (any) – The reference label for this Snippet. Used to distinguish between different instances.
dynamic_applications[].snippets[].required (string) – Required toggle.
dynamic_applications[].snippets[].snippet (string) – Python code or reusable script content for this Snippet.
dynamic_applications[].snippets[].state (string) – EnabledToggle.
dynamic_applications[].snippets[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].snippets[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].state (string) – EnabledToggle.
dynamic_applications[].threshold_objects[].guid (any) – A unique identifier for this Threshold Object.
dynamic_applications[].threshold_objects[].id (integer) – The unique numeric identifier for this Threshold Object.
dynamic_applications[].threshold_objects[].name (string) – Human-readable name for this Threshold Object.
dynamic_applications[].threshold_objects[].numeric_range_high (number) – Specifies the high end of the possible values.
dynamic_applications[].threshold_objects[].numeric_range_low (number) – Specifies the low end of the possible values.
dynamic_applications[].threshold_objects[].override_threshold_value (any) – Whether this Threshold Object appears on the Device Thresholds page for each subscriber device.
dynamic_applications[].threshold_objects[].reference (any) – The reference label for this Threshold Object. Used to distinguish between different instances.
dynamic_applications[].threshold_objects[].type (any) – Specifies whether this Threshold Object is numeric or a percentage.
dynamic_applications[].threshold_objects[].unit (string) – The unit for the data this Threshold Object is defined around.
dynamic_applications[].threshold_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].threshold_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].threshold_objects[].value (number) – The default threshold value used if a subscriber device does not override it.
dynamic_applications[].type (string) – The protocol Skylar One uses and the type of data collected by the Dynamic Application.
dynamic_applications[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
dynamic_applications[].validation_errors[].message (string) – Why the stored value is invalid. (required)
dynamic_applications[].version (number) – The version number of this Dynamic Application.

Status Codes:

200 OK – Update results
400 Bad Request – Invalid request or validation error
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – Dynamic Application Not found
415 Unsupported Media Type – Unsupported Media Type. The request body was not sent as JSON with a Content-Type of application/json.
422 Unprocessable Entity – Unprocessable entity. The complete resulting state (the stored values updated with the values of the request, including stored child entities that are not in the request) failed validation; nothing is written. A stored value that fails validation must be fixed in the request.
500 Internal Server Error – Internal server error

Request JSON Object:

entities[].abandon_collection_limit (integer) – This is how many collection objects must be unavailable before the Dynamic Application should stop trying to collect data and wait until the next scheduled collection session.
entities[].alert_objects[].formula (string) – Python expression to transform this Alert Object’s value.
entities[].alert_objects[].guid (any) – A unique identifier for this Alert Object.
entities[].alert_objects[].id (integer) – The unique numeric identifier for this Alert Object.
entities[].alert_objects[].log_message (string) – The message to appear in logs when this Alert Object is triggered.
entities[].alert_objects[].maintain_state (string) – EnabledToggle.
entities[].alert_objects[].name (string) – Human-readable name for this Alert Object.
entities[].alert_objects[].reference (any) – The reference label for this Alert Object. Used to distinguish between different instances.
entities[].alert_objects[].state (string) – EnabledToggle.
entities[].alert_objects[].triggered_alert_id (integer) – ID of the Alert Object to trigger when this Alert Object is triggered.
entities[].alert_objects[].triggered_alert_reference (any) – The reference label for identifying which Alert Object to trigger when it has not yet been created and only has a reference. Cannot be null (HTTP 422); omit it to keep the stored triggered_alert_id.
entities[].alert_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].alert_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
entities[].collection_objects[].alignment_condition (string) – Discovery alignment condition.
entities[].collection_objects[].asset_link (string) – AssetLink values that can be set when the Dynamic Application is configuration-type (SNIPPET_CONFIGURATION or BULK_SNIPPET_CONFIGURATION).
entities[].collection_objects[].asset_link_precedence (integer) – The asset link precedence value to use for this Collection Object. Must be in increments of 10.
entities[].collection_objects[].change_alerting (string) – EnabledToggle.
entities[].collection_objects[].class_type (string) – Type of data collected by a Collection Object.
entities[].collection_objects[].component_identifiers[] (string) – Component identifier type used for component mapping.
entities[].collection_objects[].description (string) – Description of what data this object gathers.
entities[].collection_objects[].disable_maintenance (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].collection_objects[].enable_deviation_alerting (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].collection_objects[].enum_values (string) – The enum values to use if this Collection Object is CONFIG_ENUM type.
entities[].collection_objects[].formula (string) – Python expression to transform collected value.
entities[].collection_objects[].group (integer) – Numerical group for related objects.
entities[].collection_objects[].guid (any) – A unique identifier for this Collection Object.
entities[].collection_objects[].hide_object (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].collection_objects[].id (integer) – The unique numeric identifier for this Collection Object.
entities[].collection_objects[].max_weeks_data (integer) – The maximum number of weeks to store data for this Collection Object.
entities[].collection_objects[].min_weeks_data (integer) – The minimum number of weeks to store data for this Collection Object.
entities[].collection_objects[].name (string) – Human-readable name for the data point.
entities[].collection_objects[].reference (any) – The reference label for this Collection Object. Used to distinguish between different instances.
entities[].collection_objects[].snippet_argument (string) – Snippet Framework arguments for collection.
entities[].collection_objects[].snippet_id (integer) – ID of the associated Snippet. A value of 0 means default / unset.
entities[].collection_objects[].snippet_reference (any) – The reference label for identifying which Snippet to link to when one has not been created yet (e.g., snip_123). Cannot be null (HTTP 422); omit it to keep the stored snippet_id.
entities[].collection_objects[].string_type (string) – String encoding/display type for configuration collection objects.
entities[].collection_objects[].table_alignment (string) – Table alignment for UI display.
entities[].collection_objects[].tabular (string) – EnabledToggle.
entities[].collection_objects[].usage_type (string) – Collection Object usage type.
entities[].collection_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].collection_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
entities[].collection_objects[].validity_check_operator (string) – Discovery validity-check operator.
entities[].collection_objects[].validity_check_pattern (string) – The pattern to use in the Discovery validity check.
entities[].component_mapping (string) – EnabledToggle.
entities[].component_mapping_dynamic_applications[] (string) – Request-scoped unique label for linking new entities.
entities[].cu_affinity (string) – Collector affinity for a Dynamic Application.
entities[].description (string) – Detailed description of purpose for this Dynamic Application.
entities[].disable_rollup_of_data (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].event_policies[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
entities[].event_policies[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
entities[].event_policies[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
entities[].event_policies[].component_type (string) – Component type associated with the Event Policy.
entities[].event_policies[].description (string) – The description of this Event Policy.
entities[].event_policies[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
entities[].event_policies[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
entities[].event_policies[].external_category (string) – Optional category used when sending this event to an external system.
entities[].event_policies[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
entities[].event_policies[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
entities[].event_policies[].guid (any) – A unique identifier for this Event Policy.
entities[].event_policies[].id (integer) – The unique numeric identifier for this Event Policy.
entities[].event_policies[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
entities[].event_policies[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
entities[].event_policies[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
entities[].event_policies[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
entities[].event_policies[].match_logic (string) – Match strategy for event text evaluation.
entities[].event_policies[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
entities[].event_policies[].name (string) – The name of this Event Policy.
entities[].event_policies[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
entities[].event_policies[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
entities[].event_policies[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
entities[].event_policies[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
entities[].event_policies[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
entities[].event_policies[].second_match_string (string) – A secondary string used to match against the originating log message.
entities[].event_policies[].severity (string) – Event severity level.
entities[].event_policies[].source (string) – Source type for the Event Policy.
entities[].event_policies[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
entities[].event_policies[].state (string) – EnabledToggle.
entities[].event_policies[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
entities[].event_policies[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
entities[].event_policies[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
entities[].event_policies[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
entities[].event_policies[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
entities[].event_policies[].topology_suppression (string) – Topology suppression behavior for correlated events.
entities[].event_policies[].trap_oid (string) – Trap OID to associate with this Event Policy.
entities[].event_policies[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].event_policies[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].event_policies[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].event_policies[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].event_policies[].validation_errors[].message (string) – Why the stored value is invalid. (required)
entities[].execution_environment (string) – The unique GUID identifier of the Execution Environment aligned to this Dynamic Application. Can be an Execution environment GUID or sl1_default_ee
entities[].guid (any) – Unique GUID identifier for this Dynamic Application. Required for update; omit or null for create.
entities[].id (integer) – The unique numeric identifier for this Dynamic Application.
entities[].is_sf_app_type (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].max_devices (integer) – The maximum amount of devices that can be grouped together to execute in a single process without causing collection issues.
entities[].name (string) – The human-readable name of this Dynamic Application. Required on create. Optional on update.
entities[].null_column_option (string) – Behavior to apply when previously reported table data is missing.
entities[].null_row_option (string) – Behavior to apply when previously reported table data is missing.
entities[].poll_interval (string) – The frequency at which Skylar One polls devices aligned to the Dynamic Application.
entities[].pp_guid (any) – The unique GUID identifier of the PowerPack this Dynamic Application is aligned to (immutable).
entities[].presentation_objects[].abbreviation_suffix (string) – The abbreviation or suffix to use for this Presentation Object.
entities[].presentation_objects[].data_unit (string) – The units for the data this Presentation Object displays.
entities[].presentation_objects[].formula (string) – Python expression to transform this Presentation Object’s value.
entities[].presentation_objects[].guid (any) – A unique identifier for this Presentation Object.
entities[].presentation_objects[].guide_text (string) – Description of what data this Presentation Object displays.
entities[].presentation_objects[].id (integer) – The unique numeric identifier for this Presentation Object.
entities[].presentation_objects[].name (string) – Human-readable name for this Presentation Object.
entities[].presentation_objects[].reference (any) – The reference label for this Presentation Object. Used to distinguish between different instances.
entities[].presentation_objects[].show_as_percent (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].presentation_objects[].summarization_state (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].presentation_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].presentation_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
entities[].release_notes (string) – Release notes, changelog and version history for this Dynamic Application.
entities[].snippets[].guid (any) – Unique identifier for this Snippet.
entities[].snippets[].id (integer) – The unique numeric identifier for this Snippet.
entities[].snippets[].name (string) – Human-readable name for this Snippet.
entities[].snippets[].reference (any) – The reference label for this Snippet. Used to distinguish between different instances.
entities[].snippets[].required (string) – Required toggle.
entities[].snippets[].snippet (string) – Python code or reusable script content for this Snippet.
entities[].snippets[].state (string) – EnabledToggle.
entities[].snippets[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].snippets[].validation_errors[].message (string) – Why the stored value is invalid. (required)
entities[].state (string) – EnabledToggle.
entities[].threshold_objects[].guid (any) – A unique identifier for this Threshold Object.
entities[].threshold_objects[].id (integer) – The unique numeric identifier for this Threshold Object.
entities[].threshold_objects[].name (string) – Human-readable name for this Threshold Object.
entities[].threshold_objects[].numeric_range_high (number) – Specifies the high end of the possible values.
entities[].threshold_objects[].numeric_range_low (number) – Specifies the low end of the possible values.
entities[].threshold_objects[].override_threshold_value (any) – Whether this Threshold Object appears on the Device Thresholds page for each subscriber device.
entities[].threshold_objects[].reference (any) – The reference label for this Threshold Object. Used to distinguish between different instances.
entities[].threshold_objects[].type (any) – Specifies whether this Threshold Object is numeric or a percentage.
entities[].threshold_objects[].unit (string) – The unit for the data this Threshold Object is defined around.
entities[].threshold_objects[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].threshold_objects[].validation_errors[].message (string) – Why the stored value is invalid. (required)
entities[].threshold_objects[].value (number) – The default threshold value used if a subscriber device does not override it.
entities[].type (string) – The protocol Skylar One uses and the type of data collected by the Dynamic Application.
entities[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].validation_errors[].message (string) – Why the stored value is invalid. (required)
entities[].version (number) – The version number of this Dynamic Application.
results[].alert_objects[].guid (string) – Uppercase 32-character hexadecimal GUID.
results[].alert_objects[].id (integer) – The unique numeric identifier for this DB entity.
results[].alert_objects[].name (string) – The name of this DB entity.
results[].alert_objects[].new (boolean) – Whether this entity is new or existing.
results[].alert_objects[].reference (any) – A unique identifier for this DB entity.
results[].collection_objects[].guid (string) – Uppercase 32-character hexadecimal GUID.
results[].collection_objects[].id (integer) – The unique numeric identifier for this DB entity.
results[].collection_objects[].name (string) – The name of this DB entity.
results[].collection_objects[].new (boolean) – Whether this entity is new or existing.
results[].collection_objects[].reference (any) – A unique identifier for this DB entity.
results[].dynamic_app.guid (string) – Uppercase 32-character hexadecimal GUID.
results[].dynamic_app.id (integer) – The unique numeric identifier for this DB entity.
results[].dynamic_app.name (string) – The name of this DB entity.
results[].dynamic_app.new (boolean) – Whether this entity is new or existing.
results[].dynamic_app.reference (any) – A unique identifier for this DB entity.
results[].event_policies[].guid (string) – Uppercase 32-character hexadecimal GUID.
results[].event_policies[].id (integer) – The unique numeric identifier for this DB entity.
results[].event_policies[].name (string) – The name of this DB entity.
results[].event_policies[].new (boolean) – Whether this entity is new or existing.
results[].event_policies[].reference (any) – A unique identifier for this DB entity.
results[].presentation_objects[].guid (string) – Uppercase 32-character hexadecimal GUID.
results[].presentation_objects[].id (integer) – The unique numeric identifier for this DB entity.
results[].presentation_objects[].name (string) – The name of this DB entity.
results[].presentation_objects[].new (boolean) – Whether this entity is new or existing.
results[].presentation_objects[].reference (any) – A unique identifier for this DB entity.
results[].snippets[].guid (string) – Uppercase 32-character hexadecimal GUID.
results[].snippets[].id (integer) – The unique numeric identifier for this DB entity.
results[].snippets[].name (string) – The name of this DB entity.
results[].snippets[].new (boolean) – Whether this entity is new or existing.
results[].snippets[].reference (any) – A unique identifier for this DB entity.
results[].threshold_objects[].guid (string) – Uppercase 32-character hexadecimal GUID.
results[].threshold_objects[].id (integer) – The unique numeric identifier for this DB entity.
results[].threshold_objects[].name (string) – The name of this DB entity.
results[].threshold_objects[].new (boolean) – Whether this entity is new or existing.
results[].threshold_objects[].reference (any) – A unique identifier for this DB entity.
success (boolean) – Whether the update call succeeded overall.

GET /event_policies/{event_identifier}

Get Event Policy

Parameters:

event_identifier (string) –
Event Policy identifier. May be one of:
- Event Policy ID (integer)
  Ex: 12345
- Event Policy GUID (32-character uppercase hex string)
  Ex: A1B2C3D4E5F6789012345678901234AB
- Event Policy name (string)
  Ex: my-event-policy

Query Parameters:

pretty (boolean) – When true, enums are returned as strings (e.g. ENABLED). When false, enums are returned as integers.
fields (string) –
Optional response field allowlist (Pydantic-style include behavior).

When provided, only the specified fields are included in the response.

Supports:
- Comma-separated field paths (e.g. guid,id,name)
- Wildcards (*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
exclude (string) –
Optional response field blocklist (Pydantic-style exclude behavior).

When provided, all response fields are returned except those excluded.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Wildcards (*.id)
If both fields and exclude are provided, fields is applied first, then exclude.

Status Codes:

200 OK – Event Policy definition
400 Bad Request – Invalid request or validation error
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – Event Policy Not found
422 Unprocessable Entity – Unprocessable entity. Stored data does not cause this: stored values that fail validation are returned with validation_errors.
500 Internal Server Error – Internal server error

Request JSON Object:

app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
component_type (string) – Component type associated with the Event Policy.
description (string) – The description of this Event Policy.
detection_weight (integer) – Validation order weight used when two event definitions are very similar.
expiry_delay (string) – Time span enum used for occurrence and expiry settings.
external_category (string) – Optional category used when sending this event to an external system.
external_event_id (integer) – Optional external event identifier used when correlating with another system.
first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
guid (any) – A unique identifier for this Event Policy.
id (integer) – The unique numeric identifier for this Event Policy.
identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
match_logic (string) – Match strategy for event text evaluation.
message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
name (string) – The name of this Event Policy.
occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
occurrence_time (string) – Time span enum used for occurrence and expiry settings.
override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
second_match_string (string) – A secondary string used to match against the originating log message.
severity (string) – Event severity level.
source (string) – Source type for the Event Policy.
source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
state (string) – EnabledToggle.
syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
topology_suppression (string) – Topology suppression behavior for correlated events.
trap_oid (string) – Trap OID to associate with this Event Policy.
use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
validation_errors[].message (string) – Why the stored value is invalid. (required)

GET /event_policies

List Event Policies (filtered)

Query Parameters:

pretty (boolean) – When true, enums are returned as strings (e.g., ENABLED). When false, enums are returned as integers.
fields (string) –
Optional response field allowlist (Pydantic-style include behavior).

When provided, only the specified fields are included in the response.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Wildcards (*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
exclude (string) –
Optional response field blocklist (Pydantic-style exclude behavior).

When provided, all response fields are returned except those excluded.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Wildcards (*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
require_all_filters (boolean) –
Controls how multiple filter conditions are combined.
- true: all filters must match (AND)
- false: any filter may match (OR)
filter[<field>][<operator>] (string) –
Filter expression in the forms:
- filter[<field>][<operator>]=<value>
- filter[<field>][not][<operator>]=<value>
Multiple filters may be provided. Supported operators:
- is
- contains
- gt (single value only)
- lt (single value only)
- search (single value only, not negatable)
Values may be comma-separated to express multi-value matching.

For is, the special value null (case-insensitive) is treated as a SQL NULL check. This includes the optional enum fields syslog_facility, syslog_severity and override_identifier_type.

Examples:
- filter[id][is]=1,2,3
- filter[name][contains]=cpu,memory
- filter[pp_guid][not][is]=null
- filter[syslog_severity][is]=null

Status Codes:

200 OK – Filtered Event Policy list
400 Bad Request – Invalid request or validation error (malformed filters, invalid fields/operators, or no filters)
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – Event Policies Not found
500 Internal Server Error – Internal server error

Request JSON Object:

errors[] (string)
event_policies[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
event_policies[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
event_policies[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
event_policies[].component_type (string) – Component type associated with the Event Policy.
event_policies[].description (string) – The description of this Event Policy.
event_policies[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
event_policies[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
event_policies[].external_category (string) – Optional category used when sending this event to an external system.
event_policies[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
event_policies[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
event_policies[].guid (any) – A unique identifier for this Event Policy.
event_policies[].id (integer) – The unique numeric identifier for this Event Policy.
event_policies[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
event_policies[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
event_policies[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
event_policies[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
event_policies[].match_logic (string) – Match strategy for event text evaluation.
event_policies[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
event_policies[].name (string) – The name of this Event Policy.
event_policies[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
event_policies[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
event_policies[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
event_policies[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
event_policies[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
event_policies[].second_match_string (string) – A secondary string used to match against the originating log message.
event_policies[].severity (string) – Event severity level.
event_policies[].source (string) – Source type for the Event Policy.
event_policies[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
event_policies[].state (string) – EnabledToggle.
event_policies[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
event_policies[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
event_policies[].topology_suppression (string) – Topology suppression behavior for correlated events.
event_policies[].trap_oid (string) – Trap OID to associate with this Event Policy.
event_policies[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
event_policies[].validation_errors[].message (string) – Why the stored value is invalid. (required)

POST /event_policies

Create or update Event Policies

Query Parameters:

retrieve (boolean) – When true, the response includes a fully-expanded entities list containing the normalized stored objects. When false, only results is returned.
pretty (boolean) – Controls enum serialization format in responses. When true, enums are returned as strings; when false, as integers.
commit (boolean) –
Controls whether Event Policies are upserted.

When true, all Event Policies are upserted on the system. When false, no Event Policies are upserted on the system.
fields (string) –
Optional entities field allowlist (Pydantic-style include behavior).

When provided, only the specified fields are included in the response. Only used when retrieve=true.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Wildcards (*.id)
If both fields and exclude are provided, fields is applied first, then exclude.
exclude (string) –
Optional entities field blocklist (Pydantic-style exclude behavior).

When provided, all response fields are returned except those excluded. Only used when retrieve=true.

Supports:
- Comma-separated field paths (e.g., guid,id,name)
- Wildcards (*.id)
If both fields and exclude are provided, fields is applied first, then exclude.

Response JSON Object:

event_policies[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
event_policies[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
event_policies[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
event_policies[].component_type (string) – Component type associated with the Event Policy.
event_policies[].description (string) – The description of this Event Policy.
event_policies[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
event_policies[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
event_policies[].external_category (string) – Optional category used when sending this event to an external system.
event_policies[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
event_policies[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
event_policies[].guid (any) – A unique identifier for this Event Policy.
event_policies[].id (integer) – The unique numeric identifier for this Event Policy.
event_policies[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
event_policies[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
event_policies[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
event_policies[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
event_policies[].match_logic (string) – Match strategy for event text evaluation.
event_policies[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
event_policies[].name (string) – The name of this Event Policy.
event_policies[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
event_policies[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
event_policies[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
event_policies[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
event_policies[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
event_policies[].second_match_string (string) – A secondary string used to match against the originating log message.
event_policies[].severity (string) – Event severity level.
event_policies[].source (string) – Source type for the Event Policy.
event_policies[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
event_policies[].state (string) – EnabledToggle.
event_policies[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
event_policies[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
event_policies[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
event_policies[].topology_suppression (string) – Topology suppression behavior for correlated events.
event_policies[].trap_oid (string) – Trap OID to associate with this Event Policy.
event_policies[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
event_policies[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
event_policies[].validation_errors[].message (string) – Why the stored value is invalid. (required)

Status Codes:

200 OK – Event Policy update results
400 Bad Request – Invalid request or validation error
401 Unauthorized – Unauthenticated
403 Forbidden – Forbidden (insufficient access hooks)
404 Not Found – Event Policy Not found
415 Unsupported Media Type – Unsupported Media Type. The request body was not sent as JSON with a Content-Type of application/json.
422 Unprocessable Entity – Unprocessable entity. The complete resulting state of the Event Policies (the stored values updated with the values of the request) failed validation; nothing is written. A stored value that fails validation must be fixed in the request.
500 Internal Server Error – Internal server error

Request JSON Object:

entities[].app_guid (any) – A unique identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
entities[].app_id (integer) – The unique numeric identifier for the Dynamic Application linked to this Event policy. Response behavior: - May be included when the Event Policy is serialized independently. - Omitted when the Event Policy is returned nested under a Dynamic Application response. Only relevant for DYNAMIC event sources.
entities[].auto_clear_events[] (string) – Request-scoped unique label for linking new entities.
entities[].component_type (string) – Component type associated with the Event Policy.
entities[].description (string) – The description of this Event Policy.
entities[].detection_weight (integer) – Validation order weight used when two event definitions are very similar.
entities[].expiry_delay (string) – Time span enum used for occurrence and expiry settings.
entities[].external_category (string) – Optional category used when sending this event to an external system.
entities[].external_event_id (integer) – Optional external event identifier used when correlating with another system.
entities[].first_match_string (string) – Correlates this event with a log message. Required for Syslog, API, and Email events.
entities[].guid (any) – A unique identifier for this Event Policy.
entities[].id (integer) – The unique numeric identifier for this Event Policy.
entities[].identifier_format (string) – If identifier_pattern returns multiple results, this field specifies which results to use and in which order.
entities[].identifier_pattern (string) – A regular expression used to extract the specific sub-entity associated with this event.
entities[].link_id (integer) – For INTERNAL events, associates the message with the specified id. For DYNAMIC events, associates the alert with the specified id. For AGENT events, associates the log policy with the specified id.
entities[].link_reference (any) – The reference to an Alert Object inside the same Dynamic Application when creating a new Alert Object in the same context. Otherwise, it is not used. Cannot be null (HTTP 422); omit it to keep the stored link_id.
entities[].match_logic (string) – Match strategy for event text evaluation.
entities[].message (string) – The message that appears in the Event Console or Viewing Events page when this event occurs.
entities[].name (string) – The name of this Event Policy.
entities[].occurrence_count (integer) – The number of identical event instances that must occur before Skylar One creates a new event message. A value of 0 means disabled.
entities[].occurrence_time (string) – Time span enum used for occurrence and expiry settings.
entities[].override_identifier_type (string) – Identifier type override used with identifier_pattern / identifier_format.
entities[].pp_guid (any) – The unique GUID identifier of the PowerPack this Event Policy is aligned to.
entities[].reference (any) – The reference label for this Event Policy. Used to distinguish between different instances.
entities[].second_match_string (string) – A secondary string used to match against the originating log message.
entities[].severity (string) – Event severity level.
entities[].source (string) – Source type for the Event Policy.
entities[].source_host_oid (string) – Specifies an OID included in the trap that contains the IP address of the device that originally sent the trap message.
entities[].state (string) – EnabledToggle.
entities[].syslog_application_name (string) – Specifies what the application name field of an incoming syslog message must match for this event to trigger.
entities[].syslog_facility (string) – Syslog facility matcher for SYSLOG event policies.
entities[].syslog_message_id (string) – Specifies what the message id field of an incoming syslog message must match for this event to trigger.
entities[].syslog_process_id (string) – Specifies what the process id field of an incoming syslog message must match for this event to trigger.
entities[].syslog_severity (string) – Syslog severity matcher for SYSLOG event policies.
entities[].topology_suppression (string) – Topology suppression behavior for correlated events.
entities[].trap_oid (string) – Trap OID to associate with this Event Policy.
entities[].use_message_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].use_multi_match (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].use_severity_modifier (string) – Boolean toggle. Must be entered as a string of TRUE or FALSE.
entities[].validation_errors[].field (string) – The field with the invalid stored value (nested locations are joined with “ -> “). (required)
entities[].validation_errors[].message (string) – Why the stored value is invalid. (required)
results[].guid (string) – Uppercase 32-character hexadecimal GUID.
results[].id (integer) – The unique numeric identifier for this DB entity.
results[].name (string) – The name of this DB entity.
results[].new (boolean) – Whether this entity is new or existing.
results[].reference (any) – A unique identifier for this DB entity.
success (boolean) – Whether the update call succeeded overall.