action_mix | object | Domain / file / command action counts rolled up from the agent_action_* tables, scoped to the window supplied by the caller (defaults to 24h). Zero across the board means no actionable events were extracted in the window. |
action_mix.commands | integer | |
action_mix.domains | integer | |
action_mix.files | integer | |
agent_id | string | Required. |
assigned_zone_id | string or null | The zone governing this agent: its manual pin, else the one the resolver gives it. |
assigned_zone_label | string or null | The assigned zone's org-unit name — the label every zone surface shows. |
assigned_zone_unit_id | string or null | The org unit the assigned zone hangs off. |
assignment_source | string — one of auto, manual | manual — pinned to a zone by hand; auto — the resolver decides. |
budget_source | string | Which scope produced budget_usd: agent | subscription_default | org_default | none. |
budget_usd | string or null | The resolved monthly budget - this agent's own row, else the default of the declared subscription that makes it Sanctioned, else the org default. Null when none is set. |
capabilities | object or null | What the agent's binding can do (prompt, show a notice, observe execution, which tools its refusals reach), as the install reported it. null before the install's first v3 bundle request: unknown, never a limit (AZ-4 handoff gap 1). |
capabilities.ask | boolean | Required. Can show its own prompt to the developer. |
capabilities.enforces | string | Required. all, or shell_only: which tools its refusals actually reach. |
capabilities.notice | boolean | Required. Can show a non-blocking message. |
capabilities.observes_execution | boolean | Required. Emits a post-execution event, so an answer can be inferred. |
category | string or null | Open category string; known values coding | analysis | ops | content | service. |
control_level | string | enforced (fetched a bundle in the last 24h — evaluating policy locally) | monitored (sent events, no bundle — we see it and cannot stop it) | known (neither). Derived per request, never stored. |
display_name | string or null | |
environment | string | Frozen Environment — production | staging | development | unknown. |
first_seen_at | string (date-time) | Required. |
function | string or null | Business function (frozen enum; wire name for the ORM's business_function). 'unknown' = not yet classified; null while the resolver has not yet run. |
host_id | string or null | |
instance_qualifier | object or null | What tells this agent apart from the other agents of its platform on its host, shown beside the name and never inside it; null for a host's first OS user in their default profile. |
instance_qualifier.os_user | string or null | The OS user captured on a later user's agent; null for a host's first user, when identity capture is off, when nothing was captured, or on a zone's agent rows for a key without agents:read. |
instance_qualifier.profile_suffix | string or null | The first 4 characters of the instance's profile part; null for a default profile. |
instance_qualifier.user_suffix | string or null | The first 4 characters of the instance's user part; null for a host's first user. |
last_seen_at | string (date-time) | Required. When the agent last sent activity. For an agent that has never been active (found by discovery, never run since), this is first_seen_at and never_active is true. |
latest_agent_version | string or null | |
latest_arch | string or null | |
latest_client_version | string or null | |
latest_hook_version | string or null | |
latest_local_ipv4 | string or null | |
latest_local_ipv6 | string or null | |
latest_os | string or null | |
latest_public_ipv4 | string or null | |
latest_public_ipv6 | string or null | |
mtd_consumption_usd | string or null | Month-to-date consumption for this agent (pricebook-weighted cost_total, every billing mode). What the budget is measured against. Null when the surface did not compute it; 0 means the agent really has not spent. |
never_active | boolean | True when the agent has never sent any activity (found by discovery and not run since): last_seen_at then repeats first_seen_at and is not a sighting of activity. |
org_unit_path | string or null | Slash-joined path of the agent's placement unit: the human owner's unit, else the service-accountable person's unit, else the service-accountable unit. Null when none applies. |
owner_display_name | string or null | The owner person's display name; null when there is no (or an orphaned) owner person. |
owner_kind | string or null | Ownership verdict: human | service | unattributed; null while the resolver has not yet run. |
owner_person_id | string or null | The resolved human owner's directory_people id — the value the owner filter of GET /agents takes (it cannot filter by display name). Null for service / unattributed / resolving. |
owner_status | string or null | The owner person's directory status (active | inactive); null when there is no owner person. |
platform | string | Required. |
proxy_as_of | string (date-time) or null | Timestamp of the latest event that actually CARRIED the proxy attributes — not of the latest event overall, so a stale shape is never reported as freshly confirmed. Null until the first carrying event. |
proxy_source | string or null | How the client found that route: manual | env | windows | macos | gnome | pac | wpad. Null under the same conditions as proxy_type. Open string, same reason. |
proxy_tls_intercepted | boolean or null | Whether the client observed the proxy terminating and re-issuing TLS. Null is NOT false: null = never observed (the client omits the attribute until a TLS handshake has actually completed), false = observed and clean. |
proxy_type | string or null | Egress proxy type last reported by this agent's client: http | https | socks5 | pac. Null = the agent egresses direct, or never reported one. Open string: the client owns the vocabulary, so an unknown value is stored and returned verbatim rather than rejected. |
sessions_count | integer | Distinct session count for this agent over the same rolling window as action_mix (defaults to 24h): how many sessions blend into one agent identity, without a per-agent sessions call. Zero means no sessions were active in the window. |
stale | boolean | This install's latest compatibility evidence (I-15 plan 02) does not intersect what the platform currently retains. NOT a fourth control level: a stale agent keeps whatever level its last bundle earned it, because 'we stopped serving it' and 'it is not under control' are different facts. |
total_events_lifetime | integer | Lifetime event count for this agent — sum of event_stats_daily.event_count across every day, never zero-floored to a 24h window. Gives an accurate count for agents idle longer than 24h, for which verdicts_24h shows 0 even when the agent has many events in older sessions. |
used_pct | number or null | mtd_consumption_usd as a percent of budget_usd. Null when there is no budget. A zero budget reports 100 when nothing was spent and 999 otherwise. |
verdicts_24h | object | Verdict counts over the last 24h. Zero if no activity. |
verdicts_24h.allow | integer | Actions the policy allowed |
verdicts_24h.ask | integer | Actions the policy sent to Ask |
verdicts_24h.block | integer | Actions the policy blocked |
verdicts_24h.total | integer | Total events in the 24h window |
window_consumption_usd | string or null | Consumption for this agent over the request's window (pricebook-weighted cost_total, every billing mode) — the figure the fleet tile prints. Never compare it to budget_usd: a budget is a calendar month. Null when the surface did not compute it; 0 means the agent really has not spent in the window. |
