> ## Documentation Index > Fetch the complete documentation index at: https://docs.swarmd.ai/llms.txt > Use this file to discover all available pages before exploring further. # Preview a monitor query against historical data > **Security Requirements** | Auth Types | Entities | Permissions | Required Roles | |------------|----------|-------------|----------------| | USER | AUDIT | READ | AUDIT:READ | ## OpenAPI ````yaml /openapi/swarmd.json post /audit/v1/monitors/preview openapi: 3.1.0 info: title: Relay version: v0 servers: - url: https://api.dev.swarmd.ai description: Development security: [] tags: - name: Policy Groups x-displayName: Policy Groups - name: Policy Bindings x-displayName: Policy Bindings - name: Evaluation Packs x-displayName: Evaluation Packs - name: Webhooks x-displayName: Webhooks - name: MCP JSON-RPC x-displayName: MCP JSON-RPC - name: Conversations x-displayName: Conversations - name: Human JSON-RPC x-displayName: Human JSON-RPC - name: Channel JSON-RPC x-displayName: Channel JSON-RPC - name: HITL Approvals x-displayName: HITL Approvals - name: Agent JSON-RPC x-displayName: Agent JSON-RPC - name: Tasks x-displayName: Tasks - name: Push Notifications x-displayName: Push Notifications - name: Messaging x-displayName: Messaging - name: LLM Runtime x-displayName: LLM Runtime - name: Agent Discovery x-displayName: Agent Discovery - name: MCP Servers x-displayName: MCP Servers - name: LLM Gateways x-displayName: LLM Gateways - name: Agents x-displayName: Agents - name: User Subscriptions x-displayName: User Subscriptions - name: LLM Providers x-displayName: LLM Providers - name: LLM Gateway Subscriptions x-displayName: LLM Gateway Subscriptions - name: Kill Switches x-displayName: Kill Switches - name: Channels x-displayName: Channels - name: Channel Subscriptions x-displayName: Channel Subscriptions - name: Agent Subscriptions x-displayName: Agent Subscriptions - name: Marketplace x-displayName: Marketplace - name: Identity Providers x-displayName: Identity Providers - name: Groups x-displayName: Groups - name: Authentication x-displayName: Authentication - name: Users x-displayName: Users - name: Tenants x-displayName: Tenants - name: mcp-consent-controller x-displayName: mcp-consent-controller - name: Audit Monitors x-displayName: Audit Monitors - name: Audit Integrity x-displayName: Audit Integrity - name: Audit Events x-displayName: Audit Events - name: Audit Traces x-displayName: Audit Traces - name: audit-rest-controller x-displayName: audit-rest-controller - name: Audit Dashboard x-displayName: Audit Dashboard - name: A2A Payments x-displayName: A2A Payments paths: /audit/v1/monitors/preview: post: tags: - Audit Monitors summary: Preview a monitor query against historical data description: |- **Security Requirements** | Auth Types | Entities | Permissions | Required Roles | |------------|----------|-------------|----------------| | USER | AUDIT | READ | AUDIT:READ | operationId: previewMonitor requestBody: content: application/json: schema: $ref: '#/components/schemas/Audit_MonitorPreviewRequest' required: true responses: '200': description: OK content: '*/*': schema: $ref: '#/components/schemas/Audit_MonitorPreviewResponse' security: - Audit_bearerAuth: [] components: schemas: Audit_MonitorPreviewRequest: type: object properties: queryConfig: oneOf: - $ref: '#/components/schemas/Audit_Change' - $ref: '#/components/schemas/Audit_Outlier' - $ref: '#/components/schemas/Audit_Threshold' lookbackDays: type: integer format: int32 Audit_MonitorPreviewResponse: type: object properties: simulatedAlertCount: type: integer format: int64 alerts: type: array items: $ref: '#/components/schemas/Audit_SimulatedAlert' warningHits: type: number criticalHits: type: number lookbackDays: type: integer format: int32 windowsEvaluated: type: integer format: int64 Audit_Change: allOf: - $ref: '#/components/schemas/Audit_MonitorQueryConfig' - type: object properties: metric: type: string enum: - REQUESTS - BLOCKS - WARNS - MASKS - HITL_HOLDS - ERRORS - ERROR_RATE_PCT - LATENCY_AVG_MS - LATENCY_P50_MS - LATENCY_P95_MS - LATENCY_P99_MS - LLM_CALLS - LLM_FAILOVERS - TOOL_CALLS - MCP_REQUESTS - USER_DISTINCT - AGENT_DISTINCT aggregation: type: string enum: - SUM - AVG - MIN - MAX - P50 - P95 - P99 - COUNT - COUNT_DISTINCT - RATE_PER_MIN window: type: string enum: - LAST_5M - LAST_15M - LAST_1H - LAST_4H - LAST_24H - LAST_7D groupBy: type: string enum: - NONE - AGENT - USER - MCP_SERVER - LLM_GATEWAY - LLM_PROVIDER - CHANNEL - POLICY filters: type: array items: $ref: '#/components/schemas/Audit_MonitorFilter' direction: type: string enum: - SPIKE - DROP - EITHER warningPercentChange: type: number criticalPercentChange: type: number Audit_Outlier: allOf: - $ref: '#/components/schemas/Audit_MonitorQueryConfig' - type: object properties: metric: type: string enum: - REQUESTS - BLOCKS - WARNS - MASKS - HITL_HOLDS - ERRORS - ERROR_RATE_PCT - LATENCY_AVG_MS - LATENCY_P50_MS - LATENCY_P95_MS - LATENCY_P99_MS - LLM_CALLS - LLM_FAILOVERS - TOOL_CALLS - MCP_REQUESTS - USER_DISTINCT - AGENT_DISTINCT aggregation: type: string enum: - SUM - AVG - MIN - MAX - P50 - P95 - P99 - COUNT - COUNT_DISTINCT - RATE_PER_MIN window: type: string enum: - LAST_5M - LAST_15M - LAST_1H - LAST_4H - LAST_24H - LAST_7D groupBy: type: string enum: - NONE - AGENT - USER - MCP_SERVER - LLM_GATEWAY - LLM_PROVIDER - CHANNEL - POLICY filters: type: array items: $ref: '#/components/schemas/Audit_MonitorFilter' Audit_Threshold: allOf: - $ref: '#/components/schemas/Audit_MonitorQueryConfig' - type: object properties: metric: type: string enum: - REQUESTS - BLOCKS - WARNS - MASKS - HITL_HOLDS - ERRORS - ERROR_RATE_PCT - LATENCY_AVG_MS - LATENCY_P50_MS - LATENCY_P95_MS - LATENCY_P99_MS - LLM_CALLS - LLM_FAILOVERS - TOOL_CALLS - MCP_REQUESTS - USER_DISTINCT - AGENT_DISTINCT aggregation: type: string enum: - SUM - AVG - MIN - MAX - P50 - P95 - P99 - COUNT - COUNT_DISTINCT - RATE_PER_MIN window: type: string enum: - LAST_5M - LAST_15M - LAST_1H - LAST_4H - LAST_24H - LAST_7D groupBy: type: string enum: - NONE - AGENT - USER - MCP_SERVER - LLM_GATEWAY - LLM_PROVIDER - CHANNEL - POLICY filters: type: array items: $ref: '#/components/schemas/Audit_MonitorFilter' comparison: type: string enum: - ABOVE - BELOW - OUTSIDE_RANGE warningThreshold: type: number criticalThreshold: type: number Audit_SimulatedAlert: type: object properties: when: type: string format: date-time severity: type: string enum: - LOW - MEDIUM - HIGH - CRITICAL subjectLabel: type: string value: type: number Audit_MonitorQueryConfig: discriminator: propertyName: type properties: type: type: string required: - type Audit_MonitorFilter: type: object properties: dimension: type: string enum: - AGENT - USER - MCP_SERVER - CHANNEL - POLICY - LLM_GATEWAY - LLM_PROVIDER - AUDIT_ACTION - MIDDLEWARE_TYPE - TRANSPORT - STAGE - POLICY_LEVEL - TASK_STATE operator: type: string enum: - IN - NOT_IN values: type: array items: type: string minItems: 1 required: - dimension - operator - values securitySchemes: Audit_bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT token (USER, AGENT, or SERVICE auth) ````