Skip to content

docs(api): describe access rules for team filters, private resources and roles #1071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ysyneu merged 1 commit into from
Oct 17, 2026
Merged

docs(api): describe access rules for team filters, private resources and roles #1071

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions api-reference/monitors.openapi.en.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -662,7 +662,7 @@
"Monitors/Data sources"
],
"x-mint": {
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Datasources Read** (`monit`) |\n\n## Usage\n\n- The datasource identified by `id` must be of type `sls`; other types fail with `InvalidParameter`.\n- Use `query` to filter the project list and `offset` and `size` to paginate; `count` is the number of projects in the page and `total` the number matching the filter.\n- The request is relayed to the Monitors edge cluster of the datasource, which calls Alibaba Cloud with the stored credentials; it times out after 30 seconds. Fails with `InvalidParameter` when no edge instance of that cluster is online, and with HTTP 503 `ServiceUnavailable` when the edge version does not support metadata discovery.",
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Datasources Read** (`monit`) |\n\n## Usage\n\n- The datasource identified by `id` must be of type `sls`; other types fail with `InvalidParameter`.\n- The caller needs query access to the datasource (see `readonly_team_ids` on the datasource); otherwise the call fails with 403 `AccessDenied`.\n- Use `query` to filter the project list and `offset` and `size` to paginate; `count` is the number of projects in the page and `total` the number matching the filter.\n- The request is relayed to the Monitors edge cluster of the datasource, which calls Alibaba Cloud with the stored credentials; it times out after 30 seconds. Fails with `InvalidParameter` when no edge instance of that cluster is online, and with HTTP 503 `ServiceUnavailable` when the edge version does not support metadata discovery.",
"href": "/en/api-reference/monitors/data-sources/monit-datasource-read-sls-projects",
"metadata": {
"sidebarTitle": "List SLS projects"
Expand Down Expand Up @@ -761,7 +761,7 @@
"Monitors/Data sources"
],
"x-mint": {
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Datasources Read** (`monit`) |\n\n## Usage\n\n- The datasource identified by `id` must be of type `sls`; other types fail with `InvalidParameter`.\n- Supply `project` to select the SLS project whose logstores to list; use `offset` and `size` to paginate. The response is a plain array of logstore names.\n- The request is relayed to the Monitors edge cluster of the datasource, which calls Alibaba Cloud with the stored credentials; it times out after 30 seconds. Fails with `InvalidParameter` when no edge instance of that cluster is online, and with HTTP 503 `ServiceUnavailable` when the edge version does not support metadata discovery.",
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Datasources Read** (`monit`) |\n\n## Usage\n\n- The datasource identified by `id` must be of type `sls`; other types fail with `InvalidParameter`.\n- The caller needs query access to the datasource (see `readonly_team_ids` on the datasource); otherwise the call fails with 403 `AccessDenied`.\n- Supply `project` to select the SLS project whose logstores to list; use `offset` and `size` to paginate. The response is a plain array of logstore names.\n- The request is relayed to the Monitors edge cluster of the datasource, which calls Alibaba Cloud with the stored credentials; it times out after 30 seconds. Fails with `InvalidParameter` when no edge instance of that cluster is online, and with HTTP 503 `ServiceUnavailable` when the edge version does not support metadata discovery.",
"href": "/en/api-reference/monitors/data-sources/monit-datasource-read-sls-logstores",
"metadata": {
"sidebarTitle": "List SLS logstores"
Expand Down Expand Up @@ -1451,7 +1451,7 @@
"Monitors/Alert rules"
],
"x-mint": {
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Alerting Rules Read** or **Alerting Rules Manage** (`monit`) |\n\n## Usage\n\n- `id` is required and must not be `0`; otherwise the call returns `InvalidParameter`.\n- A missing rule, or a rule of another account, returns `InvalidParameter` (`alert rule not found`).\n- No folder-level check applies: any caller with the permission above can read every rule in the account.",
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Alerting Rules Read** or **Alerting Rules Manage** (`monit`) |\n\n## Usage\n\n- `id` is required and must not be `0`; otherwise the call returns `InvalidParameter`.\n- A missing rule, or a rule of another account, returns `InvalidParameter` (`alert rule not found`).\n- The caller must have access to the rule's folder (the account owner or an admin, the creator of the folder or an ancestor, or a member of the team bound to it or an ancestor); otherwise the call returns `AccessDenied`. A rule whose folder no longer exists returns `InvalidParameter` (folder not found).",
"href": "/en/api-reference/monitors/alert-rules/monit-rule-read-info-v2",
"metadata": {
"sidebarTitle": "Get alert rule detail (V2)"
Expand Down Expand Up @@ -2475,7 +2475,7 @@
}
},
"400": {
"description": "The `X-DSID` header is not a number, the data source is not a Prometheus data source, or no monit-edge is registered for the data source's cluster. Returned as `text/plain`.",
"description": "The `X-DSID` header is not a number, the data source is not a Prometheus data source, no monit-edge is registered for the data source's cluster, or the data source does not exist or belongs to another account (message `data source not found`). Returned as `text/plain`.",
"content": {
"text/plain": {
"schema": {
Expand All @@ -2494,7 +2494,7 @@
"$ref": "#/components/responses/TooManyRequests"
},
"500": {
"description": "The data source does not exist or belongs to another account (message `data source not found`), or the data source lookup or proxied request failed. Returned as `text/plain`.",
"description": "The data source lookup or proxied request failed. Returned as `text/plain`.",
"content": {
"text/plain": {
"schema": {
Expand All @@ -2509,7 +2509,7 @@
"Monitors/Data sources"
],
"x-mint": {
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | Any valid `app_key` (read-only; not gated by a specific permission class) |\n| Edge requirement | Querying a specific data source requires **monit-edge v0.35.0 or later** |\n\n## Usage\n\n- Pass the target data source ID in the `X-DSID` header. It must belong to the authenticated account and be a Prometheus data source; use `/monit/datasource/list` to obtain its ID.\n- The 200 body is the data source's native Prometheus HTTP API payload, **not** the standard `{ request_id, data }` envelope. Query-string parameters are forwarded unchanged, so Prometheus's own parameters such as `match[]`, `start`, and `end` work.\n- When `X-DSID` is omitted, or any monit-edge of the data source's cluster is older than v0.35.0, the request is answered by the platform's own Prometheus instead of your data source. Send the header and keep monit-edge up to date to get your data source's values.\n- Failures raised before the data source is reached are returned as `text/plain` with the matching 4xx or 5xx status. A status of 400 or above returned by the data source itself is passed through with its own body.",
"content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | Any valid `app_key` (read-only; not gated by a specific permission class) |\n| Edge requirement | Querying a specific data source requires **monit-edge v0.35.0 or later** |\n\n## Usage\n\n- Pass the target data source ID in the `X-DSID` header. It must belong to the authenticated account and be a Prometheus data source; use `/monit/datasource/list` to obtain its ID.\n- When the data source restricts querying to certain teams, only members of those teams, its managing team, and account owners or admins can query it; others get 403. An unknown data source ID returns 400.\n- The 200 body is the data source's native Prometheus HTTP API payload, **not** the standard `{ request_id, data }` envelope. Query-string parameters are forwarded unchanged, so Prometheus's own parameters such as `match[]`, `start`, and `end` work.\n- When `X-DSID` is omitted, or any monit-edge of the data source's cluster is older than v0.35.0, the request is answered by the platform's own Prometheus instead of your data source. Send the header and keep monit-edge up to date to get your data source's values.\n- Failures raised before the data source is reached are returned as `text/plain` with the matching 4xx or 5xx status. A status of 400 or above returned by the data source itself is passed through with its own body.",
"href": "/en/api-reference/monitors/data-sources/monit-prometheus-read-label-values",
"metadata": {
"sidebarTitle": "List Prometheus label values"
Expand Down
12 changes: 6 additions & 6 deletions api-reference/monitors.openapi.zh.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -662,7 +662,7 @@
"Monitors/告警数据源"
],
"x-mint": {
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **数据源查看**（`monit`） |\n\n## 使用说明\n\n- `id` 指定的数据源类型必须为 `sls`，其他类型返回 `InvalidParameter`。\n- 使用 `query` 过滤项目列表，使用 `offset` 和 `size` 分页；`count` 为当前页项目数，`total` 为满足过滤条件的项目总数。\n- 请求会转发给该数据源所属的 Monitors edge 集群，由 edge 使用已保存的凭据调用阿里云，30 秒超时。该集群没有在线的 edge 实例时返回 `InvalidParameter`；edge 版本不支持元数据发现时返回 HTTP 503 `ServiceUnavailable`。",
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **数据源查看**（`monit`） |\n\n## 使用说明\n\n- `id` 指定的数据源类型必须为 `sls`，其他类型返回 `InvalidParameter`。\n- 调用者需要有该数据源的查询权限（见数据源的 `readonly_team_ids`），否则返回 403 `AccessDenied`。\n- 使用 `query` 过滤项目列表，使用 `offset` 和 `size` 分页；`count` 为当前页项目数，`total` 为满足过滤条件的项目总数。\n- 请求会转发给该数据源所属的 Monitors edge 集群，由 edge 使用已保存的凭据调用阿里云，30 秒超时。该集群没有在线的 edge 实例时返回 `InvalidParameter`；edge 版本不支持元数据发现时返回 HTTP 503 `ServiceUnavailable`。",
"href": "/zh/api-reference/monitors/data-sources/monit-datasource-read-sls-projects",
"metadata": {
"sidebarTitle": "查询 SLS 项目列表"
Expand Down Expand Up @@ -761,7 +761,7 @@
"Monitors/告警数据源"
],
"x-mint": {
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **数据源查看**（`monit`） |\n\n## 使用说明\n\n- `id` 指定的数据源类型必须为 `sls`，其他类型返回 `InvalidParameter`。\n- 通过 `project` 指定要列出日志库的 SLS 项目；使用 `offset` 和 `size` 分页。响应是日志库名称组成的数组。\n- 请求会转发给该数据源所属的 Monitors edge 集群，由 edge 使用已保存的凭据调用阿里云，30 秒超时。该集群没有在线的 edge 实例时返回 `InvalidParameter`；edge 版本不支持元数据发现时返回 HTTP 503 `ServiceUnavailable`。",
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **数据源查看**（`monit`） |\n\n## 使用说明\n\n- `id` 指定的数据源类型必须为 `sls`，其他类型返回 `InvalidParameter`。\n- 调用者需要有该数据源的查询权限（见数据源的 `readonly_team_ids`），否则返回 403 `AccessDenied`。\n- 通过 `project` 指定要列出日志库的 SLS 项目；使用 `offset` 和 `size` 分页。响应是日志库名称组成的数组。\n- 请求会转发给该数据源所属的 Monitors edge 集群，由 edge 使用已保存的凭据调用阿里云，30 秒超时。该集群没有在线的 edge 实例时返回 `InvalidParameter`；edge 版本不支持元数据发现时返回 HTTP 503 `ServiceUnavailable`。",
"href": "/zh/api-reference/monitors/data-sources/monit-datasource-read-sls-logstores",
"metadata": {
"sidebarTitle": "查询 SLS 日志库列表"
Expand Down Expand Up @@ -1451,7 +1451,7 @@
"Monitors/告警规则"
],
"x-mint": {
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **告警规则查看**或**告警规则管理**（`monit`） |\n\n## 使用说明\n\n- `id` 必填且不能为 `0`，否则返回 `InvalidParameter`。\n- 规则不存在或属于其他账户时返回 `InvalidParameter`（`alert rule not found`）。\n- 不做文件夹级权限校验：具备上述权限的调用者可读取账户内的任意规则。",
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **告警规则查看**或**告警规则管理**（`monit`） |\n\n## 使用说明\n\n- `id` 必填且不能为 `0`，否则返回 `InvalidParameter`。\n- 规则不存在或属于其他账户时返回 `InvalidParameter`（`alert rule not found`）。\n- 调用者必须有该规则所在文件夹的权限（账户所有者或管理员、该文件夹或其上级文件夹的创建者，或绑定到该文件夹或其上级文件夹的团队成员），否则返回 `AccessDenied`。所在文件夹已不存在的规则返回 `InvalidParameter`（folder not found）。",
"href": "/zh/api-reference/monitors/alert-rules/monit-rule-read-info-v2",
"metadata": {
"sidebarTitle": "获取告警规则详情 V2"
Expand Down Expand Up @@ -2475,7 +2475,7 @@
}
},
"400": {
"description": "`X-DSID` 请求头不是数字、数据源不是 Prometheus 类型，或数据源所在集群没有已注册的 monit-edge。以 `text/plain` 返回。",
"description": "`X-DSID` 请求头不是数字、数据源不是 Prometheus 类型，数据源所在集群没有已注册的 monit-edge，或数据源不存在、属于其他账户（消息为 `data source not found`）。以 `text/plain` 返回。",
"content": {
"text/plain": {
"schema": {
Expand All @@ -2494,7 +2494,7 @@
"$ref": "#/components/responses/TooManyRequests"
},
"500": {
"description": "数据源不存在或属于其他账户（消息为 `data source not found`），或数据源查询、代理请求失败。以 `text/plain` 返回。",
"description": "数据源查询或代理请求失败。以 `text/plain` 返回。",
"content": {
"text/plain": {
"schema": {
Expand All @@ -2509,7 +2509,7 @@
"Monitors/告警数据源"
],
"x-mint": {
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | 任意有效的 `app_key`（只读，不受特定权限分类限制） |\n| Edge 版本要求 | 查询指定数据源要求 **monit-edge v0.35.0 或更高版本** |\n\n## 使用说明\n\n- 通过 `X-DSID` 请求头传入目标数据源 ID。数据源必须属于当前账户且为 Prometheus 类型；可用 `/monit/datasource/list` 获取 ID。\n- 200 响应体是数据源原生的 Prometheus HTTP API 结构，**不是**统一的 `{ request_id, data }` envelope。查询字符串参数会原样转发，因此 Prometheus 自身的 `match[]`、`start`、`end` 等参数都可使用。\n- 省略 `X-DSID`，或数据源所在集群中有任意 monit-edge 低于 v0.35.0 时，请求会由平台自有的 Prometheus 响应，而不是您的数据源。请携带该请求头并保持 monit-edge 为较新版本，才能获得数据源自身的取值。\n- 到达数据源之前发生的失败以 `text/plain` 返回，并携带对应的 4xx/5xx 状态码。数据源自身返回的 400 及以上状态码会连同其响应体一并透传。",
"content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | 任意有效的 `app_key`（只读，不受特定权限分类限制） |\n| Edge 版本要求 | 查询指定数据源要求 **monit-edge v0.35.0 或更高版本** |\n\n## 使用说明\n\n- 通过 `X-DSID` 请求头传入目标数据源 ID。数据源必须属于当前账户且为 Prometheus 类型；可用 `/monit/datasource/list` 获取 ID。\n- 若数据源限制了可查询的团队，只有这些团队的成员、其管理团队以及账户所有者或管理员可以查询，其他人会收到 403。数据源 ID 不存在时返回 400。\n- 200 响应体是数据源原生的 Prometheus HTTP API 结构，**不是**统一的 `{ request_id, data }` envelope。查询字符串参数会原样转发，因此 Prometheus 自身的 `match[]`、`start`、`end` 等参数都可使用。\n- 省略 `X-DSID`，或数据源所在集群中有任意 monit-edge 低于 v0.35.0 时，请求会由平台自有的 Prometheus 响应，而不是您的数据源。请携带该请求头并保持 monit-edge 为较新版本，才能获得数据源自身的取值。\n- 到达数据源之前发生的失败以 `text/plain` 返回，并携带对应的 4xx/5xx 状态码。数据源自身返回的 400 及以上状态码会连同其响应体一并透传。",
"href": "/zh/api-reference/monitors/data-sources/monit-prometheus-read-label-values",
"metadata": {
"sidebarTitle": "查询 Prometheus 标签值列表"
Expand Down
Loading
Loading