{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-agent-tool-kql-query-request-schema.json",
  "title": "AgentToolKqlQueryRequest",
  "description": "Request DTO for the agent's KQL execution tool. Trimmed for LLM consumption — the\nagent supplies a query string the schema-aware sub-agent has already generated, and we\nrun it under the workspace's Log Analytics context.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-agent-tools-api-openapi.yml#/components/schemas/AgentToolKqlQueryRequest",
  "type": "object",
  "properties": {
    "query": {
      "type": [
        "null",
        "string"
      ],
      "description": "KQL query to execute against the workspace's Log Analytics workspace. Ground the query in the real schema first by calling list-kql-tables and get-kql-table-columns — queries against non-existent tables or columns return a clear error. Prefer narrowly-scoped queries (specific table, time range, project clause) over broad scans to keep results inside the row cap."
    },
    "max_rows": {
      "pattern": "^-?(?:0|[1-9]\\d*)$",
      "type": [
        "null",
        "integer",
        "string"
      ],
      "description": "Optional row cap. Defaults to 50 server-side; values above the hard maximum (200) are clamped silently. Set explicitly only when the default is too narrow for the investigation — the cap protects the LLM context window from runaway queries.",
      "format": "int32"
    }
  }
}