Skip to main content
POST
Agent tool execute kql

Path Parameters

workspaceId
string<uuid>
required

Body

application/json

Request DTO for the agent's KQL execution tool. Trimmed for LLM consumption — the agent supplies a query string the schema-aware sub-agent has already generated, and we run it under the workspace's Log Analytics context.

query
null | string

KQL query to execute against the workspace's Log Analytics workspace. Ground the query in the real schema first by calling list-kql-tables and get-kql-table-columns — queries against non-existent tables or columns return a clear error. Prefer narrowly-scoped queries (specific table, time range, project clause) over broad scans to keep results inside the row cap.

max_rows

Optional row cap. Defaults to 50 server-side; values above the hard maximum (200) are clamped silently. Set explicitly only when the default is too narrow for the investigation — the cap protects the LLM context window from runaway queries.

Response

OK

Standard v2 API response envelope for single-item responses.

data
object

Result of an agent KQL execution tool call. Returns true-columnar rows (parallel arrays indexed against the List<string> AgentToolKqlQueryResult.Columns header) — far more token-efficient than a per-row dictionary because column names are written exactly once.

meta
object