Skip to main content
POST
/
api
/
v2
/
workspaces
/
{workspaceId}
/
agent
/
tools
/
kql
/
query
Agent tool execute kql
curl --request POST \
  --url https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/kql/query \
  --header 'Content-Type: application/json' \
  --data '
{
  "query": "<string>",
  "max_rows": 123
}
'
{
  "data": {
    "success": true,
    "summary": "<string>",
    "row_count": 123,
    "truncated": true,
    "columns": [
      "<string>"
    ],
    "rows": [
      {}
    ]
  },
  "meta": {
    "requestId": "<string>",
    "timestamp": "<string>"
  }
}

Documentation Index

Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt

Use this file to discover all available pages before exploring further.

Path Parameters

​
workspaceId
string<uuid>
required

Body

application/json

Request DTO for the agent's KQL execution tool. Trimmed for LLM consumption — the agent supplies a query string the schema-aware sub-agent has already generated, and we run it under the workspace's Log Analytics context.

​
query
null | string

KQL query to execute against the workspace's Log Analytics workspace. Ground the query in the real schema first by calling list-kql-tables and get-kql-table-columns — queries against non-existent tables or columns return a clear error. Prefer narrowly-scoped queries (specific table, time range, project clause) over broad scans to keep results inside the row cap.

​
max_rows

Optional row cap. Defaults to 50 server-side; values above the hard maximum (200) are clamped silently. Set explicitly only when the default is too narrow for the investigation — the cap protects the LLM context window from runaway queries.

Response

OK

Standard v2 API response envelope for single-item responses.

​
data
object

Result of an agent KQL execution tool call. Returns row dictionaries (column → value) rather than the raw KustoQueryResponse table-of-arrays shape, because the dictionary form is far more compact and self-describing for the LLM to read.

​
meta
object