Update the retention windows. Applies immediately: the PostgreSQL prune loops re-read the policy on their next tick, and the flow store's table TTL is altered before this returns.

PUT

/api/v1/settings/retention

curl --request PUT \
  --url https://example.com/api/v1/settings/retention \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "alert_linked_days": 1, "diagnostic_days": 1, "flow_days": 1, "report_run_days": 1, "unmatched_event_hours": 1 }'

Authorizations

• bearer

Request Body^required

Media typeapplication/json

The operator-editable retention windows.

object

alert_linked_days

required

Days to keep alert history, node-state snapshots, DNS chain changes and matched events.

integer format: int32

diagnostic_days

Days to keep on-demand diagnostics: Troubleshoot analysis runs with their findings, and generated AI root-cause reports. Optional — omitting it sets the default (90).

integer format: int32

flow_days

required

Days to keep traffic-flow records, applied as a ClickHouse table TTL.

integer format: int32

report_run_days

required

Days to keep generated report runs.

integer format: int32

unmatched_event_hours

required

Hours to keep passive events that matched no rule.

integer format: int32

Example^generated

{
  "alert_linked_days": 1,
  "diagnostic_days": 1,
  "flow_days": 1,
  "report_run_days": 1,
  "unmatched_event_hours": 1
}

Responses

204

Retention updated. Lowering a window deletes data older than it on the next prune

400

A window is outside the allowed range

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks ManageConfig

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

502

The flow store rejected the retention change; nothing was saved

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

Inventory storage is unavailable (skeleton mode)

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}