# O11y

URL: https://docs.hanzo.ai/docs/cli/o11y

> The `hanzo o11y` commands.

Also for this capability: [API](https://docs.hanzo.ai/docs/openapi/o11y) · **CLI** · [MCP](https://docs.hanzo.ai/docs/mcp-tools/o11y) · [SDKs](https://docs.hanzo.ai/docs/sdks)

Your logs, metrics and traces: ship them in, query them, chart them.

[API reference →](https://docs.hanzo.ai/docs/openapi/o11y)

```bash
hanzo o11y roles list
```

Every command takes `--json` for the raw response and `--help` for its own flags. Sign in once with `hanzo auth login`; the commands below use that session, and the org they act in is the one it carries.

| Command                                                                     | What it does                                                                                                                                                  |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y countErrors`                                                    | Counts the grouped exceptions in the query window for the caller's org.                                                                                       |
| `hanzo o11y dependency_graph --end <end> --start <start>`                   | Returns the service dependency graph over the requested window: every parent→child edge observed, with call and error rates and latency percentiles per edge. |
| `hanzo o11y disks`                                                          | Lists the storage disks the datastore reports, with their names and types.                                                                                    |
| `hanzo o11y errorFromErrorID --timestamp <timestamp> --group-id <group-id>` | Returns one exception instance and the span it happened on, by its error id within a group at a timestamp.                                                    |
| `hanzo o11y errorFromGroupID --timestamp <timestamp> --group-id <group-id>` | Returns the representative exception instance of a group at a timestamp, and the span it happened on.                                                         |
| `hanzo o11y event --event-type <eventType>`                                 | Records one product-analytics event for the signed-in user — a track event with a name and free-form attributes.                                              |
| `hanzo o11y export_raw_data`                                                | Export raw telemetry rows as a file                                                                                                                           |
| `hanzo o11y features`                                                       | Returns the supported feature flags and their resolved values for the caller's org.                                                                           |
| `hanzo o11y filter_suggestions --data-source <data-source>`                 | Suggests attribute keys and example filter queries for the query builder, seeded by what the org's own telemetry carries.                                     |
| `hanzo o11y health`                                                         | Reports service health.                                                                                                                                       |
| `hanzo o11y healthz`                                                        | Health of the observability runtime's services                                                                                                                |
| `hanzo o11y listErrors`                                                     | Lists the grouped exceptions in the query window — each an exception type with its message, count, service and first/last-seen — for the caller's org.        |
| `hanzo o11y livez`                                                          | Liveness of the observability process                                                                                                                         |
| `hanzo o11y login`                                                          | Report why an observability sign-in did not complete                                                                                                          |
| `hanzo o11y nextPrevErrorIDs --timestamp <timestamp> --group-id <group-id>` | Returns the ids of the exception instances immediately after and before a given one within its group — the paging cursor the error detail view walks.         |
| `hanzo o11y query --query <query>`                                          | Evaluates one instant PromQL query against the org's metrics and returns the result at a single point in time.                                                |
| `hanzo o11y query_progress`                                                 | Watch one running query's progress                                                                                                                            |
| `hanzo o11y readyz`                                                         | Readiness of the observability runtime to serve                                                                                                               |
| `hanzo o11y sessions`                                                       | List the caller org's LLM sessions                                                                                                                            |
| `hanzo o11y span_percentile --name <name> --service-name <serviceName>`     | Places one span's duration among its peers: the p50/p90/p99 durations of like spans, and the percentile the given duration lands at.                          |
| `hanzo o11y stats`                                                          | Returns the collected usage statistics for the caller's org, as the stats reporter aggregates them — a map whose keys are the reporter's own counter names.   |
| `hanzo o11y status`                                                         | Reports whether a product's service is live: an in-cluster health probe with its measured latency, fused with the per-replica up inventory.                   |
| `hanzo o11y substitute_vars`                                                | Substitutes a query's variables and returns the resolved request, without running it — what a dashboard does before it queries.                               |
| `hanzo o11y summary`                                                        | Reports whether the platform is up.                                                                                                                           |
| `hanzo o11y testChannel`                                                    | Sends a test notification to the posted receiver.                                                                                                             |
| `hanzo o11y testRule`                                                       | Fires a test notification for the posted rule definition and answers with how many series alerted and a status message.                                       |
| `hanzo o11y usage --start <start> --end <end>`                              | Returns ingestion usage counts bucketed over the requested window, optionally narrowed to one service.                                                        |
| `hanzo o11y version`                                                        | Reports the running build: its version, whether an enterprise edition is present ("N" in this build), and whether first-user setup has completed.             |

### Alerts

| Command                            | What it does                                       |
| ---------------------------------- | -------------------------------------------------- |
| `hanzo o11y alerts add <receiver>` | Take an Alertmanager notification and page a human |
| `hanzo o11y alerts last`           | Replay the alert records this process took         |
| `hanzo o11y alerts list`           | Returns the org's current alerts.                  |

### Authz

| Command                  | What it does                                                                                                                                                           |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y authz check` | Evaluates a batch of transactions — relation plus object — for the authenticated caller and answers each with its authorization verdict, in the order they were asked. |

### Auto complete

| Command                                     | What it does                                                                                                                                                      |
| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y auto_complete attribute_values` | Reads the attribute-value request from the body rather than off the query string — the spelling the newer builder uses to send its filters alongside the request. |

### Autocomplete

| Command                                        | What it does                                                                                                                                            |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y autocomplete aggregate_attributes` | Lists the attributes usable as an aggregate target for the given telemetry and operator — what a filter builder offers after the aggregation is chosen. |
| `hanzo o11y autocomplete attribute_keys`       | Lists the attribute keys available for filtering the given telemetry, each with its data type and whether it is a materialized column.                  |
| `hanzo o11y autocomplete attribute_values`     | Lists the values one attribute key has taken — string, number and bool values in their own lists — for completing a filter.                             |

### Channels

| Command                        | What it does                                                       |
| ------------------------------ | ------------------------------------------------------------------ |
| `hanzo o11y channels create`   | Creates a notification channel, answering with the stored channel. |
| `hanzo o11y channels get <id>` | Returns one notification channel, by id.                           |
| `hanzo o11y channels list`     | Lists the org's notification channels.                             |
| `hanzo o11y channels rm <id>`  | Removes a notification channel, by id.                             |
| `hanzo o11y channels set <id>` | Replaces a notification channel's receiver, by id.                 |
| `hanzo o11y channels test`     | Sends a test notification to the posted receiver.                  |

### Cloud integrations

| Command                                                         | What it does                                                                                                                |
| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y cloud-integrations agent-check-in <cloud_provider>` | The deployed agent's check-in on its original hyphenated path, kept for backward compatibility with agents already running. |

### Cloud integrations

| Command                                                                                  | What it does                                                                                                                                                                                      |
| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y cloud_integrations accounts check_in <cloud_provider>`                       | The deployed agent's check-in — the path consistent with the account surface, reporting the agent's account and telemetry state so the connection can be tracked.                                 |
| `hanzo o11y cloud_integrations accounts create <cloud_provider>`                         | Connects a new cloud-integration account for the given provider from its posted config and credentials, answering with the account and the artifact the agent deploys to complete the connection. |
| `hanzo o11y cloud_integrations accounts get <cloud_provider> <id>`                       | Returns one connected account for the given provider, by id.                                                                                                                                      |
| `hanzo o11y cloud_integrations accounts list <cloud_provider>`                           | Lists the cloud-integration accounts connected for the given provider.                                                                                                                            |
| `hanzo o11y cloud_integrations accounts rm <cloud_provider> <id>`                        | Tears down a connected account for the given provider, by id.                                                                                                                                     |
| `hanzo o11y cloud_integrations accounts services get <cloud_provider> <id> <service_id>` | Returns one service and its configuration for a connected account of the given provider, by account id and service id.                                                                            |
| `hanzo o11y cloud_integrations accounts services list <cloud_provider> <id>`             | Lists the services metadata for one connected account of the given provider, by account id.                                                                                                       |
| `hanzo o11y cloud_integrations accounts services set <cloud_provider> <id> <service_id>` | Changes a service's configuration for one connected account of the given provider, by account id and service id.                                                                                  |
| `hanzo o11y cloud_integrations accounts set <cloud_provider> <id>`                       | Changes a connected account's configuration for the given provider, by id.                                                                                                                        |
| `hanzo o11y cloud_integrations credentials <cloud_provider>`                             | Returns the credentials the connecting agent needs to establish the cloud integration, for the given cloud provider.                                                                              |
| `hanzo o11y cloud_integrations services get <cloud_provider> <service_id>`               | Returns one service the given provider can collect from, by service id, optionally scoped to one cloud integration.                                                                               |
| `hanzo o11y cloud_integrations services list <cloud_provider>`                           | Lists the services the given provider can collect from, optionally scoped to one cloud integration.                                                                                               |

### Clusters

| Command                                | What it does                                                                                                                                                          |
| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y clusters attribute_keys`   | Lists the metric attribute keys Kubernetes clusters report, for building cluster filters.                                                                             |
| `hanzo o11y clusters attribute_values` | Lists the values one cluster attribute key has taken, for building cluster filters.                                                                                   |
| `hanzo o11y clusters list`             | Lists Kubernetes clusters over a time range, each with its CPU and memory usage against allocatable capacity and its attributes; filterable, groupable and paginated. |

### Daemonsets

| Command                                  | What it does                                                                                                                                                                                                          |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y daemonsets attribute_keys`   | Lists the metric attribute keys Kubernetes daemonsets report, for building daemonset filters.                                                                                                                         |
| `hanzo o11y daemonsets attribute_values` | Lists the values one daemonset attribute key has taken, for building daemonset filters.                                                                                                                               |
| `hanzo o11y daemonsets list`             | Lists Kubernetes daemonsets over a time range, each with the CPU and memory its pods used against request and limit, desired and available node counts, restarts and attributes; filterable, groupable and paginated. |

### Dashboard views

| Command                               | What it does                                                                                                              |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y dashboard_views create`   | Persists the calling user's dashboard-listing state (query, sort, order) as a named, reusable view shared across the org. |
| `hanzo o11y dashboard_views list`     | Returns every saved view in the calling user's org.                                                                       |
| `hanzo o11y dashboard_views rm <id>`  | Removes a saved view.                                                                                                     |
| `hanzo o11y dashboard_views set <id>` | Replaces a saved view's name and data.                                                                                    |

### Dashboards

| Command                                     | What it does                                                                                                     |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y dashboards clone <id>`          | Clones an existing v2-shape dashboard.                                                                           |
| `hanzo o11y dashboards create`              | Creates a dashboard in the v2 format that follows the Perses spec and answers with the stored dashboard.         |
| `hanzo o11y dashboards get <id>`            | Returns a v2-shape dashboard.                                                                                    |
| `hanzo o11y dashboards list`                | Returns a page of v2-shape dashboards for the org.                                                               |
| `hanzo o11y dashboards lock clear <id>`     | Unlocks a v2-shape dashboard.                                                                                    |
| `hanzo o11y dashboards lock replace <id>`   | Locks a v2-shape dashboard.                                                                                      |
| `hanzo o11y dashboards public clear <id>`   | Deletes the public-sharing config and disables public sharing of a dashboard.                                    |
| `hanzo o11y dashboards public create <id>`  | Creates the public-sharing config for a dashboard and enables public sharing, answering with the new share's id. |
| `hanzo o11y dashboards public get <id>`     | Returns the public-sharing config for a dashboard.                                                               |
| `hanzo o11y dashboards public replace <id>` | Updates the public-sharing config for a dashboard.                                                               |
| `hanzo o11y dashboards rm <id>`             | Deletes a v2-shape dashboard along with its tag relations.                                                       |
| `hanzo o11y dashboards set <id>`            | Updates a v2-shape dashboard's metadata, spec and tag set.                                                       |
| `hanzo o11y dashboards update <id>`         | Applies an RFC 6902 JSON Patch to a v2-shape dashboard.                                                          |

### Deployments

| Command                                   | What it does                                                                                                                                                                                                              |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y deployments attribute_keys`   | Lists the metric attribute keys Kubernetes deployments report, for building deployment filters.                                                                                                                           |
| `hanzo o11y deployments attribute_values` | Lists the values one deployment attribute key has taken, for building deployment filters.                                                                                                                                 |
| `hanzo o11y deployments list`             | Lists Kubernetes deployments over a time range, each with the CPU and memory its pods used against request and limit, desired and available replica counts, restarts and attributes; filterable, groupable and paginated. |

### Downtime schedules

| Command                                  | What it does                                                                                         |
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| `hanzo o11y downtime_schedules create`   | Creates a planned maintenance window, answering with the stored schedule.                            |
| `hanzo o11y downtime_schedules get <id>` | Returns one planned maintenance window, by id.                                                       |
| `hanzo o11y downtime_schedules list`     | Lists all planned maintenance windows, optionally narrowed to the active ones or the recurring ones. |
| `hanzo o11y downtime_schedules rm <id>`  | Removes a planned maintenance window, by id.                                                         |
| `hanzo o11y downtime_schedules set <id>` | Replaces a planned maintenance window, by id.                                                        |

### Error tracking

| Command                                    | What it does                                                                                                   |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y errortracking issues add <id>` | Changes an issue's lifecycle — resolve, ignore, reopen or assign — and returns the updated issue.              |
| `hanzo o11y errortracking issues get <id>` | Returns one grouped issue with its latest occurrence sample.                                                   |
| `hanzo o11y errortracking issues list`     | Lists the caller's org's grouped error issues (by fingerprint) with status, level, counts and first/last-seen. |

### Explorer

| Command                                  | What it does                                                                                             |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| `hanzo o11y explorer views create`       | Saves a new explorer view for the caller's org and returns its id.                                       |
| `hanzo o11y explorer views get <viewId>` | Returns one saved explorer view by id.                                                                   |
| `hanzo o11y explorer views list`         | Lists the caller's org's saved explorer views, optionally narrowed to one source page, name or category. |
| `hanzo o11y explorer views rm <viewId>`  | Deletes one saved explorer view by id.                                                                   |
| `hanzo o11y explorer views set <viewId>` | Replaces one saved explorer view by id with the given view and echoes it back.                           |

### Fields

| Command                    | What it does                                                                                                                         |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| `hanzo o11y fields keys`   | Returns the telemetry field keys matching the selector — the signal's fields grouped by name, and whether the catalog is complete.   |
| `hanzo o11y fields values` | Returns the values one telemetry field has taken — string, bool, number and related values — and whether the value list is complete. |

### Gateway

| Command                                                     | What it does                                                                          |
| ----------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| `hanzo o11y gateway ingestion_keys create`                  | Mints an ingestion key for the workspace, answering with the created key.             |
| `hanzo o11y gateway ingestion_keys limits <keyId>`          | Sets a signal limit on an ingestion key, by key id, answering with the created limit. |
| `hanzo o11y gateway ingestion_keys limits rm <limitId>`     | Removes an ingestion key limit, by limit id.                                          |
| `hanzo o11y gateway ingestion_keys limits update <limitId>` | Changes an ingestion key limit, by limit id.                                          |
| `hanzo o11y gateway ingestion_keys list`                    | Lists the workspace's ingestion keys, paginated.                                      |
| `hanzo o11y gateway ingestion_keys rm <keyId>`              | Removes an ingestion key, by id.                                                      |
| `hanzo o11y gateway ingestion_keys search`                  | Lists the workspace's ingestion keys whose name matches the search, paginated.        |
| `hanzo o11y gateway ingestion_keys update <keyId>`          | Changes an ingestion key, by id.                                                      |

### Global

| Command                    | What it does                                                                                                  |
| -------------------------- | ------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y global config` | Returns the deployment's global configuration: its public endpoints and which identity providers are enabled. |

### Hosts

| Command                             | What it does                                                                                                                                                                                       |
| ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y hosts attribute_keys`   | Lists the metric attribute keys hosts report, for building host filters — each with its data type and whether it is a materialized column.                                                         |
| `hanzo o11y hosts attribute_values` | Lists the values one host attribute key has taken, for building host filters — string, number and bool values in their own lists.                                                                  |
| `hanzo o11y hosts list`             | Lists monitored hosts over a time range, each with its CPU, memory, I/O wait and 15-minute load, whether it is actively reporting, its OS and its attributes; filterable, groupable and paginated. |

### Infra monitoring

| Command                                            | What it does                                                                                                                                                                                                                                                                                   |
| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y infra_monitoring checks --type <type>` | Reports whether the metrics and attributes an infra-monitoring section needs are being received — for each collector receiver or processor involved, what is present and what is missing, with a user-facing message and a docs link per missing piece.                                        |
| `hanzo o11y infra_monitoring clusters`             | Lists Kubernetes clusters with CPU and memory usage against allocatable capacity summed over their nodes, plus per-group node readiness and pod phase counts.                                                                                                                                  |
| `hanzo o11y infra_monitoring daemonsets`           | Lists Kubernetes daemonsets with the CPU and memory their pods used against request and limit, the latest desired and current scheduled NODE counts (node counts, not pod counts), and per-group pod phase counts.                                                                             |
| `hanzo o11y infra_monitoring deployments`          | Lists Kubernetes deployments with the CPU and memory their pods used against request and limit, the latest desired and available replica counts, and per-group pod phase counts.                                                                                                               |
| `hanzo o11y infra_monitoring hosts`                | Lists hosts with key infrastructure metrics — CPU, memory, I/O wait and disk usage percentages and 15-minute load — plus an active/inactive status from whether the host reported in the last ten minutes.                                                                                     |
| `hanzo o11y infra_monitoring jobs`                 | Lists Kubernetes jobs with the CPU and memory their pods used against request and limit, the latest desired-successful, active, failed and successful pod counters, and per-group pod phase counts — the phase counts are current state while the counters are cumulative over the job's life. |
| `hanzo o11y infra_monitoring namespaces`           | Lists Kubernetes namespaces with the CPU and memory their pods used and per-group pod phase counts.                                                                                                                                                                                            |
| `hanzo o11y infra_monitoring nodes`                | Lists Kubernetes nodes with CPU and memory usage against allocatable capacity, per-group readiness counts and per-group phase counts for the pods scheduled on them.                                                                                                                           |
| `hanzo o11y infra_monitoring pods`                 | Lists Kubernetes pods with CPU and memory usage against request and limit, the pod's phase and its age, plus its namespace, node, owning workload and cluster attributes.                                                                                                                      |
| `hanzo o11y infra_monitoring pvcs`                 | Lists Kubernetes persistent volume claims with available, capacity and used bytes and inode counts, plus the claim's pod, namespace, node, statefulset and cluster attributes.                                                                                                                 |
| `hanzo o11y infra_monitoring statefulsets`         | Lists Kubernetes statefulsets with the CPU and memory their pods used against request and limit, the latest desired and current replica counts, and per-group pod phase counts.                                                                                                                |

### Infra onboarding

| Command                                  | What it does                                                                                                                                             |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y infra_onboarding k8s status` | Reports how far Kubernetes infra onboarding has progressed: which metric families have arrived and, per pod, which required metadata labels are present. |

### Integrations

| Command                                                     | What it does                                                                                                                                                                |
| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y integrations connection_status <integrationId>` | Reports whether the integration's logs and metrics have been received over the lookback window, so the console can show a live connection state.                            |
| `hanzo o11y integrations get <integrationId>`               | Returns one integration's full detail — its overview, configuration steps, collected data and assets — together with its installation record when the org has installed it. |
| `hanzo o11y integrations install`                           | Installs an integration into the caller's org from its id and configuration, answering with the installed catalog item.                                                     |
| `hanzo o11y integrations list`                              | Lists the available integrations and whether each is installed in the caller's org, optionally narrowed to installed or not-installed.                                      |
| `hanzo o11y integrations uninstall`                         | Removes an integration from the caller's org by id.                                                                                                                         |

### Jobs

| Command                            | What it does                                                                                                                                                                                                                               |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `hanzo o11y jobs attribute_keys`   | Lists the metric attribute keys Kubernetes jobs report, for building job filters.                                                                                                                                                          |
| `hanzo o11y jobs attribute_values` | Lists the values one job attribute key has taken, for building job filters.                                                                                                                                                                |
| `hanzo o11y jobs list`             | Lists Kubernetes jobs over a time range, each with the CPU and memory its pods used against request and limit, desired-successful, active, failed and successful pod counts, restarts and attributes; filterable, groupable and paginated. |

### Licenses

| Command                      | What it does                      |
| ---------------------------- | --------------------------------- |
| `hanzo o11y licenses active` | Activates the enterprise license. |
| `hanzo o11y licenses get`    | Lists the org's licenses.         |

### LLM

| Command                            | What it does                                                                                                                                                                         |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `hanzo o11y llm annotation create` | Adds a human annotation to a trace or observation, optionally in a review queue.                                                                                                     |
| `hanzo o11y llm annotation get`    | Lists human annotations on traces and observations, optionally scoped to one review queue.                                                                                           |
| `hanzo o11y llm observations`      | Lists gen\_ai spans as LLM observations — each an LLM call with its model, token counts, cost and latency projected from gen\_ai.\* attributes, newest first, over the query window. |
| `hanzo o11y llm score get <id>`    | Returns a single score by id.                                                                                                                                                        |
| `hanzo o11y llm score rm <id>`     | Hard-deletes a score by id.                                                                                                                                                          |
| `hanzo o11y llm scores create`     | Attaches an eval score or human-feedback signal to a trace or a single observation.                                                                                                  |
| `hanzo o11y llm scores get`        | Lists eval scores and human-feedback signals attached to traces and observations, newest first.                                                                                      |
| `hanzo o11y llm sessions`          | Lists conversations — gen\_ai spans grouped by session.id, with their trace and observation counts, tokens and cost.                                                                 |
| `hanzo o11y llm traces`            | Lists LLM traces — gen\_ai spans grouped by trace\_id, with cost, tokens and latency rolled up across each trace.                                                                    |
| `hanzo o11y llm users`             | Lists end users — gen\_ai spans grouped by user.id, with their session, trace and observation counts, tokens and cost.                                                               |

### LLM pricing rules

| Command                                 | What it does                                                                                                    |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y llm_pricing_rules get <id>` | Returns a single LLM pricing rule by id.                                                                        |
| `hanzo o11y llm_pricing_rules list`     | Returns the LLM pricing rules for the caller's org, with pagination and an optional search and override filter. |
| `hanzo o11y llm_pricing_rules replace`  | Writes the pricing-rule batch — the single write endpoint used by both the user and the Zeus sync job.          |
| `hanzo o11y llm_pricing_rules rm <id>`  | Hard-deletes a pricing rule by id.                                                                              |

### Logs

| Command                                                                            | What it does                                                                                                                                                                              |
| ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y logs aggregate`                                                        | Returns the logs aggregate buckets for the query window.                                                                                                                                  |
| `hanzo o11y logs fields create --data-type <dataType> --name <name> --type <type>` | Changes how one log field is stored — selects or deselects it as a materialized column and tunes its index — and echoes the setting back.                                                 |
| `hanzo o11y logs fields get`                                                       | Returns the log field catalog: the fields already selected as indexed columns, and the interesting ones seen in the data that could be.                                                   |
| `hanzo o11y logs get`                                                              | Returns the most recent log records in the query window, newest first — each record an open object carrying its nanosecond timestamp and whatever fields the record was ingested with.    |
| `hanzo o11y logs livetail`                                                         | Follow log records as they arrive                                                                                                                                                         |
| `hanzo o11y logs pipelines create`                                                 | Saves the given log parsing pipelines as the new config version for the caller's org and starts deploying it.                                                                             |
| `hanzo o11y logs pipelines get <version>`                                          | Returns the caller's org's log parsing pipelines at one config version — "latest" for the newest — along with that version's deployment record and the recent version history.            |
| `hanzo o11y logs pipelines preview`                                                | Runs the given log parsing pipelines over the given sample records without saving anything, and returns the transformed records plus whatever the collector logged while simulating them. |
| `hanzo o11y logs promote_paths create`                                             | Promotes and indexes log body paths: each named path is lifted out of the JSON body into its own column, with the indexes the caller asked for.                                           |
| `hanzo o11y logs promote_paths get`                                                | Lists the log body paths already promoted or indexed, with the indexes each carries.                                                                                                      |

### Messaging queues

| Command                                                               | What it does                                                                                                                                                                                               |
| --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y messaging-queues kafka consumer-lag consumer-details`     | Returns the consumer side of a consumer-lag view: the consumer groups reading the topic/partition named in variables, with their throughput and latency over the window.                                   |
| `hanzo o11y messaging-queues kafka consumer-lag network-latency`      | Returns consumer network latency correlated per client: a throughput pass over the window finds the consumer clients, then their fetch latency joins in as a latency column per client/instance/service.   |
| `hanzo o11y messaging-queues kafka consumer-lag producer-details`     | Returns the producer side of a consumer-lag view: the producers writing to the topic/partition named in variables, with their throughput and latency over the window.                                      |
| `hanzo o11y messaging-queues kafka onboarding consumers`              | Checks whether the spans the Kafka consumer views need are arriving, row for row like producersOnboarding.                                                                                                 |
| `hanzo o11y messaging-queues kafka onboarding kafka`                  | Checks whether Kafka's own metrics — consumer lag and partition telemetry — are arriving, so the lag views can be lit up.                                                                                  |
| `hanzo o11y messaging-queues kafka onboarding producers`              | Checks whether the spans the Kafka producer views need are arriving — one row per required span attribute, with a pass/fail status and, on failure, what is missing from the instrumentation.              |
| `hanzo o11y messaging-queues kafka partition-latency consumer`        | Returns the consumer-group latency detail for the topic and partition named in the request's variables.                                                                                                    |
| `hanzo o11y messaging-queues kafka partition-latency overview`        | Returns the per-partition latency overview for the window — each topic/partition with its throughput and latency profile.                                                                                  |
| `hanzo o11y messaging-queues kafka span evaluation`                   | Correlates producer and consumer spans over the evaluation window (eval\_time bounds the scan) and returns the pairings with their end-to-end delay — the check that messages produced are being consumed. |
| `hanzo o11y messaging-queues kafka topic-throughput consumer`         | Returns the consumer topic-throughput overview for the window — what each consumer group read, per topic.                                                                                                  |
| `hanzo o11y messaging-queues kafka topic-throughput consumer-details` | Breaks one consumer topic's throughput down using the topic and service named in variables.                                                                                                                |
| `hanzo o11y messaging-queues kafka topic-throughput producer`         | Returns the producer topic-throughput overview for the window — what each producer service wrote, per topic.                                                                                               |
| `hanzo o11y messaging-queues kafka topic-throughput producer-details` | Breaks one producer topic's throughput down using the topic and service named in variables.                                                                                                                |
| `hanzo o11y messaging-queues queue-overview`                          | Lists the messaging destinations observed in the window — one row per queue/destination/service combination with its throughput and latency columns.                                                       |

### Metric

| Command                             | What it does                                     |
| ----------------------------------- | ------------------------------------------------ |
| `hanzo o11y metric metric_metadata` | Serves the OLDER /metric/metric\_metadata route. |

### Metric reduction rules

| Command                                                                                                                 | What it does                                                                                                                                     |
| ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `hanzo o11y metric_reduction_rules create --labels '["<labels>"]' --match-type <matchType> --metric-name <metricName>`  | Creates a volume-control rule for a metric and returns it with its id; a metric that already has a rule is refused.                              |
| `hanzo o11y metric_reduction_rules get <id>`                                                                            | Returns one volume-control rule by its id.                                                                                                       |
| `hanzo o11y metric_reduction_rules list`                                                                                | Lists the org's metric volume-control (label reduction) rules, pageable and sortable by name, volume or recency.                                 |
| `hanzo o11y metric_reduction_rules preview --labels '["<labels>"]' --match-type <matchType> --metric-name <metricName>` | Estimates the series reduction and the dashboards and alerts a candidate volume-control rule would touch, without persisting it.                 |
| `hanzo o11y metric_reduction_rules rm <id>`                                                                             | Deletes a volume-control rule by its id.                                                                                                         |
| `hanzo o11y metric_reduction_rules set <id> --labels '["<labels>"]' --match-type <matchType>`                           | Updates the match type and labels of a volume-control rule by its id; the metric name is immutable.                                              |
| `hanzo o11y metric_reduction_rules stats`                                                                               | Returns total ingested vs retained series and samples and the estimated monthly savings across all volume-control rules.                         |
| `hanzo o11y metric_reduction_rules timeseries`                                                                          | Returns ingested vs retained series over time across all volume-control rules, in hourly buckets, in the query-range time-series response shape. |

### Metrics

| Command                                                                   | What it does                                                                                                                              |
| ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y metrics alerts --metric-name <metric-name>`                   | Lists the alert rules that reference a metric.                                                                                            |
| `hanzo o11y metrics attributes --metric-name <metric-name>`               | Returns one metric's attribute keys, each with its unique values and their count.                                                         |
| `hanzo o11y metrics dashboards --metric-name <metric-name>`               | Lists the dashboard panels that reference a metric.                                                                                       |
| `hanzo o11y metrics get`                                                  | Lists the distinct metric names seen in a time range, each with its description, type, unit, temporality and monotonicity.                |
| `hanzo o11y metrics highlights --metric-name <metric-name>`               | Returns one metric's headline numbers: data points, total and active time series, and when it was last received.                          |
| `hanzo o11y metrics inspect --end 0 --metric-name <metricName> --start 0` | Returns one metric's raw time series over a window of at most thirty minutes — each series with its labels and timestamp/value pairs.     |
| `hanzo o11y metrics metadata create --metric-name <metricName>`           | Updates one metric's metadata — description, type, unit, temporality, monotonicity — and answers with the bare success envelope.          |
| `hanzo o11y metrics metadata get --metric-name <metric-name>`             | Returns one metric's metadata: description, type, unit, temporality and monotonicity.                                                     |
| `hanzo o11y metrics onboarding`                                           | Reports whether any non-O11y metrics have been ingested — the lightweight check onboarding polls.                                         |
| `hanzo o11y metrics stats --end 0 --limit 0 --start 0`                    | Lists metrics with their sample and time-series counts for a time range — the volume view of the metrics explorer, pageable and sortable. |
| `hanzo o11y metrics treemap --end 0 --limit 0 --mode <mode> --start 0`    | Returns the proportional distribution of metrics by sample count or time-series count, as the entries of a treemap.                       |

### Namespaces

| Command                                  | What it does                                                                                                                                                           |
| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y namespaces attribute_keys`   | Lists the metric attribute keys Kubernetes namespaces report, for building namespace filters.                                                                          |
| `hanzo o11y namespaces attribute_values` | Lists the values one namespace attribute key has taken, for building namespace filters.                                                                                |
| `hanzo o11y namespaces list`             | Lists Kubernetes namespaces over a time range, each with the CPU and memory its pods used, their phase counts and its attributes; filterable, groupable and paginated. |

### Nodes

| Command                             | What it does                                                                                                                                                                               |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `hanzo o11y nodes attribute_keys`   | Lists the metric attribute keys Kubernetes nodes report, for building node filters.                                                                                                        |
| `hanzo o11y nodes attribute_values` | Lists the values one node attribute key has taken, for building node filters.                                                                                                              |
| `hanzo o11y nodes list`             | Lists Kubernetes nodes over a time range, each with its CPU and memory usage against allocatable capacity, readiness condition counts and attributes; filterable, groupable and paginated. |

### Org

| Command                                 | What it does                                                                |
| --------------------------------------- | --------------------------------------------------------------------------- |
| `hanzo o11y org preferences get <name>` | Returns one org-scoped preference, by name.                                 |
| `hanzo o11y org preferences list`       | Lists every org-scoped preference, each with its current and default value. |
| `hanzo o11y org preferences set <name>` | Sets one org-scoped preference, by name.                                    |

### Orgs

| Command                                   | What it does                                                                                                          |
| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y orgs me filters get <signal>` | Returns the org's quick filters for one signal — traces, logs, metrics, exceptions or api\_monitoring.                |
| `hanzo o11y orgs me filters list`         | Returns the org's quick filters for every signal — the attribute shortlists its explorers offer as one-click filters. |
| `hanzo o11y orgs me filters replace`      | Replaces the org's quick filters for one signal with the attribute list given.                                        |
| `hanzo o11y orgs me get`                  | Returns the caller's own organization.                                                                                |
| `hanzo o11y orgs me replace`              | Rewrites the caller's own organization record — display name, name, alias — always addressed as "me", never by id.    |

### Pods

| Command                            | What it does                                                                                                                                                                            |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y pods attribute_keys`   | Lists the metric attribute keys Kubernetes pods report, for building pod filters.                                                                                                       |
| `hanzo o11y pods attribute_values` | Lists the values one pod attribute key has taken, for building pod filters.                                                                                                             |
| `hanzo o11y pods list`             | Lists Kubernetes pods over a time range, each with its CPU and memory usage against request and limit, restart count, phase counts and attributes; filterable, groupable and paginated. |

### Processes

| Command                                 | What it does                                                                                                                                      |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y processes attribute_keys`   | Lists the metric attribute keys processes report, for building process filters.                                                                   |
| `hanzo o11y processes attribute_values` | Lists the values one process attribute key has taken, for building process filters.                                                               |
| `hanzo o11y processes list`             | Lists monitored processes over a time range, each with its name, PID, command line and CPU and memory usage; filterable, groupable and paginated. |

### Product

| Command                      | What it does                                                                                                                                                |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y product metrics` | Returns one product's RED series — request rate, errors, p50 and p95 latency — for the caller's org, plus that org's LLM usage rollup over the same window. |

### Public

| Command                                                       | What it does                                                                                              |
| ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| `hanzo o11y public dashboards get <id>`                       | Returns the sanitized dashboard data for public access — the read a shared dashboard's public page makes. |
| `hanzo o11y public dashboards widgets query_range <id> <idx>` | Returns the query-range result for one widget of a public dashboard.                                      |

### PVCs

| Command                            | What it does                                                                                                                                                                     |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y pvcs attribute_keys`   | Lists the metric attribute keys persistent volume claims report, for building volume filters.                                                                                    |
| `hanzo o11y pvcs attribute_values` | Lists the values one persistent-volume-claim attribute key has taken, for building volume filters.                                                                               |
| `hanzo o11y pvcs list`             | Lists Kubernetes persistent volume claims over a time range, each with its available, capacity and used bytes, inode counts and attributes; filterable, groupable and paginated. |

### Query filter

| Command                                                                    | What it does                                                                          |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| `hanzo o11y query_filter analyze --query <query> --query-type <queryType>` | Analyzes a query and extracts the metric names it reads and the columns it groups by. |

### Query range

| Command                                                                                | What it does                                                                                                                                                                                                              |
| -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y query_range create`                                                        | Executes a composite query over a time range: builder queries over traces, logs and metrics, formulas, trace operators, PromQL and Datastore SQL, answering time series, scalars or raw records as the request type asks. |
| `hanzo o11y query_range format`                                                        | Parses a builder query and echoes it back normalized to the v3 shape — the endpoint the UI uses to canonicalize a query without running it.                                                                               |
| `hanzo o11y query_range get --start <start> --end <end> --step <step> --query <query>` | Runs a Prometheus-style range query over metrics — the legacy read that predates the v5 querier — and returns the matrix, vector or scalar the query resolved to.                                                         |
| `hanzo o11y query_range preview`                                                       | Validates a composite query and renders the Datastore statements it would run WITHOUT executing it — a dry run for agentic and tooling use.                                                                               |

### Reviews

| Command                                         | What it does                                                                                            |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| `hanzo o11y reviews create`                     | Creates a human-review queue in the caller's org and project.                                           |
| `hanzo o11y reviews get <id>`                   | Returns one review queue with its pending and completed counts and its first page of items.             |
| `hanzo o11y reviews items create <id>`          | Enqueues traces, observations or sessions on a review queue.                                            |
| `hanzo o11y reviews items list <id>`            | Returns a page of one review queue's items, newest first, optionally filtered to PENDING or COMPLETED.  |
| `hanzo o11y reviews items update <id> <itemId>` | Moves one queue item between PENDING and COMPLETED and sets its assignee.                               |
| `hanzo o11y reviews list`                       | Returns a page of the caller org's human-review queues, newest first, narrowed to the caller's project. |
| `hanzo o11y reviews rm <id>`                    | Removes one review queue and every item in it.                                                          |
| `hanzo o11y reviews update <id>`                | Changes a review queue's name, description or score-config set.                                         |

### Roles

| Command                     | What it does                                                                                                                                      |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y roles create`   | Creates a custom role in the caller's org from a name, an optional description and the transaction groups it grants, answering the new role's id. |
| `hanzo o11y roles get <id>` | Returns one role with the transaction groups it grants.                                                                                           |
| `hanzo o11y roles list`     | Lists every role in the caller's org — the managed ones the platform seeds and the custom ones its admins created.                                |
| `hanzo o11y roles rm <id>`  | Deletes a custom role.                                                                                                                            |
| `hanzo o11y roles set <id>` | Replaces a custom role's description and transaction groups.                                                                                      |

### Route policies

| Command                              | What it does                                                      |
| ------------------------------------ | ----------------------------------------------------------------- |
| `hanzo o11y route_policies create`   | Creates a route policy, answering with the stored policy.         |
| `hanzo o11y route_policies get <id>` | Returns one route policy, by id.                                  |
| `hanzo o11y route_policies list`     | Lists the org's route policies.                                   |
| `hanzo o11y route_policies rm <id>`  | Removes a route policy, by id.                                    |
| `hanzo o11y route_policies set <id>` | Replaces a route policy, by id, answering with the stored policy. |

### Rules

| Command                                                     | What it does                                                                                                                        |
| ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y rules create`                                   | Creates a new alert rule and answers with the stored rule.                                                                          |
| `hanzo o11y rules get <id>`                                 | Returns one alert rule with its evaluation state, by id.                                                                            |
| `hanzo o11y rules history filter_keys <id>`                 | Returns the distinct label keys present in a rule's history entries over the selected range, for building history filters.          |
| `hanzo o11y rules history filter_values <id> --name <name>` | Returns the distinct values a given label key has taken across a rule's history entries.                                            |
| `hanzo o11y rules history overall_status create <id>`       | Returns the overall firing/inactive windows for a rule, for the posted query range.                                                 |
| `hanzo o11y rules history overall_status get <id>`          | Returns the overall firing/inactive intervals for a rule over the selected range.                                                   |
| `hanzo o11y rules history stats create <id>`                | Returns trigger and resolution statistics for a rule, current window against the prior one, for the posted query range.             |
| `hanzo o11y rules history stats get <id>`                   | Returns trigger and resolution statistics for a rule over the selected time range, current window against the prior one.            |
| `hanzo o11y rules history timeline create <id>`             | Returns a rule's state-transition timeline for the posted query range, each entry carrying its related-logs or related-traces link. |
| `hanzo o11y rules history timeline get <id>`                | Returns paginated timeline entries for a rule's state transitions, filterable by state and a label expression, cursor-paginated.    |
| `hanzo o11y rules history top_contributors create <id>`     | Returns the label combinations that contributed most to a rule firing, for the posted query range.                                  |
| `hanzo o11y rules history top_contributors get <id>`        | Returns the label combinations that contributed most to a rule firing over the selected range.                                      |
| `hanzo o11y rules list`                                     | Lists all alert rules with their current evaluation state.                                                                          |
| `hanzo o11y rules rm <id>`                                  | Removes an alert rule, by id.                                                                                                       |
| `hanzo o11y rules set <id>`                                 | Replaces an alert rule's definition, by id.                                                                                         |
| `hanzo o11y rules test`                                     | Fires a test notification for a rule definition without saving it, answering with how many series would alert.                      |
| `hanzo o11y rules update <id>`                              | Applies a partial update to an alert rule, by id, answering with the stored rule — the common toggle for enabling or muting a rule. |

### Sentinel

| Command                                                      | What it does                                                                                                                                                                                                   |
| ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y sentinel discover --project <project>`           | Aggregates a project's captured errors into a table — the caller names the filters, the groupings and the aggregations, and gets back the columns and rows they asked for.                                     |
| `hanzo o11y sentinel events get <id> --project <project>`    | Returns one captured error event of a project, by its id.                                                                                                                                                      |
| `hanzo o11y sentinel issues events <id> --project <project>` | Lists one issue's captured occurrences, scoped to a project — a project is an isolation unit, so the caller declares which project's occurrences to read.                                                      |
| `hanzo o11y sentinel issues get <id>`                        | Returns one grouped issue of the caller's org with its latest occurrence sample.                                                                                                                               |
| `hanzo o11y sentinel issues list`                            | Lists the caller's org's grouped error issues, optionally narrowed to one project and one time window, and filtered by status, level, environment, service, a free-text query and a sort.                      |
| `hanzo o11y sentinel issues set <id>`                        | Changes an issue's lifecycle — resolve, ignore, reopen or assign — and returns the updated issue.                                                                                                              |
| `hanzo o11y sentinel logs --project <project>`               | Lists a project's captured error events, newest first, optionally narrowed to those whose message or exception text contains a search string.                                                                  |
| `hanzo o11y sentinel projects create --name <name>`          | Creates a Sentry project under the caller's org and returns it.                                                                                                                                                |
| `hanzo o11y sentinel projects get <id>`                      | Returns one Sentry project of the caller's org.                                                                                                                                                                |
| `hanzo o11y sentinel projects list`                          | Lists the caller's org's Sentry projects — one per product that has reported an error, plus any created by hand.                                                                                               |
| `hanzo o11y sentinel projects rm <id>`                       | Deletes one Sentry project of the caller's org; retained events are not touched.                                                                                                                               |
| `hanzo o11y sentinel stats --project <project>`              | Returns a project's event-rate timeseries: one bucket per interval over the requested period, counting the events in it.                                                                                       |
| `hanzo o11y sentinel traces get <id> --project <project>`    | Returns one trace's captured errors for a project — every error event that carried the trace id, in the order the events plane holds them.                                                                     |
| `hanzo o11y sentinel traces list --project <project>`        | Lists the traces a project's captured errors reference, each with how many errors landed on it, when they started and stopped, and the latest message seen — the entry point for "which requests are failing". |

### Service

| Command                                     | What it does                                                                                                                       |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y service entry_point_operations` | Returns one service's entry-point operations with the same latency and error profile topOperations reports.                        |
| `hanzo o11y service top_level_operations`   | Maps each service to its entry-point span names — for the one service named in the request, or for every service when none is.     |
| `hanzo o11y service top_operations`         | Returns one service's heaviest operations in the window, each with p50/p95/p99 latency, how often it ran and how often it errored. |

### Service accounts

| Command                                           | What it does                                                                                                                   |
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| `hanzo o11y service_accounts create`              | Creates a service account in the caller's org, answering its id.                                                               |
| `hanzo o11y service_accounts get <id>`            | Returns one service account with the roles it holds.                                                                           |
| `hanzo o11y service_accounts keys create <id>`    | Mints an API key for a service account and answers the key's id and its secret — the one time the secret is ever shown.        |
| `hanzo o11y service_accounts keys list <id>`      | Lists a service account's API keys — metadata only, never the secrets.                                                         |
| `hanzo o11y service_accounts keys rm <id> <fid>`  | Revokes an API key.                                                                                                            |
| `hanzo o11y service_accounts keys set <id> <fid>` | Renames an API key or moves its expiry.                                                                                        |
| `hanzo o11y service_accounts list`                | Lists the caller's org's service accounts.                                                                                     |
| `hanzo o11y service_accounts me get`              | Returns the calling service account itself, with the roles it holds — the self-inspection read for a key-authenticated caller. |
| `hanzo o11y service_accounts me replace`          | Renames the calling service account.                                                                                           |
| `hanzo o11y service_accounts rm <id>`             | Deletes a service account and revokes every key it holds.                                                                      |
| `hanzo o11y service_accounts roles create <id>`   | Assigns a role, named by its id, to a service account.                                                                         |
| `hanzo o11y service_accounts roles list <id>`     | Lists the roles a service account holds.                                                                                       |
| `hanzo o11y service_accounts roles rm <id> <rid>` | Removes a role from a service account.                                                                                         |
| `hanzo o11y service_accounts set <id>`            | Renames a service account.                                                                                                     |

### Services

| Command                      | What it does                                                                                                                                                                                                              |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y services create` | Lists the instrumented services seen in the window, each with the request profile of its entry-point spans: p99 and average latency, call and error rates, and the entry-point operations the numbers were computed over. |
| `hanzo o11y services list`   | Lists the name of every service the trace store holds, with no window applied — the complete catalog, for pickers and autocomplete.                                                                                       |

### Settings

| Command                            | What it does                                                                                                                                    |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y settings apdex create` | Sets one service's apdex threshold and the status codes excluded from its score.                                                                |
| `hanzo o11y settings apdex get`    | Returns apdex settings for the named services.                                                                                                  |
| `hanzo o11y settings ttl create`   | Sets the org's retention policy for one signal: the default TTL in days, ordered per-label retention rules, and optional cold-storage settings. |
| `hanzo o11y settings ttl get`      | Returns the org's current retention policy: default TTL, custom per-label rules, and cold-storage settings where configured.                    |

### Span mapper groups

| Command                                                                  | What it does                                                                                                                                    |
| ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y span_mapper_groups create`                                   | Creates a mapping group: the name it is known by, the span and resource attributes whose presence selects a span into it, and whether it is on. |
| `hanzo o11y span_mapper_groups list`                                     | Lists the caller's org's mapping groups, optionally only the enabled ones.                                                                      |
| `hanzo o11y span_mapper_groups rm <groupId>`                             | Deletes a mapping group and every mapper under it.                                                                                              |
| `hanzo o11y span_mapper_groups span_mappers create <groupId>`            | Adds a mapper to a group: which field context it reads, the move or copy it performs, and whether it is on.                                     |
| `hanzo o11y span_mapper_groups span_mappers list <groupId>`              | Lists the mappers belonging to one group, in the order they are applied.                                                                        |
| `hanzo o11y span_mapper_groups span_mappers rm <groupId> <mapperId>`     | Deletes one mapper from a group.                                                                                                                |
| `hanzo o11y span_mapper_groups span_mappers update <groupId> <mapperId>` | Changes a mapper's field context, config or enabled state.                                                                                      |
| `hanzo o11y span_mapper_groups update <groupId>`                         | Changes a group's name, condition or enabled state.                                                                                             |

### Statefulsets

| Command                                    | What it does                                                                                                                                                                                                               |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y statefulsets attribute_keys`   | Lists the metric attribute keys Kubernetes statefulsets report, for building statefulset filters.                                                                                                                          |
| `hanzo o11y statefulsets attribute_values` | Lists the values one statefulset attribute key has taken, for building statefulset filters.                                                                                                                                |
| `hanzo o11y statefulsets list`             | Lists Kubernetes statefulsets over a time range, each with the CPU and memory its pods used against request and limit, desired and available replica counts, restarts and attributes; filterable, groupable and paginated. |

### Third party APIs

| Command                                       | What it does                                                                                                                     |
| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y third-party-apis overview domain` | Returns one external domain's endpoint-level breakdown — each endpoint with its rate, error and latency columns over the window. |
| `hanzo o11y third-party-apis overview list`   | Lists the external domains the instrumented services call, with request rate, error percentage and latency per domain.           |

### Trace funnels

| Command                                                         | What it does                                                                                                                |
| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y trace-funnels analytics error-traces <funnel_id>`   | Returns the errored traces through a step transition of a saved funnel — the entry point for "why is this step failing".    |
| `hanzo o11y trace-funnels analytics error-traces-all`           | Returns the errored traces through a step transition of a funnel described inline.                                          |
| `hanzo o11y trace-funnels analytics overview <funnel_id>`       | Returns a saved funnel's conversion overview over a window: how many entered, how many converted, the rate and the latency. |
| `hanzo o11y trace-funnels analytics overview-all`               | Returns the conversion overview of a funnel described inline.                                                               |
| `hanzo o11y trace-funnels analytics slow-traces <funnel_id>`    | Returns the slowest traces through a step transition of a saved funnel — the entry point for "why is this step slow".       |
| `hanzo o11y trace-funnels analytics slow-traces-all`            | Returns the slowest traces through a step transition of a funnel described inline.                                          |
| `hanzo o11y trace-funnels analytics steps create <funnel_id>`   | Returns a saved funnel's per-step metrics over a window — the counts and latencies at each step, in step order.             |
| `hanzo o11y trace-funnels analytics steps create-all`           | Returns the per-step metrics of a funnel described inline.                                                                  |
| `hanzo o11y trace-funnels analytics steps overview <funnel_id>` | Returns the conversion between two named steps of a saved funnel — the step-to-step drill-down behind the overview.         |
| `hanzo o11y trace-funnels analytics steps overview-all`         | Returns the conversion between two steps of a funnel described inline.                                                      |
| `hanzo o11y trace-funnels analytics validate <funnel_id>`       | Lists the traces that match a saved funnel over a window — the read that answers "is this funnel finding anything at all".  |
| `hanzo o11y trace-funnels analytics validate-all`               | Lists the traces that match a funnel described inline — the builder's "try this" before anything is saved.                  |
| `hanzo o11y trace-funnels get <funnel_id>`                      | Returns one funnel with its steps.                                                                                          |
| `hanzo o11y trace-funnels list`                                 | Lists the caller's org's funnels, each with its steps and who last touched it.                                              |
| `hanzo o11y trace-funnels new`                                  | Creates an empty funnel with a name, answering the funnel it created.                                                       |
| `hanzo o11y trace-funnels rm <funnel_id>`                       | Deletes a funnel.                                                                                                           |
| `hanzo o11y trace-funnels set <funnel_id>`                      | Renames a funnel or rewrites its description, answering the funnel as it now stands.                                        |
| `hanzo o11y trace-funnels steps update`                         | Replaces a funnel's steps — the funnel is named in the body rather than the path — and answers the funnel as it now stands. |

### Traces

| Command                                                                              | What it does                                                                                                                                                                                  |
| ------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y traces aggregations <traceId>`                                           | Computes span aggregations over one trace — span count, duration or share of execution time — grouped by the resource field each aggregation names.                                           |
| `hanzo o11y traces fields create --data-type <dataType> --name <name> --type <type>` | Changes how one span field is stored — selects or deselects it as a materialized column and tunes its index — and echoes the setting back.                                                    |
| `hanzo o11y traces fields get`                                                       | Returns the trace field catalog: the span fields already selected as indexed columns, and the interesting ones seen in the data that could be.                                                |
| `hanzo o11y traces flamegraph <traceId>`                                             | Returns a trace's flamegraph: spans bucketed by depth level, each level ordered as it is drawn, around the selected span.                                                                     |
| `hanzo o11y traces get <traceId>`                                                    | Returns one trace's spans as a column/row table, optionally centred on a span and walked a fixed number of levels up and down from it — the read the trace explorer opens a trace with.       |
| `hanzo o11y traces list`                                                             | Lists the caller org's recent traces — one row per trace with its span count and wall-clock duration, most recently active first.                                                             |
| `hanzo o11y traces waterfall <traceId>`                                              | Returns a trace's waterfall: every span when the trace is small enough, a capped window around the selected span when it is not, with the uncollapsed subtrees the caller asked to keep open. |

### User

| Command                                  | What it does                                                                         |
| ---------------------------------------- | ------------------------------------------------------------------------------------ |
| `hanzo o11y user preferences get <name>` | Returns one preference of the calling user, by name.                                 |
| `hanzo o11y user preferences list`       | Lists every preference of the calling user, each with its current and default value. |
| `hanzo o11y user preferences set <name>` | Sets one preference of the calling user, by name.                                    |

### Users

| Command                                            | What it does                                                                                                                                                             |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `hanzo o11y users me dashboards list`              | Dashboard list V2 personalized for the calling user: each dashboard carries the caller's pinned state, and pinned dashboards float to the top of the requested ordering. |
| `hanzo o11y users me dashboards pins clear <id>`   | Removes the caller's pin for a dashboard.                                                                                                                                |
| `hanzo o11y users me dashboards pins replace <id>` | Pins a dashboard for the calling user.                                                                                                                                   |
| `hanzo o11y users me get`                          | Returns the calling user together with every role they hold.                                                                                                             |

### Variables

| Command                                      | What it does                                                                       |
| -------------------------------------------- | ---------------------------------------------------------------------------------- |
| `hanzo o11y variables query --query <query>` | Evaluates a dashboard variable query and returns the values the variable may take. |

### Zeus

| Command                         | What it does                                                                                                                     |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `hanzo o11y zeus hosts get`     | Returns the deployment's host info from Zeus.                                                                                    |
| `hanzo o11y zeus hosts replace` | Records the deployment's host in Zeus, overwriting any prior one.                                                                |
| `hanzo o11y zeus profiles`      | Records the deployment's profile in Zeus — how the team uses observability today and what they plan — overwriting any prior one. |
