capture_list
Read-only listing of packet captures. Wraps GET /api/captures. Operators see their own captures; admin (sa) sees all. The upstream endpoint returns the 200 most-recent rows ordered by id desc.
Use this for 'is there a capture running on device X?' / 'do we have packet evidence for the incident?' / 'what captures finished today?' questions. Pair with capture_get to drill into one row.
Each row carries: id, user_id, device_id, label, status (starting|running|stopped|expired|failed), filter (jsonb), started_at, ended_at, expires_at, packets, bytes, byte_cap.
Filters (client-side, AND-combined): device_id, status, search (substring on label).
Read-only is deliberate: capture creation, stop, delete, and pcapng download endpoints are NOT wrapped. PCAP bytes aren't an LLM-shaped payload anyway.
Permission: capture. Examples: capture_list({}) capture_list({status: 'running'}) capture_list({device_id: 42, status: 'stopped'})
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | 1-indexed page number (default 1). | |
| search | No | Case-insensitive substring on label. | |
| status | No | Restrict by lifecycle state. | |
| per_page | No | Rows per page (default 50, max 200). | |
| device_id | No | Restrict to one device id. |