create_report_definition
Create a report definition to configure audit data filters, schedule, and delivery. After creation, trigger the report on demand.
Instructions
Create a new audit report definition.
Defines what data is included, how it is scheduled, and where it
is delivered. After creating, use trigger_report_definition to
generate a report on demand.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Unique display name for the definition. | |
| integration_type | Yes | Data source type. Values: "oltp", "snowflake". | |
| description | No | Optional human-readable description. | |
| lookback_days | No | Number of complete calendar days to include in each report window (excludes the trigger day). | |
| timezone | No | IANA timezone for the report window (e.g. "America/New_York"). | |
| schedule_cron | No | 6-field cron expression controlling when the report runs automatically. Format: "minute hour day-of-month month day-of-week year" Use ? in day-of-month OR day-of-week (not both) when the other field is specified. Use * for "every". Days: SUN MON TUE WED THU FRI SAT Months: JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC Common examples — convert natural language like: "every day at 12 PM" → "0 12 * * ? *" "every day at 9 AM" → "0 9 * * ? *" "every Monday at 9 AM" → "0 9 ? * MON *" "every weekday at 8:30 AM" → "30 8 ? * MON-FRI *" "every Sunday at 6 PM" → "0 18 ? * SUN *" "first day of month midnight" → "0 0 1 * ? *" "every hour" → "0 * * * ? *" | |
| schedule_enabled | No | Whether the schedule is active. | |
| schedule_timezone | No | IANA timezone for schedule evaluation (e.g. "America/New_York"). All cron times are interpreted in this timezone. | |
| delivery | No | Delivery configuration as a dict or JSON string. Shape: {"channels": [{"type": "email", "enabled": bool, "recipients": ["email@example.com"]}]}. | |
| filters | No | Filter groups as a dict or JSON string. Shape: {"filter_groups": [{"filters": [{"field": "database_name", "pattern": {"match_type": "exact", "value": "mydb"}}]}]}. OLTP fields: database_name, table_name, schema_name, column_name, statement_type, consuming_user, event_source, event_name, repo_user, repo_host, repo_name, repo_type, application_name, client_host, connection_id, statement_text, policy_blocked, execution_success, row_count. Snowflake fields: username, current_role, ip_address, client, query_type, warehouse, warehouse_size. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||