update_report_definition
Update an audit report definition by replacing its entire configuration. Provide the definition ID, name, and integration type, along with optional settings like schedule and filters.
Instructions
Update an existing audit report definition (full replacement).
Replaces the definition's configuration entirely. All fields that should be preserved must be included.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| definition_id | Yes | ID of the definition to update. | |
| name | Yes | Unique display name for the definition. | |
| integration_type | Yes | Data source type. Values: "oltp", "snowflake". | |
| description | No | Optional human-readable description. | |
| lookback_days | No | Number of complete calendar days to include in each report window (excludes the trigger day). | |
| timezone | No | IANA timezone for the report window (e.g. "America/New_York"). | |
| schedule_cron | No | 6-field cron expression controlling when the report runs automatically. Format: "minute hour day-of-month month day-of-week year" Use ? in day-of-month OR day-of-week (not both) when the other field is specified. Use * for "every". Days: SUN MON TUE WED THU FRI SAT Months: JAN FEB MAR APR MAY JUN JUL AUG SEP OCT NOV DEC Common examples — convert natural language like: "every day at 12 PM" → "0 12 * * ? *" "every day at 9 AM" → "0 9 * * ? *" "every Monday at 9 AM" → "0 9 ? * MON *" "every weekday at 8:30 AM" → "30 8 ? * MON-FRI *" "every Sunday at 6 PM" → "0 18 ? * SUN *" "first day of month midnight" → "0 0 1 * ? *" "every hour" → "0 * * * ? *" | |
| schedule_enabled | No | Whether the schedule is active. | |
| schedule_timezone | No | IANA timezone for schedule evaluation (e.g. "America/New_York"). All cron times are interpreted in this timezone. | |
| delivery | No | Delivery configuration as a dict or JSON string. Shape: {"channels": [{"type": "email", "enabled": bool, "recipients": ["email@example.com"]}]}. | |
| filters | No | Filter groups as a dict or JSON string. Shape: {"filter_groups": [{"filters": [{"field": "database_name", "pattern": {"match_type": "exact", "value": "mydb"}}]}]}. OLTP fields: database_name, table_name, schema_name, column_name, statement_type, consuming_user, event_source, event_name, repo_user, repo_host, repo_name, repo_type, application_name, client_host, connection_id, statement_text, policy_blocked, execution_success, row_count. Snowflake fields: username, current_role, ip_address, client, query_type, warehouse, warehouse_size. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||