Show which OctoWatch API host and account the MCP server is using (password never returned).

List users and groups tree (GetUsersGroups2). Type 0=root, 1=group, 2=user.

These Type values are for the UI tree only. For report POST filters use NodeType 14=group and NodeType 1=user (AliasID). Cached ~5 min per MCP session; pass refresh=true to force reload.

List or summarize DLP/rule Risks for a period.

Use for: policy/keyword/USB/AI rule hits. Default mode=summary (by_user from Analytics/Overall; by_rule/by_day/sample from Risks/Overall2). Not for idle time (get_idle_summary) or timetable deviations (list_anomalies).

List formal Alerts / deviations (POST /api/Alerts/Overall2).

Use for: lateness, overtime, unusual app-share, timetable-fired alerts. Do NOT use for idle/inactive duration — that is get_idle_summary (InactiveTime). Do NOT use for DLP keyword/USB policy hits — that is list_risks.

Rank users by inactive (idle) time from Productivity/Overall3.

Use for: 'who was idle longest?', 'idle > N hours', InactiveTime totals. Do NOT use list_anomalies for idle — Alerts are formal deviations only.

Top apps and sites by ActiveTime (POST /api/Activity/Overall2).

Timesheet / attendance summary (POST /api/TimeSheet/Overall2).

Per-user productivity rollup (Overall3 + stats + Analytics metrics).

List scheduled report mailing settings and background processing tasks.

Analytics rollups: view=overall|disciplina|activity|productivity.

Dashboard widgets (metadata only; screenshot blobs stripped when compact).

Chronometry timeline (POST /api/Chrono/Overall2).

Day structure: mode=list (DayStructureList) or detail (GetDayStructure).

detail requires user_id. Filters match console: ProductivityFilter 0–4, ActivityTypeFilter 0–2 (defaults 0).

Single Monitoring list (Sites, Apps, Screens, Keystrokes, Mail, …).

For keyword search across many Monitoring kinds (console Tools → Search), use search_monitoring(filter_key=…) instead of calling this 13–19 times.

Sensitive kinds return text truncated when compact=true. No binary media.

Console Tools → Search: parallel Monitoring fan-out with FilterKey.

Use for: 'find keyword X across activity' (sites/apps/keys/mail/files/…). Prefer this over calling list_monitoring many times. Not for Risks (list_risks), idle (get_idle_summary), or formal Alerts (list_anomalies). Does not search SearchQueries.

kinds: optional comma-separated subset (e.g. "Sites,Apps,Mail" or "sites,mail"). Default = all Tools Search sources.

Activity drill-down: ActivityWindow (needs activity_name) or CategoryWindow (needs category_guid).

Online presence (POST /api/Live/Overall2). No webcam or live stream frames.

Desktop video metadata (SPA GET contracts; no DownloadVideo).

which_content: needs user_id; uses DateTo (or period end) as DateTime. videos: needs user_id + DateFrom/DateTo (UserID header). downloads: Bearer only (exported file list).

Directory reads: users/groups tree, users, groups, computers, additional operators.

users_groups is session-cached (~5 min); pass refresh=true to force reload.

User/computer detail reads (SPA GET headers).

user_data / tooltip / group: need user_id (AliasID). group = group path for that user (not load-by-GroupID). computer / users_from_computer: need computer_guid (ComputerGuid).

Read-only account/profile/license Gets (SPA header contracts).

profiles: GetProfiles2 — ProfilesType 0|1|2; optional user_id + alias_type (1=user, 14=group); defaults AliasID/AliasType=-1. timetable/rules/profile_settings/computer_settings: require profile_id. computer_profiles: optional computer_guid (Guid header).

Static gap matrix: which console APIs are covered vs intentional out-of-scope.