--- search: tags: - Operations - POST seo: description: >- Root-cause an incident for one or more services over a time window. Returns a… Reference for the POST /v1/diagnose endpoint in the sigiro API Reference API. sidebar: badge: POST label: Diagnose a service title: Diagnose a service type: openapi-operation --- Root-cause an incident for one or more services over a time window. Returns a triage summary — NOT raw telemetry: a ranked `findings` array (read this first), per-operation anomaly flags, and bounded samples of spans/logs. Every lead carries a ready-to-run SQL string (`drill_down_sql` on findings, operations, spans, and log patterns; `drill_all_sql` on the spans/logs sections) that you paste VERBATIM into `POST /v1/query` to fetch the underlying rows and go deeper. Typical agent loop: `GET /v1/services` → `POST /v1/diagnose` → for any finding or anomalous operation, run its `drill_down_sql` via `/v1/query`. Timestamps are microseconds since the Unix epoch. The response is a map `{results: {service: block}, errors: {service: message}}` — partial results survive a single failing service.