# THIS IS AN EXAMPLE FILE
# DO NO MAKE CHANGES TO IT
# THEY MAY BE OVER-WRITTEN
#
# A suggested profile for AI assistants (and tools/elm-ask): enough to answer
# everyday questions about devices, alerts, SDTs, collectors and websites, and
# nothing that exposes users, API tokens, contact details, integration secrets
# or device configurations.
#
# To use it: copy to ~/.config/logicmonitor/credentials/ai.ini, fill in the
# credentials, adjust the list, then run the assistant with: elm -p ai ...
#
# Pair it with an API token whose LogicMonitor role is read-only and limited to
# the same areas. The list below is what the assistant may ask for; the role
# decides what it gets. Check the two agree:
#
#   tools/elm-check-access.sh -p ai          # ok / denied by LM (403) / needs id
#   tools/elm-check-access.sh -p ai --json   # same, with each command's API path
#
# allowed_commands is a guard rail against wrong guesses, not a security
# boundary: the token's role is what actually limits access.
#
# config files use unrepr format (see config.example.ini)

access_id = '12345678901234567890'
access_key = '1234567890123456789123456789012345678901'
account_name = 'example'

# ALLOWED
#   Devices and groups   DeviceList DeviceById DeviceGroupList DeviceGroupById
#                        ImmediateDeviceListByDeviceGroupId DevicePropertyList
#                        DevicePropertyByName DeviceGroupPropertyList
#                        DeviceGroupPropertyByName
#                        (credential properties come back masked as ********)
#   What is monitored    DeviceDatasourceList DeviceDatasourceById
#                        DeviceDatasourceInstanceList DeviceDatasourceInstanceById
#                        DeviceDatasourceInstanceData DeviceInstanceList
#                        DeviceGroupDatasourceList
#   Alerts               AlertList AlertById AlertListByDeviceId
#                        AlertListByDeviceGroupId WebsiteAlertListByWebsiteId
#   SDTs                 SDTList SdtById AllSDTListByDeviceId DeviceGroupSDTList
#                        SDTHistoryByDeviceId WebsiteSDTListByWebsiteId
#                        (SDTList covers every scope: a ResourceGroupSDT silences
#                        a whole group, a DeviceDataSourceInstanceSDT one instance,
#                        so its rows are not a count of devices in downtime)
#   Collectors           CollectorList CollectorById CollectorGroupList
#                        CollectorGroupById CollectorsByGroupId CollectorVersionList
#                        (collector config blobs and tokens are empty for a
#                        read-only token; with write permission they are not)
#   Websites             WebsiteList WebsiteById WebsiteGroupList WebsiteGroupById
#   Ops notes            OpsNoteList OpsNoteById
#
# Together these answer the common troubleshooting question end to end: is
# device X alerting, and if not, why -- its own setting, a group's, an SDT, or
# the collector it sits on being down.
#
# ADD IF THE ROLE ALLOWS THEM
#   DatasourceList DatasourceById AssociatedDeviceListByDataSourceId
#       datasource definitions (Settings > LogicModules). Needed for "SNMP
#       alerts" and the like: alert names do not say how data is collected, so
#       the answer comes from matching datasources by collectMethod. The one
#       most worth widening a role for.
#   MetricsUsage MetricsSummary    licence and device counts
#   AlertRuleList                  which rule routed an alert
#   UnmonitoredDeviceList          discovered but not monitored
#
# LEFT OUT, and why
#   AdminList AdminById ApiTokenList ApiTokenListByAdminId RoleList AccessGroupList
#   AdminGroupList AdminGroupById RoleGroupList RoleGroupById
#       users, API tokens and permissions
#   AuditLogList AuditLogById      usernames, source IPs and activity
#   PortalInfo                     portal contacts' names, emails and phone numbers
#   RecipientGroupList EscalationChainList
#                                  people and their contact details
#   IntegrationList IntegrationAuditLogs
#                                  webhook URLs and integration credentials
#   DeviceConfigSourceConfigList DeviceConfigSourceConfigById
#                                  device running configs, which can hold secrets
#   NetscanList NetscanById        discovery credentials
#   CollectorInstaller CollectorDownloadTokenById CollectorLogFiles
#   CollectorLogFileByName DebugCommandResult
#                                  installers, download tokens and collector logs
#   V4Metadata                     ~13 MB per call: expensive for an assistant
#   everything else                not needed for everyday questions; add
#                                  deliberately if you need it
#
# Exact names, no wildcards, so commands added to elm later are not allowed until
# someone adds them. The list must stay on one line (the format has no
# multi-line values). [] allows nothing; removing the line allows everything;
# None or '' is an error.

allowed_commands = ['DeviceList', 'DeviceById', 'DeviceGroupList', 'DeviceGroupById', 'ImmediateDeviceListByDeviceGroupId', 'DevicePropertyList', 'DevicePropertyByName', 'DeviceGroupPropertyList', 'DeviceGroupPropertyByName', 'DeviceDatasourceList', 'DeviceDatasourceById', 'DeviceDatasourceInstanceList', 'DeviceDatasourceInstanceById', 'DeviceDatasourceInstanceData', 'DeviceInstanceList', 'DeviceGroupDatasourceList', 'AlertList', 'AlertById', 'AlertListByDeviceId', 'AlertListByDeviceGroupId', 'WebsiteAlertListByWebsiteId', 'SDTList', 'SdtById', 'AllSDTListByDeviceId', 'DeviceGroupSDTList', 'SDTHistoryByDeviceId', 'WebsiteSDTListByWebsiteId', 'CollectorList', 'CollectorById', 'CollectorGroupList', 'CollectorGroupById', 'CollectorsByGroupId', 'CollectorVersionList', 'WebsiteList', 'WebsiteById', 'WebsiteGroupList', 'WebsiteGroupById', 'OpsNoteList', 'OpsNoteById']