Operator platform
Capabilities
Workflows and surfaces an internal operator actually uses. Everything below maps to authenticated routes in the running deployment—not marketing features.
Why these surfaces exist: Why operators need a control plane · How ingest and correlation work
Operator surfaces
Private routes below require authentication. This table explains intent—not live data.
- /overviewOverview
Workspace pulse: health posture, open issues, and cross-app signals at a glance.
Why it matters: Gives operators a single landing point before drilling into an application or incident.
- /appsApps
Catalog of registered applications, integrations, and per-app operational entry points.
Why it matters: Maps the portfolio to control-plane coverage so gaps (missing collectors, stale tokens) are obvious.
- /apps/[slug]/eventsEvents (per app)
Ingestion visibility and timelines for a specific app slug—debugging, correlation, and category filters.
Why it matters: The product does not rely on a single ambiguous “global events” page; events are grounded in app registration.
- /incidentsIncidents
Grouped operational failure states and severity-driven triage lists.
Why it matters: Turns raw event streams into narratives operators can own, escalate, or close.
- /metricsMetrics
Platform telemetry and quantitative signals collected for the workspace.
Why it matters: Supports trend questions that pure logs cannot answer when collectors are wired.
- /activityActivity
Operator actions and audit-oriented visibility across the control plane.
Why it matters: Explains changes to configuration and posture, not only application-side telemetry.
- /alertsAlerts
Alerting and notification-oriented surfaces tied to workspace rules and integrations.
Why it matters: Connects continuous monitoring to human response paths where configured.
- /settingsSettings
Workspace and account-level configuration boundaries.
Why it matters: Keeps privileged changes explicit and separate from read-only operational browsing.
Workflow themes
Event intake
Providers POST structured payloads; XFlow validates, dedupes, rate-limits, and persists. Operators verify delivery and debug via per-app event views.
Incident awareness
Severities and categories lift operational issues out of unstructured logs into triage-friendly lists.
Operational traceability
Request IDs propagate through APIs; dedupe keys stabilize idempotent retries. Operators can explain duplicates versus new failures.
Security and boundary discipline
Browser sessions, bearer-based ingest, and encrypted connection material are intentionally separated. Internal JSON APIs remain authenticated.
Production-minded defaults
Structured logging, optional error tracking, health/readiness probes, and explicit ingest outcomes (created vs skipped) favor operability over silent success.
Evaluate next
Capabilities only make sense once the category and incident narrative are clear—then sign in or walk the demo.