# window_too_large

An audit count or ranking asked for a window longer than its bucket allows (400).

## Meaning

Counts (`GET /v1/admin/orgs/{slug}/audit-events/counts`) and the threat overview
bound the window by bucket: `1m` up to 2 hours, `10m` up to 2 days, `1h` up to 31
days and `1d` up to 90 days. Rankings (`.../audit-events/top`) allow at most 31 days.
A bucket asked for is never coarsened silently.

## Impact

The chart or ranking is not drawn. It is a caller error; the dashboard's own ranges
stay inside the bounds.

## Diagnosis

Read `detail`: it states the window and the longest one the bucket allows.

## Mitigation

- As an admin-API caller: shorten the window, pick a coarser bucket, or leave the
  bucket out so the server chooses the finest that fits.

## Escalation

Escalate when a window inside the documented bound is refused. Open an issue with the
request id, the query parameters and the server version.

---

[Problem code runbooks](https://www.nauthera.io/docs/v1/runbooks/problems) · Generated from [`internal/runbook/problems.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/problems.yaml) in nauthera-server.