test(integration): cover alerts authz across managed roles

Covers v2/v3 rules, rule views, state history, legacy v1 rules routes
(kept out of the OpenAPI spec by the generator), downtime schedules and
route policies. Route policy writes stay admin-only, matching the
previous AdminAccess gate.

docs/api/openapi.yml

@@ -8810,6 +8810,98 @@ components:
         message:
           type: string
       type: object
+    RuletypesLabelPair:
+      properties:
+        key:
+          type: string
+        value:
+          type: string
+      required:
+      - key
+      - value
+      type: object
+    RuletypesListOrder:
+      enum:
+      - asc
+      - desc
+      type: string
+    RuletypesListSort:
+      enum:
+      - updated_at
+      - created_at
+      - name
+      - state
+      - severity
+      type: string
+    RuletypesListableRule:
+      properties:
+        alert:
+          type: string
+        alertType:
+          $ref: '#/components/schemas/RuletypesAlertType'
+        createdAt:
+          format: date-time
+          type: string
+        createdBy:
+          type: string
+        description:
+          type: string
+        disabled:
+          type: boolean
+        id:
+          type: string
+        labels:
+          additionalProperties:
+            type: string
+          type: object
+        ruleType:
+          $ref: '#/components/schemas/RuletypesRuleType'
+        state:
+          $ref: '#/components/schemas/RuletypesAlertState'
+        updatedAt:
+          format: date-time
+          type: string
+        updatedBy:
+          type: string
+      required:
+      - id
+      - state
+      - alert
+      - alertType
+      - ruleType
+      type: object
+    RuletypesListableRuleViews:
+      properties:
+        views:
+          items:
+            $ref: '#/components/schemas/RuletypesRuleView'
+          type: array
+      required:
+      - views
+      type: object
+    RuletypesListableRules:
+      properties:
+        labels:
+          items:
+            $ref: '#/components/schemas/RuletypesLabelPair'
+          type: array
+        reservedKeywords:
+          items:
+            type: string
+          type: array
+        rules:
+          items:
+            $ref: '#/components/schemas/RuletypesListableRule'
+          type: array
+        total:
+          format: int64
+          type: integer
+      required:
+      - rules
+      - total
+      - labels
+      - reservedKeywords
+      type: object
     RuletypesMatchType:
       enum:
       - at_least_once
@@ -8884,6 +8976,16 @@ components:
       - ruleType
       - condition
       type: object
+    RuletypesPostableRuleView:
+      properties:
+        data:
+          $ref: '#/components/schemas/RuletypesRuleViewData'
+        name:
+          type: string
+      required:
+      - name
+      - data
+      type: object
     RuletypesQueryType:
       enum:
       - builder
@@ -9022,6 +9124,45 @@ components:
       - promql_rule
       - anomaly_rule
       type: string
+    RuletypesRuleView:
+      properties:
+        createdAt:
+          format: date-time
+          type: string
+        data:
+          $ref: '#/components/schemas/RuletypesRuleViewData'
+        id:
+          type: string
+        name:
+          type: string
+        orgId:
+          type: string
+        updatedAt:
+          format: date-time
+          type: string
+      required:
+      - id
+      - name
+      - data
+      - orgId
+      type: object
+    RuletypesRuleViewData:
+      properties:
+        order:
+          $ref: '#/components/schemas/RuletypesListOrder'
+        query:
+          type: string
+        sort:
+          $ref: '#/components/schemas/RuletypesListSort'
+        states:
+          items:
+            type: string
+          type: array
+        version:
+          type: string
+      required:
+      - version
+      type: object
     RuletypesScheduleType:
       enum:
       - hourly
@@ -12045,9 +12186,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - planned-maintenance:list
       - tokenizer:
-        - VIEWER
+        - planned-maintenance:list
       summary: List downtime schedules
       tags:
       - downtimeschedules
@@ -12101,9 +12242,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - planned-maintenance:create
       - tokenizer:
-        - EDITOR
+        - planned-maintenance:create
       summary: Create downtime schedule
       tags:
       - downtimeschedules
@@ -12147,9 +12288,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - planned-maintenance:delete
       - tokenizer:
-        - EDITOR
+        - planned-maintenance:delete
       summary: Delete downtime schedule
       tags:
       - downtimeschedules
@@ -12204,9 +12345,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - planned-maintenance:read
       - tokenizer:
-        - VIEWER
+        - planned-maintenance:read
       summary: Get downtime schedule by ID
       tags:
       - downtimeschedules
@@ -12260,9 +12401,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - planned-maintenance:update
       - tokenizer:
-        - EDITOR
+        - planned-maintenance:update
       summary: Update downtime schedule
       tags:
       - downtimeschedules
@@ -13525,9 +13666,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - route-policy:list
       - tokenizer:
-        - VIEWER
+        - route-policy:list
       summary: List route policies
       tags:
       - routepolicies
@@ -13581,9 +13722,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - route-policy:create
       - tokenizer:
-        - ADMIN
+        - route-policy:create
       summary: Create route policy
       tags:
       - routepolicies
@@ -13627,9 +13768,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - route-policy:delete
       - tokenizer:
-        - ADMIN
+        - route-policy:delete
       summary: Delete route policy
       tags:
       - routepolicies
@@ -13684,9 +13825,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - route-policy:read
       - tokenizer:
-        - VIEWER
+        - route-policy:read
       summary: Get route policy by ID
       tags:
       - routepolicies
@@ -13752,9 +13893,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - route-policy:update
       - tokenizer:
-        - ADMIN
+        - route-policy:update
       summary: Update route policy
       tags:
       - routepolicies
@@ -20821,11 +20962,237 @@ paths:
       summary: Get users by role id
       tags:
       - users
-  /api/v2/rules:
+  /api/v2/rule_views:
     get:
       deprecated: false
-      description: This endpoint lists all alert rules with their current evaluation
-        state
+      description: Returns every saved view in the calling user's org. Saved views
+        are shared org-wide.
+      operationId: ListRuleViews
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/RuletypesListableRuleViews'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - rule:list
+      - tokenizer:
+        - rule:list
+      summary: List rule saved views
+      tags:
+      - rules
+    post:
+      deprecated: false
+      description: Persists the calling user's rule listing state (query, states,
+        sort, order) as a named, reusable view shared across the org.
+      operationId: CreateRuleView
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RuletypesPostableRuleView'
+      responses:
+        "201":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/RuletypesRuleView'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: Created
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - rule:list
+      - tokenizer:
+        - rule:list
+      summary: Create rule saved view
+      tags:
+      - rules
+  /api/v2/rule_views/{id}:
+    delete:
+      deprecated: false
+      description: Removes a saved view. Saved views are shared org-wide. Deleting
+        a non-existent view returns 404.
+      operationId: DeleteRuleView
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - rule:list
+      - tokenizer:
+        - rule:list
+      summary: Delete rule saved view
+      tags:
+      - rules
+    put:
+      deprecated: false
+      description: Replaces a saved view's name and data. Saved views are shared org-wide.
+      operationId: UpdateRuleView
+      parameters:
+      - in: path
+        name: id
+        required: true
+        schema:
+          type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RuletypesPostableRuleView'
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/RuletypesRuleView'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - rule:list
+      - tokenizer:
+        - rule:list
+      summary: Update rule saved view
+      tags:
+      - rules
+  /api/v2/rules:
+    get:
+      deprecated: true
+      description: 'This endpoint lists all alert rules with their current evaluation
+        state. Deprecated: use ListRulesV3, which supports filtering, sorting and
+        pagination.'
       operationId: ListRules
       responses:
         "200":
@@ -20864,9 +21231,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: List alert rules
       tags:
       - rules
@@ -21704,9 +22071,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:create
       - tokenizer:
-        - EDITOR
+        - rule:create
       summary: Create alert rule
       tags:
       - rules
@@ -21750,9 +22117,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:delete
       - tokenizer:
-        - EDITOR
+        - rule:delete
       summary: Delete alert rule
       tags:
       - rules
@@ -21807,9 +22174,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get alert rule by ID
       tags:
       - rules
@@ -22659,9 +23026,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:update
       - tokenizer:
-        - EDITOR
+        - rule:update
       summary: Patch alert rule
       tags:
       - rules
@@ -23499,9 +23866,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:update
       - tokenizer:
-        - EDITOR
+        - rule:update
       summary: Update alert rule
       tags:
       - rules
@@ -23600,9 +23967,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get rule history filter keys
       tags:
       - rules
@@ -23709,9 +24076,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get rule history filter values
       tags:
       - rules
@@ -23783,9 +24150,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get rule overall status timeline
       tags:
       - rules
@@ -23854,9 +24221,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get rule history stats
       tags:
       - rules
@@ -23945,9 +24312,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get rule history timeline
       tags:
       - rules
@@ -24019,9 +24386,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get top contributors to rule firing
       tags:
       - rules
@@ -24860,9 +25227,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:create
       - tokenizer:
-        - EDITOR
+        - rule:create
       summary: Test alert rule
       tags:
       - rules
@@ -26607,6 +26974,90 @@ paths:
       summary: Get metric dashboards (v2)
       tags:
       - metrics
+  /api/v3/rules:
+    get:
+      deprecated: false
+      description: Returns a page of alert rules with their current evaluation state,
+        trimmed to the fields the list page renders. Supports a filter DSL (`query`),
+        a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`),
+        order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). The
+        response also carries the org's label pairs and the reserved filter keys for
+        building filter suggestions.
+      operationId: ListRulesV3
+      parameters:
+      - in: query
+        name: query
+        schema:
+          type: string
+      - in: query
+        name: states
+        schema:
+          items:
+            type: string
+          type: array
+      - in: query
+        name: sort
+        schema:
+          $ref: '#/components/schemas/RuletypesListSort'
+      - in: query
+        name: order
+        schema:
+          $ref: '#/components/schemas/RuletypesListOrder'
+      - in: query
+        name: limit
+        schema:
+          type: integer
+      - in: query
+        name: offset
+        schema:
+          type: integer
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/RuletypesListableRules'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - rule:list
+      - tokenizer:
+        - rule:list
+      summary: List alert rules (v3)
+      tags:
+      - rules
   /api/v3/traces/{traceID}/flamegraph:
     post:
       deprecated: false

ee/sqlstore/postgressqlstore/formatter.go

@@ -23,6 +23,15 @@ func (f *formatter) JSONExtractString(column, path string) []byte {
 	return append(f.TextToJsonColumn(column), ops...)
 }
 
+func (f *formatter) JSONExtractMapValue(column, mapField, key string) []byte {
+	sql := f.TextToJsonColumn(column)
+	sql = append(sql, "->"...)
+	sql = schema.Append(f.bunf, sql, mapField)
+	sql = append(sql, "->>"...)
+	sql = schema.Append(f.bunf, sql, key)
+	return sql
+}
+
 func (f *formatter) JSONType(column, path string) []byte {
 	var sql []byte
 	sql = append(sql, "jsonb_typeof("...)

ee/sqlstore/postgressqlstore/formatter_test.go

@@ -55,6 +55,39 @@ func TestJSONExtractString(t *testing.T) {
 	}
 }
 
+func TestJSONExtractMapValue(t *testing.T) {
+	tests := []struct {
+		name     string
+		column   string
+		mapField string
+		key      string
+		expected string
+	}{
+		{
+			name:     "plain key",
+			column:   "data",
+			mapField: "labels",
+			key:      "team",
+			expected: `"data"::jsonb->'labels'->>'team'`,
+		},
+		{
+			name:     "dotted key stays one map entry",
+			column:   "data",
+			mapField: "labels",
+			key:      "k8s.cluster",
+			expected: `"data"::jsonb->'labels'->>'k8s.cluster'`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f := newFormatter(pgdialect.New())
+			got := string(f.JSONExtractMapValue(tt.column, tt.mapField, tt.key))
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
 func TestJSONType(t *testing.T) {
 	tests := []struct {
 		name     string

frontend/src/api/generated/services/rules/index.ts

@@ -19,7 +19,9 @@ import type {
 
 import type {
 	CreateRule201,
+	CreateRuleView201,
 	DeleteRuleByIDPathParameters,
+	DeleteRuleViewPathParameters,
 	GetRuleByID200,
 	GetRuleByIDPathParameters,
 	GetRuleHistoryFilterKeys200,
@@ -40,13 +42,19 @@ import type {
 	GetRuleHistoryTopContributors200,
 	GetRuleHistoryTopContributorsParams,
 	GetRuleHistoryTopContributorsPathParameters,
+	ListRuleViews200,
 	ListRules200,
+	ListRulesV3200,
+	ListRulesV3Params,
 	PatchRuleByID200,
 	PatchRuleByIDPathParameters,
 	RenderErrorResponseDTO,
 	RuletypesPostableRuleDTO,
+	RuletypesPostableRuleViewDTO,
 	TestRule200,
 	UpdateRuleByIDPathParameters,
+	UpdateRuleView200,
+	UpdateRuleViewPathParameters,
 } from '../sigNoz.schemas';
 
 import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
@@ -73,7 +81,353 @@ const withQueryKey = <T extends object, K>(
 };
 
 /**
- * This endpoint lists all alert rules with their current evaluation state
+ * Returns every saved view in the calling user's org. Saved views are shared org-wide.
+ * @summary List rule saved views
+ */
+export const listRuleViews = (signal?: AbortSignal) => {
+	return GeneratedAPIInstance<ListRuleViews200>({
+		url: `/api/v2/rule_views`,
+		method: 'GET',
+		signal,
+	});
+};
+
+export const getListRuleViewsQueryKey = () => {
+	return [`/api/v2/rule_views`] as const;
+};
+
+export const getListRuleViewsQueryOptions = <
+	TData = Awaited<ReturnType<typeof listRuleViews>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(options?: {
+	query?: UseQueryOptions<
+		Awaited<ReturnType<typeof listRuleViews>>,
+		TError,
+		TData
+	>;
+}) => {
+	const { query: queryOptions } = options ?? {};
+
+	const queryKey = queryOptions?.queryKey ?? getListRuleViewsQueryKey();
+
+	const queryFn: QueryFunction<Awaited<ReturnType<typeof listRuleViews>>> = ({
+		signal,
+	}) => listRuleViews(signal);
+
+	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
+		Awaited<ReturnType<typeof listRuleViews>>,
+		TError,
+		TData
+	> & { queryKey: QueryKey };
+};
+
+export type ListRuleViewsQueryResult = NonNullable<
+	Awaited<ReturnType<typeof listRuleViews>>
+>;
+export type ListRuleViewsQueryError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary List rule saved views
+ */
+
+export function useListRuleViews<
+	TData = Awaited<ReturnType<typeof listRuleViews>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(options?: {
+	query?: UseQueryOptions<
+		Awaited<ReturnType<typeof listRuleViews>>,
+		TError,
+		TData
+	>;
+}): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
+	const queryOptions = getListRuleViewsQueryOptions(options);
+
+	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
+		queryKey: QueryKey;
+	};
+
+	return { ...query, queryKey: queryOptions.queryKey };
+}
+
+/**
+ * @summary List rule saved views
+ */
+export const invalidateListRuleViews = async (
+	queryClient: QueryClient,
+	options?: InvalidateOptions,
+): Promise<QueryClient> => {
+	await queryClient.invalidateQueries(
+		{ queryKey: getListRuleViewsQueryKey() },
+		options,
+	);
+
+	return queryClient;
+};
+
+/**
+ * Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.
+ * @summary Create rule saved view
+ */
+export const createRuleView = (
+	ruletypesPostableRuleViewDTO?: BodyType<RuletypesPostableRuleViewDTO>,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<CreateRuleView201>({
+		url: `/api/v2/rule_views`,
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		data: ruletypesPostableRuleViewDTO,
+		signal,
+	});
+};
+
+export const getCreateRuleViewMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof createRuleView>>,
+		TError,
+		{ data?: BodyType<RuletypesPostableRuleViewDTO> },
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof createRuleView>>,
+	TError,
+	{ data?: BodyType<RuletypesPostableRuleViewDTO> },
+	TContext
+> => {
+	const mutationKey = ['createRuleView'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof createRuleView>>,
+		{ data?: BodyType<RuletypesPostableRuleViewDTO> }
+	> = (props) => {
+		const { data } = props ?? {};
+
+		return createRuleView(data);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type CreateRuleViewMutationResult = NonNullable<
+	Awaited<ReturnType<typeof createRuleView>>
+>;
+export type CreateRuleViewMutationBody =
+	| BodyType<RuletypesPostableRuleViewDTO>
+	| undefined;
+export type CreateRuleViewMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Create rule saved view
+ */
+export const useCreateRuleView = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof createRuleView>>,
+		TError,
+		{ data?: BodyType<RuletypesPostableRuleViewDTO> },
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof createRuleView>>,
+	TError,
+	{ data?: BodyType<RuletypesPostableRuleViewDTO> },
+	TContext
+> => {
+	return useMutation(getCreateRuleViewMutationOptions(options));
+};
+/**
+ * Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.
+ * @summary Delete rule saved view
+ */
+export const deleteRuleView = (
+	{ id }: DeleteRuleViewPathParameters,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<void>({
+		url: `/api/v2/rule_views/${id}`,
+		method: 'DELETE',
+		signal,
+	});
+};
+
+export const getDeleteRuleViewMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof deleteRuleView>>,
+		TError,
+		{ pathParams: DeleteRuleViewPathParameters },
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof deleteRuleView>>,
+	TError,
+	{ pathParams: DeleteRuleViewPathParameters },
+	TContext
+> => {
+	const mutationKey = ['deleteRuleView'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof deleteRuleView>>,
+		{ pathParams: DeleteRuleViewPathParameters }
+	> = (props) => {
+		const { pathParams } = props ?? {};
+
+		return deleteRuleView(pathParams);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type DeleteRuleViewMutationResult = NonNullable<
+	Awaited<ReturnType<typeof deleteRuleView>>
+>;
+
+export type DeleteRuleViewMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Delete rule saved view
+ */
+export const useDeleteRuleView = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof deleteRuleView>>,
+		TError,
+		{ pathParams: DeleteRuleViewPathParameters },
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof deleteRuleView>>,
+	TError,
+	{ pathParams: DeleteRuleViewPathParameters },
+	TContext
+> => {
+	return useMutation(getDeleteRuleViewMutationOptions(options));
+};
+/**
+ * Replaces a saved view's name and data. Saved views are shared org-wide.
+ * @summary Update rule saved view
+ */
+export const updateRuleView = (
+	{ id }: UpdateRuleViewPathParameters,
+	ruletypesPostableRuleViewDTO?: BodyType<RuletypesPostableRuleViewDTO>,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<UpdateRuleView200>({
+		url: `/api/v2/rule_views/${id}`,
+		method: 'PUT',
+		headers: { 'Content-Type': 'application/json' },
+		data: ruletypesPostableRuleViewDTO,
+		signal,
+	});
+};
+
+export const getUpdateRuleViewMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof updateRuleView>>,
+		TError,
+		{
+			pathParams: UpdateRuleViewPathParameters;
+			data?: BodyType<RuletypesPostableRuleViewDTO>;
+		},
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof updateRuleView>>,
+	TError,
+	{
+		pathParams: UpdateRuleViewPathParameters;
+		data?: BodyType<RuletypesPostableRuleViewDTO>;
+	},
+	TContext
+> => {
+	const mutationKey = ['updateRuleView'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof updateRuleView>>,
+		{
+			pathParams: UpdateRuleViewPathParameters;
+			data?: BodyType<RuletypesPostableRuleViewDTO>;
+		}
+	> = (props) => {
+		const { pathParams, data } = props ?? {};
+
+		return updateRuleView(pathParams, data);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type UpdateRuleViewMutationResult = NonNullable<
+	Awaited<ReturnType<typeof updateRuleView>>
+>;
+export type UpdateRuleViewMutationBody =
+	| BodyType<RuletypesPostableRuleViewDTO>
+	| undefined;
+export type UpdateRuleViewMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Update rule saved view
+ */
+export const useUpdateRuleView = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof updateRuleView>>,
+		TError,
+		{
+			pathParams: UpdateRuleViewPathParameters;
+			data?: BodyType<RuletypesPostableRuleViewDTO>;
+		},
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof updateRuleView>>,
+	TError,
+	{
+		pathParams: UpdateRuleViewPathParameters;
+		data?: BodyType<RuletypesPostableRuleViewDTO>;
+	},
+	TContext
+> => {
+	return useMutation(getUpdateRuleViewMutationOptions(options));
+};
+/**
+ * This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.
+ * @deprecated
  * @summary List alert rules
  */
 export const listRules = (signal?: AbortSignal) => {
@@ -115,6 +469,7 @@ export type ListRulesQueryResult = NonNullable<
 export type ListRulesQueryError = ErrorType<RenderErrorResponseDTO>;
 
 /**
+ * @deprecated
  * @summary List alert rules
  */
 
@@ -134,6 +489,7 @@ export function useListRules<
 }
 
 /**
+ * @deprecated
  * @summary List alert rules
  */
 export const invalidateListRules = async (
@@ -1388,3 +1744,97 @@ export const useTestRule = <
 > => {
 	return useMutation(getTestRuleMutationOptions(options));
 };
+/**
+ * Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.
+ * @summary List alert rules (v3)
+ */
+export const listRulesV3 = (
+	params?: ListRulesV3Params,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<ListRulesV3200>({
+		url: `/api/v3/rules`,
+		method: 'GET',
+		params,
+		signal,
+	});
+};
+
+export const getListRulesV3QueryKey = (params?: ListRulesV3Params) => {
+	return [`/api/v3/rules`, ...(params ? [params] : [])] as const;
+};
+
+export const getListRulesV3QueryOptions = <
+	TData = Awaited<ReturnType<typeof listRulesV3>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	params?: ListRulesV3Params,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof listRulesV3>>,
+			TError,
+			TData
+		>;
+	},
+) => {
+	const { query: queryOptions } = options ?? {};
+
+	const queryKey = queryOptions?.queryKey ?? getListRulesV3QueryKey(params);
+
+	const queryFn: QueryFunction<Awaited<ReturnType<typeof listRulesV3>>> = ({
+		signal,
+	}) => listRulesV3(params, signal);
+
+	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
+		Awaited<ReturnType<typeof listRulesV3>>,
+		TError,
+		TData
+	> & { queryKey: QueryKey };
+};
+
+export type ListRulesV3QueryResult = NonNullable<
+	Awaited<ReturnType<typeof listRulesV3>>
+>;
+export type ListRulesV3QueryError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary List alert rules (v3)
+ */
+
+export function useListRulesV3<
+	TData = Awaited<ReturnType<typeof listRulesV3>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	params?: ListRulesV3Params,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof listRulesV3>>,
+			TError,
+			TData
+		>;
+	},
+): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
+	const queryOptions = getListRulesV3QueryOptions(params, options);
+
+	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
+		queryKey: QueryKey;
+	};
+
+	return { ...query, queryKey: queryOptions.queryKey };
+}
+
+/**
+ * @summary List alert rules (v3)
+ */
+export const invalidateListRulesV3 = async (
+	queryClient: QueryClient,
+	params?: ListRulesV3Params,
+	options?: InvalidateOptions,
+): Promise<QueryClient> => {
+	await queryClient.invalidateQueries(
+		{ queryKey: getListRulesV3QueryKey(params) },
+		options,
+	);
+
+	return queryClient;
+};

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -10060,6 +10060,149 @@ export interface RuletypesGettableTestRuleDTO {
 	message?: string;
 }
 
+export interface RuletypesLabelPairDTO {
+	/**
+	 * @type string
+	 */
+	key: string;
+	/**
+	 * @type string
+	 */
+	value: string;
+}
+
+export enum RuletypesListOrderDTO {
+	asc = 'asc',
+	desc = 'desc',
+}
+export enum RuletypesListSortDTO {
+	updated_at = 'updated_at',
+	created_at = 'created_at',
+	name = 'name',
+	state = 'state',
+	severity = 'severity',
+}
+export type RuletypesListableRuleDTOLabels = { [key: string]: string };
+
+export enum RuletypesRuleTypeDTO {
+	threshold_rule = 'threshold_rule',
+	promql_rule = 'promql_rule',
+	anomaly_rule = 'anomaly_rule',
+}
+export interface RuletypesListableRuleDTO {
+	/**
+	 * @type string
+	 */
+	alert: string;
+	alertType: RuletypesAlertTypeDTO;
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	createdAt?: string;
+	/**
+	 * @type string
+	 */
+	createdBy?: string;
+	/**
+	 * @type string
+	 */
+	description?: string;
+	/**
+	 * @type boolean
+	 */
+	disabled?: boolean;
+	/**
+	 * @type string
+	 */
+	id: string;
+	/**
+	 * @type object
+	 */
+	labels?: RuletypesListableRuleDTOLabels;
+	ruleType: RuletypesRuleTypeDTO;
+	state: RuletypesAlertStateDTO;
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	updatedAt?: string;
+	/**
+	 * @type string
+	 */
+	updatedBy?: string;
+}
+
+export interface RuletypesRuleViewDataDTO {
+	order?: RuletypesListOrderDTO;
+	/**
+	 * @type string
+	 */
+	query?: string;
+	sort?: RuletypesListSortDTO;
+	/**
+	 * @type array
+	 */
+	states?: string[];
+	/**
+	 * @type string
+	 */
+	version: string;
+}
+
+export interface RuletypesRuleViewDTO {
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	createdAt?: string;
+	data: RuletypesRuleViewDataDTO;
+	/**
+	 * @type string
+	 */
+	id: string;
+	/**
+	 * @type string
+	 */
+	name: string;
+	/**
+	 * @type string
+	 */
+	orgId: string;
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	updatedAt?: string;
+}
+
+export interface RuletypesListableRuleViewsDTO {
+	/**
+	 * @type array
+	 */
+	views: RuletypesRuleViewDTO[];
+}
+
+export interface RuletypesListableRulesDTO {
+	/**
+	 * @type array
+	 */
+	labels: RuletypesLabelPairDTO[];
+	/**
+	 * @type array
+	 */
+	reservedKeywords: string[];
+	/**
+	 * @type array
+	 */
+	rules: RuletypesListableRuleDTO[];
+	/**
+	 * @type integer
+	 * @format int64
+	 */
+	total: number;
+}
+
 export interface RuletypesRenotifyDTO {
 	/**
 	 * @type array,null
@@ -10156,11 +10299,6 @@ export interface RuletypesRuleConditionDTO {
 	thresholds?: RuletypesRuleThresholdDataDTO;
 }
 
-export enum RuletypesRuleTypeDTO {
-	threshold_rule = 'threshold_rule',
-	promql_rule = 'promql_rule',
-	anomaly_rule = 'anomaly_rule',
-}
 export interface RuletypesPostableRuleDTO {
 	/**
 	 * @type string
@@ -10213,6 +10351,14 @@ export interface RuletypesPostableRuleDTO {
 	version?: string;
 }
 
+export interface RuletypesPostableRuleViewDTO {
+	data: RuletypesRuleViewDataDTO;
+	/**
+	 * @type string
+	 */
+	name: string;
+}
+
 export type RuletypesRuleDTOAnnotations = { [key: string]: string };
 
 export type RuletypesRuleDTOLabels = { [key: string]: string };
@@ -13493,6 +13639,36 @@ export type GetUsersByRoleID200 = {
 	status: string;
 };
 
+export type ListRuleViews200 = {
+	data: RuletypesListableRuleViewsDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type CreateRuleView201 = {
+	data: RuletypesRuleViewDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
+export type DeleteRuleViewPathParameters = {
+	id: string;
+};
+export type UpdateRuleViewPathParameters = {
+	id: string;
+};
+export type UpdateRuleView200 = {
+	data: RuletypesRuleViewDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
 export type ListRules200 = {
 	/**
 	 * @type array
@@ -14054,6 +14230,45 @@ export type GetMetricDashboardsV2200 = {
 	status: string;
 };
 
+export type ListRulesV3Params = {
+	/**
+	 * @type string
+	 * @description undefined
+	 */
+	query?: string;
+	/**
+	 * @type array
+	 * @description undefined
+	 */
+	states?: string[];
+	/**
+	 * @description undefined
+	 */
+	sort?: RuletypesListSortDTO;
+	/**
+	 * @description undefined
+	 */
+	order?: RuletypesListOrderDTO;
+	/**
+	 * @type integer
+	 * @description undefined
+	 */
+	limit?: number;
+	/**
+	 * @type integer
+	 * @description undefined
+	 */
+	offset?: number;
+};
+
+export type ListRulesV3200 = {
+	data: RuletypesListableRulesDTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
 export type GetFlamegraphPathParameters = {
 	traceID: string;
 };

frontend/src/api/querySuggestions/__tests__/getFieldKeySuggestions.test.ts

@@ -37,12 +37,13 @@ describe('getFieldKeySuggestions', () => {
 		const response = keysResponse();
 		mockedAIKeys.mockResolvedValue(response);
 
-		const filterConfig = { searchText: 'llm' };
+		const fieldKeysConfig = { searchText: 'llm' };
+		const abortSignal = new AbortController().signal;
 
 		await expect(
-			getFieldKeySuggestions(filterConfig, 'builder_ai_query'),
+			getFieldKeySuggestions(fieldKeysConfig, 'builder_ai_query', abortSignal),
 		).resolves.toBe(response);
-		expect(mockedAIKeys).toHaveBeenCalledWith(filterConfig);
+		expect(mockedAIKeys).toHaveBeenCalledWith(fieldKeysConfig, abortSignal);
 		expect(mockedGenericKeys).not.toHaveBeenCalled();
 	});
 
@@ -58,15 +59,16 @@ describe('getFieldKeySuggestions', () => {
 		const response = keysResponse();
 		mockedGenericKeys.mockResolvedValue(response);
 
-		const filterConfig = {
+		const fieldKeysConfig = {
 			signal: TelemetrytypesSignalDTO.traces,
 			searchText: 'svc',
 		};
+		const abortSignal = new AbortController().signal;
 
 		await expect(
-			getFieldKeySuggestions(filterConfig, builderQueryType),
+			getFieldKeySuggestions(fieldKeysConfig, builderQueryType, abortSignal),
 		).resolves.toBe(response);
-		expect(mockedGenericKeys).toHaveBeenCalledWith(filterConfig);
+		expect(mockedGenericKeys).toHaveBeenCalledWith(fieldKeysConfig, abortSignal);
 		expect(mockedAIKeys).not.toHaveBeenCalled();
 	});
 });

frontend/src/api/querySuggestions/__tests__/getFieldValueSuggestions.test.ts

@@ -34,12 +34,13 @@ describe('getFieldValueSuggestions', () => {
 		const response = valuesResponse();
 		mockedAIValues.mockResolvedValue(response);
 
-		const filterConfig = { name: 'gen_ai.request.model', searchText: 'gpt' };
+		const fieldValuesConfig = { name: 'gen_ai.request.model', searchText: 'gpt' };
+		const abortSignal = new AbortController().signal;
 
 		await expect(
-			getFieldValueSuggestions(filterConfig, 'builder_ai_query'),
+			getFieldValueSuggestions(fieldValuesConfig, 'builder_ai_query', abortSignal),
 		).resolves.toBe(response);
-		expect(mockedAIValues).toHaveBeenCalledWith(filterConfig);
+		expect(mockedAIValues).toHaveBeenCalledWith(fieldValuesConfig, abortSignal);
 		expect(mockedGenericValues).not.toHaveBeenCalled();
 	});
 
@@ -55,16 +56,20 @@ describe('getFieldValueSuggestions', () => {
 		const response = valuesResponse();
 		mockedGenericValues.mockResolvedValue(response);
 
-		const filterConfig = {
+		const fieldValuesConfig = {
 			signal: TelemetrytypesSignalDTO.traces,
 			name: 'service.name',
 			searchText: 'front',
 		};
+		const abortSignal = new AbortController().signal;
 
 		await expect(
-			getFieldValueSuggestions(filterConfig, builderQueryType),
+			getFieldValueSuggestions(fieldValuesConfig, builderQueryType, abortSignal),
 		).resolves.toBe(response);
-		expect(mockedGenericValues).toHaveBeenCalledWith(filterConfig);
+		expect(mockedGenericValues).toHaveBeenCalledWith(
+			fieldValuesConfig,
+			abortSignal,
+		);
 		expect(mockedAIValues).not.toHaveBeenCalled();
 	});
 });

frontend/src/api/querySuggestions/getFieldKeySuggestions.ts

@@ -2,12 +2,13 @@ import { getAIObservabilityFieldsKeys } from 'api/generated/services/ai-observab
 import { getFieldsKeys } from 'api/generated/services/fields';
 import type { BuilderQueryType } from 'types/api/v5/queryRange';
 
-import { FieldKeysFilterConfig, FieldKeysResponse } from './types';
+import { FieldKeysConfig, FieldKeysResponse } from './types';
 
 export const getFieldKeySuggestions = (
-	filterConfig: FieldKeysFilterConfig,
+	fieldKeysConfig: FieldKeysConfig,
 	builderQueryType?: BuilderQueryType,
+	abortSignal?: AbortSignal,
 ): Promise<FieldKeysResponse> =>
 	builderQueryType === 'builder_ai_query'
-		? getAIObservabilityFieldsKeys(filterConfig)
-		: getFieldsKeys(filterConfig);
+		? getAIObservabilityFieldsKeys(fieldKeysConfig, abortSignal)
+		: getFieldsKeys(fieldKeysConfig, abortSignal);

frontend/src/api/querySuggestions/getFieldValueSuggestions.ts

@@ -2,12 +2,13 @@ import { getAIObservabilityFieldsValues } from 'api/generated/services/ai-observ
 import { getFieldsValues } from 'api/generated/services/fields';
 import type { BuilderQueryType } from 'types/api/v5/queryRange';
 
-import { FieldValuesFilterConfig, FieldValuesResponse } from './types';
+import { FieldValuesConfig, FieldValuesResponse } from './types';
 
 export const getFieldValueSuggestions = (
-	filterConfig: FieldValuesFilterConfig,
+	fieldValuesConfig: FieldValuesConfig,
 	builderQueryType?: BuilderQueryType,
+	abortSignal?: AbortSignal,
 ): Promise<FieldValuesResponse> =>
 	builderQueryType === 'builder_ai_query'
-		? getAIObservabilityFieldsValues(filterConfig)
-		: getFieldsValues(filterConfig);
+		? getAIObservabilityFieldsValues(fieldValuesConfig, abortSignal)
+		: getFieldsValues(fieldValuesConfig, abortSignal);

frontend/src/api/querySuggestions/types.ts

@@ -1,7 +1,7 @@
 import type {
 	GetAIObservabilityFieldsKeys200,
-	GetAIObservabilityFieldsKeysParams,
 	GetAIObservabilityFieldsValues200,
+	GetAIObservabilityFieldsKeysParams,
 	GetAIObservabilityFieldsValuesParams,
 	GetFieldsKeys200,
 	GetFieldsKeysParams,
@@ -9,14 +9,19 @@ import type {
 	GetFieldsValuesParams,
 } from 'api/generated/services/sigNoz.schemas';
 
-export type FieldKeysFilterConfig =
+export type FieldKeysConfig =
 	| GetFieldsKeysParams
 	| GetAIObservabilityFieldsKeysParams;
 
-export type FieldValuesFilterConfig =
+export type FieldValuesConfig =
 	| GetFieldsValuesParams
 	| GetAIObservabilityFieldsValuesParams;
 
+export type FieldKeysConfigProp = Omit<
+	FieldKeysConfig,
+	'signal' | 'searchText'
+>;
+
 export type FieldKeysResponse =
 	| GetFieldsKeys200
 	| GetAIObservabilityFieldsKeys200;

frontend/src/components/FieldsSelector/FieldsSelector.tsx

@@ -6,7 +6,8 @@ import useDebouncedFn from 'hooks/useDebouncedFunction';
 import { Check, TableColumnsSplit, X } from '@signozhq/icons';
 import { FloatingPanel } from 'periscope/components/FloatingPanel';
 import { buildCompositeKey } from 'container/OptionsMenu/utils';
-import { TelemetryFieldKey } from 'types/api/v5/queryRange';
+import { FieldKeysConfigProp } from 'api/querySuggestions/types';
+import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
 import AddedFields from './AddedFields';
@@ -31,6 +32,9 @@ interface FieldsSelectorProps {
 	// Lets users add a free-typed field which
 	// does not show up in the suggestions
 	allowCustomFields?: boolean;
+	fieldKeysConfig?: FieldKeysConfigProp;
+	builderQueryType?: BuilderQueryType;
+	extraFields?: TelemetryFieldKey[];
 	width?: number;
 	height?: number;
 	defaultPosition?: { x: number; y: number };
@@ -50,6 +54,9 @@ function FieldsSelectorContent({
 	maxFields,
 	requiredFields,
 	allowCustomFields,
+	fieldKeysConfig,
+	builderQueryType,
+	extraFields,
 	width = DEFAULT_PANEL_WIDTH,
 	height,
 	defaultPosition,
@@ -158,6 +165,9 @@ function FieldsSelectorContent({
 					onAdd={handleAdd}
 					isAtLimit={isAtLimit}
 					allowCustomFields={allowCustomFields}
+					fieldKeysConfig={fieldKeysConfig}
+					builderQueryType={builderQueryType}
+					extraFields={extraFields}
 				/>
 
 				{hasUnsavedChanges && (

frontend/src/components/FieldsSelector/OtherFields.tsx

@@ -3,18 +3,22 @@ import { Button } from '@signozhq/ui/button';
 import { Skeleton } from 'antd';
 import cx from 'classnames';
 import OverlayScrollbar from 'components/OverlayScrollbar/OverlayScrollbar';
-import { REACT_QUERY_KEY } from 'constants/reactQueryKeys';
 import { buildCompositeKey } from 'container/OptionsMenu/utils';
-import { useGetQueryKeySuggestions } from 'hooks/querySuggestions/useGetQueryKeySuggestions';
+import { FieldKeysConfigProp } from 'api/querySuggestions/types';
+import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
 import {
+	BuilderQueryType,
 	FieldContext,
 	SignalType,
 	TelemetryFieldKey,
 } from 'types/api/v5/queryRange';
-import { DataSource } from 'types/common/queryBuilder';
+import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
+import { mergeExtraFields } from 'utils/extraFields';
 
 import styles from './FieldsSelector.module.scss';
 
+const EMPTY_EXTRA_FIELDS: TelemetryFieldKey[] = [];
+
 interface OtherFieldsProps {
 	signal: DataSource;
 	debouncedInputValue: string;
@@ -22,6 +26,9 @@ interface OtherFieldsProps {
 	onAdd: (field: TelemetryFieldKey) => void;
 	isAtLimit: boolean;
 	allowCustomFields?: boolean;
+	fieldKeysConfig?: FieldKeysConfigProp;
+	builderQueryType?: BuilderQueryType;
+	extraFields?: TelemetryFieldKey[];
 }
 
 function OtherFields({
@@ -31,26 +38,26 @@ function OtherFields({
 	onAdd,
 	isAtLimit,
 	allowCustomFields,
+	fieldKeysConfig,
+	builderQueryType,
+	extraFields = EMPTY_EXTRA_FIELDS,
 }: OtherFieldsProps): JSX.Element {
-	const { data, isFetching } = useGetQueryKeySuggestions(
+	const { data: fetchedFields, isFetching } = useFieldKeysSuggestion(
 		{
-			signal,
+			...fieldKeysConfig,
+			signal: DATA_SOURCE_TO_SIGNAL[signal],
 			searchText: debouncedInputValue,
 		},
-		{
-			queryKey: [
-				REACT_QUERY_KEY.GET_FIELDS_SELECTOR_SUGGESTIONS,
-				signal,
-				debouncedInputValue,
-			],
-			enabled: true,
-		},
+		builderQueryType,
 	);
 
 	const otherFields = useMemo<TelemetryFieldKey[]>(() => {
-		const rawSuggestions = Object.values(data?.data.data.keys || {}).flat();
+		const search = debouncedInputValue.trim().toLowerCase();
 		// Normalize: synthesize `key` once so downstream reads can trust it.
-		const suggestions: TelemetryFieldKey[] = rawSuggestions.map((attr) => ({
+		const suggestions: TelemetryFieldKey[] = mergeExtraFields(
+			extraFields.filter((field) => field.name.toLowerCase().includes(search)),
+			fetchedFields ?? [],
+		).map((attr) => ({
 			...attr,
 			key: buildCompositeKey(attr.name, attr.fieldContext, attr.fieldDataType),
 			signal: attr.signal as SignalType,
@@ -87,7 +94,13 @@ function OtherFields({
 			key: buildCompositeKey(typed, ''),
 		};
 		return [customField, ...available];
-	}, [data, addedFields, allowCustomFields, debouncedInputValue]);
+	}, [
+		extraFields,
+		fetchedFields,
+		addedFields,
+		allowCustomFields,
+		debouncedInputValue,
+	]);
 
 	if (isFetching) {
 		return (

frontend/src/components/FieldsSelector/__tests__/FieldsSelector.test.tsx

@@ -1,11 +1,17 @@
 import { act, fireEvent, render, screen } from 'tests/test-utils';
-import { useGetQueryKeySuggestions } from 'hooks/querySuggestions/useGetQueryKeySuggestions';
 import { TelemetryFieldKey } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
 import FieldsSelector from '../FieldsSelector';
+import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
 
-jest.mock('hooks/querySuggestions/useGetQueryKeySuggestions');
+jest.mock('hooks/querySuggestions/useFieldKeysSuggestion', () => ({
+	useFieldKeysSuggestion: jest.fn(() => ({
+		data: undefined,
+		isFetching: false,
+		isFetched: true,
+	})),
+}));
 
 jest.mock('@signozhq/ui/sonner', () => ({
 	...jest.requireActual('@signozhq/ui/sonner'),
@@ -21,22 +27,15 @@ jest.mock('periscope/components/FloatingPanel', () => ({
 }));
 
 const mockSuggestions = (names: string[]): void => {
-	(useGetQueryKeySuggestions as jest.Mock).mockReturnValue({
-		data: {
-			data: {
-				data: {
-					keys: {
-						attributeKeys: names.map((name) => ({
-							name,
-							signal: 'logs',
-							fieldDataType: 'string',
-							fieldContext: '',
-						})),
-					},
-				},
-			},
-		},
+	(useFieldKeysSuggestion as jest.Mock).mockReturnValue({
+		data: names.map((name) => ({
+			name,
+			signal: 'logs',
+			fieldDataType: 'string',
+			fieldContext: '',
+		})),
 		isFetching: false,
+		isFetched: true,
 	});
 };
 

frontend/src/components/FieldsSelector/__tests__/OtherFields.test.tsx

@@ -1,29 +1,30 @@
 import { fireEvent, render, screen } from 'tests/test-utils';
-import { useGetQueryKeySuggestions } from 'hooks/querySuggestions/useGetQueryKeySuggestions';
-import { TelemetryFieldKey } from 'types/api/v5/queryRange';
-import { DataSource } from 'types/common/queryBuilder';
+import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
+import { FieldKeysConfigProp } from 'api/querySuggestions/types';
+import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
+import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
+import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
 
 import OtherFields from '../OtherFields';
 
-jest.mock('hooks/querySuggestions/useGetQueryKeySuggestions');
+jest.mock('hooks/querySuggestions/useFieldKeysSuggestion', () => ({
+	useFieldKeysSuggestion: jest.fn(() => ({
+		data: undefined,
+		isFetching: false,
+		isFetched: true,
+	})),
+}));
 
 const mockSuggestions = (names: string[]): void => {
-	(useGetQueryKeySuggestions as jest.Mock).mockReturnValue({
-		data: {
-			data: {
-				data: {
-					keys: {
-						attributeKeys: names.map((name) => ({
-							name,
-							signal: 'logs',
-							fieldDataType: 'string',
-							fieldContext: '',
-						})),
-					},
-				},
-			},
-		},
+	(useFieldKeysSuggestion as jest.Mock).mockReturnValue({
+		data: names.map((name) => ({
+			name,
+			signal: 'logs',
+			fieldDataType: 'string',
+			fieldContext: '',
+		})),
 		isFetching: false,
+		isFetched: true,
 	});
 };
 
@@ -82,7 +83,6 @@ describe('OtherFields — custom (free-typed) option', () => {
 		mockSuggestions(['orderId']);
 		renderOtherFields({ debouncedInputValue: 'orderid' });
 
-		// the real suggestion shows, the lowercased custom name does not
 		expect(screen.getByText('orderId')).toBeInTheDocument();
 		expect(screen.queryByText('orderid')).not.toBeInTheDocument();
 	});
@@ -116,10 +116,126 @@ describe('OtherFields — custom (free-typed) option', () => {
 	it('shows the custom option at the field limit but hides its Add button', () => {
 		renderOtherFields({ debouncedInputValue: 'unknown.a.b.c', isAtLimit: true });
 
-		// same as every other row at the limit: name shown, no Add button
 		expect(screen.getByText('unknown.a.b.c')).toBeInTheDocument();
 		expect(
 			screen.queryByRole('button', { name: /add/i }),
 		).not.toBeInTheDocument();
 	});
 });
+
+describe('OtherFields — field keys config', () => {
+	const pool: TelemetryFieldKey[] = [
+		{ name: 'total_tokens', fieldContext: 'trace', fieldDataType: 'float64' },
+		{ name: 'llm_call_count', fieldContext: 'trace', fieldDataType: 'float64' },
+	];
+
+	const fieldKeysConfig: FieldKeysConfigProp = {
+		fieldContext: TelemetrytypesFieldContextDTO.trace,
+	};
+	const builderQueryType: BuilderQueryType = 'builder_ai_query';
+
+	const mockPool = (fields: TelemetryFieldKey[]): void => {
+		(useFieldKeysSuggestion as jest.Mock).mockReturnValue({
+			data: fields,
+			isFetching: false,
+			isFetched: true,
+		});
+	};
+
+	beforeEach(() => {
+		mockPool(pool);
+	});
+
+	it('lists the pool it is handed', () => {
+		renderOtherFields({
+			fieldKeysConfig,
+			builderQueryType,
+			allowCustomFields: false,
+		});
+
+		expect(screen.getByText('total_tokens')).toBeInTheDocument();
+		expect(screen.getByText('llm_call_count')).toBeInTheDocument();
+	});
+
+	it('forwards the fetch params and search to the shared keys hook', () => {
+		renderOtherFields({
+			fieldKeysConfig,
+			builderQueryType,
+			allowCustomFields: false,
+			debouncedInputValue: 'llm',
+		});
+
+		expect(useFieldKeysSuggestion).toHaveBeenCalledWith(
+			{
+				...fieldKeysConfig,
+				signal: DATA_SOURCE_TO_SIGNAL[DataSource.LOGS],
+				searchText: 'llm',
+			},
+			builderQueryType,
+		);
+	});
+
+	it('lists extra fields the keys endpoint never returns', () => {
+		mockPool([{ name: 'total_tokens' } as TelemetryFieldKey]);
+
+		renderOtherFields({
+			fieldKeysConfig,
+			builderQueryType,
+			extraFields: [{ name: 'last_activity_time' } as TelemetryFieldKey],
+			allowCustomFields: false,
+		});
+
+		expect(screen.getByText('last_activity_time')).toBeInTheDocument();
+		expect(screen.getByText('total_tokens')).toBeInTheDocument();
+	});
+
+	it('filters extra fields by search text', () => {
+		mockPool([]);
+
+		renderOtherFields({
+			fieldKeysConfig,
+			builderQueryType,
+			extraFields: [
+				{ name: 'last_activity_time' } as TelemetryFieldKey,
+				{ name: 'timestamp' } as TelemetryFieldKey,
+			],
+			debouncedInputValue: 'activity',
+			allowCustomFields: false,
+		});
+
+		expect(screen.getByText('last_activity_time')).toBeInTheDocument();
+		expect(screen.queryByText('timestamp')).not.toBeInTheDocument();
+	});
+
+	it('keeps a fetched key whose name does not contain the search text', () => {
+		mockPool([
+			{ name: 'service.name', fieldContext: 'resource' } as TelemetryFieldKey,
+		]);
+
+		renderOtherFields({
+			debouncedInputValue: 'resource.service',
+			allowCustomFields: false,
+		});
+
+		expect(screen.getByText('service.name')).toBeInTheDocument();
+	});
+
+	it('omits pool fields that are already added', () => {
+		renderOtherFields({
+			fieldKeysConfig,
+			builderQueryType,
+			allowCustomFields: false,
+			addedFields: [
+				{
+					name: 'total_tokens',
+					fieldContext: 'trace',
+					fieldDataType: 'float64',
+					key: 'trace:total_tokens:float64',
+				},
+			],
+		});
+
+		expect(screen.queryByText('total_tokens')).not.toBeInTheDocument();
+		expect(screen.getByText('llm_call_count')).toBeInTheDocument();
+	});
+});

frontend/src/components/OrderBy/ListViewOrderBy.tsx

@@ -1,16 +1,23 @@
 import { useEffect, useRef, useState } from 'react';
-import { useQuery } from 'react-query';
 import { Select, Spin } from 'antd';
-import { getKeySuggestions } from 'api/querySuggestions/getKeySuggestions';
-import { QueryKeyDataSuggestionsProps } from 'types/api/querySuggestions/types';
-import { DataSource } from 'types/common/queryBuilder';
+import { FieldKeysConfigProp } from 'api/querySuggestions/types';
+import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
+import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
+import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
 
 import './ListViewOrderBy.styles.scss';
 
+const DEFAULT_EXTRA_FIELDS: TelemetryFieldKey[] = [
+	{ name: 'timestamp' } as TelemetryFieldKey,
+];
+
 interface ListViewOrderByProps {
 	value: string;
 	onChange: (value: string) => void;
 	dataSource: DataSource;
+	fieldKeysConfig?: FieldKeysConfigProp;
+	builderQueryType?: BuilderQueryType;
+	extraFields?: TelemetryFieldKey[];
 }
 
 // Loader component for the dropdown when loading or no results
@@ -26,6 +33,9 @@ function ListViewOrderBy({
 	value,
 	onChange,
 	dataSource,
+	fieldKeysConfig,
+	builderQueryType,
+	extraFields = DEFAULT_EXTRA_FIELDS,
 }: ListViewOrderByProps): JSX.Element {
 	const [searchInput, setSearchInput] = useState('');
 	const [debouncedInput, setDebouncedInput] = useState('');
@@ -34,17 +44,14 @@ function ListViewOrderBy({
 	>([]);
 	const debounceTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
 
-	// Fetch key suggestions based on debounced input
-	const { data, isLoading } = useQuery({
-		queryKey: ['orderByKeySuggestions', dataSource, debouncedInput],
-		queryFn: async () => {
-			const response = await getKeySuggestions({
-				signal: dataSource,
-				searchText: debouncedInput,
-			});
-			return response.data;
+	const { data, isLoading } = useFieldKeysSuggestion(
+		{
+			...fieldKeysConfig,
+			signal: DATA_SOURCE_TO_SIGNAL[dataSource],
+			searchText: debouncedInput,
 		},
-	});
+		builderQueryType,
+	);
 
 	useEffect(
 		() => (): void => {
@@ -55,24 +62,24 @@ function ListViewOrderBy({
 		[],
 	);
 
+	const extraKeysSignature = extraFields.map((field) => field.name).join(',');
+
 	// Update options when API data changes
 	useEffect(() => {
-		const rawKeys: QueryKeyDataSuggestionsProps[] = data?.data?.keys
-			? Object.values(data.data?.keys).flat()
-			: [];
+		const keyNames = (data ?? []).map((field) => field.name);
+		const search = searchInput.trim().toLowerCase();
+		const extraMatches = extraKeysSignature
+			.split(',')
+			.filter((key) => key.length > 0 && key.toLowerCase().includes(search));
+		const uniqueKeys = [...new Set([...extraMatches, ...keyNames])];
 
-		const keyNames = rawKeys.map((key) => key.name);
-		const uniqueKeys = [
-			...new Set(searchInput ? keyNames : ['timestamp', ...keyNames]),
-		];
-
-		const updatedOptions = uniqueKeys.flatMap((key) => [
-			{ label: `${key} (desc)`, value: `${key}:desc` },
-			{ label: `${key} (asc)`, value: `${key}:asc` },
-		]);
-
-		setSelectOptions(updatedOptions);
-	}, [data, searchInput]);
+		setSelectOptions(
+			uniqueKeys.flatMap((key) => [
+				{ label: `${key} (desc)`, value: `${key}:desc` },
+				{ label: `${key} (asc)`, value: `${key}:asc` },
+			]),
+		);
+	}, [data, searchInput, extraKeysSignature]);
 
 	// Handle search input with debounce
 	const handleSearch = (input: string): void => {

frontend/src/components/OrderBy/__tests__/ListViewOrderBy.test.tsx

@@ -0,0 +1,169 @@
+import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
+import { ENVIRONMENT } from 'constants/env';
+import {
+	TRACE_VIEW_BUILDER_QUERY_TYPE,
+	TRACE_VIEW_FIELD_KEYS,
+	TRACE_VIEW_ORDER_BY_EXTRA_FIELDS,
+} from 'container/LLMObservability/Explorer/constants';
+import { server } from 'mocks-server/server';
+import { rest } from 'msw';
+import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
+import { DataSource } from 'types/common/queryBuilder';
+
+import ListViewOrderBy from '../ListViewOrderBy';
+
+const seenAI: URLSearchParams[] = [];
+const seenGeneric: URLSearchParams[] = [];
+
+const mockAIKeys = (names: string[]): void => {
+	server.use(
+		rest.get(
+			`${ENVIRONMENT.baseURL}/api/v1/ai_observability/fields/keys`,
+			(req, res, ctx) => {
+				seenAI.push(req.url.searchParams);
+				return res(
+					ctx.status(200),
+					ctx.json({
+						status: 'success',
+						data: {
+							complete: true,
+							keys: Object.fromEntries(names.map((name) => [name, [{ name }]])),
+						},
+					}),
+				);
+			},
+		),
+	);
+};
+
+const mockGenericKeys = (names: string[]): void => {
+	server.use(
+		rest.get(`${ENVIRONMENT.baseURL}/api/v1/fields/keys`, (req, res, ctx) => {
+			seenGeneric.push(req.url.searchParams);
+			return res(
+				ctx.status(200),
+				ctx.json({
+					status: 'success',
+					data: {
+						complete: true,
+						keys: Object.fromEntries(names.map((name) => [name, [{ name }]])),
+					},
+				}),
+			);
+		}),
+	);
+};
+
+const openDropdown = (): void => {
+	fireEvent.mouseDown(screen.getByRole('combobox'));
+};
+
+const getOptionLabels = (): string[] =>
+	Array.from(document.querySelectorAll('.ant-select-item-option-content')).map(
+		(node) => node.textContent ?? '',
+	);
+
+describe('ListViewOrderBy', () => {
+	beforeEach(() => {
+		seenAI.length = 0;
+		seenGeneric.length = 0;
+	});
+
+	it('reads the ai_observability trace context for an AI query', async () => {
+		mockAIKeys(['total_tokens']);
+
+		render(
+			<ListViewOrderBy
+				value="last_activity_time:desc"
+				onChange={jest.fn()}
+				dataSource={DataSource.TRACES}
+				fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
+				builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
+				extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
+			/>,
+		);
+
+		await waitFor(() => {
+			expect(seenAI).toHaveLength(1);
+		});
+		expect(seenAI[0]?.get('searchText')).toBe('');
+		expect(seenAI[0]?.get('fieldContext')).toBe(
+			TelemetrytypesFieldContextDTO.trace,
+		);
+		expect(seenGeneric).toHaveLength(0);
+	});
+
+	it('offers the extra keys alongside the ones the endpoint reports', async () => {
+		mockAIKeys(['total_tokens']);
+
+		render(
+			<ListViewOrderBy
+				value="last_activity_time:desc"
+				onChange={jest.fn()}
+				dataSource={DataSource.TRACES}
+				fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
+				builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
+				extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
+			/>,
+		);
+
+		openDropdown();
+
+		await waitFor(() => {
+			expect(getOptionLabels()).toContain('total_tokens (desc)');
+		});
+		expect(getOptionLabels()).toContain('last_activity_time (asc)');
+	});
+
+	it('keeps a matching extra key while searching', async () => {
+		mockAIKeys([]);
+
+		render(
+			<ListViewOrderBy
+				value="last_activity_time:desc"
+				onChange={jest.fn()}
+				dataSource={DataSource.TRACES}
+				fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
+				builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
+				extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
+			/>,
+		);
+
+		await waitFor(() => {
+			expect(seenAI.length).toBeGreaterThan(0);
+		});
+
+		openDropdown();
+		fireEvent.change(screen.getByRole('combobox'), {
+			target: { value: 'activity' },
+		});
+
+		await waitFor(() => {
+			expect(getOptionLabels()).toContain('last_activity_time (desc)');
+		});
+	});
+
+	it('defaults to timestamp and the generic endpoint', async () => {
+		mockGenericKeys(['service.name']);
+
+		render(
+			<ListViewOrderBy
+				value="timestamp:desc"
+				onChange={jest.fn()}
+				dataSource={DataSource.TRACES}
+			/>,
+		);
+
+		await waitFor(() => {
+			expect(seenGeneric).toHaveLength(1);
+		});
+		expect(seenGeneric[0]?.get('signal')).toBe(DataSource.TRACES);
+		expect(seenGeneric[0]?.get('searchText')).toBe('');
+
+		openDropdown();
+
+		await waitFor(() => {
+			expect(getOptionLabels()).toContain('timestamp (desc)');
+		});
+	});
+});

frontend/src/constants/localStorage.ts

@@ -12,6 +12,8 @@ export enum LOCALSTORAGE {
 	GRAPH_VISIBILITY_STATES = 'GRAPH_VISIBILITY_STATES',
 	TRACES_LIST_COLUMNS = 'TRACES_LIST_COLUMNS',
 	TRACES_VIEW_COLUMNS = 'TRACES_VIEW_COLUMNS',
+	AI_OBSERVABILITY_TRACE_VIEW_COLUMNS = 'AI_OBSERVABILITY_TRACE_VIEW_COLUMNS',
+	AI_OBSERVABILITY_LIST_COLUMNS = 'AI_OBSERVABILITY_LIST_COLUMNS',
 	LOGS_LIST_COLUMNS = 'LOGS_LIST_COLUMNS',
 	LOGS_LIST_COLUMN_SIZING = 'LOGS_LIST_COLUMN_SIZING',
 	LOGGED_IN_USER_NAME = 'LOGGED_IN_USER_NAME',

frontend/src/constants/reactQueryKeys.ts

@@ -106,8 +106,8 @@ export const REACT_QUERY_KEY = {
 	// Dashboard Grid Card Query Keys
 	DASHBOARD_GRID_CARD_QUERY_RANGE: 'DASHBOARD_GRID_CARD_QUERY_RANGE',
 
-	// Fields Selector Query Keys
-	GET_FIELDS_SELECTOR_SUGGESTIONS: 'GET_FIELDS_SELECTOR_SUGGESTIONS',
+	// Field Keys Suggestion Query Keys
+	FIELD_KEYS_SUGGESTION: 'FIELD_KEYS_SUGGESTION',
 
 	// AI Assistant Query Keys
 	AI_ASSISTANT_EMPTY_STATE_CHIPS: 'AI_ASSISTANT_EMPTY_STATE_CHIPS',

frontend/src/container/LLMObservability/Explorer/Controls/index.tsx

@@ -1,10 +1,12 @@
 import { memo, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Settings } from '@signozhq/icons';
+import { FieldKeysConfigProp } from 'api/querySuggestions/types';
 import FieldsSelector from 'components/FieldsSelector';
 import Controls, { ControlsProps } from 'container/Controls';
 import { OptionsMenuConfig } from 'container/OptionsMenu/types';
 import useQueryPagination from 'hooks/queryPagination/useQueryPagination';
+import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
 import { DataSource } from 'types/common/queryBuilder';
 
 import styles from './Controls.module.scss';
@@ -14,7 +16,10 @@ function TraceExplorerControls({
 	totalCount,
 	perPageOptions,
 	config,
-	showSizeChanger = true,
+	fieldKeysConfig,
+	builderQueryType,
+	extraFields,
+	requiredFields,
 }: TraceExplorerControlsProps): JSX.Element | null {
 	const { t } = useTranslation(['trace']);
 	const [isFieldsSelectorOpen, setIsFieldsSelectorOpen] = useState(false);
@@ -44,6 +49,10 @@ function TraceExplorerControls({
 						onFieldsChange={config.fieldsSelector.onFieldsChange}
 						onClose={(): void => setIsFieldsSelectorOpen(false)}
 						signal={DataSource.TRACES}
+						fieldKeysConfig={fieldKeysConfig}
+						builderQueryType={builderQueryType}
+						extraFields={extraFields}
+						requiredFields={requiredFields}
 					/>
 				</>
 			)}
@@ -57,26 +66,28 @@ function TraceExplorerControls({
 				handleCountItemsPerPageChange={handleCountItemsPerPageChange}
 				handleNavigateNext={handleNavigateNext}
 				handleNavigatePrevious={handleNavigatePrevious}
-				showSizeChanger={showSizeChanger}
 			/>
 		</div>
 	);
 }
 
-TraceExplorerControls.defaultProps = {
-	config: null,
-};
-
 type TraceExplorerControlsProps = Pick<
 	ControlsProps,
 	'isLoading' | 'totalCount' | 'perPageOptions'
 > & {
 	config?: OptionsMenuConfig | null;
-	showSizeChanger?: boolean;
+	fieldKeysConfig?: FieldKeysConfigProp;
+	builderQueryType?: BuilderQueryType;
+	extraFields?: TelemetryFieldKey[];
+	requiredFields?: readonly string[];
 };
 
 TraceExplorerControls.defaultProps = {
-	showSizeChanger: true,
+	config: null,
+	fieldKeysConfig: undefined,
+	builderQueryType: undefined,
+	extraFields: undefined,
+	requiredFields: undefined,
 };
 
 export default memo(TraceExplorerControls);

frontend/src/container/LLMObservability/Explorer/TracesView/TracesView.module.scss

@@ -10,6 +10,25 @@
 
 .actionsContainer {
 	display: flex;
-	justify-content: space-between;
+	justify-content: flex-end;
 	align-items: center;
 }
+
+.orderByContainer {
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-4);
+}
+
+.orderByLabel {
+	color: var(--muted-foreground);
+	// Between --periscope-font-size-small (11px) and -base (13px), so literal.
+	font-size: 12px;
+	font-style: normal;
+	font-weight: 400;
+	line-height: 16px; /* 133.333% */
+
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-2);
+}

frontend/src/container/LLMObservability/Explorer/TracesView/TracesView.tsx

@@ -3,35 +3,45 @@ import {
 	memo,
 	MutableRefObject,
 	SetStateAction,
+	useCallback,
 	useEffect,
 	useMemo,
+	useState,
 } from 'react';
 import { QueryKey } from 'react-query';
 // eslint-disable-next-line no-restricted-imports
 import { useSelector } from 'react-redux';
-import { Typography } from '@signozhq/ui/typography';
 import logEvent from 'api/common/logEvent';
-import DownloadOptionsMenu from 'components/DownloadOptionsMenu/DownloadOptionsMenu';
+import ListViewOrderBy from 'components/OrderBy/ListViewOrderBy';
 import { ENTITY_VERSION_V5 } from 'constants/app';
+import { LOCALSTORAGE } from 'constants/localStorage';
 import { QueryParams } from 'constants/query';
 import { initialQueryAIWithType, PANEL_TYPES } from 'constants/queryBuilder';
 import { REACT_QUERY_KEY } from 'constants/reactQueryKeys';
-import TraceExplorerControls from 'container/TracesExplorer/Controls';
-import { getTraceLink } from 'container/TracesExplorer/ListView/utils';
-import { TracesTableRow } from 'container/TracesExplorer/TracesTable/getFieldColumn';
-import TracesTable from 'container/TracesExplorer/TracesTable/TracesTable';
+import { getTraceLink } from '../ListView/utils';
+import { TracesTableRow } from '../TracesTable/getFieldColumn';
+import TracesTable from '../TracesTable/TracesTable';
 import { useGetQueryRange } from 'hooks/queryBuilder/useGetQueryRange';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { Pagination } from 'hooks/queryPagination';
 import useUrlQueryData from 'hooks/useUrlQueryData';
+import { ArrowUp10, Minus } from '@signozhq/icons';
 import { AppState } from 'store/reducers';
 import { Warning } from 'types/api';
 import { DataSource } from 'types/common/queryBuilder';
 import { GlobalReducer } from 'types/reducer/globalTime';
-import DOCLINKS from 'utils/docLinks';
 
+import TraceExplorerControls from '../Controls';
+import {
+	TRACE_VIEW_BUILDER_QUERY_TYPE,
+	TRACE_VIEW_COLUMN_EXTRA_FIELDS,
+	TRACE_VIEW_DEFAULT_ORDER_BY,
+	TRACE_VIEW_FIELD_KEYS,
+	TRACE_VIEW_ORDER_BY_EXTRA_FIELDS,
+} from '../constants';
 import { getListViewQuery } from '../explorerUtils';
-import { columns, PER_PAGE_OPTIONS } from './configs';
+import { PER_PAGE_OPTIONS } from './configs';
+import { useTraceViewColumns } from './useTraceViewColumns';
 import styles from './TracesView.module.scss';
 
 interface TracesViewProps {
@@ -49,6 +59,16 @@ function TracesView({
 }: TracesViewProps): JSX.Element {
 	const { stagedQuery, panelType } = useQueryBuilder();
 
+	const [orderBy, setOrderBy] = useState<string>(TRACE_VIEW_DEFAULT_ORDER_BY);
+
+	const {
+		columns,
+		selectedFields,
+		onFieldsChange,
+		requiredFields,
+		isLoading: isColumnsLoading,
+	} = useTraceViewColumns();
+
 	const {
 		selectedTime: globalSelectedTime,
 		maxTime,
@@ -60,8 +80,8 @@ function TracesView({
 	);
 
 	const transformedQuery = useMemo(
-		() => getListViewQuery(stagedQuery || initialQueryAIWithType),
-		[stagedQuery],
+		() => getListViewQuery(stagedQuery || initialQueryAIWithType, orderBy),
+		[stagedQuery, orderBy],
 	);
 
 	const queryKey = useMemo(
@@ -73,6 +93,7 @@ function TracesView({
 			stagedQuery,
 			panelType,
 			paginationQueryData,
+			orderBy,
 		],
 		[
 			globalSelectedTime,
@@ -81,6 +102,7 @@ function TracesView({
 			stagedQuery,
 			panelType,
 			paginationQueryData,
+			orderBy,
 		],
 	);
 
@@ -142,27 +164,43 @@ function TracesView({
 		}
 	}, [isLoading, isFetching, isError, rows.length]);
 
+	const handleOrderChange = useCallback((value: string): void => {
+		setOrderBy(value);
+	}, []);
+
+	const fieldsSelectorConfig = useMemo(
+		() => ({ fieldsSelector: { value: selectedFields, onFieldsChange } }),
+		[selectedFields, onFieldsChange],
+	);
+
 	return (
 		<div className={styles.container}>
 			<div className={styles.actionsContainer}>
-				<Typography>
-					This tab only shows Root Spans. More details
-					<Typography.Link href={DOCLINKS.TRACES_DETAILS_LINK} target="_blank">
-						{' '}
-						here
-					</Typography.Link>
-				</Typography>
-
 				<div className="trace-explorer-controls">
-					<DownloadOptionsMenu
-						dataSource={DataSource.TRACES}
-						panelType={PANEL_TYPES.TRACE}
-					/>
+					<div className={styles.orderByContainer}>
+						<div className={styles.orderByLabel}>
+							Order by <Minus size={14} /> <ArrowUp10 size={14} />
+						</div>
+
+						<ListViewOrderBy
+							value={orderBy}
+							onChange={handleOrderChange}
+							dataSource={DataSource.TRACES}
+							fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
+							builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
+							extraFields={TRACE_VIEW_ORDER_BY_EXTRA_FIELDS}
+						/>
+					</div>
 
 					<TraceExplorerControls
 						isLoading={isLoading}
 						totalCount={rows.length}
 						perPageOptions={PER_PAGE_OPTIONS}
+						config={fieldsSelectorConfig}
+						fieldKeysConfig={TRACE_VIEW_FIELD_KEYS}
+						builderQueryType={TRACE_VIEW_BUILDER_QUERY_TYPE}
+						extraFields={TRACE_VIEW_COLUMN_EXTRA_FIELDS}
+						requiredFields={requiredFields}
 					/>
 				</div>
 			</div>
@@ -170,10 +208,11 @@ function TracesView({
 			<TracesTable
 				data={rows}
 				columns={columns}
+				columnStorageKey={LOCALSTORAGE.AI_OBSERVABILITY_TRACE_VIEW_COLUMNS}
 				respectColumnOrder
 				panelType="TRACE"
 				getRowHref={getTraceLink}
-				isLoading={isLoading}
+				isLoading={isLoading || isColumnsLoading}
 				isFetching={isFetching}
 				isError={isError}
 				error={error}

frontend/src/container/LLMObservability/Explorer/TracesView/__tests__/useTraceViewColumns.test.tsx

@@ -0,0 +1,219 @@
+/* eslint-disable no-restricted-syntax */
+import { ReactNode } from 'react';
+import { QueryClient, QueryClientProvider } from 'react-query';
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { ENVIRONMENT } from 'constants/env';
+import { server } from 'mocks-server/server';
+import { rest } from 'msw';
+import {
+	TelemetrytypesFieldContextDTO,
+	TelemetrytypesFieldDataTypeDTO,
+} from 'api/generated/services/sigNoz.schemas';
+import { useColumnStore } from 'components/TanStackTableView/useColumnStore';
+import { LOCALSTORAGE } from 'constants/localStorage';
+import { TelemetryFieldKey } from 'types/api/v5/queryRange';
+
+import { useTraceViewColumns } from '../useTraceViewColumns';
+
+const STORAGE_KEY = LOCALSTORAGE.AI_OBSERVABILITY_TRACE_VIEW_COLUMNS;
+
+const AGGREGATE_KEYS = [
+	'llm_call_count',
+	'tool_call_count',
+	'distinct_tool_count',
+	'input_tokens',
+	'output_tokens',
+	'total_tokens',
+	'estimated_total_cost',
+	'max_llm_duration_nano',
+];
+
+const fieldNames = (fields: TelemetryFieldKey[]): string[] =>
+	fields.map((field) => field.name);
+
+const columnNames = (columns: { header?: unknown }[]): string[] =>
+	columns.map((column) => column.header as string);
+
+function wrapper({ children }: { children: ReactNode }): JSX.Element {
+	const queryClient = new QueryClient({
+		defaultOptions: { queries: { retry: false } },
+	});
+	return (
+		<QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+	);
+}
+
+const seenAI: URLSearchParams[] = [];
+
+const mockAggregateKeys = (names: string[]): void => {
+	server.use(
+		rest.get(
+			`${ENVIRONMENT.baseURL}/api/v1/ai_observability/fields/keys`,
+			(req, res, ctx) => {
+				seenAI.push(req.url.searchParams);
+				return res(
+					ctx.status(200),
+					ctx.json({
+						status: 'success',
+						data: {
+							complete: true,
+							keys: Object.fromEntries(
+								names.map((name) => [
+									name,
+									[
+										{
+											name,
+											fieldContext: TelemetrytypesFieldContextDTO.trace,
+											fieldDataType: TelemetrytypesFieldDataTypeDTO.float64,
+										},
+									],
+								]),
+							),
+						},
+					}),
+				);
+			},
+		),
+	);
+};
+
+const renderColumns = async (): Promise<
+	ReturnType<typeof renderHook<ReturnType<typeof useTraceViewColumns>, unknown>>
+> => {
+	const rendered = renderHook(() => useTraceViewColumns(), { wrapper });
+	await waitFor(() => {
+		expect(rendered.result.current.isLoading).toBe(false);
+	});
+	return rendered;
+};
+
+describe('useTraceViewColumns', () => {
+	beforeEach(() => {
+		seenAI.length = 0;
+		useColumnStore.getState().tables = {};
+		localStorage.clear();
+		mockAggregateKeys(AGGREGATE_KEYS);
+	});
+
+	it('reads the aggregates from the trace context of the keys endpoint', async () => {
+		await renderColumns();
+
+		expect(seenAI).toHaveLength(1);
+		expect(seenAI[0]?.get('searchText')).toBe('');
+		expect(seenAI[0]?.get('fieldContext')).toBe(
+			TelemetrytypesFieldContextDTO.trace,
+		);
+	});
+
+	it('pools the hardcoded display-only columns with the endpoint aggregates', async () => {
+		const { result } = await renderColumns();
+
+		expect(columnNames(result.current.columns)).toStrictEqual([
+			'service.name',
+			'root_span_name',
+			'trace_duration_nano',
+			'span_count',
+			'trace_id',
+			'start_time',
+			'end_time',
+			'error_count',
+			'input',
+			'output',
+			...AGGREGATE_KEYS,
+		]);
+	});
+
+	it('selects only the default-visible columns on first render', async () => {
+		const { result } = await renderColumns();
+
+		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
+			'service.name',
+			'root_span_name',
+			'trace_duration_nano',
+			'span_count',
+			'trace_id',
+			'llm_call_count',
+			'total_tokens',
+			'estimated_total_cost',
+		]);
+	});
+
+	it('keeps a newly reported aggregate hidden until it is picked', async () => {
+		mockAggregateKeys(['brand_new_aggregate']);
+
+		const { result } = await renderColumns();
+
+		expect(columnNames(result.current.columns)).toContain('brand_new_aggregate');
+		expect(fieldNames(result.current.selectedFields)).not.toContain(
+			'brand_new_aggregate',
+		);
+	});
+
+	it('hides the columns dropped from the selection', async () => {
+		const { result } = await renderColumns();
+
+		act(() => {
+			result.current.onFieldsChange([
+				{ name: 'trace_id' },
+				{ name: 'total_tokens', fieldContext: 'trace', fieldDataType: 'float64' },
+			]);
+		});
+
+		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
+			'trace_id',
+			'total_tokens',
+		]);
+	});
+
+	it('shows a column added back from the pool', async () => {
+		const { result } = await renderColumns();
+
+		act(() => {
+			result.current.onFieldsChange([{ name: 'trace_id' }]);
+		});
+		act(() => {
+			result.current.onFieldsChange([{ name: 'trace_id' }, { name: 'input' }]);
+		});
+
+		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
+			'trace_id',
+			'input',
+		]);
+	});
+
+	it('keeps the trace id column even when the selection drops it', async () => {
+		const { result } = await renderColumns();
+
+		act(() => {
+			result.current.onFieldsChange([{ name: 'span_count' }]);
+		});
+
+		expect(fieldNames(result.current.selectedFields)).toContain('trace_id');
+		expect(result.current.requiredFields).toStrictEqual(['trace_id']);
+	});
+
+	it('persists the selection order', async () => {
+		const { result } = await renderColumns();
+
+		act(() => {
+			result.current.onFieldsChange([
+				{ name: 'total_tokens', fieldContext: 'trace', fieldDataType: 'float64' },
+				{ name: 'trace_id' },
+				{ name: 'service.name', fieldContext: 'resource' },
+			]);
+		});
+
+		expect(fieldNames(result.current.selectedFields)).toStrictEqual([
+			'total_tokens',
+			'trace_id',
+			'service.name',
+		]);
+		expect(
+			useColumnStore.getState().tables[STORAGE_KEY].columnOrder,
+		).toStrictEqual([
+			'trace:total_tokens:float64',
+			'trace_id',
+			'resource:service.name',
+		]);
+	});
+});

frontend/src/container/LLMObservability/Explorer/TracesView/configs.tsx

@@ -5,18 +5,29 @@ import { DEFAULT_PER_PAGE_OPTIONS } from 'hooks/queryPagination';
 
 export const PER_PAGE_OPTIONS: number[] = [10, ...DEFAULT_PER_PAGE_OPTIONS];
 
-const TRACE_FIELDS = [
-	{ name: 'service.name', fieldContext: 'resource' },
-	{ name: 'name' },
-	{ name: 'duration_nano' },
-	{ name: 'span_count' },
-	{ name: 'trace_id' },
-] as TelemetryFieldKey[];
+/** Always visible: it is the row's link to the trace. */
+export const TRACE_ID_COLUMN_ID = 'trace_id';
 
-export const columns: TableColumnDef<TracesTableRow>[] = TRACE_FIELDS.map(
-	(field) => ({
+/** Everything else starts hidden, including any aggregate the endpoint adds later. */
+const DEFAULT_VISIBLE_FIELDS = new Set([
+	'service.name',
+	'root_span_name',
+	'trace_duration_nano',
+	'span_count',
+	'llm_call_count',
+	'total_tokens',
+	'estimated_total_cost',
+	TRACE_ID_COLUMN_ID,
+]);
+
+export const buildTraceViewColumns = (
+	fields: TelemetryFieldKey[],
+): TableColumnDef<TracesTableRow>[] =>
+	fields.map((field) => ({
 		...getFieldColumn(field),
-		enableRemove: false,
-		canBeHidden: false,
-	}),
-);
+		defaultVisibility: DEFAULT_VISIBLE_FIELDS.has(field.name),
+		// The shared column builder pins anything in TIMESTAMP_FIELD_NAMES; these stay movable.
+		enableMove: field.name !== TRACE_ID_COLUMN_ID,
+		enableRemove: field.name !== TRACE_ID_COLUMN_ID,
+		canBeHidden: field.name !== TRACE_ID_COLUMN_ID,
+	}));

frontend/src/container/LLMObservability/Explorer/TracesView/useTraceViewColumns.ts

@@ -0,0 +1,109 @@
+import { useCallback, useEffect, useMemo } from 'react';
+import { useFieldKeysSuggestion } from 'hooks/querySuggestions/useFieldKeysSuggestion';
+import { mergeExtraFields } from 'utils/extraFields';
+import type { TableColumnDef } from 'components/TanStackTableView/types';
+import {
+	hideColumn,
+	initializeFromDefaults,
+	setColumnOrder,
+	showColumn,
+	useColumnOrder,
+	useHiddenColumnIds,
+} from 'components/TanStackTableView/useColumnStore';
+import { LOCALSTORAGE } from 'constants/localStorage';
+import { buildCompositeKey } from 'container/OptionsMenu/utils';
+import { TracesTableRow } from '../TracesTable/getFieldColumn';
+import { TelemetryFieldKey } from 'types/api/v5/queryRange';
+import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
+
+import {
+	TRACE_VIEW_BUILDER_QUERY_TYPE,
+	TRACE_VIEW_COLUMN_EXTRA_FIELDS,
+	TRACE_VIEW_FIELD_KEYS,
+} from '../constants';
+import { buildTraceViewColumns, TRACE_ID_COLUMN_ID } from './configs';
+
+const STORAGE_KEY = LOCALSTORAGE.AI_OBSERVABILITY_TRACE_VIEW_COLUMNS;
+
+/** Matches the id getFieldColumn derives, so fields and columns address alike. */
+const columnIdOf = (field: TelemetryFieldKey): string =>
+	buildCompositeKey(field.name, field.fieldContext, field.fieldDataType);
+
+interface UseTraceViewColumns {
+	columns: TableColumnDef<TracesTableRow>[];
+	selectedFields: TelemetryFieldKey[];
+	onFieldsChange: (next: TelemetryFieldKey[]) => void;
+	requiredFields: readonly string[];
+	isLoading: boolean;
+}
+
+// TODO(ai-explorer): browser-local only, unlike the list views' `?options=` columns.
+export function useTraceViewColumns(): UseTraceViewColumns {
+	const { data: fetchedFields = [], isFetched } = useFieldKeysSuggestion(
+		{
+			...TRACE_VIEW_FIELD_KEYS,
+			signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
+			searchText: '',
+		},
+		TRACE_VIEW_BUILDER_QUERY_TYPE,
+	);
+
+	const availableFields = useMemo(
+		() => mergeExtraFields(TRACE_VIEW_COLUMN_EXTRA_FIELDS, fetchedFields),
+		[fetchedFields],
+	);
+
+	const columns = useMemo(
+		() => buildTraceViewColumns(availableFields),
+		[availableFields],
+	);
+
+	// Defaults from a partial column set would persist as the user's own choice.
+	useEffect(() => {
+		if (isFetched) {
+			initializeFromDefaults(STORAGE_KEY, columns);
+		}
+	}, [isFetched, columns]);
+
+	const hiddenColumnIds = useHiddenColumnIds(STORAGE_KEY);
+	const columnOrder = useColumnOrder(STORAGE_KEY);
+
+	const selectedFields = useMemo(() => {
+		const hidden = new Set(hiddenColumnIds);
+		const orderIndex = new Map(columnOrder.map((id, index) => [id, index]));
+
+		return availableFields
+			.filter((field) => !hidden.has(columnIdOf(field)))
+			.sort(
+				(a, b) =>
+					(orderIndex.get(columnIdOf(a)) ?? Infinity) -
+					(orderIndex.get(columnIdOf(b)) ?? Infinity),
+			);
+	}, [availableFields, hiddenColumnIds, columnOrder]);
+
+	const onFieldsChange = useCallback(
+		(next: TelemetryFieldKey[]): void => {
+			const keptIds = new Set(next.map(columnIdOf));
+
+			columns.forEach((column) => {
+				if (keptIds.has(column.id) || column.id === TRACE_ID_COLUMN_ID) {
+					showColumn(STORAGE_KEY, column.id);
+				} else {
+					hideColumn(STORAGE_KEY, column.id);
+				}
+			});
+
+			// Columns missing from the order sort last, so the visible ones suffice.
+			setColumnOrder(STORAGE_KEY, next.map(columnIdOf));
+		},
+		[columns],
+	);
+
+	return {
+		columns,
+		selectedFields,
+		onFieldsChange,
+		requiredFields: [TRACE_ID_COLUMN_ID],
+		isLoading: !isFetched,
+	};
+}

frontend/src/container/LLMObservability/Explorer/constants.ts

@@ -1,3 +1,6 @@
+import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
+import { TelemetryFieldKey } from 'types/api/v5/queryRange';
+
 export const TOOLBAR_VIEWS = {
 	list: {
 		name: 'list',
@@ -34,3 +37,29 @@ export const TOOLBAR_VIEWS = {
 		key: 'clickhouse',
 	},
 };
+
+export const TRACE_VIEW_DEFAULT_ORDER_BY = 'last_activity_time:desc';
+
+/** Display-only: ordering or filtering on one is an error, so the keys endpoint omits them. */
+export const TRACE_VIEW_COLUMN_EXTRA_FIELDS: TelemetryFieldKey[] = [
+	{ name: 'service.name', fieldContext: 'resource' },
+	{ name: 'root_span_name' },
+	{ name: 'trace_duration_nano' },
+	{ name: 'span_count' },
+	{ name: 'trace_id' },
+	{ name: 'start_time' },
+	{ name: 'end_time' },
+	{ name: 'error_count' },
+	{ name: 'input' },
+	{ name: 'output' },
+] as TelemetryFieldKey[];
+
+export const TRACE_VIEW_FIELD_KEYS = {
+	fieldContext: TelemetrytypesFieldContextDTO.trace,
+} as const;
+
+export const TRACE_VIEW_BUILDER_QUERY_TYPE = 'builder_ai_query' as const;
+
+export const TRACE_VIEW_ORDER_BY_EXTRA_FIELDS: TelemetryFieldKey[] = [
+	{ name: 'last_activity_time' } as TelemetryFieldKey,
+];

frontend/src/hooks/querySuggestions/__tests__/useFieldKeysSuggestion.test.ts

@@ -0,0 +1,185 @@
+import { QueryClient } from 'react-query';
+import { ENVIRONMENT } from 'constants/env';
+import { server } from 'mocks-server/server';
+import { rest } from 'msw';
+import { TelemetrytypesFieldContextDTO } from 'api/generated/services/sigNoz.schemas';
+import { FieldKeysConfig, FieldKeysResponse } from 'api/querySuggestions/types';
+import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
+import { DATA_SOURCE_TO_SIGNAL, DataSource } from 'types/common/queryBuilder';
+
+import {
+	getFieldKeysQueryOptions,
+	toFieldKeys,
+} from '../useFieldKeysSuggestion';
+
+/** Drives the options object the way react-query does, without a client. */
+const fetchKeys = async (
+	fieldKeysConfig: FieldKeysConfig,
+	builderQueryType?: BuilderQueryType,
+): Promise<TelemetryFieldKey[]> => {
+	const { queryFn, select } = getFieldKeysQueryOptions(
+		fieldKeysConfig,
+		builderQueryType,
+	);
+	const response = await (
+		queryFn as (context: { signal: AbortSignal }) => Promise<FieldKeysResponse>
+	)({ signal: new AbortController().signal });
+
+	return select?.(response) ?? [];
+};
+
+const mockKeys = (
+	path: '/api/v1/ai_observability/fields/keys' | '/api/v1/fields/keys',
+	names: string[],
+	onRequest?: (params: URLSearchParams) => void,
+): void => {
+	server.use(
+		rest.get(`${ENVIRONMENT.baseURL}${path}`, (req, res, ctx) => {
+			onRequest?.(req.url.searchParams);
+			return res(
+				ctx.status(200),
+				ctx.json({
+					status: 'success',
+					data: {
+						complete: true,
+						keys: Object.fromEntries(names.map((name) => [name, [{ name }]])),
+					},
+				}),
+			);
+		}),
+	);
+};
+
+describe('useFieldKeysSuggestion', () => {
+	let queryClient: QueryClient;
+
+	beforeEach(() => {
+		queryClient = new QueryClient({
+			defaultOptions: { queries: { retry: false } },
+		});
+	});
+
+	it('reads the ai_observability endpoint for a builder_ai_query', async () => {
+		const seen: URLSearchParams[] = [];
+		mockKeys(
+			'/api/v1/ai_observability/fields/keys',
+			['total_tokens'],
+			(params) => {
+				seen.push(params);
+			},
+		);
+
+		const keys = await fetchKeys(
+			{
+				signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
+				searchText: 'llm',
+				fieldContext: TelemetrytypesFieldContextDTO.trace,
+			},
+			'builder_ai_query',
+		);
+
+		expect(seen).toHaveLength(1);
+		expect(seen[0]?.get('searchText')).toBe('llm');
+		expect(seen[0]?.get('fieldContext')).toBe(
+			TelemetrytypesFieldContextDTO.trace,
+		);
+		expect(keys.map((key) => key.name)).toStrictEqual(['total_tokens']);
+	});
+
+	it('reads the generic endpoint for an unmarked query', async () => {
+		const seen: URLSearchParams[] = [];
+		mockKeys('/api/v1/fields/keys', ['service.name'], (params) => {
+			seen.push(params);
+		});
+
+		const keys = await fetchKeys({
+			signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
+			searchText: 'svc',
+		});
+
+		expect(seen).toHaveLength(1);
+		expect(seen[0]?.get('signal')).toBe(DataSource.TRACES);
+		expect(seen[0]?.get('searchText')).toBe('svc');
+		expect(keys.map((key) => key.name)).toStrictEqual(['service.name']);
+	});
+
+	it('reads the trace context of the ai_observability endpoint', async () => {
+		const seen: URLSearchParams[] = [];
+		mockKeys(
+			'/api/v1/ai_observability/fields/keys',
+			['total_tokens'],
+			(params) => {
+				seen.push(params);
+			},
+		);
+
+		const keys = await fetchKeys(
+			{
+				signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
+				searchText: '',
+				fieldContext: TelemetrytypesFieldContextDTO.trace,
+			},
+			'builder_ai_query',
+		);
+
+		expect(seen[0]?.get('searchText')).toBe('');
+		expect(keys.map((key) => key.name)).toStrictEqual(['total_tokens']);
+	});
+
+	it('reuses the cached keys response for a second empty search', async () => {
+		const seen: URLSearchParams[] = [];
+		mockKeys(
+			'/api/v1/ai_observability/fields/keys',
+			['total_tokens'],
+			(params) => {
+				seen.push(params);
+			},
+		);
+
+		const fieldKeysConfig = {
+			signal: DATA_SOURCE_TO_SIGNAL[DataSource.TRACES],
+			searchText: '',
+			fieldContext: TelemetrytypesFieldContextDTO.trace,
+		};
+
+		// Built twice: equal keys must resolve to one cache entry, not two requests.
+		await queryClient.fetchQuery(
+			getFieldKeysQueryOptions(fieldKeysConfig, 'builder_ai_query'),
+		);
+		await queryClient.fetchQuery(
+			getFieldKeysQueryOptions(fieldKeysConfig, 'builder_ai_query'),
+		);
+
+		expect(seen).toHaveLength(1);
+	});
+
+	it('hands the query signal to the fetcher so a superseded search aborts', async () => {
+		server.use(
+			rest.get(`${ENVIRONMENT.baseURL}/api/v1/fields/keys`, (_req, res, ctx) =>
+				res(ctx.delay(500), ctx.status(200), ctx.json({ status: 'success' })),
+			),
+		);
+
+		const controller = new AbortController();
+		const { queryFn } = getFieldKeysQueryOptions({
+			signal: DATA_SOURCE_TO_SIGNAL[DataSource.LOGS],
+			searchText: 'svc',
+		});
+		const pending = (
+			queryFn as (context: { signal: AbortSignal }) => Promise<unknown>
+		)({ signal: controller.signal });
+
+		controller.abort();
+
+		await expect(pending).rejects.toBeDefined();
+	});
+
+	it('treats a null keys map as empty', () => {
+		expect(
+			toFieldKeys({
+				status: 'success',
+				data: { complete: false, keys: null },
+			}),
+		).toStrictEqual([]);
+	});
+});

frontend/src/hooks/querySuggestions/useFieldKeysSuggestion.ts

@@ -0,0 +1,50 @@
+import {
+	QueryKey,
+	useQuery,
+	UseQueryOptions,
+	UseQueryResult,
+} from 'react-query';
+import { ErrorType } from 'api/generatedAPIInstance';
+import { RenderErrorResponseDTO } from 'api/generated/services/sigNoz.schemas';
+import { getFieldKeySuggestions } from 'api/querySuggestions/getFieldKeySuggestions';
+import { FIELD_API_CACHE_TIME } from 'constants/queryCacheTime';
+import { REACT_QUERY_KEY } from 'constants/reactQueryKeys';
+import { FieldKeysConfig, FieldKeysResponse } from 'api/querySuggestions/types';
+import { BuilderQueryType, TelemetryFieldKey } from 'types/api/v5/queryRange';
+
+export type FieldKeysQueryOptions = UseQueryOptions<
+	FieldKeysResponse,
+	ErrorType<RenderErrorResponseDTO>,
+	TelemetryFieldKey[]
+> & { queryKey: QueryKey };
+
+export const toFieldKeys = (
+	res: FieldKeysResponse | undefined,
+): TelemetryFieldKey[] =>
+	Object.values(res?.data?.keys ?? {})
+		.flat()
+		.map((key) => ({ ...key }) as TelemetryFieldKey);
+
+export const getFieldKeysQueryOptions = (
+	fieldKeysConfig: FieldKeysConfig,
+	builderQueryType?: BuilderQueryType,
+): FieldKeysQueryOptions => ({
+	queryKey: [
+		REACT_QUERY_KEY.FIELD_KEYS_SUGGESTION,
+		builderQueryType,
+		fieldKeysConfig,
+	],
+	queryFn: ({ signal }): Promise<FieldKeysResponse> =>
+		getFieldKeySuggestions(fieldKeysConfig, builderQueryType, signal),
+	select: toFieldKeys,
+	staleTime: FIELD_API_CACHE_TIME,
+	cacheTime: FIELD_API_CACHE_TIME,
+	refetchOnMount: false,
+	refetchOnWindowFocus: false,
+});
+
+export const useFieldKeysSuggestion = (
+	fieldKeysConfig: FieldKeysConfig,
+	builderQueryType?: BuilderQueryType,
+): UseQueryResult<TelemetryFieldKey[], ErrorType<RenderErrorResponseDTO>> =>
+	useQuery(getFieldKeysQueryOptions(fieldKeysConfig, builderQueryType));

frontend/src/utils/__tests__/extraFields.test.ts

@@ -0,0 +1,44 @@
+import { TelemetryFieldKey } from 'types/api/v5/queryRange';
+
+import { mergeExtraFields } from '../extraFields';
+
+describe('mergeExtraFields', () => {
+	it('drops fetched keys that share a composite key with an extra field', () => {
+		expect(
+			mergeExtraFields(
+				[{ name: 'trace_id' } as TelemetryFieldKey],
+				[
+					{ name: 'trace_id' } as TelemetryFieldKey,
+					{ name: 'total_tokens' } as TelemetryFieldKey,
+				],
+			).map((key) => key.name),
+		).toStrictEqual(['trace_id', 'total_tokens']);
+	});
+
+	it('keeps extra and fetched keys that share a name but differ in context', () => {
+		expect(
+			mergeExtraFields(
+				[{ name: 'service.name', fieldContext: 'resource' } as TelemetryFieldKey],
+				[
+					{
+						name: 'service.name',
+						fieldContext: 'attribute',
+					} as TelemetryFieldKey,
+					{ name: 'total_tokens' } as TelemetryFieldKey,
+				],
+			),
+		).toStrictEqual([
+			{ name: 'service.name', fieldContext: 'resource' },
+			{ name: 'service.name', fieldContext: 'attribute' },
+			{ name: 'total_tokens' },
+		]);
+	});
+
+	it('returns the fetched keys when there are no extra fields', () => {
+		expect(
+			mergeExtraFields(undefined, [
+				{ name: 'total_tokens' } as TelemetryFieldKey,
+			]).map((key) => key.name),
+		).toStrictEqual(['total_tokens']);
+	});
+});

frontend/src/utils/extraFields.ts

@@ -0,0 +1,23 @@
+import { buildCompositeKey } from 'container/OptionsMenu/utils';
+import { TelemetryFieldKey } from 'types/api/v5/queryRange';
+
+export const mergeExtraFields = (
+	extra: TelemetryFieldKey[] = [],
+	fetched: TelemetryFieldKey[],
+): TelemetryFieldKey[] => {
+	const extraKeys = new Set(
+		extra.map((field) =>
+			buildCompositeKey(field.name, field.fieldContext, field.fieldDataType),
+		),
+	);
+
+	return [
+		...extra,
+		...fetched.filter(
+			(field) =>
+				!extraKeys.has(
+					buildCompositeKey(field.name, field.fieldContext, field.fieldDataType),
+				),
+		),
+	];
+};

pkg/apiserver/signozapiserver/alertmanager.go

@@ -292,88 +292,123 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetAllRoutePolicies), handler.OpenAPIDef{
-		ID:                  "GetAllRoutePolicies",
-		Tags:                []string{"routepolicies"},
-		Summary:             "List route policies",
-		Description:         "This endpoint lists all route policies for the organization",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetAllRoutePolicies, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetAllRoutePolicies",
+			Tags:                []string{"routepolicies"},
+			Summary:             "List route policies",
+			Description:         "This endpoint lists all route policies for the organization",
+			Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetRoutePolicyByID), handler.OpenAPIDef{
-		ID:                  "GetRoutePolicyByID",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Get route policy by ID",
-		Description:         "This endpoint returns a route policy by ID",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetRoutePolicyByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRoutePolicyByID",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Get route policy by ID",
+			Description:         "This endpoint returns a route policy by ID",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.CreateRoutePolicy), handler.OpenAPIDef{
-		ID:                  "CreateRoutePolicy",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Create route policy",
-		Description:         "This endpoint creates a route policy",
-		Request:             new(alertmanagertypes.PostableRoutePolicy),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.CreateRoutePolicy, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRoutePolicy",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Create route policy",
+			Description:         "This endpoint creates a route policy",
+			Request:             new(alertmanagertypes.PostableRoutePolicy),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.UpdateRoutePolicy), handler.OpenAPIDef{
-		ID:                  "UpdateRoutePolicy",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Update route policy",
-		Description:         "This endpoint updates a route policy by ID",
-		Request:             new(alertmanagertypes.PostableRoutePolicy),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.UpdateRoutePolicy, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateRoutePolicy",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Update route policy",
+			Description:         "This endpoint updates a route policy by ID",
+			Request:             new(alertmanagertypes.PostableRoutePolicy),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.DeleteRoutePolicyByID), handler.OpenAPIDef{
-		ID:                  "DeleteRoutePolicyByID",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Delete route policy",
-		Description:         "This endpoint deletes a route policy by ID",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.DeleteRoutePolicyByID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRoutePolicyByID",
+			Tags:              []string{"routepolicies"},
+			Summary:           "Delete route policy",
+			Description:       "This endpoint deletes a route policy by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/apiserver/signozapiserver/ruler.go

@@ -4,185 +4,422 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addRulerRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRules), handler.OpenAPIDef{
-		ID:                  "ListRules",
-		Tags:                []string{"rules"},
-		Summary:             "List alert rules",
-		Description:         "This endpoint lists all alert rules with their current evaluation state",
-		Response:            make([]*ruletypes.Rule, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRules",
+			Tags:                []string{"rules"},
+			Summary:             "List alert rules",
+			Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
+			Response:            make([]*ruletypes.Rule, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			Deprecated:          true,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetRuleByID), handler.OpenAPIDef{
-		ID:                  "GetRuleByID",
-		Tags:                []string{"rules"},
-		Summary:             "Get alert rule by ID",
-		Description:         "This endpoint returns an alert rule by ID",
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v3/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRulesV3, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRulesV3",
+			Tags:                []string{"rules"},
+			Summary:             "List alert rules (v3)",
+			Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
+			RequestQuery:        new(ruletypes.ListRulesParams),
+			Response:            new(ruletypes.ListableRules),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateRule), handler.OpenAPIDef{
-		ID:                  "CreateRule",
-		Tags:                []string{"rules"},
-		Summary:             "Create alert rule",
-		Description:         "This endpoint creates a new alert rule",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRuleByID",
+			Tags:                []string{"rules"},
+			Summary:             "Get alert rule by ID",
+			Description:         "This endpoint returns an alert rule by ID",
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateRuleByID), handler.OpenAPIDef{
-		ID:                 "UpdateRuleByID",
-		Tags:               []string{"rules"},
-		Summary:            "Update alert rule",
-		Description:        "This endpoint updates an alert rule by ID",
-		Request:            new(ruletypes.PostableRule),
-		RequestContentType: "application/json",
-		RequestExamples:    postableRuleExamples(),
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRule",
+			Tags:                []string{"rules"},
+			Summary:             "Create alert rule",
+			Description:         "This endpoint creates a new alert rule",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteRuleByID), handler.OpenAPIDef{
-		ID:                "DeleteRuleByID",
-		Tags:              []string{"rules"},
-		Summary:           "Delete alert rule",
-		Description:       "This endpoint deletes an alert rule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                 "UpdateRuleByID",
+			Tags:               []string{"rules"},
+			Summary:            "Update alert rule",
+			Description:        "This endpoint updates an alert rule by ID",
+			Request:            new(ruletypes.PostableRule),
+			RequestContentType: "application/json",
+			RequestExamples:    postableRuleExamples(),
+			SuccessStatusCode:  http.StatusNoContent,
+			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.PatchRuleByID), handler.OpenAPIDef{
-		ID:                  "PatchRuleByID",
-		Tags:                []string{"rules"},
-		Summary:             "Patch alert rule",
-		Description:         "This endpoint applies a partial update to an alert rule by ID",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPatch).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRuleByID",
+			Tags:              []string{"rules"},
+			Summary:           "Delete alert rule",
+			Description:       "This endpoint deletes an alert rule by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/test", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.TestRule), handler.OpenAPIDef{
-		ID:                  "TestRule",
-		Tags:                []string{"rules"},
-		Summary:             "Test alert rule",
-		Description:         "This endpoint fires a test notification for the given rule definition",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.GettableTestRule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.PatchRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "PatchRuleByID",
+			Tags:                []string{"rules"},
+			Summary:             "Patch alert rule",
+			Description:         "This endpoint applies a partial update to an alert rule by ID",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListDowntimeSchedules), handler.OpenAPIDef{
-		ID:                  "ListDowntimeSchedules",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "List downtime schedules",
-		Description:         "This endpoint lists all planned maintenance / downtime schedules",
-		RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
-		Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/test", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.TestRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "TestRule",
+			Tags:                []string{"rules"},
+			Summary:             "Test alert rule",
+			Description:         "This endpoint fires a test notification for the given rule definition",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.GettableTestRule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                  "GetDowntimeScheduleByID",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "Get downtime schedule by ID",
-		Description:         "This endpoint returns a downtime schedule by ID",
-		Response:            new(alertmanagertypes.PlannedMaintenance),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRuleViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRuleViews",
+			Tags:                []string{"rules"},
+			Summary:             "List rule saved views",
+			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+			Response:            new(ruletypes.ListableRuleViews),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateDowntimeSchedule), handler.OpenAPIDef{
-		ID:                  "CreateDowntimeSchedule",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "Create downtime schedule",
-		Description:         "This endpoint creates a new planned maintenance / downtime schedule",
-		Request:             new(alertmanagertypes.PostablePlannedMaintenance),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.PlannedMaintenance),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Create rule saved view",
+			Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
+			Request:             new(ruletypes.PostableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                 "UpdateDowntimeScheduleByID",
-		Tags:               []string{"downtimeschedules"},
-		Summary:            "Update downtime schedule",
-		Description:        "This endpoint updates a downtime schedule by ID",
-		Request:            new(alertmanagertypes.PostablePlannedMaintenance),
-		RequestContentType: "application/json",
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Update rule saved view",
+			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+			Request:             new(ruletypes.UpdatableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                "DeleteDowntimeScheduleByID",
-		Tags:              []string{"downtimeschedules"},
-		Summary:           "Delete downtime schedule",
-		Description:       "This endpoint deletes a downtime schedule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Delete rule saved view",
+			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListDowntimeSchedules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDowntimeSchedules",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "List downtime schedules",
+			Description:         "This endpoint lists all planned maintenance / downtime schedules",
+			RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
+			Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetDowntimeScheduleByID",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "Get downtime schedule by ID",
+			Description:         "This endpoint returns a downtime schedule by ID",
+			Response:            new(alertmanagertypes.PlannedMaintenance),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateDowntimeSchedule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateDowntimeSchedule",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "Create downtime schedule",
+			Description:         "This endpoint creates a new planned maintenance / downtime schedule",
+			Request:             new(alertmanagertypes.PostablePlannedMaintenance),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.PlannedMaintenance),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                 "UpdateDowntimeScheduleByID",
+			Tags:               []string{"downtimeschedules"},
+			Summary:            "Update downtime schedule",
+			Description:        "This endpoint updates a downtime schedule by ID",
+			Request:            new(alertmanagertypes.PostablePlannedMaintenance),
+			RequestContentType: "application/json",
+			SuccessStatusCode:  http.StatusNoContent,
+			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteDowntimeScheduleByID",
+			Tags:              []string{"downtimeschedules"},
+			Summary:           "Delete downtime schedule",
+			Description:       "This endpoint deletes a downtime schedule by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/apiserver/signozapiserver/rulestatehistory.go

@@ -4,7 +4,8 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/rulestatehistorytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/gorilla/mux"
@@ -13,7 +14,7 @@ import (
 func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 
 	if err := router.Handle("/api/v2/rules/{id}/history/stats", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryStats),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryStats, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryStats",
 			Tags:                []string{"rules"},
@@ -24,13 +25,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/timeline", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTimeline",
 			Tags:                []string{"rules"},
@@ -41,13 +50,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/top_contributors", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryContributors),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryContributors, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTopContributors",
 			Tags:                []string{"rules"},
@@ -58,13 +75,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/filter_keys", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterKeys",
 			Tags:                []string{"rules"},
@@ -75,13 +100,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/filter_values", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterValues",
 			Tags:                []string{"rules"},
@@ -92,13 +125,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/overall_status", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryOverallStatus",
 			Tags:                []string{"rules"},
@@ -109,8 +150,16 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 

pkg/query-service/app/http_handler.go

@@ -28,6 +28,7 @@ import (
 
 	"github.com/prometheus/prometheus/promql"
 
+	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/query-service/app/integrations"
@@ -57,6 +58,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/query-service/postprocess"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ctxtypes"
 	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
 	"github.com/SigNoz/signoz/pkg/types/featuretypes"
@@ -359,22 +361,191 @@ func (aH *APIHandler) Respond(w http.ResponseWriter, data interface{}) {
 	writeHttpResponse(w, data)
 }
 
+func newScopedSecuritySchemes(scopes ...string) []handler.OpenAPISecurityScheme {
+	return []handler.OpenAPISecurityScheme{
+		{Name: authtypes.IdentNProviderAPIKey.StringValue(), Scopes: scopes},
+		{Name: authtypes.IdentNProviderTokenizer.StringValue(), Scopes: scopes},
+	}
+}
+
+func newRuleHistoryV1OpenAPIDef(id string) handler.OpenAPIDef {
+	return handler.OpenAPIDef{
+		ID:                id,
+		Tags:              []string{"rules"},
+		Summary:           "Get rule history (v1, deprecated)",
+		Description:       "Deprecated legacy endpoint. Use the v2 rule history routes.",
+		SuccessStatusCode: http.StatusOK,
+		Deprecated:        true,
+		SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)),
+	}
+}
+
+func newRuleHistoryV1ResourceDefs() handler.Option {
+	return handler.WithResourceDefs(handler.BasicResourceDef{
+		Resource: coretypes.ResourceMetaResourceRule,
+		Verb:     coretypes.VerbRead,
+		Category: coretypes.ActionCategoryDataAccess,
+		ID:       coretypes.PathParam("id"),
+		Selector: coretypes.IDSelector,
+	})
+}
+
 // RegisterRoutes registers routes for this handler on the given router
 func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	router.HandleFunc("/api/v1/query_range", am.ViewAccess(aH.queryRangeMetrics)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/query", am.ViewAccess(aH.queryMetrics)).Methods(http.MethodGet)
 
-	router.HandleFunc("/api/v1/rules", am.ViewAccess(aH.listRules)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/rules/{id}", am.ViewAccess(aH.getRule)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/rules", am.EditAccess(aH.createRule)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}", am.EditAccess(aH.editRule)).Methods(http.MethodPut)
-	router.HandleFunc("/api/v1/rules/{id}", am.EditAccess(aH.deleteRule)).Methods(http.MethodDelete)
-	router.HandleFunc("/api/v1/rules/{id}", am.EditAccess(aH.patchRule)).Methods(http.MethodPatch)
-	router.HandleFunc("/api/v1/testRule", am.EditAccess(aH.testRule)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/stats", am.ViewAccess(aH.getRuleStats)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/timeline", am.ViewAccess(aH.getRuleStateHistory)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/top_contributors", am.ViewAccess(aH.getRuleStateHistoryTopContributors)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v1/rules/{id}/history/overall_status", am.ViewAccess(aH.getOverallStateTransitions)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules", handler.New(
+		am.CheckResources(aH.listRules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                "ListRulesV1",
+			Tags:              []string{"rules"},
+			Summary:           "List alert rules (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use ListRulesV3.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.getRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                "GetRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Get alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use GetRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet)
+	router.Handle("/api/v1/rules", handler.New(
+		am.CheckResources(aH.createRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "CreateRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Create alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use CreateRule.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.editRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "UpdateRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Update alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use UpdateRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.deleteRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Delete alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use DeleteRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDelete)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete)
+	router.Handle("/api/v1/rules/{id}", handler.New(
+		am.CheckResources(aH.patchRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "PatchRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Patch alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use PatchRuleByID.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPatch)
+	router.Handle("/api/v1/testRule", handler.New(
+		am.CheckResources(aH.testRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "TestRuleV1",
+			Tags:              []string{"rules"},
+			Summary:           "Test alert rule (v1, deprecated)",
+			Description:       "Deprecated legacy endpoint. Use TestRule.",
+			SuccessStatusCode: http.StatusOK,
+			Deprecated:        true,
+			SecuritySchemes:   newScopedSecuritySchemes(coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/stats", handler.New(
+		am.CheckResources(aH.getRuleStats, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryStatsV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/timeline", handler.New(
+		am.CheckResources(aH.getRuleStateHistory, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryTimelineV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/top_contributors", handler.New(
+		am.CheckResources(aH.getRuleStateHistoryTopContributors, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryTopContributorsV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)
+	router.Handle("/api/v1/rules/{id}/history/overall_status", handler.New(
+		am.CheckResources(aH.getOverallStateTransitions, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		newRuleHistoryV1OpenAPIDef("GetRuleHistoryOverallStatusV1"),
+		newRuleHistoryV1ResourceDefs(),
+	)).Methods(http.MethodPost)
 
 	router.HandleFunc("/api/v1/dashboards", am.ViewAccess(aH.List)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/dashboards", am.EditAccess(aH.Signoz.Handlers.Dashboard.Create)).Methods(http.MethodPost)

pkg/query-service/rules/manager.go

@@ -718,8 +718,8 @@ func (m *Manager) Rules() []Rule {
 
 // TriggeredAlerts returns the list of the manager's rules.
 func (m *Manager) TriggeredAlerts() []*ruletypes.NamedAlert {
-	// m.mtx.RLock()
-	// defer m.mtx.RUnlock()
+	m.mtx.RLock()
+	defer m.mtx.RUnlock()
 
 	namedAlerts := []*ruletypes.NamedAlert{}
 
@@ -851,6 +851,8 @@ func (m *Manager) ListRuleStates(ctx context.Context) (*ruletypes.GettableRules,
 	// initiate response object
 	resp := make([]*ruletypes.GettableRule, 0)
 
+	stateByRuleID := m.snapshotRuleStates()
+
 	for _, s := range storedRules {
 
 		ruleResponse := ruletypes.GettableRule{}
@@ -863,11 +865,11 @@ func (m *Manager) ListRuleStates(ctx context.Context) (*ruletypes.GettableRules,
 		ruleResponse.Id = s.ID.StringValue()
 
 		// fetch state of rule from memory
-		if rm, ok := m.rules[ruleResponse.Id]; !ok {
+		if state, ok := stateByRuleID[ruleResponse.Id]; !ok {
 			ruleResponse.State = ruletypes.StateDisabled
 			ruleResponse.Disabled = true
 		} else {
-			ruleResponse.State = rm.State()
+			ruleResponse.State = state
 		}
 		ruleResponse.CreatedAt = s.CreatedAt
 		ruleResponse.CreatedBy = &s.CreatedBy
@@ -879,6 +881,84 @@ func (m *Manager) ListRuleStates(ctx context.Context) (*ruletypes.GettableRules,
 	return &ruletypes.GettableRules{Rules: resp}, nil
 }
 
+// ListRules' total counts what is pageable after corrupt-row drops and the states filter.
+func (m *Manager) ListRules(ctx context.Context, params *ruletypes.ListRulesParams) (*ruletypes.ListableRules, error) {
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	states, err := params.AlertStates()
+	if err != nil {
+		return nil, err
+	}
+	stateFilter := make(map[ruletypes.AlertState]struct{}, len(states))
+	for _, state := range states {
+		stateFilter[state] = struct{}{}
+	}
+
+	storedRules, err := m.ruleStore.GetStoredRulesMatching(ctx, claims.OrgID, params.Query)
+	if err != nil {
+		return nil, err
+	}
+
+	stateByRuleID := m.snapshotRuleStates()
+
+	listableRules := make([]*ruletypes.ListableRule, 0, len(storedRules))
+	for _, s := range storedRules {
+		gettable := ruletypes.GettableRule{}
+		if err := json.Unmarshal([]byte(s.Data), &gettable); err != nil {
+			m.logger.ErrorContext(ctx, "failed to unmarshal rule from db", slog.String("rule.id", s.ID.StringValue()), errors.Attr(err))
+			continue
+		}
+
+		gettable.Id = s.ID.StringValue()
+		if state, ok := stateByRuleID[gettable.Id]; ok {
+			gettable.State = state
+		} else {
+			gettable.State = ruletypes.StateDisabled
+			gettable.Disabled = true
+		}
+		if len(stateFilter) > 0 {
+			if _, ok := stateFilter[gettable.State]; !ok {
+				continue
+			}
+		}
+
+		gettable.CreatedAt = s.CreatedAt
+		gettable.CreatedBy = &s.CreatedBy
+		gettable.UpdatedAt = s.UpdatedAt
+		gettable.UpdatedBy = &s.UpdatedBy
+		listableRules = append(listableRules, ruletypes.NewListableRule(&gettable))
+	}
+
+	total := int64(len(listableRules))
+	ruletypes.SortListableRules(listableRules, params.Sort, params.Order)
+
+	start := min(params.Offset, len(listableRules))
+	end := min(start+params.Limit, len(listableRules))
+	currentPageRules := listableRules[start:end]
+
+	rawLabels, err := m.ruleStore.GetStoredRuleLabels(ctx, claims.OrgID)
+	if err != nil {
+		return nil, err
+	}
+	labelPairs := ruletypes.NewLabelPairsFromRawJSON(rawLabels, ruletypes.MaxListLabelPairs)
+
+	return ruletypes.NewListableRules(currentPageRules, total, labelPairs), nil
+}
+
+func (m *Manager) snapshotRuleStates() map[string]ruletypes.AlertState {
+	m.mtx.RLock()
+	defer m.mtx.RUnlock()
+
+	states := make(map[string]ruletypes.AlertState, len(m.rules))
+	for id, rule := range m.rules {
+		states[id] = rule.State()
+	}
+	return states
+}
+
 func (m *Manager) GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.GettableRule, error) {
 	claims, err := authtypes.ClaimsFromContext(ctx)
 	if err != nil {
@@ -899,7 +979,10 @@ func (m *Manager) GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.Getta
 	}
 	r.Id = id.StringValue()
 	// fetch state of rule from memory
-	if rm, ok := m.rules[r.Id]; !ok {
+	m.mtx.RLock()
+	rm, ok := m.rules[r.Id]
+	m.mtx.RUnlock()
+	if !ok {
 		r.State = ruletypes.StateDisabled
 		r.Disabled = true
 	} else {

pkg/ruler/handler.go

@@ -4,6 +4,7 @@ import "net/http"
 
 type Handler interface {
 	ListRules(http.ResponseWriter, *http.Request)
+	ListRulesV3(http.ResponseWriter, *http.Request)
 	GetRuleByID(http.ResponseWriter, *http.Request)
 	CreateRule(http.ResponseWriter, *http.Request)
 	UpdateRuleByID(http.ResponseWriter, *http.Request)
@@ -11,6 +12,11 @@ type Handler interface {
 	PatchRuleByID(http.ResponseWriter, *http.Request)
 	TestRule(http.ResponseWriter, *http.Request)
 
+	ListRuleViews(http.ResponseWriter, *http.Request)
+	CreateRuleView(http.ResponseWriter, *http.Request)
+	UpdateRuleView(http.ResponseWriter, *http.Request)
+	DeleteRuleView(http.ResponseWriter, *http.Request)
+
 	ListDowntimeSchedules(http.ResponseWriter, *http.Request)
 	GetDowntimeScheduleByID(http.ResponseWriter, *http.Request)
 	CreateDowntimeSchedule(http.ResponseWriter, *http.Request)

pkg/ruler/ruler.go

@@ -17,6 +17,9 @@ type Ruler interface {
 	// ListRuleStates returns all rules with their current evaluation state.
 	ListRuleStates(ctx context.Context) (*ruletypes.GettableRules, error)
 
+	// ListRules returns a filtered, sorted page of rules with state, plus label pairs and reserved filter keys.
+	ListRules(ctx context.Context, params *ruletypes.ListRulesParams) (*ruletypes.ListableRules, error)
+
 	// GetRule returns a single rule by ID.
 	GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.GettableRule, error)
 
@@ -46,4 +49,9 @@ type Ruler interface {
 	// TODO: expose downtime CRUD as methods on Ruler directly instead of leaking the
 	// store interface. The handler should not call store methods directly.
 	MaintenanceStore() alertmanagertypes.MaintenanceStore
+
+	CreateRuleView(ctx context.Context, orgID valuer.UUID, postable ruletypes.PostableRuleView) (*ruletypes.RuleView, error)
+	ListRuleViews(ctx context.Context, orgID valuer.UUID) (*ruletypes.ListableRuleViews, error)
+	UpdateRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatable ruletypes.UpdatableRuleView) (*ruletypes.RuleView, error)
+	DeleteRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error
 }

pkg/ruler/rulestore/rulestoretest/rule.go

@@ -64,6 +64,16 @@ func (m *MockSQLRuleStore) GetStoredRules(ctx context.Context, orgID string) ([]
 	return m.ruleStore.GetStoredRules(ctx, orgID)
 }
 
+// GetStoredRulesMatching implements ruletypes.RuleStore - delegates to underlying ruleStore to trigger SQL.
+func (m *MockSQLRuleStore) GetStoredRulesMatching(ctx context.Context, orgID string, query string) ([]*ruletypes.StorableRule, error) {
+	return m.ruleStore.GetStoredRulesMatching(ctx, orgID, query)
+}
+
+// GetStoredRuleLabels implements ruletypes.RuleStore - delegates to underlying ruleStore to trigger SQL.
+func (m *MockSQLRuleStore) GetStoredRuleLabels(ctx context.Context, orgID string) ([]string, error) {
+	return m.ruleStore.GetStoredRuleLabels(ctx, orgID)
+}
+
 // GetStoredRulesByMetricName implements ruletypes.RuleStore - delegates to underlying ruleStore.
 func (m *MockSQLRuleStore) GetStoredRulesByMetricName(ctx context.Context, orgID string, metricName string) ([]ruletypes.RuleAlert, error) {
 	return m.ruleStore.GetStoredRulesByMetricName(ctx, orgID, metricName)

pkg/ruler/rulestore/sqlrulestore/filterquery.go

@@ -0,0 +1,20 @@
+package sqlrulestore
+
+import (
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+)
+
+// Compile wraps compiler errors in the rules list filter error code.
+func Compile(query string, formatter sqlstore.SQLFormatter) (*sqlcompiler.Compiled, error) {
+	compiled, errs := sqlcompiler.Compile(query, formatter, ruleFieldResolver{})
+	if len(errs) > 0 {
+		return nil, errors.NewInvalidInputf(ruletypes.ErrCodeRuleListFilterInvalid,
+			"invalid filter query: %s", strings.Join(errs, "; "))
+	}
+	return compiled, nil
+}

pkg/ruler/rulestore/sqlrulestore/filterquery_resolver.go

@@ -0,0 +1,168 @@
+package sqlrulestore
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
+	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
+	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+)
+
+const (
+	ruleDataColumn  = "rule.data"
+	ruleLabelsField = "labels"
+	nameJSONPath    = "$.alert"
+	descriptionPath = "$.description"
+	labelsJSONPath  = "$.labels"
+	alertTypePath   = "$.alertType"
+	ruleTypePath    = "$.ruleType"
+)
+
+// ruleFieldResolver maps rule list DSL keys; label keys are case-sensitive and unknown keys are rejected.
+type ruleFieldResolver struct{}
+
+func (r ruleFieldResolver) ResolveComparison(v *sqlcompiler.Visitor, rawKey string, operation qbtypesv5.FilterOperator, ctx *grammar.ComparisonContext) string {
+	key := strings.ToLower(rawKey)
+
+	if allowedOperations, isReserved := ruletypes.ReservedOps[ruletypes.DSLKey(key)]; isReserved {
+		return r.resolveReservedKey(v, ctx, operation, ruletypes.DSLKey(key), allowedOperations)
+	}
+
+	if strings.HasPrefix(key, ruletypes.DSLLabelsKeyPrefix) {
+		labelKey := rawKey[len(ruletypes.DSLLabelsKeyPrefix):]
+		if labelKey == "" {
+			v.AddError("labels filter is missing a key, use labels.<key>")
+			return ""
+		}
+		if _, allowed := ruletypes.LabelsKeyOps[operation]; !allowed {
+			v.AddError("operator %s is not allowed on a labels.<key> filter", sqlcompiler.OperationName(operation))
+			return ""
+		}
+		return r.labelComparison(v, ctx, operation, labelKey)
+	}
+
+	v.AddError("unknown filter key %q, use one of the reserved keys or labels.<key>", rawKey)
+	return ""
+}
+
+func (r ruleFieldResolver) resolveReservedKey(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key ruletypes.DSLKey, allowedOperations map[qbtypesv5.FilterOperator]struct{}) string {
+	if _, allowed := allowedOperations[operation]; !allowed {
+		v.AddError("operator %s is not allowed for key %q", sqlcompiler.OperationName(operation), key)
+		return ""
+	}
+	switch key {
+	case ruletypes.DSLKeyName:
+		columnExpression := string(v.Formatter.JSONExtractString(ruleDataColumn, nameJSONPath))
+		return v.BuildStringOperation(v.Sb, ctx, operation, columnExpression, string(key))
+	case ruletypes.DSLKeySeverity:
+		// severity is an alias for labels.severity, sharing its missing-label semantics.
+		return r.labelComparison(v, ctx, operation, "severity")
+	case ruletypes.DSLKeyCreatedBy:
+		return v.BuildStringOperation(v.Sb, ctx, operation, "rule.created_by", string(key))
+	case ruletypes.DSLKeyUpdatedBy:
+		return v.BuildStringOperation(v.Sb, ctx, operation, "rule.updated_by", string(key))
+	case ruletypes.DSLKeyCreatedAt:
+		return v.BuildTimestampComparison(ctx, operation, "rule.created_at")
+	case ruletypes.DSLKeyUpdatedAt:
+		return v.BuildTimestampComparison(ctx, operation, "rule.updated_at")
+	case ruletypes.DSLKeyAlertType:
+		return r.enumComparison(v, ctx, operation, key, alertTypePath, alertTypeValues)
+	case ruletypes.DSLKeyRuleType:
+		return r.enumComparison(v, ctx, operation, key, ruleTypePath, ruleTypeValues)
+	}
+	v.AddError("no handler for reserved key %q", key)
+	return ""
+}
+
+// A missing label evaluates as the empty string for every value operator; EXISTS/NOT EXISTS test the raw extraction.
+func (ruleFieldResolver) labelComparison(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, labelKey string) string {
+	columnExpression := string(v.Formatter.JSONExtractMapValue(ruleDataColumn, ruleLabelsField, labelKey))
+
+	switch operation {
+	case qbtypesv5.FilterOperatorExists:
+		return fmt.Sprintf("%s IS NOT NULL", columnExpression)
+	case qbtypesv5.FilterOperatorNotExists:
+		return fmt.Sprintf("%s IS NULL", columnExpression)
+	}
+
+	keyForError := ruletypes.DSLLabelsKeyPrefix + labelKey
+	columnExpression = fmt.Sprintf("COALESCE(%s, '')", columnExpression)
+	return v.BuildStringOperation(v.Sb, ctx, operation, columnExpression, keyForError)
+}
+
+func (ruleFieldResolver) enumComparison(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key ruletypes.DSLKey, jsonPath string, allowedValues []string) string {
+	columnExpression := string(v.Formatter.JSONExtractString(ruleDataColumn, jsonPath))
+
+	var values []string
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual:
+		value, ok := v.ExtractSingleStringValue(ctx, string(key))
+		if !ok {
+			return ""
+		}
+		values = []string{value}
+	case qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn:
+		list, ok := v.ExtractStringValueList(ctx, string(key))
+		if !ok {
+			return ""
+		}
+		values = list
+	default:
+		v.AddError("operator %s on %q is not implemented", sqlcompiler.OperationName(operation), key)
+		return ""
+	}
+
+	for _, value := range values {
+		if !slices.Contains(allowedValues, value) {
+			v.AddError("invalid value %q for %q, expected one of: %s", value, key, strings.Join(allowedValues, ", "))
+			return ""
+		}
+	}
+
+	arguments := make([]any, len(values))
+	for i, s := range values {
+		arguments[i] = s
+	}
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual:
+		return v.Sb.Equal(columnExpression, arguments[0])
+	case qbtypesv5.FilterOperatorNotEqual:
+		return v.Sb.NotEqual(columnExpression, arguments[0])
+	case qbtypesv5.FilterOperatorNotIn:
+		return v.Sb.NotIn(columnExpression, arguments...)
+	default:
+		return v.Sb.In(columnExpression, arguments...)
+	}
+}
+
+// ResolveFreeText searches name, description and the raw labels JSON (which also matches label keys).
+func (ruleFieldResolver) ResolveFreeText(v *sqlcompiler.Visitor, value string) string {
+	nameColumn := string(v.Formatter.JSONExtractString(ruleDataColumn, nameJSONPath))
+	descriptionColumn := string(v.Formatter.JSONExtractString(ruleDataColumn, descriptionPath))
+	labelsColumn := string(v.Formatter.JSONExtractString(ruleDataColumn, labelsJSONPath))
+
+	return v.Sb.Or(
+		v.BuildFreeTextContains(v.Sb, nameColumn, value),
+		v.BuildFreeTextContains(v.Sb, descriptionColumn, value),
+		v.BuildFreeTextContains(v.Sb, labelsColumn, value),
+	)
+}
+
+var alertTypeValues = func() []string {
+	values := make([]string, 0, 4)
+	for _, value := range (ruletypes.AlertType("")).Enum() {
+		values = append(values, string(value.(ruletypes.AlertType)))
+	}
+	return values
+}()
+
+var ruleTypeValues = func() []string {
+	values := make([]string, 0, 3)
+	for _, value := range (ruletypes.RuleType{}).Enum() {
+		values = append(values, value.(ruletypes.RuleType).StringValue())
+	}
+	return values
+}()

pkg/ruler/rulestore/sqlrulestore/filterquery_test.go

@@ -0,0 +1,407 @@
+package sqlrulestore
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/sqlstore/sqlstoretest"
+	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+)
+
+type compileCase struct {
+	subtestName              string
+	dslQueryToCompile        string
+	emptyQueryExpected       bool
+	expectedSQL              string
+	expectedArgs             []any
+	expectedErrShouldContain string
+}
+
+func runCompileCases(t *testing.T, cases []compileCase) {
+	t.Helper()
+	for _, c := range cases {
+		t.Run(c.subtestName, func(t *testing.T) {
+			out, err := Compile(c.dslQueryToCompile, formatter(t))
+
+			if c.expectedErrShouldContain != "" {
+				require.Error(t, err)
+				assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(c.expectedErrShouldContain))
+				return
+			}
+
+			require.NoError(t, err)
+			if c.emptyQueryExpected {
+				assert.True(t, out.IsEmpty())
+				return
+			}
+			require.NotNil(t, out)
+
+			if c.expectedSQL != "" {
+				assert.Equal(t, normalizeSQL(c.expectedSQL), normalizeSQL(out.SQL))
+			}
+			if c.expectedArgs != nil {
+				require.Len(t, out.Args, len(c.expectedArgs))
+				for i, want := range c.expectedArgs {
+					// Equal instants can differ in *Location, so compare via .Equal() instead of DeepEqual.
+					if wantT, ok := want.(time.Time); ok {
+						gotT, ok := out.Args[i].(time.Time)
+						require.True(t, ok, "arg[%d]: want time.Time, got %T", i, out.Args[i])
+						assert.True(t, wantT.Equal(gotT), "arg[%d]: want %s, got %s", i, wantT, gotT)
+						continue
+					}
+					assert.Equal(t, want, out.Args[i], "arg[%d]", i)
+				}
+			}
+		})
+	}
+}
+
+func TestCompileEmpty(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{subtestName: "empty query yields nil", dslQueryToCompile: "", emptyQueryExpected: true},
+		{subtestName: "whitespace query yields nil", dslQueryToCompile: "   ", emptyQueryExpected: true},
+	})
+}
+
+func TestCompileName(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:       "name equals",
+			dslQueryToCompile: "name = 'payment latency'",
+			expectedSQL:       `json_extract("rule"."data", '$.alert') = ?`,
+			expectedArgs:      []any{"payment latency"},
+		},
+		{
+			subtestName:       "name contains escapes wildcards",
+			dslQueryToCompile: "name CONTAINS '50%'",
+			expectedSQL:       `json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\'`,
+			expectedArgs:      []any{`%50\%%`},
+		},
+		{
+			subtestName:       "name ilike",
+			dslQueryToCompile: "name ILIKE 'Prod%'",
+			expectedSQL:       `lower(json_extract("rule"."data", '$.alert')) LIKE LOWER(?) ESCAPE '\'`,
+			expectedArgs:      []any{"Prod%"},
+		},
+		{
+			subtestName:       "name in list",
+			dslQueryToCompile: "name IN ['a', 'b']",
+			expectedSQL:       `json_extract("rule"."data", '$.alert') IN (?, ?)`,
+			expectedArgs:      []any{"a", "b"},
+		},
+		{
+			subtestName:              "range operator rejected on name",
+			dslQueryToCompile:        "name > 'x'",
+			expectedErrShouldContain: `operator > is not allowed for key "name"`,
+		},
+		{
+			subtestName:              "regexp rejected on name",
+			dslQueryToCompile:        "name REGEXP 'x.*'",
+			expectedErrShouldContain: `operator REGEXP is not allowed for key "name"`,
+		},
+	})
+}
+
+func TestCompileSeverityAndLabels(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:       "severity equals targets labels map",
+			dslQueryToCompile: "severity = 'critical'",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') = ?`,
+			expectedArgs:      []any{"critical"},
+		},
+		{
+			subtestName:       "severity negation treats a missing label as empty string",
+			dslQueryToCompile: "severity != 'critical'",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') <> ?`,
+			expectedArgs:      []any{"critical"},
+		},
+		{
+			subtestName:       "severity != empty string excludes rules without severity",
+			dslQueryToCompile: "severity != ''",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') <> ?`,
+			expectedArgs:      []any{""},
+		},
+		{
+			subtestName:       "severity exists through the alias",
+			dslQueryToCompile: "severity EXISTS",
+			expectedSQL:       `json_extract("rule"."data", '$.labels."severity"') IS NOT NULL`,
+		},
+		{
+			subtestName:       "severity not exists through the alias",
+			dslQueryToCompile: "severity NOT EXISTS",
+			expectedSQL:       `json_extract("rule"."data", '$.labels."severity"') IS NULL`,
+		},
+		{
+			subtestName:       "label equals",
+			dslQueryToCompile: "labels.team = 'infra'",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ?`,
+			expectedArgs:      []any{"infra"},
+		},
+		{
+			subtestName:       "dotted label key is one map entry",
+			dslQueryToCompile: "labels.k8s.cluster = 'prod-1'",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."k8s.cluster"'), '') = ?`,
+			expectedArgs:      []any{"prod-1"},
+		},
+		{
+			subtestName:       "label key keeps its case",
+			dslQueryToCompile: "labels.Team = 'infra'",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."Team"'), '') = ?`,
+			expectedArgs:      []any{"infra"},
+		},
+		{
+			subtestName:       "label exists",
+			dslQueryToCompile: "labels.team EXISTS",
+			expectedSQL:       `json_extract("rule"."data", '$.labels."team"') IS NOT NULL`,
+		},
+		{
+			subtestName:       "label not exists",
+			dslQueryToCompile: "labels.team NOT EXISTS",
+			expectedSQL:       `json_extract("rule"."data", '$.labels."team"') IS NULL`,
+		},
+		{
+			subtestName:       "label not contains includes label-less rules",
+			dslQueryToCompile: "labels.team NOT CONTAINS 'infra'",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."team"'), '') NOT LIKE ? ESCAPE '\'`,
+			expectedArgs:      []any{"%infra%"},
+		},
+		{
+			subtestName:       "label not in includes label-less rules",
+			dslQueryToCompile: "labels.team NOT IN ['a', 'b']",
+			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."team"'), '') NOT IN (?, ?)`,
+			expectedArgs:      []any{"a", "b"},
+		},
+	})
+}
+
+func TestCompileEnums(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:       "alert_type equals",
+			dslQueryToCompile: "alert_type = 'LOGS_BASED_ALERT'",
+			expectedSQL:       `json_extract("rule"."data", '$.alertType') = ?`,
+			expectedArgs:      []any{"LOGS_BASED_ALERT"},
+		},
+		{
+			subtestName:       "rule_type in list",
+			dslQueryToCompile: "rule_type IN ['threshold_rule', 'promql_rule']",
+			expectedSQL:       `json_extract("rule"."data", '$.ruleType') IN (?, ?)`,
+			expectedArgs:      []any{"threshold_rule", "promql_rule"},
+		},
+		{
+			subtestName:              "invalid alert_type value rejected",
+			dslQueryToCompile:        "alert_type = 'bogus'",
+			expectedErrShouldContain: `invalid value "bogus" for "alert_type"`,
+		},
+		{
+			subtestName:              "contains rejected on rule_type",
+			dslQueryToCompile:        "rule_type CONTAINS 'thresh'",
+			expectedErrShouldContain: `operator CONTAINS is not allowed for key "rule_type"`,
+		},
+	})
+}
+
+func TestCompileAuditColumns(t *testing.T) {
+	createdAt, err := time.Parse(time.RFC3339, "2026-01-02T15:04:05Z")
+	require.NoError(t, err)
+	updatedFrom, err := time.Parse(time.RFC3339, "2026-02-01T00:00:00Z")
+	require.NoError(t, err)
+	updatedTo, err := time.Parse(time.RFC3339, "2026-03-01T00:00:00Z")
+	require.NoError(t, err)
+
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:       "created_by equals",
+			dslQueryToCompile: "created_by = 'nikhil@signoz.io'",
+			expectedSQL:       `rule.created_by = ?`,
+			expectedArgs:      []any{"nikhil@signoz.io"},
+		},
+		{
+			subtestName:       "created_at range",
+			dslQueryToCompile: "created_at >= '2026-01-02T15:04:05Z'",
+			expectedSQL:       `rule.created_at >= ?`,
+			expectedArgs:      []any{createdAt},
+		},
+		{
+			subtestName:       "updated_at between",
+			dslQueryToCompile: "updated_at BETWEEN '2026-02-01T00:00:00Z' AND '2026-03-01T00:00:00Z'",
+			expectedSQL:       `rule.updated_at BETWEEN ? AND ?`,
+			expectedArgs:      []any{updatedFrom, updatedTo},
+		},
+		{
+			subtestName:              "non-timestamp rejected on created_at",
+			dslQueryToCompile:        "created_at >= 'yesterday'",
+			expectedErrShouldContain: "invalid RFC3339 timestamp",
+		},
+	})
+}
+
+func TestCompileFreeText(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:       "bare word searches name, description and labels",
+			dslQueryToCompile: "payment",
+			expectedSQL: `(lower(COALESCE(json_extract("rule"."data", '$.alert'), '')) LIKE LOWER(?) ESCAPE '\' ` +
+				`OR lower(COALESCE(json_extract("rule"."data", '$.description'), '')) LIKE LOWER(?) ESCAPE '\' ` +
+				`OR lower(COALESCE(json_extract("rule"."data", '$.labels'), '')) LIKE LOWER(?) ESCAPE '\')`,
+			expectedArgs: []any{"%payment%", "%payment%", "%payment%"},
+		},
+	})
+}
+
+func TestCompileComposition(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:       "and of label and column",
+			dslQueryToCompile: "labels.team = 'infra' AND created_by = 'x'",
+			expectedSQL:       `(COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ? AND rule.created_by = ?)`,
+			expectedArgs:      []any{"infra", "x"},
+		},
+		{
+			subtestName:       "not wraps the inner predicate",
+			dslQueryToCompile: "NOT (name = 'x')",
+			expectedSQL:       `NOT (json_extract("rule"."data", '$.alert') = ?)`,
+			expectedArgs:      []any{"x"},
+		},
+		{
+			subtestName:       "or of name and severity",
+			dslQueryToCompile: "name CONTAINS 'pay' OR severity = 'critical'",
+			expectedSQL:       `(json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\' OR COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') = ?)`,
+			expectedArgs:      []any{"%pay%", "critical"},
+		},
+	})
+}
+
+func TestCompileComplexExamples(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName: "name CONTAINS + label = + severity IN + created_by !=",
+			dslQueryToCompile: `name CONTAINS 'latency' AND labels.team = 'payments' ` +
+				`AND severity IN ['critical', 'error'] AND created_by != 'ops@signoz.io'`,
+			expectedSQL: `(json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\' ` +
+				`AND COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ? ` +
+				`AND COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') IN (?, ?) ` +
+				`AND rule.created_by <> ?)`,
+			expectedArgs: []any{"%latency%", "payments", "critical", "error", "ops@signoz.io"},
+		},
+		{
+			subtestName: "nested OR / AND with parens",
+			dslQueryToCompile: `(labels.env IN ['prod', 'staging'] OR name LIKE '%prod%') ` +
+				`AND (severity = 'critical' OR labels.team EXISTS)`,
+			expectedSQL: `((COALESCE(json_extract("rule"."data", '$.labels."env"'), '') IN (?, ?) ` +
+				`OR json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\') ` +
+				`AND (COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') = ? ` +
+				`OR json_extract("rule"."data", '$.labels."team"') IS NOT NULL))`,
+			expectedArgs: []any{"prod", "staging", "%prod%", "critical"},
+		},
+		{
+			subtestName:       "NOT over a group ANDed with an enum",
+			dslQueryToCompile: `NOT (labels.team = 'infra' OR name CONTAINS 'cpu') AND alert_type = 'METRIC_BASED_ALERT'`,
+			expectedSQL: `(NOT ((COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ? ` +
+				`OR json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\')) ` +
+				`AND json_extract("rule"."data", '$.alertType') = ?)`,
+			expectedArgs: []any{"infra", "%cpu%", "METRIC_BASED_ALERT"},
+		},
+		{
+			subtestName: "free text with three-level nesting and a timestamp",
+			dslQueryToCompile: `prod AND (name ILIKE '%pay%' ` +
+				`OR (labels.team != 'infra' AND updated_at > '2026-01-02T15:04:05Z'))`,
+			expectedSQL: `((lower(COALESCE(json_extract("rule"."data", '$.alert'), '')) LIKE LOWER(?) ESCAPE '\' ` +
+				`OR lower(COALESCE(json_extract("rule"."data", '$.description'), '')) LIKE LOWER(?) ESCAPE '\' ` +
+				`OR lower(COALESCE(json_extract("rule"."data", '$.labels'), '')) LIKE LOWER(?) ESCAPE '\') ` +
+				`AND (lower(json_extract("rule"."data", '$.alert')) LIKE LOWER(?) ESCAPE '\' ` +
+				`OR (COALESCE(json_extract("rule"."data", '$.labels."team"'), '') <> ? AND rule.updated_at > ?)))`,
+			expectedArgs: []any{"%prod%", "%prod%", "%prod%", "%pay%", "infra",
+				time.Date(2026, 1, 2, 15, 4, 5, 0, time.UTC)},
+		},
+	})
+}
+
+func TestCompileErrors(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:              "unknown key rejected instead of matching nothing",
+			dslQueryToCompile:        "team = 'infra'",
+			expectedErrShouldContain: `unknown filter key "team"`,
+		},
+		{
+			subtestName:              "state is not a DSL key",
+			dslQueryToCompile:        "state = 'firing'",
+			expectedErrShouldContain: `unknown filter key "state"`,
+		},
+		{
+			subtestName:              "syntax error surfaces position",
+			dslQueryToCompile:        "created_by ==== (((",
+			expectedErrShouldContain: "syntax error",
+		},
+		{
+			subtestName:              "like pattern with dangling escape rejected",
+			dslQueryToCompile:        `name LIKE 'prod\\'`,
+			expectedErrShouldContain: "must not end with an unescaped backslash",
+		},
+		{
+			subtestName:              "ilike pattern with dangling escape rejected",
+			dslQueryToCompile:        `name ILIKE '%\\'`,
+			expectedErrShouldContain: "must not end with an unescaped backslash",
+		},
+		{
+			subtestName:              "label like pattern with dangling escape rejected",
+			dslQueryToCompile:        `labels.team NOT LIKE 'infra\\'`,
+			expectedErrShouldContain: "must not end with an unescaped backslash",
+		},
+	})
+}
+
+func TestCompileTrailingLiteralBackslash(t *testing.T) {
+	runCompileCases(t, []compileCase{
+		{
+			subtestName:       "escaped trailing backslash compiles",
+			dslQueryToCompile: `name LIKE '%\\\\'`,
+			expectedSQL:       `json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\'`,
+			expectedArgs:      []any{`%\\`},
+		},
+	})
+}
+
+// Guards that every ruletypes.ReservedOps key has a case in resolveReservedKey.
+func TestCompileReservedKeysAllHandled(t *testing.T) {
+	sampleQueries := map[ruletypes.DSLKey]string{
+		ruletypes.DSLKeyName:      "name = 'x'",
+		ruletypes.DSLKeySeverity:  "severity = 'critical'",
+		ruletypes.DSLKeyCreatedBy: "created_by = 'x'",
+		ruletypes.DSLKeyUpdatedBy: "updated_by = 'x'",
+		ruletypes.DSLKeyCreatedAt: "created_at >= '2026-01-02T15:04:05Z'",
+		ruletypes.DSLKeyUpdatedAt: "updated_at >= '2026-01-02T15:04:05Z'",
+		ruletypes.DSLKeyAlertType: "alert_type = 'METRIC_BASED_ALERT'",
+		ruletypes.DSLKeyRuleType:  "rule_type = 'threshold_rule'",
+	}
+
+	for key := range ruletypes.ReservedOps {
+		query, ok := sampleQueries[key]
+		require.True(t, ok, "no sample query for reserved key %q, add one", key)
+
+		out, err := Compile(query, formatter(t))
+		require.NoError(t, err, "reserved key %q failed to compile", key)
+		assert.False(t, out.IsEmpty(), "reserved key %q compiled to empty SQL", key)
+	}
+}
+
+func formatter(t *testing.T) sqlstore.SQLFormatter {
+	t.Helper()
+	p := sqlstoretest.New(sqlstore.Config{Provider: "sqlite"}, sqlmock.QueryMatcherEqual)
+	return p.Formatter()
+}
+
+func normalizeSQL(s string) string {
+	s = strings.Join(strings.Fields(s), " ")
+	s = strings.ReplaceAll(s, "( ", "(")
+	s = strings.ReplaceAll(s, " )", ")")
+	return s
+}

pkg/ruler/rulestore/sqlrulestore/rule.go

@@ -3,6 +3,7 @@ package sqlrulestore
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"log/slog"
 	"slices"
 
@@ -89,6 +90,46 @@ func (r *rule) DeleteRule(ctx context.Context, orgID valuer.UUID, id valuer.UUID
 	return nil
 }
 
+func (r *rule) GetStoredRulesMatching(ctx context.Context, orgID string, query string) ([]*ruletypes.StorableRule, error) {
+	compiled, err := Compile(query, r.sqlstore.Formatter())
+	if err != nil {
+		return nil, err
+	}
+
+	rules := make([]*ruletypes.StorableRule, 0)
+	q := r.sqlstore.
+		BunDB().
+		NewSelect().
+		Model(&rules).
+		Where("org_id = ?", orgID)
+	if !compiled.IsEmpty() {
+		q = q.Where(compiled.SQL, compiled.Args...)
+	}
+	if err := q.Scan(ctx); err != nil {
+		return nil, err
+	}
+
+	return rules, nil
+}
+
+func (r *rule) GetStoredRuleLabels(ctx context.Context, orgID string) ([]string, error) {
+	labelsExpression := string(r.sqlstore.Formatter().JSONExtractString("rule.data", "$.labels"))
+
+	labels := make([]string, 0)
+	err := r.sqlstore.
+		BunDB().
+		NewSelect().
+		Model((*ruletypes.StorableRule)(nil)).
+		ColumnExpr(fmt.Sprintf("COALESCE(%s, '')", labelsExpression)).
+		Where("org_id = ?", orgID).
+		Scan(ctx, &labels)
+	if err != nil {
+		return nil, err
+	}
+
+	return labels, nil
+}
+
 func (r *rule) GetStoredRules(ctx context.Context, orgID string) ([]*ruletypes.StorableRule, error) {
 	rules := make([]*ruletypes.StorableRule, 0)
 	err := r.sqlstore.

pkg/ruler/rulestore/sqlrulestore/rule_view.go

@@ -0,0 +1,93 @@
+package sqlrulestore
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	ruletypes "github.com/SigNoz/signoz/pkg/types/ruletypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+func (r *rule) CreateRuleView(ctx context.Context, view *ruletypes.RuleView) error {
+	_, err := r.sqlstore.
+		BunDBCtx(ctx).
+		NewInsert().
+		Model(view).
+		Exec(ctx)
+	if err != nil {
+		return r.sqlstore.WrapAlreadyExistsErrf(err, errors.CodeAlreadyExists, "rule view with id %s already exists", view.ID)
+	}
+	return nil
+}
+
+func (r *rule) GetRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*ruletypes.RuleView, error) {
+	view := new(ruletypes.RuleView)
+	err := r.sqlstore.
+		BunDB().
+		NewSelect().
+		Model(view).
+		Where("id = ?", id).
+		Where("org_id = ?", orgID).
+		Scan(ctx)
+	if err != nil {
+		return nil, r.sqlstore.WrapNotFoundErrf(err, ruletypes.ErrCodeRuleViewNotFound, "rule view with id %s doesn't exist", id)
+	}
+	return view, nil
+}
+
+func (r *rule) ListRuleViews(ctx context.Context, orgID valuer.UUID) ([]*ruletypes.RuleView, error) {
+	views := make([]*ruletypes.RuleView, 0)
+	err := r.sqlstore.
+		BunDB().
+		NewSelect().
+		Model(&views).
+		Where("org_id = ?", orgID).
+		OrderExpr("updated_at DESC").
+		Scan(ctx)
+	if err != nil {
+		return nil, errors.WrapInternalf(err, errors.CodeInternal, "couldn't list rule views")
+	}
+	return views, nil
+}
+
+func (r *rule) UpdateRuleView(ctx context.Context, view *ruletypes.RuleView) error {
+	res, err := r.sqlstore.
+		BunDBCtx(ctx).
+		NewUpdate().
+		Model(view).
+		WherePK().
+		Where("org_id = ?", view.OrgID).
+		Exec(ctx)
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't update rule view")
+	}
+	rows, err := res.RowsAffected()
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't read rule view update result")
+	}
+	if rows == 0 {
+		return errors.Newf(errors.TypeNotFound, ruletypes.ErrCodeRuleViewNotFound, "rule view with id %s doesn't exist", view.ID)
+	}
+	return nil
+}
+
+func (r *rule) DeleteRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
+	res, err := r.sqlstore.
+		BunDBCtx(ctx).
+		NewDelete().
+		Model(new(ruletypes.RuleView)).
+		Where("id = ?", id).
+		Where("org_id = ?", orgID).
+		Exec(ctx)
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't delete rule view")
+	}
+	rows, err := res.RowsAffected()
+	if err != nil {
+		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't read rule view delete result")
+	}
+	if rows == 0 {
+		return errors.Newf(errors.TypeNotFound, ruletypes.ErrCodeRuleViewNotFound, "rule view with id %s doesn't exist", id)
+	}
+	return nil
+}

pkg/ruler/signozruler/handler.go

@@ -43,6 +43,29 @@ func (handler *handler) ListRules(rw http.ResponseWriter, req *http.Request) {
 	render.Success(rw, http.StatusOK, view)
 }
 
+func (handler *handler) ListRulesV3(rw http.ResponseWriter, req *http.Request) {
+	ctx, cancel := context.WithTimeout(req.Context(), 30*time.Second)
+	defer cancel()
+
+	params := new(ruletypes.ListRulesParams)
+	if err := binding.Query.BindQuery(req.URL.Query(), params); err != nil {
+		render.Error(rw, err)
+		return
+	}
+	if err := params.Validate(); err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	listableRules, err := handler.ruler.ListRules(ctx, params)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusOK, listableRules)
+}
+
 func (handler *handler) GetRuleByID(rw http.ResponseWriter, req *http.Request) {
 	ctx, cancel := context.WithTimeout(req.Context(), 30*time.Second)
 	defer cancel()
@@ -322,3 +345,122 @@ func (handler *handler) DeleteDowntimeScheduleByID(rw http.ResponseWriter, req *
 
 	render.Success(rw, http.StatusNoContent, nil)
 }
+
+func (handler *handler) ListRuleViews(rw http.ResponseWriter, req *http.Request) {
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	views, err := handler.ruler.ListRuleViews(ctx, orgID)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusOK, views)
+}
+
+func (handler *handler) CreateRuleView(rw http.ResponseWriter, req *http.Request) {
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	var postable ruletypes.PostableRuleView
+	if err := binding.JSON.BindBody(req.Body, &postable); err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	view, err := handler.ruler.CreateRuleView(ctx, orgID, postable)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusCreated, view)
+}
+
+func (handler *handler) UpdateRuleView(rw http.ResponseWriter, req *http.Request) {
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	id, err := valuer.NewUUID(mux.Vars(req)["id"])
+	if err != nil {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "id is not a valid uuid-v7"))
+		return
+	}
+
+	var updatable ruletypes.UpdatableRuleView
+	if err := binding.JSON.BindBody(req.Body, &updatable); err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	view, err := handler.ruler.UpdateRuleView(ctx, orgID, id, updatable)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusOK, view)
+}
+
+func (handler *handler) DeleteRuleView(rw http.ResponseWriter, req *http.Request) {
+	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	id, err := valuer.NewUUID(mux.Vars(req)["id"])
+	if err != nil {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "id is not a valid uuid-v7"))
+		return
+	}
+
+	if err := handler.ruler.DeleteRuleView(ctx, orgID, id); err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusNoContent, nil)
+}

pkg/ruler/signozruler/provider.go

@@ -116,6 +116,10 @@ func (provider *provider) ListRuleStates(ctx context.Context) (*ruletypes.Gettab
 	return provider.manager.ListRuleStates(ctx)
 }
 
+func (provider *provider) ListRules(ctx context.Context, params *ruletypes.ListRulesParams) (*ruletypes.ListableRules, error) {
+	return provider.manager.ListRules(ctx, params)
+}
+
 func (provider *provider) GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.GettableRule, error) {
 	return provider.manager.GetRule(ctx, id)
 }
@@ -143,3 +147,41 @@ func (provider *provider) TestNotification(ctx context.Context, orgID valuer.UUI
 func (provider *provider) MaintenanceStore() alertmanagertypes.MaintenanceStore {
 	return provider.manager.MaintenanceStore()
 }
+
+func (provider *provider) CreateRuleView(ctx context.Context, orgID valuer.UUID, postable ruletypes.PostableRuleView) (*ruletypes.RuleView, error) {
+	if err := postable.Validate(); err != nil {
+		return nil, err
+	}
+	view := postable.NewRuleView(orgID)
+	if err := provider.ruleStore.CreateRuleView(ctx, view); err != nil {
+		return nil, err
+	}
+	return view, nil
+}
+
+func (provider *provider) ListRuleViews(ctx context.Context, orgID valuer.UUID) (*ruletypes.ListableRuleViews, error) {
+	views, err := provider.ruleStore.ListRuleViews(ctx, orgID)
+	if err != nil {
+		return nil, err
+	}
+	return &ruletypes.ListableRuleViews{Views: views}, nil
+}
+
+func (provider *provider) UpdateRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatable ruletypes.UpdatableRuleView) (*ruletypes.RuleView, error) {
+	if err := updatable.Validate(); err != nil {
+		return nil, err
+	}
+	view, err := provider.ruleStore.GetRuleView(ctx, orgID, id)
+	if err != nil {
+		return nil, err
+	}
+	view.Update(updatable)
+	if err := provider.ruleStore.UpdateRuleView(ctx, view); err != nil {
+		return nil, err
+	}
+	return view, nil
+}
+
+func (provider *provider) DeleteRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
+	return provider.ruleStore.DeleteRuleView(ctx, orgID, id)
+}

pkg/signoz/provider.go

@@ -254,6 +254,8 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddIngestionTuplesFactory(sqlstore),
 		sqlmigration.NewAddSubscriptionTuplesFactory(sqlstore),
 		sqlmigration.NewNormalizeQuickFilterFieldsFactory(sqlstore),
+		sqlmigration.NewAddRuleViewFactory(sqlstore, sqlschema),
+		sqlmigration.NewAddAlertTuplesFactory(sqlstore),
 	)
 }
 

pkg/sqlmigration/127_add_rule_view.go

@@ -0,0 +1,78 @@
+package sqlmigration
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlschema"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addRuleView struct {
+	sqlstore  sqlstore.SQLStore
+	sqlschema sqlschema.SQLSchema
+}
+
+func NewAddRuleViewFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_rule_view"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addRuleView{
+			sqlstore:  sqlstore,
+			sqlschema: sqlschema,
+		}, nil
+	})
+}
+
+func (migration *addRuleView) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addRuleView) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	sqls := migration.sqlschema.Operator().CreateTable(&sqlschema.Table{
+		Name: "rule_view",
+		Columns: []*sqlschema.Column{
+			{Name: "id", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "name", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "data", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "org_id", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "created_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
+			{Name: "updated_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
+		},
+		PrimaryKeyConstraint: &sqlschema.PrimaryKeyConstraint{ColumnNames: []sqlschema.ColumnName{"id"}},
+		ForeignKeyConstraints: []*sqlschema.ForeignKeyConstraint{
+			{
+				ReferencingColumnName: sqlschema.ColumnName("org_id"),
+				ReferencedTableName:   sqlschema.TableName("organizations"),
+				ReferencedColumnName:  sqlschema.ColumnName("id"),
+			},
+		},
+	})
+
+	for _, sql := range sqls {
+		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
+			return err
+		}
+	}
+
+	if _, err := tx.NewCreateIndex().
+		Table("rule_view").
+		Column("org_id").
+		Index("idx_rule_view_org_id").
+		IfNotExists().
+		Exec(ctx); err != nil {
+		return err
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addRuleView) Down(_ context.Context, _ *bun.DB) error {
+	return nil
+}

pkg/sqlmigration/128_add_alert_tuples.go

@@ -0,0 +1,179 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addAlertTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddAlertTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_alert_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addAlertTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addAlertTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addAlertTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// rule, planned-maintenance and route-policy moved from role gates to
+	// CheckResources, which on enterprise requires real tuples -- existing orgs
+	// never had these written, only new orgs get them from the registry at bootstrap.
+	writeVerbs := []string{"create", "read", "update", "delete", "list"}
+	readVerbs := []string{"read", "list"}
+
+	tuples := make([]migrationTuple, 0, 33)
+	for _, objectName := range []string{"rule", "planned-maintenance"} {
+		for _, verb := range writeVerbs {
+			tuples = append(tuples,
+				migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", objectName, verb},
+				migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", objectName, verb},
+			)
+		}
+		for _, verb := range readVerbs {
+			tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", objectName, verb})
+		}
+	}
+	for _, verb := range writeVerbs {
+		tuples = append(tuples, migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb})
+	}
+	for _, verb := range readVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "route-policy", verb},
+			migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "route-policy", verb},
+		)
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addAlertTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/sqlstore/sqlitesqlstore/formatter.go

@@ -1,6 +1,7 @@
 package sqlitesqlstore
 
 import (
+	"fmt"
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/sqlstore"
@@ -25,6 +26,12 @@ func (f *formatter) JSONExtractString(column, path string) []byte {
 	return sql
 }
 
+func (f *formatter) JSONExtractMapValue(column, mapField, key string) []byte {
+	// Quote the key as one path segment; a double quote in it is inexpressible in sqlite JSON paths.
+	escapedKey := strings.NewReplacer(`\`, `\\`).Replace(key)
+	return f.JSONExtractString(column, fmt.Sprintf(`$.%s."%s"`, mapField, escapedKey))
+}
+
 func (f *formatter) JSONType(column, path string) []byte {
 	var sql []byte
 	sql = append(sql, "json_type("...)

pkg/sqlstore/sqlstore.go

@@ -114,6 +114,9 @@ type SQLFormatter interface {
 	// JSONKeys return extracted key from json as well as alias to be used for select and where clause
 	JSONKeys(column, path, alias string) ([]byte, []byte)
 
+	// JSONExtractMapValue extracts one key's value from a JSON object field; dots in the key are not path nesting.
+	JSONExtractMapValue(column, mapField, key string) []byte
+
 	// TextToJsonColumn converts a text column to JSON type
 	TextToJsonColumn(column string) []byte
 

pkg/sqlstore/sqlstoretest/formatter.go

@@ -1,6 +1,7 @@
 package sqlstoretest
 
 import (
+	"fmt"
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/sqlstore"
@@ -25,6 +26,11 @@ func (f *formatter) JSONExtractString(column, path string) []byte {
 	return sql
 }
 
+func (f *formatter) JSONExtractMapValue(column, mapField, key string) []byte {
+	escapedKey := strings.NewReplacer(`\`, `\\`).Replace(key)
+	return f.JSONExtractString(column, fmt.Sprintf(`$.%s."%s"`, mapField, escapedKey))
+}
+
 func (f *formatter) JSONType(column, path string) []byte {
 	var sql []byte
 	sql = append(sql, "json_type("...)

pkg/types/coretypes/registry_resource.go

@@ -48,7 +48,7 @@ var (
 	ResourceServiceAccount                               = NewResourceServiceAccount()
 	ResourceUser                                         = NewResourceUser()
 	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel)
-	ResourceMetaResourceRoutePolicy                      = NewResourceMetaResource(KindRoutePolicy)
+	ResourceMetaResourceRoutePolicy                      = NewResourceMetaResource(KindRoutePolicy, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceApdexSetting                     = NewResourceMetaResource(KindApdexSetting)
 	ResourceMetaResourceAuthDomain                       = NewResourceMetaResource(KindAuthDomain)
 	ResourceMetaResourceSession                          = NewResourceMetaResource(KindSession)
@@ -64,8 +64,8 @@ var (
 	ResourceMetaResourceOrgPreference                    = NewResourceMetaResource(KindOrgPreference)
 	ResourceMetaResourceQuickFilter                      = NewResourceMetaResource(KindQuickFilter, VerbList, VerbRead, VerbUpdate)
 	ResourceMetaResourceTTLSetting                       = NewResourceMetaResource(KindTTLSetting)
-	ResourceMetaResourceRule                             = NewResourceMetaResource(KindRule)
-	ResourceMetaResourcePlannedMaintenance               = NewResourceMetaResource(KindPlannedMaintenance)
+	ResourceMetaResourceRule                             = NewResourceMetaResource(KindRule, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
+	ResourceMetaResourcePlannedMaintenance               = NewResourceMetaResource(KindPlannedMaintenance, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceSavedView                        = NewResourceMetaResource(KindSavedView, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceTraceFunnel                      = NewResourceMetaResource(KindTraceFunnel)
 	ResourceMetaResourceFactorPassword                   = NewResourceMetaResource(KindFactorPassword)

pkg/types/ruletypes/list.go

@@ -0,0 +1,147 @@
+package ruletypes
+
+import (
+	"slices"
+	"unicode/utf8"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+const (
+	DefaultListLimit = 20
+	MaxListLimit     = 5000
+	MaxListQueryLen  = 1024
+)
+
+var ErrCodeRuleListInvalid = errors.MustNewCode("rule_list_invalid")
+
+type ListSort struct{ valuer.String }
+
+var (
+	ListSortUpdatedAt = ListSort{valuer.NewString("updated_at")}
+	ListSortCreatedAt = ListSort{valuer.NewString("created_at")}
+	ListSortName      = ListSort{valuer.NewString("name")}
+	ListSortState     = ListSort{valuer.NewString("state")}
+	ListSortSeverity  = ListSort{valuer.NewString("severity")}
+)
+
+func (ListSort) Enum() []any {
+	return []any{ListSortUpdatedAt, ListSortCreatedAt, ListSortName, ListSortState, ListSortSeverity}
+}
+
+func (s ListSort) IsValid() bool {
+	return slices.ContainsFunc(s.Enum(), func(v any) bool { return v == s })
+}
+
+type ListOrder struct{ valuer.String }
+
+var (
+	ListOrderAsc  = ListOrder{valuer.NewString("asc")}
+	ListOrderDesc = ListOrder{valuer.NewString("desc")}
+)
+
+func (ListOrder) Enum() []any {
+	return []any{ListOrderAsc, ListOrderDesc}
+}
+
+func (o ListOrder) IsValid() bool {
+	return slices.ContainsFunc(o.Enum(), func(v any) bool { return v == o })
+}
+
+// ListFilter is the rule listing state shared by the v3 list params and saved views.
+type ListFilter struct {
+	Query string `query:"query" json:"query"`
+	// gin cannot bind a slice of valuer enums; AlertStates converts these.
+	States []string  `query:"states" json:"states" nullable:"false"`
+	Sort   ListSort  `query:"sort" json:"sort"`
+	Order  ListOrder `query:"order" json:"order"`
+}
+
+// Validate normalizes in place; zero sort/order get the defaults, nil states an empty slice.
+func (f *ListFilter) Validate() error {
+	if f.States == nil {
+		f.States = []string{}
+	}
+
+	if n := utf8.RuneCountInString(f.Query); n > MaxListQueryLen {
+		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
+			"query cannot be longer than %d characters, got %d", MaxListQueryLen, n)
+	}
+
+	if _, err := f.AlertStates(); err != nil {
+		return err
+	}
+
+	if f.Sort.IsZero() {
+		f.Sort = ListSortUpdatedAt
+	} else if !f.Sort.IsValid() {
+		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
+			"invalid sort %q, expected one of: `updated_at`, `created_at`, `name`, `state`, `severity`", f.Sort)
+	}
+
+	if f.Order.IsZero() {
+		f.Order = ListOrderDesc
+	} else if !f.Order.IsValid() {
+		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
+			"invalid order %q, expected `asc` or `desc`", f.Order)
+	}
+
+	return nil
+}
+
+// AlertStates parses States; empty means no state filtering.
+func (f *ListFilter) AlertStates() ([]AlertState, error) {
+	if len(f.States) == 0 {
+		return nil, nil
+	}
+
+	states := make([]AlertState, 0, len(f.States))
+	for _, raw := range f.States {
+		state, err := parseAlertState(raw)
+		if err != nil {
+			return nil, err
+		}
+		states = append(states, state)
+	}
+
+	return states, nil
+}
+
+func parseAlertState(raw string) (AlertState, error) {
+	state := AlertState{valuer.NewString(raw)}
+	if !slices.Contains(state.Enum(), any(state)) {
+		return AlertState{}, errors.NewInvalidInputf(ErrCodeRuleListInvalid,
+			"invalid state %q, expected one of: `firing`, `pending`, `recovering`, `inactive`, `nodata`, `disabled`", raw)
+	}
+	return state, nil
+}
+
+type ListRulesParams struct {
+	ListFilter
+	Limit  int `query:"limit"`
+	Offset int `query:"offset"`
+}
+
+// Validate normalizes in place; an over-max limit is clamped, not rejected.
+func (p *ListRulesParams) Validate() error {
+	if err := p.ListFilter.Validate(); err != nil {
+		return err
+	}
+
+	if p.Limit == 0 {
+		p.Limit = DefaultListLimit
+	} else if p.Limit < 0 {
+		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
+			"invalid limit %d, must be a positive integer", p.Limit)
+	} else if p.Limit > MaxListLimit {
+		p.Limit = MaxListLimit
+	}
+
+	if p.Offset < 0 {
+		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
+			"invalid offset %d, must be a non-negative integer", p.Offset)
+	}
+
+	return nil
+}

pkg/types/ruletypes/list_filter.go

@@ -0,0 +1,100 @@
+package ruletypes
+
+import (
+	"slices"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+)
+
+var ErrCodeRuleListFilterInvalid = errors.MustNewCode("rule_list_filter_invalid")
+
+// DSLKey is a reserved (column-level) key in the rule list filter DSL.
+type DSLKey string
+
+const (
+	DSLKeyName      DSLKey = "name"
+	DSLKeySeverity  DSLKey = "severity"
+	DSLKeyCreatedBy DSLKey = "created_by"
+	DSLKeyUpdatedBy DSLKey = "updated_by"
+	DSLKeyCreatedAt DSLKey = "created_at"
+	DSLKeyUpdatedAt DSLKey = "updated_at"
+	DSLKeyAlertType DSLKey = "alert_type"
+	DSLKeyRuleType  DSLKey = "rule_type"
+
+	// Label keys under this prefix are matched exactly (case-sensitive).
+	DSLLabelsKeyPrefix = "labels."
+
+	// Advertised in reservedKeywords; not itself a filterable key.
+	DSLKeyLabelsPlaceholder DSLKey = "labels.<key>"
+)
+
+func ReservedFilterKeys() []DSLKey {
+	keys := make([]DSLKey, 0, len(ReservedOps)+1)
+	for key := range ReservedOps {
+		keys = append(keys, key)
+	}
+	keys = append(keys, DSLKeyLabelsPlaceholder)
+	slices.SortFunc(keys, func(a, b DSLKey) int {
+		return strings.Compare(string(a), string(b))
+	})
+	return keys
+}
+
+// ReservedOps lists the operators each reserved DSL key accepts; `labels.<key>` terms use LabelsKeyOps.
+var ReservedOps = map[DSLKey]map[qbtypesv5.FilterOperator]struct{}{
+	DSLKeyName: stringSearchOps(),
+	// severity aliases labels.severity, so it takes the labels operator set.
+	DSLKeySeverity:  LabelsKeyOps,
+	DSLKeyCreatedBy: stringSearchOps(),
+	DSLKeyUpdatedBy: stringSearchOps(),
+	DSLKeyCreatedAt: numericRangeOps(),
+	DSLKeyUpdatedAt: numericRangeOps(),
+	DSLKeyAlertType: enumOps(),
+	DSLKeyRuleType:  enumOps(),
+}
+
+// LabelsKeyOps operators target the label's value; EXISTS/NOT EXISTS test its presence.
+var LabelsKeyOps = opsSet(
+	qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
+	qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike,
+	qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike,
+	qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains,
+	qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn,
+	qbtypesv5.FilterOperatorExists, qbtypesv5.FilterOperatorNotExists,
+)
+
+func stringSearchOps() map[qbtypesv5.FilterOperator]struct{} {
+	return opsSet(
+		qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
+		qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike,
+		qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike,
+		qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains,
+		qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn,
+	)
+}
+
+func numericRangeOps() map[qbtypesv5.FilterOperator]struct{} {
+	return opsSet(
+		qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
+		qbtypesv5.FilterOperatorLessThan, qbtypesv5.FilterOperatorLessThanOrEq,
+		qbtypesv5.FilterOperatorGreaterThan, qbtypesv5.FilterOperatorGreaterThanOrEq,
+		qbtypesv5.FilterOperatorBetween, qbtypesv5.FilterOperatorNotBetween,
+	)
+}
+
+func enumOps() map[qbtypesv5.FilterOperator]struct{} {
+	return opsSet(
+		qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
+		qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn,
+	)
+}
+
+func opsSet(ops ...qbtypesv5.FilterOperator) map[qbtypesv5.FilterOperator]struct{} {
+	m := make(map[qbtypesv5.FilterOperator]struct{}, len(ops))
+	for _, op := range ops {
+		m[op] = struct{}{}
+	}
+	return m
+}

pkg/types/ruletypes/list_filter_test.go

@@ -0,0 +1,34 @@
+package ruletypes
+
+import (
+	"testing"
+
+	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestReservedFilterKeys(t *testing.T) {
+	assert.Equal(t, []DSLKey{
+		DSLKeyAlertType,
+		DSLKeyCreatedAt,
+		DSLKeyCreatedBy,
+		DSLKeyLabelsPlaceholder,
+		DSLKeyName,
+		DSLKeyRuleType,
+		DSLKeySeverity,
+		DSLKeyUpdatedAt,
+		DSLKeyUpdatedBy,
+	}, ReservedFilterKeys())
+}
+
+func TestFilterOpsExcludeRegexp(t *testing.T) {
+	for key, ops := range ReservedOps {
+		assert.NotEmpty(t, ops, "key %q has no operators", key)
+		assert.NotContains(t, ops, qbtypesv5.FilterOperatorRegexp, "key %q allows REGEXP", key)
+		assert.NotContains(t, ops, qbtypesv5.FilterOperatorNotRegexp, "key %q allows NOT REGEXP", key)
+	}
+	assert.NotContains(t, LabelsKeyOps, qbtypesv5.FilterOperatorRegexp)
+	assert.NotContains(t, LabelsKeyOps, qbtypesv5.FilterOperatorNotRegexp)
+	assert.Contains(t, LabelsKeyOps, qbtypesv5.FilterOperatorExists)
+	assert.Contains(t, LabelsKeyOps, qbtypesv5.FilterOperatorNotExists)
+}

pkg/types/ruletypes/list_test.go

@@ -0,0 +1,126 @@
+package ruletypes
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestListRulesParamsValidate(t *testing.T) {
+	testCases := []struct {
+		name      string
+		params    ListRulesParams
+		wantErr   string
+		wantSort  ListSort
+		wantOrder ListOrder
+		wantLimit int
+	}{
+		{
+			name:      "empty params get defaults",
+			params:    ListRulesParams{},
+			wantSort:  ListSortUpdatedAt,
+			wantOrder: ListOrderDesc,
+			wantLimit: DefaultListLimit,
+		},
+		{
+			name:      "explicit values kept",
+			params:    ListRulesParams{ListFilter: ListFilter{Sort: ListSortSeverity, Order: ListOrderAsc}, Limit: 50, Offset: 100},
+			wantSort:  ListSortSeverity,
+			wantOrder: ListOrderAsc,
+			wantLimit: 50,
+		},
+		{
+			name:      "over-max limit clamped",
+			params:    ListRulesParams{Limit: MaxListLimit + 1},
+			wantSort:  ListSortUpdatedAt,
+			wantOrder: ListOrderDesc,
+			wantLimit: MaxListLimit,
+		},
+		{
+			name:    "invalid state rejected",
+			params:  ListRulesParams{ListFilter: ListFilter{States: []string{"bogus"}}},
+			wantErr: `invalid state "bogus"`,
+		},
+		{
+			name:    "invalid sort rejected",
+			params:  ListRulesParams{ListFilter: ListFilter{Sort: ListSort{valuer.NewString("bogus")}}},
+			wantErr: "invalid sort",
+		},
+		{
+			name:    "invalid order rejected",
+			params:  ListRulesParams{ListFilter: ListFilter{Order: ListOrder{valuer.NewString("bogus")}}},
+			wantErr: "invalid order",
+		},
+		{
+			name:    "negative limit rejected",
+			params:  ListRulesParams{Limit: -1},
+			wantErr: "invalid limit",
+		},
+		{
+			name:    "negative offset rejected",
+			params:  ListRulesParams{Offset: -1},
+			wantErr: "invalid offset",
+		},
+		{
+			name:    "over-long query rejected",
+			params:  ListRulesParams{ListFilter: ListFilter{Query: strings.Repeat("a", MaxListQueryLen+1)}},
+			wantErr: "query cannot be longer",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.params.Validate()
+			if tc.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantSort, tc.params.Sort)
+			assert.Equal(t, tc.wantOrder, tc.params.Order)
+			assert.Equal(t, tc.wantLimit, tc.params.Limit)
+		})
+	}
+}
+
+func TestListRulesParamsAlertStates(t *testing.T) {
+	testCases := []struct {
+		name       string
+		states     []string
+		wantErr    string
+		wantStates []AlertState
+	}{
+		{
+			name:       "valid states parsed to typed values",
+			states:     []string{"firing", "pending"},
+			wantStates: []AlertState{StateFiring, StatePending},
+		},
+		{
+			name:   "absent states mean no filtering",
+			states: nil,
+		},
+		{
+			name:    "invalid state rejected",
+			states:  []string{"bogus"},
+			wantErr: `invalid state "bogus"`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			params := ListRulesParams{ListFilter: ListFilter{States: tc.states}}
+			states, err := params.AlertStates()
+			if tc.wantErr != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tc.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantStates, states)
+		})
+	}
+}

pkg/types/ruletypes/listable_rule.go

@@ -0,0 +1,162 @@
+package ruletypes
+
+import (
+	"cmp"
+	"encoding/json"
+	"slices"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/types"
+)
+
+const MaxListLabelPairs = 1000
+
+// ListableRule is the slim per-row shape of the list endpoint; the full rule stays behind get-by-id.
+type ListableRule struct {
+	Id          string            `json:"id" required:"true"`
+	State       AlertState        `json:"state" required:"true"`
+	AlertName   string            `json:"alert" required:"true"`
+	Description string            `json:"description,omitempty"`
+	AlertType   AlertType         `json:"alertType" required:"true"`
+	RuleType    RuleType          `json:"ruleType" required:"true"`
+	Disabled    bool              `json:"disabled"`
+	Labels      map[string]string `json:"labels,omitempty"`
+	types.TimeAuditable
+	types.UserAuditable
+}
+
+func NewListableRule(rule *GettableRule) *ListableRule {
+	listable := &ListableRule{
+		Id:          rule.Id,
+		State:       rule.State,
+		AlertName:   rule.AlertName,
+		Description: rule.Description,
+		AlertType:   rule.AlertType,
+		RuleType:    rule.RuleType,
+		Disabled:    rule.Disabled,
+		Labels:      rule.Labels,
+		TimeAuditable: types.TimeAuditable{
+			CreatedAt: rule.CreatedAt,
+			UpdatedAt: rule.UpdatedAt,
+		},
+	}
+	if rule.CreatedBy != nil {
+		listable.CreatedBy = *rule.CreatedBy
+	}
+	if rule.UpdatedBy != nil {
+		listable.UpdatedBy = *rule.UpdatedBy
+	}
+	return listable
+}
+
+// LabelPair is one distinct label key/value observed on the org's rules.
+type LabelPair struct {
+	Key   string `json:"key" required:"true"`
+	Value string `json:"value" required:"true"`
+}
+
+type ListableRules struct {
+	Rules            []*ListableRule `json:"rules" required:"true" nullable:"false"`
+	Total            int64           `json:"total" required:"true"`
+	Labels           []LabelPair     `json:"labels" required:"true" nullable:"false"`
+	ReservedKeywords []DSLKey        `json:"reservedKeywords" required:"true" nullable:"false"`
+}
+
+func NewListableRules(rules []*ListableRule, total int64, labels []LabelPair) *ListableRules {
+	return &ListableRules{
+		Rules:            rules,
+		Total:            total,
+		Labels:           labels,
+		ReservedKeywords: ReservedFilterKeys(),
+	}
+}
+
+// Display priority, worst first; NOT AlertState.Severity(), which ranks disabled/nodata above firing.
+var stateDisplayRank = map[AlertState]int{
+	StateFiring:     5,
+	StatePending:    4,
+	StateRecovering: 3,
+	StateNoData:     2,
+	StateInactive:   1,
+	StateDisabled:   0,
+}
+
+var severityDisplayRank = map[string]int{
+	"critical": 4,
+	"error":    3,
+	"warning":  2,
+	"info":     1,
+}
+
+// Ties break on name then id ascending (order applies to the primary key only) so pages stay stable.
+func SortListableRules(rules []*ListableRule, sortBy ListSort, order ListOrder) {
+	direction := 1
+	if order == ListOrderDesc {
+		direction = -1
+	}
+	slices.SortStableFunc(rules, func(a, b *ListableRule) int {
+		if c := direction * compareListableRules(a, b, sortBy); c != 0 {
+			return c
+		}
+		if c := strings.Compare(strings.ToLower(a.AlertName), strings.ToLower(b.AlertName)); c != 0 {
+			return c
+		}
+		return strings.Compare(a.Id, b.Id)
+	})
+}
+
+func compareListableRules(a, b *ListableRule, sortBy ListSort) int {
+	switch sortBy {
+	case ListSortName:
+		return strings.Compare(strings.ToLower(a.AlertName), strings.ToLower(b.AlertName))
+	case ListSortCreatedAt:
+		return a.CreatedAt.Compare(b.CreatedAt)
+	case ListSortState:
+		return cmp.Compare(stateDisplayRank[a.State], stateDisplayRank[b.State])
+	case ListSortSeverity:
+		severityA := a.Labels["severity"]
+		severityB := b.Labels["severity"]
+		rankA := severityDisplayRank[strings.ToLower(severityA)]
+		rankB := severityDisplayRank[strings.ToLower(severityB)]
+		if rankA != rankB {
+			return cmp.Compare(rankA, rankB)
+		}
+		if rankA == 0 {
+			return strings.Compare(strings.ToLower(severityA), strings.ToLower(severityB))
+		}
+		return 0
+	}
+	return a.UpdatedAt.Compare(b.UpdatedAt)
+}
+
+// NewLabelPairsFromRawJSON skips blank or malformed entries and caps the result at limit.
+func NewLabelPairsFromRawJSON(raws []string, limit int) []LabelPair {
+	set := make(map[LabelPair]struct{})
+	for _, raw := range raws {
+		if raw == "" || raw == "null" {
+			continue
+		}
+		labels := make(map[string]string)
+		if err := json.Unmarshal([]byte(raw), &labels); err != nil {
+			continue
+		}
+		for key, value := range labels {
+			set[LabelPair{Key: key, Value: value}] = struct{}{}
+		}
+	}
+
+	pairs := make([]LabelPair, 0, len(set))
+	for pair := range set {
+		pairs = append(pairs, pair)
+	}
+	slices.SortFunc(pairs, func(a, b LabelPair) int {
+		if c := strings.Compare(a.Key, b.Key); c != 0 {
+			return c
+		}
+		return strings.Compare(a.Value, b.Value)
+	})
+	if len(pairs) > limit {
+		pairs = pairs[:limit]
+	}
+	return pairs
+}

pkg/types/ruletypes/listable_rule_test.go

@@ -0,0 +1,163 @@
+package ruletypes
+
+import (
+	"testing"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/stretchr/testify/assert"
+)
+
+func listableRule(name string, state AlertState, severity string, updatedAt time.Time) *ListableRule {
+	rule := &ListableRule{
+		AlertName: name,
+		State:     state,
+		TimeAuditable: types.TimeAuditable{
+			UpdatedAt: updatedAt,
+		},
+	}
+	if severity != "" {
+		rule.Labels = map[string]string{"severity": severity}
+	}
+	return rule
+}
+
+func names(rules []*ListableRule) []string {
+	out := make([]string, 0, len(rules))
+	for _, rule := range rules {
+		out = append(out, rule.AlertName)
+	}
+	return out
+}
+
+func TestSortListableRules(t *testing.T) {
+	base := time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC)
+
+	testCases := []struct {
+		name      string
+		rules     []*ListableRule
+		sortBy    ListSort
+		order     ListOrder
+		wantNames []string
+	}{
+		{
+			name: "state desc is display priority firing first",
+			rules: []*ListableRule{
+				listableRule("disabled", StateDisabled, "", base),
+				listableRule("nodata", StateNoData, "", base),
+				listableRule("firing", StateFiring, "", base),
+				listableRule("inactive", StateInactive, "", base),
+				listableRule("pending", StatePending, "", base),
+				listableRule("recovering", StateRecovering, "", base),
+			},
+			sortBy:    ListSortState,
+			order:     ListOrderDesc,
+			wantNames: []string{"firing", "pending", "recovering", "nodata", "inactive", "disabled"},
+		},
+		{
+			name: "severity desc ranks known values then custom ones lexically",
+			rules: []*ListableRule{
+				listableRule("warn", StateInactive, "warning", base),
+				listableRule("custom-b", StateInactive, "bbb", base),
+				listableRule("crit", StateInactive, "critical", base),
+				listableRule("custom-a", StateInactive, "aaa", base),
+				listableRule("none", StateInactive, "", base),
+			},
+			sortBy: ListSortSeverity,
+			order:  ListOrderDesc,
+			// desc flips the lexical compare between custom values too
+			wantNames: []string{"crit", "warn", "custom-b", "custom-a", "none"},
+		},
+		{
+			name: "name asc is case-insensitive",
+			rules: []*ListableRule{
+				listableRule("banana", StateInactive, "", base),
+				listableRule("Apple", StateInactive, "", base),
+				listableRule("cherry", StateInactive, "", base),
+			},
+			sortBy:    ListSortName,
+			order:     ListOrderAsc,
+			wantNames: []string{"Apple", "banana", "cherry"},
+		},
+		{
+			name: "updated_at desc puts newest first",
+			rules: []*ListableRule{
+				listableRule("old", StateInactive, "", base),
+				listableRule("new", StateInactive, "", base.Add(time.Hour)),
+			},
+			sortBy:    ListSortUpdatedAt,
+			order:     ListOrderDesc,
+			wantNames: []string{"new", "old"},
+		},
+		{
+			name: "state desc ties break on name asc",
+			rules: []*ListableRule{
+				listableRule("banana", StateFiring, "", base),
+				listableRule("zebra", StateDisabled, "", base),
+				listableRule("Apple", StateFiring, "", base),
+				listableRule("cherry", StateFiring, "", base),
+			},
+			sortBy:    ListSortState,
+			order:     ListOrderDesc,
+			wantNames: []string{"Apple", "banana", "cherry", "zebra"},
+		},
+		{
+			name: "state asc flips buckets but tiebreak stays name asc",
+			rules: []*ListableRule{
+				listableRule("banana", StateFiring, "", base),
+				listableRule("zebra", StateDisabled, "", base),
+				listableRule("Apple", StateFiring, "", base),
+				listableRule("cherry", StateFiring, "", base),
+			},
+			sortBy:    ListSortState,
+			order:     ListOrderAsc,
+			wantNames: []string{"zebra", "Apple", "banana", "cherry"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			SortListableRules(tc.rules, tc.sortBy, tc.order)
+			assert.Equal(t, tc.wantNames, names(tc.rules))
+		})
+	}
+}
+
+func TestSortListableRulesIdTiebreak(t *testing.T) {
+	base := time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC)
+
+	for _, order := range []ListOrder{ListOrderAsc, ListOrderDesc} {
+		t.Run(order.StringValue(), func(t *testing.T) {
+			older := listableRule("dup", StateFiring, "", base)
+			older.Id = "01aaa"
+			newer := listableRule("dup", StateFiring, "", base)
+			newer.Id = "01bbb"
+
+			rules := []*ListableRule{newer, older}
+			SortListableRules(rules, ListSortState, order)
+			assert.Equal(t, []string{"01aaa", "01bbb"}, []string{rules[0].Id, rules[1].Id})
+		})
+	}
+}
+
+func TestNewLabelPairsFromRawJSON(t *testing.T) {
+	pairs := NewLabelPairsFromRawJSON([]string{
+		`{"team":"infra","severity":"critical"}`,
+		`{"team":"infra"}`,
+		`{"team":"payments"}`,
+		"",
+		"null",
+		"not-json",
+	}, MaxListLabelPairs)
+
+	assert.Equal(t, []LabelPair{
+		{Key: "severity", Value: "critical"},
+		{Key: "team", Value: "infra"},
+		{Key: "team", Value: "payments"},
+	}, pairs)
+}
+
+func TestNewLabelPairsFromRawJSONCap(t *testing.T) {
+	pairs := NewLabelPairsFromRawJSON([]string{`{"a":"1","b":"2","c":"3"}`}, 2)
+	assert.Len(t, pairs, 2)
+}

pkg/types/ruletypes/rule.go

@@ -11,7 +11,8 @@ import (
 )
 
 type StorableRule struct {
-	bun.BaseModel `bun:"table:rule"`
+	// The alias must stay rule: the list filter compiler emits rule.<col> refs.
+	bun.BaseModel `bun:"table:rule,alias:rule"`
 	types.Identifiable
 	types.TimeAuditable
 	types.UserAuditable
@@ -58,6 +59,16 @@ type RuleStore interface {
 	EditRule(context.Context, *StorableRule, func(context.Context) error) error
 	DeleteRule(context.Context, valuer.UUID, valuer.UUID, func(context.Context) error) error
 	GetStoredRules(context.Context, string) ([]*StorableRule, error)
+	// GetStoredRulesMatching returns the org's rules matching a list filter query; an empty query matches all.
+	GetStoredRulesMatching(context.Context, string, string) ([]*StorableRule, error)
+	// GetStoredRuleLabels returns each rule's labels as raw JSON text, empty string when absent.
+	GetStoredRuleLabels(context.Context, string) ([]string, error)
 	GetStoredRule(context.Context, valuer.UUID, valuer.UUID) (*StorableRule, error)
 	GetStoredRulesByMetricName(context.Context, string, string) ([]RuleAlert, error)
+
+	CreateRuleView(context.Context, *RuleView) error
+	GetRuleView(context.Context, valuer.UUID, valuer.UUID) (*RuleView, error)
+	ListRuleViews(context.Context, valuer.UUID) ([]*RuleView, error)
+	UpdateRuleView(context.Context, *RuleView) error
+	DeleteRuleView(context.Context, valuer.UUID, valuer.UUID) error
 }

pkg/types/ruletypes/rule_view.go

@@ -0,0 +1,110 @@
+package ruletypes
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/uptrace/bun"
+)
+
+const (
+	RuleViewSchemaVersion = "v1"
+	MaxRuleViewNameLen    = 64
+)
+
+var (
+	ErrCodeRuleViewInvalidInput = errors.MustNewCode("rule_view_invalid_input")
+	ErrCodeRuleViewNotFound     = errors.MustNewCode("rule_view_not_found")
+)
+
+type RuleView struct {
+	bun.BaseModel `bun:"table:rule_view,alias:rule_view"`
+
+	types.Identifiable
+	types.TimeAuditable
+
+	Name  string       `bun:"name,type:text,notnull" json:"name" required:"true"`
+	Data  RuleViewData `bun:"data,type:text,notnull" json:"data" required:"true"`
+	OrgID valuer.UUID  `bun:"org_id,type:text,notnull" json:"orgId" required:"true"`
+}
+
+// RuleViewData holds the rule listing state (ListRulesParams minus pagination) a view replays.
+type RuleViewData struct {
+	Version string `json:"version" required:"true"`
+	ListFilter
+}
+
+func (d *RuleViewData) Validate() error {
+	if d.Version != RuleViewSchemaVersion {
+		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput,
+			"version must be %q, got %q", RuleViewSchemaVersion, d.Version)
+	}
+	return d.ListFilter.Validate()
+}
+
+type PostableRuleView struct {
+	Name string       `json:"name" required:"true"`
+	Data RuleViewData `json:"data" required:"true"`
+}
+
+func (p *PostableRuleView) UnmarshalJSON(data []byte) error {
+	dec := json.NewDecoder(bytes.NewReader(data))
+	dec.DisallowUnknownFields()
+	type alias PostableRuleView
+	var tmp alias
+	if err := dec.Decode(&tmp); err != nil {
+		return errors.WrapInvalidInputf(err, ErrCodeRuleViewInvalidInput, "invalid saved view request body").WithAdditional(err.Error())
+	}
+	*p = PostableRuleView(tmp)
+	return p.Validate()
+}
+
+func (p *PostableRuleView) Validate() error {
+	if err := validateRuleViewName(p.Name); err != nil {
+		return err
+	}
+	return p.Data.Validate()
+}
+
+func (p PostableRuleView) NewRuleView(orgID valuer.UUID) *RuleView {
+	now := time.Now()
+	return &RuleView{
+		Identifiable:  types.Identifiable{ID: valuer.GenerateUUID()},
+		TimeAuditable: types.TimeAuditable{CreatedAt: now, UpdatedAt: now},
+		OrgID:         orgID,
+		Name:          p.Name,
+		Data:          p.Data,
+	}
+}
+
+type UpdatableRuleView = PostableRuleView
+
+func (v *RuleView) Update(updateable UpdatableRuleView) {
+	v.Name = updateable.Name
+	v.Data = updateable.Data
+	v.UpdatedAt = time.Now()
+}
+
+type ListableRuleViews struct {
+	Views []*RuleView `json:"views" required:"true" nullable:"false"`
+}
+
+func validateRuleViewName(name string) error {
+	if strings.TrimSpace(name) == "" {
+		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput, "name is required")
+	}
+	if name != strings.TrimSpace(name) {
+		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput, "name must not have leading or trailing whitespace")
+	}
+	if n := utf8.RuneCountInString(name); n > MaxRuleViewNameLen {
+		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput,
+			"name must be at most %d characters, got %d", MaxRuleViewNameLen, n)
+	}
+	return nil
+}

pkg/types/ruletypes/rule_view_test.go

@@ -0,0 +1,184 @@
+package ruletypes
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRuleViewDataValidate(t *testing.T) {
+	cases := []struct {
+		description string
+		data        RuleViewData
+		expectError bool
+	}{
+		{
+			description: "valid with all fields set",
+			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Query: "name CONTAINS 'prod'", States: []string{"firing", "pending"}, Sort: ListSortName, Order: ListOrderAsc}},
+			expectError: false,
+		},
+		{
+			description: "valid with zero states, sort and order",
+			data:        RuleViewData{Version: RuleViewSchemaVersion},
+			expectError: false,
+		},
+		{
+			description: "query over the cap is rejected",
+			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Query: strings.Repeat("x", MaxListQueryLen+1)}},
+			expectError: true,
+		},
+		{
+			description: "wrong version is rejected",
+			data:        RuleViewData{Version: "v2"},
+			expectError: true,
+		},
+		{
+			description: "empty version is rejected",
+			data:        RuleViewData{},
+			expectError: true,
+		},
+		{
+			description: "unknown state is rejected",
+			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{States: []string{"exploding"}}},
+			expectError: true,
+		},
+		{
+			description: "unknown sort is rejected",
+			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Sort: ListSort{valuer.NewString("bogus")}}},
+			expectError: true,
+		},
+		{
+			description: "unknown order is rejected",
+			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Order: ListOrder{valuer.NewString("sideways")}}},
+			expectError: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			err := c.data.Validate()
+			if c.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestRuleViewDataValidateDefaults(t *testing.T) {
+	data := RuleViewData{Version: RuleViewSchemaVersion}
+	require.NoError(t, data.Validate())
+	assert.Equal(t, ListSortUpdatedAt, data.Sort)
+	assert.Equal(t, ListOrderDesc, data.Order)
+	assert.Equal(t, []string{}, data.States)
+}
+
+func TestPostableRuleViewUnmarshalJSON(t *testing.T) {
+	cases := []struct {
+		description    string
+		body           string
+		expectError    bool
+		expectedErrMsg string
+		expectedName   string
+	}{
+		{
+			description:  "valid body keeps name as-is",
+			body:         `{"name":"my view","data":{"version":"v1","query":"severity = 'critical'","states":["firing"],"sort":"name","order":"asc"}}`,
+			expectError:  false,
+			expectedName: "my view",
+		},
+		{
+			description:    "name with surrounding whitespace is rejected",
+			body:           `{"name":"  my view  ","data":{"version":"v1"}}`,
+			expectError:    true,
+			expectedErrMsg: "name must not have leading or trailing whitespace",
+		},
+		{
+			description: "unknown field is rejected",
+			body:        `{"name":"my view","data":{"version":"v1"},"extra":true}`,
+			expectError: true,
+		},
+		{
+			description:    "blank name is rejected",
+			body:           `{"name":"   ","data":{"version":"v1"}}`,
+			expectError:    true,
+			expectedErrMsg: "name is required",
+		},
+		{
+			description:    "name over max length is rejected",
+			body:           `{"name":"` + strings.Repeat("x", MaxRuleViewNameLen+1) + `","data":{"version":"v1"}}`,
+			expectError:    true,
+			expectedErrMsg: "name must be at most",
+		},
+		{
+			description: "invalid data version is rejected",
+			body:        `{"name":"my view","data":{"version":"v9"}}`,
+			expectError: true,
+		},
+		{
+			description:    "invalid state is rejected",
+			body:           `{"name":"my view","data":{"version":"v1","states":["exploding"]}}`,
+			expectError:    true,
+			expectedErrMsg: "invalid state",
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.description, func(t *testing.T) {
+			var p PostableRuleView
+			err := json.Unmarshal([]byte(c.body), &p)
+			if c.expectError {
+				assert.Error(t, err)
+				if c.expectedErrMsg != "" {
+					assert.ErrorContains(t, err, c.expectedErrMsg)
+				}
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, c.expectedName, p.Name)
+		})
+	}
+}
+
+func TestPostableRuleViewNewRuleView(t *testing.T) {
+	orgID := valuer.GenerateUUID()
+	postable := PostableRuleView{
+		Name: "my view",
+		Data: RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{States: []string{"firing"}, Sort: ListSortName, Order: ListOrderAsc}},
+	}
+
+	view := postable.NewRuleView(orgID)
+
+	assert.Equal(t, orgID, view.OrgID)
+	assert.Equal(t, "my view", view.Name)
+	assert.Equal(t, postable.Data, view.Data)
+	assert.False(t, view.ID.IsZero())
+	assert.False(t, view.CreatedAt.IsZero())
+	assert.Equal(t, view.CreatedAt, view.UpdatedAt)
+}
+
+func TestRuleViewUpdate(t *testing.T) {
+	orgID := valuer.GenerateUUID()
+	view := PostableRuleView{
+		Name: "original",
+		Data: RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Sort: ListSortName, Order: ListOrderAsc}},
+	}.NewRuleView(orgID)
+	createdAt := view.CreatedAt
+
+	view.Update(UpdatableRuleView{
+		Name: "renamed",
+		Data: RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{States: []string{"disabled"}, Sort: ListSortCreatedAt, Order: ListOrderDesc}},
+	})
+
+	assert.Equal(t, "renamed", view.Name)
+	assert.Equal(t, []string{"disabled"}, view.Data.States)
+	assert.Equal(t, ListSortCreatedAt, view.Data.Sort)
+	assert.Equal(t, ListOrderDesc, view.Data.Order)
+	assert.Equal(t, createdAt, view.CreatedAt)
+	assert.True(t, view.UpdatedAt.After(createdAt))
+}

tests/fixtures/alerts.py

@@ -19,6 +19,7 @@ from fixtures.logger import setup_logger
 from fixtures.logs import Logs
 from fixtures.maildev import get_all_mails, verify_email_received
 from fixtures.metrics import Metrics
+from fixtures.notification_channel import ensure_notification_channel
 from fixtures.traces import Traces
 
 logger = setup_logger(__name__)
@@ -88,6 +89,70 @@ def create_alert_rule_with_channel(
     return _create_alert_rule_with_channel
 
 
+def delete_all_rules(signoz: types.SigNoz, token: str) -> None:
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/rules"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    for rule in response.json()["data"]:
+        delete_response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"/api/v1/rules/{rule['id']}"),
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert delete_response.status_code == HTTPStatus.OK, f"failed to delete rule {rule['id']}: {delete_response.text}"
+
+
+@pytest.fixture(name="seed_alert_rules", scope="function")
+def seed_alert_rules(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    create_alert_rule: Callable[[dict], str],
+) -> Callable[[dict, list[dict]], None]:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Cleanup is owned by create_alert_rule, which deletes the rules it created.
+    def _seed_alert_rules(channel_config: dict, rules: list[dict]) -> None:
+        delete_all_rules(signoz, admin_token)
+        ensure_notification_channel(signoz, admin_token, channel_config)
+        for rule in rules:
+            create_alert_rule(rule)
+
+    return _seed_alert_rules
+
+
+@pytest.fixture(name="create_rule_view", scope="function")
+def create_rule_view(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> Callable[[dict], dict]:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    view_ids = []
+
+    def _create_rule_view(view: dict) -> dict:
+        response = requests.post(
+            signoz.self.host_configs["8080"].get("/api/v2/rule_views"),
+            json=view,
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.CREATED, f"Failed to create rule view, api returned {response.status_code} with response: {response.text}"
+        created = response.json()["data"]
+        view_ids.append(created["id"])
+        return created
+
+    yield _create_rule_view
+    # A view the test already deleted returns 404; only real failures are logged.
+    for view_id in view_ids:
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"/api/v2/rule_views/{view_id}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        if response.status_code not in (HTTPStatus.NO_CONTENT, HTTPStatus.NOT_FOUND):
+            logger.error("Error deleting rule view: %s", {"view_id": view_id, "response": response.text})
+
+
 def labels_to_map(labels: list[dict]) -> dict[str, str]:
     """Converts the label list shape of the v2 rule history APIs to a plain map."""
     return {label["key"]["name"]: label["value"] for label in labels or []}

tests/fixtures/notification_channel.py

@@ -35,6 +35,26 @@ EMAIL_TRANSPORT_KEYS = [
 ]
 
 
+def ensure_notification_channel(signoz: types.SigNoz, token: str, channel_config: dict) -> None:
+    # Deliberately no teardown: the stock channel fixture's teardown is broken, so channels are reused idempotently.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/channels"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    if channel_config["name"] in [channel["name"] for channel in response.json()["data"] or []]:
+        return
+
+    create_response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v1/channels"),
+        json=channel_config,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert create_response.status_code == HTTPStatus.CREATED, f"failed to create channel: {create_response.text}"
+
+
 def assert_email_channel_payload_clean(payload: str) -> None:
     receiver = json.loads(payload)
     for email_config in receiver["email_configs"]:

tests/integration/tests/alerts/06_list_rules_v3.py

@@ -0,0 +1,542 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.types import Operation, SigNoz
+
+BASE_URL = "/api/v3/rules"
+
+SEED_CHANNEL = {"name": "list-rules-v3-channel", "email_configs": [{"to": "list-rules-v3@integration.test"}]}
+
+EVALUATION = {"kind": "rolling", "spec": {"evalWindow": "5m0s", "frequency": "1m"}}
+
+NOTIFICATION_SETTINGS = {
+    "groupBy": [],
+    "usePolicy": False,
+    "renotify": {"enabled": False, "interval": "30m", "alertStates": []},
+}
+
+METRIC_CONDITION = {
+    "thresholds": {
+        "kind": "basic",
+        "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": ["list-rules-v3-channel"]}],
+    },
+    "compositeQuery": {
+        "queryType": "builder",
+        "panelType": "graph",
+        "queries": [
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "metrics",
+                    "aggregations": [{"metricName": "list_rules_v3_cpu", "timeAggregation": "avg", "spaceAggregation": "max"}],
+                },
+            }
+        ],
+    },
+    "selectedQueryName": "A",
+}
+
+LOGS_CONDITION = {
+    "thresholds": {
+        "kind": "basic",
+        "spec": [{"name": "critical", "target": 100, "matchType": "at_least_once", "op": "above", "channels": ["list-rules-v3-channel"]}],
+    },
+    "compositeQuery": {
+        "queryType": "builder",
+        "panelType": "graph",
+        "queries": [
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "logs",
+                    "aggregations": [{"expression": "count()"}],
+                    "filter": {"expression": ""},
+                },
+            }
+        ],
+    },
+    "selectedQueryName": "A",
+}
+
+PROMQL_CONDITION = {
+    "thresholds": {
+        "kind": "basic",
+        "spec": [{"name": "critical", "target": 1, "matchType": "at_least_once", "op": "below", "channels": ["list-rules-v3-channel"]}],
+    },
+    "compositeQuery": {
+        "queryType": "promql",
+        "panelType": "graph",
+        "queries": [{"type": "promql", "spec": {"name": "A", "query": '{"list_rules_v3_up"}'}}],
+    },
+    "selectedQueryName": "A",
+}
+
+SEED_RULES = [
+    {
+        "alert": "payment latency high",
+        "description": "p99 latency guard",
+        "alertType": "METRIC_BASED_ALERT",
+        "ruleType": "threshold_rule",
+        "condition": METRIC_CONDITION,
+        "labels": {"severity": "critical", "team": "payments", "k8s.cluster": "prod-1"},
+        "annotations": {"summary": "s", "description": "d"},
+        "evaluation": EVALUATION,
+        "notificationSettings": NOTIFICATION_SETTINGS,
+        "version": "v5",
+        "schemaVersion": "v2alpha1",
+    },
+    {
+        "alert": "payment gateway errors",
+        "description": "error rate watch",
+        "alertType": "LOGS_BASED_ALERT",
+        "ruleType": "threshold_rule",
+        "condition": LOGS_CONDITION,
+        "labels": {"severity": "warning", "team": "payments"},
+        "annotations": {"summary": "s", "description": "d"},
+        "evaluation": EVALUATION,
+        "notificationSettings": NOTIFICATION_SETTINGS,
+        "version": "v5",
+        "schemaVersion": "v2alpha1",
+    },
+    {
+        "alert": "checkout conversion drop",
+        "description": "funnel watcher",
+        "alertType": "METRIC_BASED_ALERT",
+        "ruleType": "threshold_rule",
+        "condition": METRIC_CONDITION,
+        "labels": {"severity": "important", "team": "checkout"},
+        "annotations": {"summary": "s", "description": "d"},
+        "disabled": True,
+        "evaluation": EVALUATION,
+        "notificationSettings": NOTIFICATION_SETTINGS,
+        "version": "v5",
+        "schemaVersion": "v2alpha1",
+    },
+    {
+        "alert": "infra cpu saturation",
+        "description": "node headroom",
+        "alertType": "METRIC_BASED_ALERT",
+        "ruleType": "threshold_rule",
+        "condition": METRIC_CONDITION,
+        "labels": {"team": "infra"},
+        "annotations": {"summary": "s", "description": "d"},
+        "evaluation": EVALUATION,
+        "notificationSettings": NOTIFICATION_SETTINGS,
+        "version": "v5",
+        "schemaVersion": "v2alpha1",
+    },
+    {
+        "alert": "prom uptime probe",
+        "description": "blackbox liveness",
+        "alertType": "METRIC_BASED_ALERT",
+        "ruleType": "promql_rule",
+        "condition": PROMQL_CONDITION,
+        "labels": {},
+        "annotations": {"summary": "s", "description": "d"},
+        "evaluation": EVALUATION,
+        "notificationSettings": NOTIFICATION_SETTINGS,
+        "version": "v5",
+        "schemaVersion": "v2alpha1",
+    },
+]
+
+RESERVED_KEYWORDS = [
+    "alert_type",
+    "created_at",
+    "created_by",
+    "labels.<key>",
+    "name",
+    "rule_type",
+    "severity",
+    "updated_at",
+    "updated_by",
+]
+
+
+def test_envelope_and_slim_rows(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    seed_alert_rules: Callable[[dict, list[dict]], None],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()["data"]
+
+    assert data["total"] == 5
+    assert len(data["rules"]) == 5
+    assert data["reservedKeywords"] == RESERVED_KEYWORDS
+
+    label_pairs = [(pair["key"], pair["value"]) for pair in data["labels"]]
+    assert label_pairs == sorted(label_pairs), "label pairs must be sorted by key then value"
+    for expected_pair in [
+        ("k8s.cluster", "prod-1"),
+        ("severity", "critical"),
+        ("severity", "important"),
+        ("severity", "warning"),
+        ("team", "checkout"),
+        ("team", "infra"),
+        ("team", "payments"),
+    ]:
+        assert expected_pair in label_pairs, f"missing label pair {expected_pair}"
+
+    by_name = {rule["alert"]: rule for rule in data["rules"]}
+    assert set(by_name) == {r["alert"] for r in SEED_RULES}
+
+    for rule in data["rules"]:
+        for forbidden_field in ("condition", "annotations", "notificationSettings", "evaluation", "source", "version", "schemaVersion"):
+            assert forbidden_field not in rule, f"slim row leaked {forbidden_field}"
+        for required_field in ("id", "state", "alert", "alertType", "ruleType", "createdAt", "updatedAt"):
+            assert required_field in rule, f"slim row missing {required_field}"
+        assert rule["createdBy"] == USER_ADMIN_EMAIL
+        assert rule["updatedBy"] == USER_ADMIN_EMAIL
+
+    assert by_name["checkout conversion drop"]["state"] == "disabled"
+    assert by_name["checkout conversion drop"]["disabled"] is True
+    assert by_name["payment latency high"]["state"] == "inactive"
+    assert by_name["payment latency high"]["description"] == "p99 latency guard"
+    assert by_name["payment latency high"]["labels"] == {"severity": "critical", "team": "payments", "k8s.cluster": "prod-1"}
+    assert by_name["payment gateway errors"]["alertType"] == "LOGS_BASED_ALERT"
+    assert by_name["prom uptime probe"]["ruleType"] == "promql_rule"
+
+
+def test_query_filters(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    seed_alert_rules: Callable[[dict, list[dict]], None],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+
+    cases = [
+        ("name = 'payment latency high'", {"payment latency high"}),
+        ("name CONTAINS 'payment'", {"payment latency high", "payment gateway errors"}),
+        # free text goes through LOWER() on both dialects, so a case mismatch must still match
+        ("PAYMENT", {"payment latency high", "payment gateway errors"}),
+        # free text also matches the description field
+        ("blackbox", {"prom uptime probe"}),
+        (f"created_by = '{USER_ADMIN_EMAIL}'", {r["alert"] for r in SEED_RULES}),
+        ("created_at >= '2020-01-01T00:00:00Z'", {r["alert"] for r in SEED_RULES}),
+        ("created_at < '2020-01-01T00:00:00Z'", set()),
+        ("alert_type = 'LOGS_BASED_ALERT'", {"payment gateway errors"}),
+        ("rule_type = 'promql_rule'", {"prom uptime probe"}),
+        ("rule_type IN ['threshold_rule']", {"payment latency high", "payment gateway errors", "checkout conversion drop", "infra cpu saturation"}),
+        ("labels.team = 'payments'", {"payment latency high", "payment gateway errors"}),
+        ("labels.k8s.cluster = 'prod-1'", {"payment latency high"}),
+        ("labels.team EXISTS", {"payment latency high", "payment gateway errors", "checkout conversion drop", "infra cpu saturation"}),
+        ("labels.team NOT EXISTS", {"prom uptime probe"}),
+        ("NOT (labels.team EXISTS)", {"prom uptime probe"}),
+        (
+            "(labels.team = 'payments' OR labels.team = 'infra') AND name NOT CONTAINS 'gateway'",
+            {"payment latency high", "infra cpu saturation"},
+        ),
+    ]
+
+    for query, expected_names in cases:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params={"query": query},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, f"query {query!r}: {response.text}"
+        data = response.json()["data"]
+        assert {rule["alert"] for rule in data["rules"]} == expected_names, f"query {query!r}"
+        assert data["total"] == len(expected_names), f"query {query!r}: total mismatch"
+
+
+def test_label_missing_semantics(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    seed_alert_rules: Callable[[dict, list[dict]], None],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+
+    # A missing label uniformly evaluates as the empty string for value
+    # operators; presence is expressed with EXISTS / NOT EXISTS.
+    cases = [
+        ("severity = ''", {"infra cpu saturation", "prom uptime probe"}),
+        ("severity != ''", {"payment latency high", "payment gateway errors", "checkout conversion drop"}),
+        ("severity != 'critical'", {"payment gateway errors", "checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
+        ("severity EXISTS", {"payment latency high", "payment gateway errors", "checkout conversion drop"}),
+        ("severity NOT EXISTS", {"infra cpu saturation", "prom uptime probe"}),
+        ("severity = 'critical'", {"payment latency high"}),
+        ("severity IN ['critical', 'warning']", {"payment latency high", "payment gateway errors"}),
+        ("labels.team != 'payments'", {"checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
+        ("labels.team NOT IN ['payments']", {"checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
+        ("labels.team NOT CONTAINS 'pay'", {"checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
+    ]
+
+    for query, expected_names in cases:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params={"query": query},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, f"query {query!r}: {response.text}"
+        data = response.json()["data"]
+        assert {rule["alert"] for rule in data["rules"]} == expected_names, f"query {query!r}"
+        assert data["total"] == len(expected_names), f"query {query!r}: total mismatch"
+
+
+def test_states_param(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    seed_alert_rules: Callable[[dict, list[dict]], None],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+
+    # No telemetry is seeded, so enabled rules sit at inactive and the one
+    # disabled rule reads disabled, deterministic without waiting on evals.
+    cases = [
+        ({"states": ["disabled"]}, {"checkout conversion drop"}),
+        ({"states": ["inactive"]}, {"payment latency high", "payment gateway errors", "infra cpu saturation", "prom uptime probe"}),
+        ({"states": ["inactive", "disabled"]}, {r["alert"] for r in SEED_RULES}),
+        ({"states": ["firing"]}, set()),
+        ({"states": ["disabled"], "query": "labels.team = 'checkout'"}, {"checkout conversion drop"}),
+        ({"states": ["disabled"], "query": "labels.team = 'payments'"}, set()),
+    ]
+
+    for params, expected_names in cases:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params=params,
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, f"params {params!r}: {response.text}"
+        data = response.json()["data"]
+        assert {rule["alert"] for rule in data["rules"]} == expected_names, f"params {params!r}"
+        assert data["total"] == len(expected_names), f"params {params!r}: total mismatch"
+
+
+def test_sorting(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    seed_alert_rules: Callable[[dict, list[dict]], None],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        params={"sort": "name", "order": "asc"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
+        "checkout conversion drop",
+        "infra cpu saturation",
+        "payment gateway errors",
+        "payment latency high",
+        "prom uptime probe",
+    ]
+
+    # state display priority: inactive (rank 1) outranks disabled (rank 0);
+    # the four inactive rules tie on state and must break on name asc
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        params={"sort": "state", "order": "desc"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
+        "infra cpu saturation",
+        "payment gateway errors",
+        "payment latency high",
+        "prom uptime probe",
+        "checkout conversion drop",
+    ]
+
+    # asc flips the state buckets but the name tiebreak stays ascending
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        params={"sort": "state", "order": "asc"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
+        "checkout conversion drop",
+        "infra cpu saturation",
+        "payment gateway errors",
+        "payment latency high",
+        "prom uptime probe",
+    ]
+
+    # severity: known ranks first (critical > warning), then custom values
+    # lexically, then rules without severity tie and break on name asc
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        params={"sort": "severity", "order": "desc"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
+        "payment latency high",
+        "payment gateway errors",
+        "checkout conversion drop",
+        "infra cpu saturation",
+        "prom uptime probe",
+    ]
+
+    for order in ("asc", "desc"):
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params={"sort": "created_at", "order": order},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK
+        created_ats = [rule["createdAt"] for rule in response.json()["data"]["rules"]]
+        assert created_ats == sorted(created_ats, reverse=order == "desc"), f"created_at {order} not monotonic"
+
+
+def test_pagination(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    seed_alert_rules: Callable[[dict, list[dict]], None],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+
+    pages = []
+    for offset in (0, 2, 4):
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params={"sort": "name", "order": "asc", "limit": 2, "offset": offset},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK
+        data = response.json()["data"]
+        assert data["total"] == 5, f"offset {offset}: total must stay the full filtered count"
+        pages.append([rule["alert"] for rule in data["rules"]])
+
+    assert [len(page) for page in pages] == [2, 2, 1]
+    flattened = [name for page in pages for name in page]
+    assert len(flattened) == len(set(flattened)), "pages must be disjoint"
+    assert set(flattened) == {r["alert"] for r in SEED_RULES}
+
+    # state sort is almost all ties (four inactive rules); the name/id tiebreak
+    # must keep the pages disjoint and in the same order on every request
+    tie_pages = []
+    for offset in (0, 2, 4):
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params={"sort": "state", "order": "desc", "limit": 2, "offset": offset},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK
+        tie_pages.append([rule["alert"] for rule in response.json()["data"]["rules"]])
+
+    assert [name for page in tie_pages for name in page] == [
+        "infra cpu saturation",
+        "payment gateway errors",
+        "payment latency high",
+        "prom uptime probe",
+        "checkout conversion drop",
+    ], "tied rows must not shuffle between page requests"
+
+    # a past-the-end offset returns an empty page but keeps the real total
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        params={"limit": 2, "offset": 50},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()["data"]
+    assert data["rules"] == []
+    assert data["total"] == 5
+
+    # an over-max limit is clamped, not rejected
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        params={"limit": 6000},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["data"]["total"] == 5
+
+
+def test_error_contract(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    cases = [
+        ({"query": "created_by ==== ((("}, "rule_list_filter_invalid", "invalid filter query:"),
+        ({"query": "team = 'infra'"}, "rule_list_filter_invalid", 'unknown filter key "team"'),
+        ({"query": "state = 'firing'"}, "rule_list_filter_invalid", 'unknown filter key "state"'),
+        ({"query": "alert_type = 'bogus'"}, "rule_list_filter_invalid", "METRIC_BASED_ALERT"),
+        ({"query": "name REGEXP 'x.*'"}, "rule_list_filter_invalid", "operator REGEXP is not allowed"),
+        ({"query": "created_at >= 'yesterday'"}, "rule_list_filter_invalid", "invalid RFC3339 timestamp"),
+        ({"query": "name LIKE 'prod\\\\'"}, "rule_list_filter_invalid", "must not end with an unescaped backslash"),
+        ({"states": ["bogus"]}, "rule_list_invalid", 'invalid state "bogus"'),
+        ({"sort": "bogus"}, "rule_list_invalid", "invalid sort"),
+        ({"order": "bogus"}, "rule_list_invalid", "invalid order"),
+        ({"limit": -1}, "rule_list_invalid", "invalid limit"),
+        ({"offset": -1}, "rule_list_invalid", "invalid offset"),
+    ]
+
+    for params, expected_code, expected_message_part in cases:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(BASE_URL),
+            params=params,
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.BAD_REQUEST, f"params {params!r}: {response.text}"
+        error = response.json()["error"]
+        assert error["code"] == expected_code, f"params {params!r}"
+        assert expected_message_part in error["message"], f"params {params!r}: {error['message']}"
+
+
+def test_v2_list_still_serves_bare_array(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    seed_alert_rules: Callable[[dict, list[dict]], None],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/rules"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()["data"]
+    assert isinstance(data, list), "deprecated v2 must keep returning a bare array"
+    assert {rule["alert"] for rule in data} == {r["alert"] for r in SEED_RULES}

tests/integration/tests/alerts/07_rule_views.py

@@ -0,0 +1,269 @@
+import uuid
+from collections.abc import Callable
+from http import HTTPStatus
+
+import pytest
+import requests
+
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.types import Operation, SigNoz
+
+BASE_URL = "/api/v2/rule_views"
+
+
+@pytest.mark.parametrize(
+    ("body", "expected_code", "expected_message"),
+    [
+        ({"data": {"version": "v1"}}, "rule_view_invalid_input", "name is required"),
+        ({"name": "   ", "data": {"version": "v1"}}, "rule_view_invalid_input", "name is required"),
+        (
+            {"name": "  Storage  ", "data": {"version": "v1"}},
+            "rule_view_invalid_input",
+            "name must not have leading or trailing whitespace",
+        ),
+        (
+            {"name": "x" * 65, "data": {"version": "v1"}},
+            "rule_view_invalid_input",
+            "name must be at most 64 characters, got 65",
+        ),
+        (
+            {"name": "wrong-version", "data": {"version": "v2"}},
+            "rule_view_invalid_input",
+            'version must be "v1", got "v2"',
+        ),
+        (
+            {"name": "missing-version", "data": {}},
+            "rule_view_invalid_input",
+            'version must be "v1", got ""',
+        ),
+        (
+            {"name": "bad-state", "data": {"version": "v1", "states": ["exploding"]}},
+            "rule_list_invalid",
+            'invalid state "exploding"',
+        ),
+        (
+            {"name": "bad-sort", "data": {"version": "v1", "sort": "bogus"}},
+            "rule_list_invalid",
+            "invalid sort",
+        ),
+        (
+            {"name": "bad-order", "data": {"version": "v1", "order": "bogus"}},
+            "rule_list_invalid",
+            "invalid order",
+        ),
+        (
+            {"name": "long-query", "data": {"version": "v1", "query": "x" * 1025}},
+            "rule_list_invalid",
+            "query cannot be longer than 1024 characters",
+        ),
+        (
+            {"name": "rejects-unknown", "data": {"version": "v1"}, "unknownfield": "boom"},
+            "rule_view_invalid_input",
+            "invalid saved view request body",
+        ),
+    ],
+    ids=[
+        "missing_name",
+        "blank_name",
+        "whitespace_name",
+        "name_too_long",
+        "wrong_schema_version",
+        "missing_version",
+        "invalid_state",
+        "invalid_sort",
+        "invalid_order",
+        "query_too_long",
+        "unknown_field",
+    ],
+)
+def test_create_rejects_invalid_body(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    body: dict,
+    expected_code: str,
+    expected_message: str,
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        json=body,
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+    assert response.json()["error"]["code"] == expected_code
+    assert expected_message in response.json()["error"]["message"]
+
+
+def test_update_rejects_malformed_id(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/not-a-uuid"),
+        json={"name": "x", "data": {"version": "v1"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+
+
+def test_update_missing_view_returns_not_found(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{uuid.uuid4()}"),
+        json={"name": "x", "data": {"version": "v1"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.NOT_FOUND
+    assert response.json()["error"]["code"] == "rule_view_not_found"
+
+
+def test_delete_rejects_malformed_id(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/not-a-uuid"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.BAD_REQUEST
+
+
+def test_delete_missing_view_returns_not_found(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{uuid.uuid4()}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+
+    assert response.status_code == HTTPStatus.NOT_FOUND
+    assert response.json()["error"]["code"] == "rule_view_not_found"
+
+
+def test_rule_view_lifecycle(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    create_rule_view: Callable[[dict], dict],
+):
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # List assertions filter on this test's names so foreign views never interfere.
+    owned_names = {"Critical Prod", "Critical Staging", "Disabled"}
+
+    created = create_rule_view(
+        {
+            "name": "Critical Prod",
+            "data": {
+                "version": "v1",
+                "query": "name CONTAINS 'prod' AND severity = 'critical'",
+                "states": ["firing", "pending"],
+                "sort": "name",
+                "order": "asc",
+            },
+        }
+    )
+    view_id = created["id"]
+    assert created["name"] == "Critical Prod"
+    assert created["data"]["version"] == "v1"
+    assert created["data"]["query"] == "name CONTAINS 'prod' AND severity = 'critical'"
+    assert created["data"]["states"] == ["firing", "pending"]
+
+    # Omitted states, sort and order are normalized on save: [] and the list defaults, never null.
+    disabled = create_rule_view({"name": "Disabled", "data": {"version": "v1"}})
+    assert disabled["name"] == "Disabled"
+    assert disabled["data"]["states"] == []
+    assert disabled["data"]["sort"] == "updated_at"
+    assert disabled["data"]["order"] == "desc"
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    views = [v for v in response.json()["data"]["views"] if v["name"] in owned_names]
+    assert {v["name"] for v in views} == {"Critical Prod", "Disabled"}
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+        json={
+            "name": "Critical Staging",
+            "data": {
+                "version": "v1",
+                "query": "name CONTAINS 'staging'",
+                "states": ["firing"],
+                "sort": "created_at",
+                "order": "desc",
+            },
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    updated = response.json()["data"]
+    assert updated["id"] == view_id
+    assert updated["name"] == "Critical Staging"
+    assert updated["data"]["query"] == "name CONTAINS 'staging'"
+    assert updated["data"]["states"] == ["firing"]
+    assert updated["data"]["sort"] == "created_at"
+    assert updated["data"]["order"] == "desc"
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    listed = {v["name"]: v for v in response.json()["data"]["views"] if v["name"] in owned_names}
+    assert set(listed) == {"Critical Staging", "Disabled"}
+    assert listed["Critical Staging"]["data"]["query"] == "name CONTAINS 'staging'"
+
+    assert (
+        requests.delete(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        ).status_code
+        == HTTPStatus.NO_CONTENT
+    )
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(BASE_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert {v["name"] for v in response.json()["data"]["views"] if v["name"] in owned_names} == {"Disabled"}
+
+    assert (
+        requests.delete(
+            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        ).status_code
+        == HTTPStatus.NOT_FOUND
+    )

tests/integration/tests/alerts/08_authz.py

@@ -0,0 +1,377 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    create_active_user,
+)
+from fixtures.notification_channel import ensure_notification_channel
+from fixtures.types import Operation, SigNoz
+
+V1_RULES_URL = "/api/v1/rules"
+V2_RULES_URL = "/api/v2/rules"
+V3_RULES_URL = "/api/v3/rules"
+RULE_VIEWS_URL = "/api/v2/rule_views"
+DOWNTIME_URL = "/api/v1/downtime_schedules"
+ROUTE_POLICIES_URL = "/api/v1/route_policies"
+
+_EDITOR_EMAIL = "editor+alertauthz@integration.test"
+_EDITOR_PASSWORD = "password123Z$"
+_VIEWER_EMAIL = "viewer+alertauthz@integration.test"
+_VIEWER_PASSWORD = "password123Z$"
+
+_TARGET_RULE = "alert authz target"
+_EDITOR_RULE = "alert authz editor rule"
+_EDITOR_RULE_V1 = "alert authz editor rule v1"
+_DOWNTIME_NAME = "alert-authz-downtime"
+_ROUTE_POLICY_NAME = "alert-authz-route-policy"
+_VIEW_NAME = "alert-authz-view"
+
+SEED_CHANNEL = {"name": "alert-authz-channel", "email_configs": [{"to": "alert-authz@integration.test"}]}
+
+RULE_CONDITION = {
+    "thresholds": {
+        "kind": "basic",
+        "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": ["alert-authz-channel"]}],
+    },
+    "compositeQuery": {
+        "queryType": "builder",
+        "panelType": "graph",
+        "queries": [
+            {
+                "type": "builder_query",
+                "spec": {
+                    "name": "A",
+                    "signal": "metrics",
+                    "aggregations": [{"metricName": "alert_authz_cpu", "timeAggregation": "avg", "spaceAggregation": "max"}],
+                },
+            }
+        ],
+    },
+    "selectedQueryName": "A",
+}
+
+
+RULE_TEMPLATE = {
+    "description": "authz coverage rule",
+    "alertType": "METRIC_BASED_ALERT",
+    "ruleType": "threshold_rule",
+    "condition": RULE_CONDITION,
+    "labels": {"severity": "critical"},
+    "annotations": {"summary": "s", "description": "d"},
+    "evaluation": {"kind": "rolling", "spec": {"evalWindow": "5m0s", "frequency": "1m"}},
+    "notificationSettings": {"groupBy": [], "usePolicy": False, "renotify": {"enabled": False, "interval": "30m", "alertStates": []}},
+    "version": "v5",
+    "schemaVersion": "v2alpha1",
+}
+
+
+def test_setup_users_and_target(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # A rerun against a --reuse stack starts from the previous run's state, and
+    # inviting an existing address fails, so only invite what is missing.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+
+    for email, role, password, name in (
+        (_EDITOR_EMAIL, "signoz-editor", _EDITOR_PASSWORD, "alert authz editor"),
+        (_VIEWER_EMAIL, "signoz-viewer", _VIEWER_PASSWORD, "alert authz viewer"),
+    ):
+        if email not in existing_emails:
+            create_active_user(signoz, admin_token, email=email, role=role, password=password, name=name)
+
+    ensure_notification_channel(signoz, admin_token, SEED_CHANNEL)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    for name in (_TARGET_RULE, _EDITOR_RULE, _EDITOR_RULE_V1):
+        if name in ids:
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{ids[name]}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _TARGET_RULE},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+
+def test_viewer_allowed_on_reads(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    target_id = ids[_TARGET_RULE]
+
+    for path in (
+        V2_RULES_URL,
+        f"{V2_RULES_URL}/{target_id}",
+        V1_RULES_URL,
+        f"{V1_RULES_URL}/{target_id}",
+        DOWNTIME_URL,
+        ROUTE_POLICIES_URL,
+    ):
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(path),
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, f"GET {path}: expected 200, got {response.status_code}: {response.text}"
+
+
+def test_viewer_allowed_on_rule_views(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # Rule views ride on the rule list verb, which a viewer holds, so the whole
+    # CRUD surface is open to them.
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "desc"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    view_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{RULE_VIEWS_URL}/{view_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_viewer_forbidden_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    target_id = ids[_TARGET_RULE]
+
+    # Authz runs before body parsing, so an empty body still proves the 403.
+    for method, path in (
+        ("post", V2_RULES_URL),
+        ("put", f"{V2_RULES_URL}/{target_id}"),
+        ("patch", f"{V2_RULES_URL}/{target_id}"),
+        ("delete", f"{V2_RULES_URL}/{target_id}"),
+        ("post", f"{V2_RULES_URL}/test"),
+        ("post", V1_RULES_URL),
+        ("put", f"{V1_RULES_URL}/{target_id}"),
+        ("patch", f"{V1_RULES_URL}/{target_id}"),
+        ("delete", f"{V1_RULES_URL}/{target_id}"),
+        ("post", "/api/v1/testRule"),
+        ("post", DOWNTIME_URL),
+        ("put", f"{DOWNTIME_URL}/{target_id}"),
+        ("delete", f"{DOWNTIME_URL}/{target_id}"),
+        ("post", ROUTE_POLICIES_URL),
+        ("put", f"{ROUTE_POLICIES_URL}/{target_id}"),
+        ("delete", f"{ROUTE_POLICIES_URL}/{target_id}"),
+    ):
+        response = getattr(requests, method)(
+            signoz.self.host_configs["8080"].get(path),
+            json={},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.FORBIDDEN, f"{method.upper()} {path}: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_editor_allowed_on_rule_and_downtime_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _EDITOR_RULE},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    rule_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V1_RULES_URL),
+        json={**RULE_TEMPLATE, "alert": _EDITOR_RULE_V1},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    v1_rule_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V1_RULES_URL}/{v1_rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(DOWNTIME_URL),
+        json={
+            "name": _DOWNTIME_NAME,
+            "description": "authz coverage window",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-22T00:00:00Z"},
+            "alertIds": [],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    downtime_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        json={
+            "name": _DOWNTIME_NAME,
+            "description": "authz coverage window updated",
+            "schedule": {"timezone": "UTC", "startTime": "2026-09-21T00:00:00Z", "endTime": "2026-09-23T00:00:00Z"},
+            "alertIds": [],
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{DOWNTIME_URL}/{downtime_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_editor_forbidden_on_route_policy_writes(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    for method, path in (
+        ("post", ROUTE_POLICIES_URL),
+        ("put", f"{ROUTE_POLICIES_URL}/00000000-0000-0000-0000-000000000000"),
+        ("delete", f"{ROUTE_POLICIES_URL}/00000000-0000-0000-0000-000000000000"),
+    ):
+        response = getattr(requests, method)(
+            signoz.self.host_configs["8080"].get(path),
+            json={},
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.FORBIDDEN, f"{method.upper()} {path}: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_admin_allowed_on_route_policy_writes(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(ROUTE_POLICIES_URL),
+        json={
+            "name": _ROUTE_POLICY_NAME,
+            "expression": 'threshold.name == "critical"',
+            "channels": ["alert-authz-channel"],
+            "description": "authz coverage policy",
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    policy_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{ROUTE_POLICIES_URL}/{policy_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_alert_authz_cleanup(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V3_RULES_URL}?limit=200"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {rule["alert"]: rule["id"] for rule in response.json()["data"]["rules"]}
+    for name in (_TARGET_RULE, _EDITOR_RULE, _EDITOR_RULE_V1):
+        if name in ids:
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"{V2_RULES_URL}/{ids[name]}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {name}: {response.text}"