@spec list(Req.Request.t(), String.t(), keyword()) ::
  {:ok, term()} | {:error, UnifiApi.Error.t()}

Lists IDS / IPS events.

Options

• :within_hours — within=N.
• :limit — _limit=N.
• :start — _start=N.

@spec stream(Req.Request.t(), String.t(), keyword()) :: Enumerable.t()

Returns a lazy stream that auto-paginates IDS / IPS events via _start / _limit.

Error contract

A mid-stream error does not raise by default: the stream halts and yields {:error, %UnifiApi.StreamError{}, last_start} as its final element, so the enumerable is heterogeneous and Enum.map(stream, & &1["key"]) crashes on a transient 500. Match the tail:

items = Enum.to_list(stream)

case List.last(items) do
  {:error, error, cursor} -> {:error, error, cursor}
  _ -> {:ok, items}
end

Pass raise_errors: true to raise UnifiApi.StreamError instead.

Options

• :within_hours — passed through to every page as within=N.
• :limit — page size (default 500).
• :max_pages — halt after this many successful pages (default: unbounded).
• :max_items — halt once this many detections have been yielded; the final page is truncated to fit (default: unbounded).
• :raise_errors — when true, raise UnifiApi.StreamError on a mid-stream error instead of yielding {:error, reason, last_start} as the final element (default: false).

:max_pages, :max_items and :raise_errors are forwarded verbatim to UnifiApi.Client.stream_v1/3 and behave exactly as they do in UnifiApi.Client.stream/3. Any other key raises ArgumentError.

Examples

# The 100 most recent detections in the last 12 hours
UnifiApi.Network.IDS.stream(authed, "default", within_hours: 12, max_items: 100)
|> Enum.to_list()