galangel · Oct 14, 2026 · Oct 15, 2026 · Oct 16, 2026 · Oct 19, 2026
diff --git a/agents.md b/agents.md
@@ -711,3 +711,44 @@ No unresolved reviewer comments on the PR. No screenshots marked for documentati
 * `OIQ-AI-service`, `oiq-resources` - no commits.
 
 No unresolved reviewer comments on the PR. No screenshots marked for documentation use. Assignees unchanged.
+
+### 2026-10-14 - daily scan (since 2026-10-13 06:09), doc changes made
+
+* `Artemis` - #476 (Gavriel-M, ORIONIQ-1823): the `oiq-marketplace-free-trial` flag is removed, so the free trial is on for every account. Closes the open item from 2026-10-12. Added a **Free trial** section to `marketplace.md`. Source of wording: `AgentCommon/constants.ts` (`FREE_TRIAL_MESSAGES`) and `free-trial.util.ts`. The free run count and per-run price are template and Consul data, so the section does not quote them.
+  * #438 (yotamloe, ORIONIQ-1433, ORIONIQ-1772): agent memory, with a Memory **Agent docs** tab and a "Remember between runs" toggle in the agent editor. Not documented. Real memory still needs the per-account `oiq-agent-docs` flag and ai-service 3.12.0 in the region, so it is a staged rollout. Revisit when the flag is removed. `memory.md` stays accurate for account and user documents.
+  * #473 and #475 (Gavriel-M, ORIONIQ-1811): `GET /orioniq-be/integrations/connection-options` and an `agentConfig` body on `PUT /agents/alert/:alertId/rca`. Session routes for the Open 360 alert form. No gaia UI has merged yet, so nothing is customer-visible. Not part of the public `/v2` API, so `api.md` is unchanged. Revisit when the alert form change lands in `gaia-hermes-ws`.
+  * #464, #465 (galangel, ORIONIQ-1793): chat turn context as `turnContext` data. Internal. #478 and its revert #485: filter chip focus, net zero. #481, #479, #480, #482, #463: vendor and release chores.
+* `OIQ-AI-service` - #520 (augment770-dev, ORIONIQ-1799): one default date and time format in answers. Prompt behavior, no route or schema change. #523: ECR image build workflow. No doc change.
+* `gaia-hermes-ws` - #17196 and #17179 (Unified Dashboards, APPZ-3423 and APPZ-1937), #17191 (fake gateway for local dev). Out of OrionIQ scope.
+* `oiq-resources` - no commits.
+
+### 2026-10-15 - daily scan (since 2026-10-14), doc changes made
+
+* `Artemis` - #369 (Gavriel-M, ORIONIQ-1683): new public `POST /v1/orioniq-be/agents/search`, gateway-authenticated with an API token, scoped to the token's own account, `pageSize` capped at 50. It is the first route of the **v1 public URL convention** (`/v1/orioniq-be/<collection>[/:id][/<action>]`); the 12 existing `/v2` endpoints are frozen. Added **List agents** to `api.md`. Source of the field list: the PR body and `public.routes.ts`. Known gap in the endpoint: security-rule agents also show "Logz.io Alert" in `displayName`.
+  * #474, #488, #489 (RoyiSitbon): the structured RCA answer renders as a report in the invocation drawer, with stats, a pie chart and named investigators on the Analysis tab. Not documented: no verified copy for the report, and `agents-hub.md` describes the Output tab only in general terms. Revisit with the RCA v2 flag rollout.
+  * #487, #486: filter chip focus fix, RUM listener leak. Internal.
+* `gaia-hermes-ws` - #17199, #17200 (Gavriel-M, ORIONIQ-1811): the alert and SIEM rule AI Analysis step gets a **Configure your agent** dialog (instructions, output detail, recipients) saved with the alert or rule. It retires the **Configure agent after saving** checkbox, and the hub link is now **Manage in Agents Hub**. Updated the three pages that described the old checkbox: both `configure-alerts-explore.md` twins and `manage-security-rules.md`. The dialog is behind the RCA v2 flag per the PR test plan, and the PR has no screenshots.
+  * #17207 (typed swagger, TypeScript bump), #17203 (Span Explorer), #17204 (Unified Dashboards legend): out of OrionIQ scope.
+* `OIQ-AI-service` - #528, #522 (kevkle): RCA OIHV loop and deepagent telemetry domain. Internal runtime, no public route or schema change.
+* `oiq-resources` - no commits.
+
+Existing PR #975 had no unresolved reviewer comments. No screenshots marked for documentation use. Assignees extended with the authors of the triggering commits.
+
+### 2026-10-16 - daily scan (since 2026-10-15 06:00), doc changes made
+
+* `Artemis` - #501 (Gavriel-M, ORIONIQ-1683): `POST /v1/orioniq-be/agents/search` now honors `sort` (first entry only; fields `name`, `type`, `active`, `createdAt`, `updatedAt`, `lastRun`; bad entry falls back to `createdAt` desc). Added the `sort` rows and example to **List agents** in `api.md`. Source: `agent-search-filters.ts` and the swagger constants.
+  * #492 (yotamloe, ORIONIQ-1841): agent builder takes its account from the session. Internal fix. #493 (RoyiSitbon): RCA report moved into `orion-chat`, still no verified copy. #498, #483: version packages.
+* `gaia-hermes-ws` - #17217 (RoyiSitbon, ORIONIQ-1833): Open 360 drawer renders the RCA report and the onboarding survey is served by orioniq-be (`/orioniq-be/user-docs/survey`, session route). #17202, #17205, #17206, #17216 (Gavriel-M, ORIONIQ-1811, ORIONIQ-1830, ORIONIQ-1621): integrations picker and form-agnostic RCA agent setup modal, analytics events. Same RCA v2 flag as #17199 and #17200, no screenshots, not documented yet. #17211, #17212, #17214 (APPZ-3491): Swagger for other services, out of scope.
+* `OIQ-AI-service` - #525, #521 (galangel): CI image tags and dev-namespace overrides. Internal.
+* `oiq-resources` - #115 (Gavriel-M, ORIONIQ-1621): agent memory made configurable in marketplace templates. Still behind the `oiq-agent-docs` flag, not documented. Revisit when the flag is removed.
+
+Existing PR #975 had no unresolved reviewer comments. Appended to its branch. Gavriel-M, RoyiSitbon and galangel are the authors of triggering commits; vicmiletsky's commits were out of scope.
+
+### 2026-10-19 - daily scan (since 2026-10-18 06:00), no doc changes
+
+* `Artemis` - #494 (Gavriel-M, ORIONIQ-1621): agent memory now covers every agent except chat and Alert AI Analysis v1, on by default per run. Still shown only when `memoryAvailable` answers true, which needs the pod-mounted `oiq-agent-docs` flag. Not documented. Revisit when the flag is removed.
+* `OIQ-AI-service` - #526 (augment770-dev, ORIONIQ-1827): Haiku 5.5 and named invocation profiles. #529 (yotamloe, ORIONIQ-1486): `@timestamp` rejected in aggregation tools. #532 (ralongit): agents may use the integration writes they hold. Internal runtime and prompt behavior, no public route or schema change.
+* `oiq-resources` - #116 to #119 (ralongit, ORIONIQ-1377): fixes to the Alert Digest and Alert Tuning Report templates and the `logzio_api.md` skill (unified alert events filters, log-alert grouping by title, alert links by name). The six tuning patterns and the alert links already match the `marketplace.md` descriptions. No doc change.
+* `gaia-hermes-ws` - no commits.
+
+Existing PR #975 had no unresolved reviewer comments and is approved. No screenshots marked for documentation use. Appended the log entry only. Assignees unchanged.
diff --git a/docs/open360/alerts/configure-alerts-explore.md b/docs/open360/alerts/configure-alerts-explore.md
@@ -220,7 +220,9 @@ AI Agent Analysis runs **once every hour**.
 
 #### Configure the agent
 
-Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**.
+Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings.
+
+For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub.
 
 The agent is editable like any other, so beyond the settings on this page you can:
 

diff --git a/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md b/docs/user-guide/cloud-siem/security-rules/manage-security-rules.md
@@ -176,7 +176,9 @@ Every run is stored in the agent's invocation history, where you can read the fu
 
 #### Configure the agent
 
-Turning the toggle on creates an OrionIQ agent for the rule, and you can update it at any time. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the rule form links to it with **Manage in Agent Hub**.
+Turning the toggle on creates an OrionIQ agent for the rule when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the rule form, and they are saved with the rule. Turning the toggle off and saving removes the agent and its settings. The button is disabled on protected rules and for read-only users.
+
+For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub.
 
 The agent is editable like any other, so beyond the settings above you can:
 

diff --git a/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md b/docs/user-guide/explore/explore-log-alerts/configure-alerts-explore.md
@@ -189,7 +189,9 @@ AI Agent Analysis runs **once every hour**.
 
 #### Configure the agent
 
-Enabling AI Agent Analysis creates an OrionIQ agent for the alert. Select **Configure agent after saving** to open it right after you save, or manage it later from the Agents Hub — the alert form links to it with **Manage in Agent Hub**.
+Enabling AI Agent Analysis creates an OrionIQ agent for the alert when you save it. Select **Configure your agent** to set the agent's instructions, output detail (Summary or Detailed), and recipients. **Apply** adds your changes to the alert form, and they are saved with the alert. Turning AI Agent Analysis off and saving removes the agent and its settings.
+
+For full agent configuration, use **Manage in Agents Hub**, which opens the agent in the Agents Hub.
 
 The agent is editable like any other, so beyond the settings on this page you can:
 

diff --git a/docs/user-guide/orioniq/api.md b/docs/user-guide/orioniq/api.md
@@ -2,13 +2,13 @@
 sidebar_position: 9
 title: OrionIQ API
 image: https://dytvr9ot2sszz.cloudfront.net/logz-docs/social-assets/docs-social.jpg
-description: Trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API.
-keywords: [OrionIQ, API, agents, trigger agent, agent run, feedback, api token, automation]
+description: List agents, trigger OrionIQ agents, poll for results, send follow-ups, and submit feedback using the OrionIQ API.
+keywords: [OrionIQ, API, agents, list agents, agent ID, trigger agent, agent run, feedback, api token, automation]
 ---
 
 Agents configured with the **API** trigger run on demand when you call the OrionIQ API. Use it to start a run from a CI pipeline, an incident workflow, or any external system, then poll for the result.
 
-To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**.
+To get an agent's ID and a ready-to-copy request for each endpoint, open the agent's actions menu in the [Agents Hub](/docs/user-guide/orioniq/agents-hub/) and select **API References**. To look agents up with the API instead, use [List agents](#list-agents).
 
 ## Authentication
 
@@ -34,6 +34,86 @@ If AI features are disabled for the account, [Run an agent](#run-an-agent) and [
 If the account has reached its configured AI usage cap, [Run an agent](#run-an-agent) and [Send a follow-up](#send-a-follow-up) return `429` (`errorCode: "CAP_EXCEEDED"`). See [OrionIQ Settings → Capping](/docs/user-guide/orioniq/settings/#capping) for usage and budget limits.
 :::
 
+## List agents
+
+```
+POST /v1/orioniq-be/agents/search
+```
+
+Returns the agents in the token's account, so you can find an agent ID without opening the Agents Hub. Sub-account agents are not included. Listing starts no AI work, so it also works when AI features are disabled.
+
+### Sample request
+
+```shell
+curl -X POST -L \
+  https://<<API-URL>>/v1/orioniq-be/agents/search \
+  -H 'Content-Type: application/json' \
+  -H 'X-API-TOKEN: <<API-TOKEN>>' \
+  -d '{
+    "filter": {
+      "searchTerm": "checkout",
+      "active": true
+    },
+    "sort": [
+      {
+        "field": "lastRun",
+        "descending": true
+      }
+    ],
+    "pagination": {
+      "pageNumber": 1,
+      "pageSize": 20
+    }
+  }'
+```
+
+All fields are optional. A filter value the API cannot use is ignored.
+
+| Field | Description |
+|---|---|
+| `filter.searchTerm` | Returns agents whose title contains this text. |
+| `filter.type` | Filters by agent type. |
+| `filter.trigger` | Filters by trigger. An unknown value returns no results. |
+| `filter.active` | `true` for enabled agents, `false` for disabled ones. |
+| `filter.createdBy` | Filters by creator. |
+| `sort` | A list where only the first entry is used. Each entry takes a `field` and an optional `descending` flag (default `false`). |
+| `sort[].field` | One of `name`, `type`, `active`, `createdAt`, `updatedAt`, or `lastRun`. |
+| `pagination.pageNumber` | The page to return. |
+| `pagination.pageSize` | Results per page. Defaults to 50 and is capped at 50. |
+
+Results are ordered by creation time, newest first, unless you set `sort`. An unusable `sort` entry falls back to the default order. In ascending order, agents that never ran come first when sorting by `lastRun`.
+
+### Response
+
+```json
+{
+  "total": 1,
+  "results": [
+    {
+      "id": "<agent-id>",
+      "name": "<agent-name>",
+      "displayName": "Checkout Latency Review",
+      "description": "Reviews latency on the checkout service.",
+      "type": "<agent-type>",
+      "trigger": "<trigger>",
+      "active": true,
+      "isSystemAgent": false,
+      "createdAt": "2026-10-01T08:00:00Z",
+      "updatedAt": "2026-10-10T09:30:00Z",
+      "lastRun": "2026-10-14T06:00:00Z"
+    }
+  ],
+  "pagination": {
+    "pageNumber": 1,
+    "pageSize": 20
+  }
+}
+```
+
+`total` is the number of matching agents across all pages. A page past the end returns an empty `results` list. Use `displayName` as the agent's title. Each `id` works as `<<AGENT-ID>>` in the other endpoints.
+
+A request authenticated with a session or share token instead of an API token returns `401`.
+
 ## Run an agent
 
 ```

diff --git a/docs/user-guide/orioniq/marketplace.md b/docs/user-guide/orioniq/marketplace.md
@@ -54,6 +54,14 @@ After you click **Activate agent**, a confirmation shows how the agent runs. Cli
 
 You can activate a template more than once. Once agents exist for a template, its card and preview show the number of active agents. Click it to open the Agents Hub filtered to those agents. To switch an agent off, use the Agents Hub.
 
+## Free trial
+
+Every agent you activate from the Marketplace starts with a free trial. The template card, the preview, the activation dialog, and the confirmation after you activate all show how many free runs the agent has.
+
+When the free runs are used, the agent switches off automatically and nothing is charged. In the [Agents Hub](/docs/user-guide/orioniq/agents-hub/), the **Cost** column shows the runs left, and an agent whose trial is over is marked **Trial ended**. Nothing runs or is charged until you turn it back on, and turning it on again asks you to confirm that each run is billed.
+
+If you can see pricing, the activation dialog and the agent form also offer **Keep running after the free runs**. Select it to let the agent keep running, billed per run, once the trial ends.
+
 If a template you're interested in is not yet available, click **Add to Wish List** to signal your interest. This helps Logz.io prioritize which templates to build next.
 
 You can also click **+ Create New Agent** in the top right corner to build a custom agent from scratch.