{
  "sql": "SELECT\n  RayID AS ray_id,\n  EdgeResponseStatus AS status,\n  '[REDACTED]' AS client_ip_redacted,\n  'cloudflare' AS provider\nFROM http_requests\nWHERE EdgeResponseStatus >= 400\n",
  "input": {
    "RayID": "0000000000000002",
    "ClientIP": "2001:db8::42",
    "EdgeResponseStatus": 502,
    "ClientRequestURI": "/check?client_ip=2001:db8::42",
    "ClientRequestUserAgent": "SyntheticProbe/1.0"
  }
}