{
  "sql": "SELECT\n  RayID AS ray_id,\n  EdgeResponseStatus AS status,\n  '[REDACTED]' AS client_ip_redacted,\n  'cloudflare' AS provider\nFROM http_requests\nWHERE EdgeResponseStatus >= 400\n",
  "input": {
    "RayID": "0000000000000004",
    "ClientIP": "::ffff:192.0.2.10",
    "EdgeResponseStatus": 404,
    "ClientRequestURI": "/missing?session=synthetic-only",
    "ClientRequestUserAgent": "SyntheticProbe/1.0"
  }
}