Views

A view is a dataset defined by a Hamelin query under a catalog name you choose, resolved at query time rather than persisted by default. The name may be top-level or schema-qualified. The resource id is prefixed VIE_.

A view reads from other datasets and exposes their transformed output as a named dataset the rest of the platform can query. Unlike a table, a view holds no rows of its own by default. A view's output feeds unions, mappers, detections, and other views downstream, and its fromDatasets name the datasets it depends on.

Variants

A view comes in two variants, determined by the materialized field.

• A virtual view holds no rows. The platform re-runs its query whenever something reads it. This is the default (materialized is false).
• A materialized view persists its output to storage and refreshes incrementally, on the same machinery a continuous table uses. Unlike a continuous table, a materialized view is fully re-derived when its definition changes. See incremental queries for why the two differ.

Inputs

Field	Type	Required	Description
name	string	Required	Dataset name in schema.name format, e.g. events.okta_admin, or a single identifier. Each segment starts with a letter or underscore and continues with letters, digits, or underscores.
query	string	Required	The Hamelin query that defines the view's rows.
deploy	boolean	Required	Whether the view is active. true makes the view queryable and, when materialized, runs it. false leaves it as saved content.
materialized	boolean	Optional	Whether the view persists its output to storage. false resolves the query at read time. true materializes and refreshes it incrementally. Default false.
maxLatency	enum	Optional	Ceiling on how stale a materialized view's rows may be: MAX_1H (one hour) or MAX_1D (one day). Default MAX_1H. Applies only when materialized.
startsAt	timestamp	Optional	For a materialized view, rows are only materialized for events at or after this time. Defaults to the deploy time. Null and ignored when not materialized.
retentionDays	integer	Optional	Days to retain materialized rows. Must be greater than 0. Null keeps the Space default.
sortedByColumns	array<string>	Optional	Columns the materialized dataset is sorted by. Each must be a non-empty string.
archived	boolean	Optional	Whether the view is archived. A view must be deployed and materialized before it can be archived. Default false.

Outputs

Field	Type	Description
deploymentStatus	enum	Materialization state: UNDEPLOYED, DEPLOY_PENDING, DEPLOY_IN_PROGRESS, DEPLOYED, UPDATE_PENDING, UPDATE_IN_PROGRESS, REFRESH_IN_PROGRESS, FAILED, ARCHIVED, CLEANUP_PENDING, CLEANUP_IN_PROGRESS.
endsAt	timestamp	For a materialized view, the time past which rows are no longer materialized. Null when not materialized or unbounded.
lastMaterializedAt	timestamp	When a materialized view last refreshed. Null if it never has or is not materialized.
fromDatasets	array<object>	The source datasets the query reads, each with name, resourceName, resourceId, and spaceId.
schemaId	string	Schema resource ID this view's output conforms to. Null when unconstrained.
detection	string	The detection that relies on this view, when one does.
integration	string	The integration that relies on this view, when one does.
lookup	string	The lookup that derives this view as its backing dataset, when one does.
readOnly	boolean	true when the view cannot be edited in place, such as one owned by a lookup or created by the platform.
isSystemCreated	boolean	true when the platform created the view rather than a user.

Plus the common resource fields.

Related

• Tables, the persisted counterpart a view reads from and a materialized view resembles.
• Unions, a dataset that combines views and tables.
• Connectors, the source datasets that feed views through tables.
• Incremental queries, how a materialized view refreshes.
• Data dependencies, how a view fits the dependency graph its fromDatasets describe.
• Changesets, how view edits are staged and committed.