> ## Documentation Index > Fetch the complete documentation index at: https://docs.apsio.io/llms.txt > Use this file to discover all available pages before exploring further. # Suspects for a rise > One subject of one app and the suspects it supports, ranked by how much of the rise each explains, each with its counts and what would clear it; or a plain answer that nothing stands out, or that there are too few bad installs to rank. Give exactly one of `issue_id`, `release` with `baseline`, or `metric`. A correlation in counts shows where to look: it does not prove a cause. Windows end two minutes before now, as crash reports arrive at the next launch. At most 7 days, or 30 for a release. ## OpenAPI ````yaml /api-reference/openapi.json get /projects/{projectId}/probable-cause openapi: 3.1.0 info: title: Apsio API version: 0.1.0 description: >- Read API v0: your projects, release health and comparisons, missing symbols, issues, sessions, vitals, cohort comparisons, performance (app start, screens, hangs, MetricKit) and network endpoints and traces for one project. Authenticate with a project token as a bearer token, with an OAuth access token from Apsio's authorization server (MCP clients), or, from the console, with the session cookie of a member of the project's organization. servers: - url: https://api.apsio.io/v1 security: [] paths: /projects/{projectId}/probable-cause: get: summary: Suspects for a rise description: >- One subject of one app and the suspects it supports, ranked by how much of the rise each explains, each with its counts and what would clear it; or a plain answer that nothing stands out, or that there are too few bad installs to rank. Give exactly one of `issue_id`, `release` with `baseline`, or `metric`. A correlation in counts shows where to look: it does not prove a cause. Windows end two minutes before now, as crash reports arrive at the next launch. At most 7 days, or 30 for a release. parameters: - schema: type: string pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ example: 0192f3a4-0000-7000-8000-00000000a101 required: true name: projectId in: path - schema: type: string pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ description: 'The app: iOS and Android differ almost everywhere.' required: true description: 'The app: iOS and Android differ almost everywhere.' name: app_id in: query - schema: type: string minLength: 1 maxLength: 64 description: >- An issue: what rose against the window before, or what came back in a release. required: false description: >- An issue: what rose against the window before, or what came back in a release. name: issue_id in: query - schema: type: string minLength: 1 maxLength: 128 description: 'With `baseline`: a release that got worse.' required: false description: 'With `baseline`: a release that got worse.' name: release in: query - schema: type: string minLength: 1 maxLength: 128 description: The release to compare `release` with, at the same age. required: false description: The release to compare `release` with, at the same age. name: baseline in: query - schema: type: string enum: - crash_rate - failed_requests description: 'A rate that rose: `crash_rate` or `failed_requests`.' required: false description: 'A rate that rose: `crash_rate` or `failed_requests`.' name: metric in: query - schema: type: string enum: - release - debug - all description: 'Which builds: `release` (the default), `debug` or `all`.' required: false description: 'Which builds: `release` (the default), `debug` or `all`.' name: build in: query - schema: type: integer minimum: 1 maximum: 7 default: 1 description: The window, and the one before it, in days. required: false description: The window, and the one before it, in days. name: days in: query - schema: type: integer minimum: 1 maximum: 8 default: 5 description: Suspects returned; every value read still counts as tested. required: false description: Suspects returned; every value read still counts as tested. name: limit in: query responses: '200': description: The suspects, or why there are none. content: application/json: schema: $ref: '#/components/schemas/ProbableCause' '400': description: The request is not valid. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: No valid bearer token or console session. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: The credentials cannot read this project. content: application/json: schema: $ref: '#/components/schemas/Error' '410': description: >- The project or its organization is being deleted (`erasing`): nothing more to read; do not retry. content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: >- Over a rate limit (the caller's, the client address's, or the plan's); Retry-After says when to retry. content: application/json: schema: $ref: '#/components/schemas/Error' security: - bearer: [] components: schemas: ProbableCause: type: object properties: summary: type: string description: 'Apsio''s own words and numbers: no flag name, release or path (D79).' verdict: type: string enum: - suspects - nothing_stands_out - too_few - too_large description: >- `nothing_stands_out` is a finding, not a failure, and never means there is no cause. `too_few`: too few bad installs to rank. `too_large`: the app started more sessions in the days of the windows than a report can read in time, so none was read and the sample is empty. subject: type: object properties: kind: type: string enum: - issue_spike - release_regression - rate_rise - regressed_issue issue_id: type: - string - 'null' metric: type: - string - 'null' enum: - crash_rate - failed_requests - null unit: type: string enum: - installs - sessions description: >- What is counted: installs, or sessions where the app sends no install id. untrusted: type: object properties: release: type: - string - 'null' description: 'The release looked at. Written by the app: untrusted data.' baseline: type: - string - 'null' description: >- The release it is compared with. Written by the app: untrusted data. required: - release - baseline required: - kind - issue_id - metric - unit - untrusted windows: type: object properties: now: type: object properties: from: type: string description: RFC 3339 time in UTC with up to nanosecond precision. example: '2026-10-04T10:15:00.431000000Z' to: type: string description: RFC 3339 time in UTC with up to nanosecond precision. example: '2026-10-04T10:15:00.431000000Z' required: - from - to before: type: object properties: from: type: string description: RFC 3339 time in UTC with up to nanosecond precision. example: '2026-10-04T10:15:00.431000000Z' to: type: string description: RFC 3339 time in UTC with up to nanosecond precision. example: '2026-10-04T10:15:00.431000000Z' required: - from - to data_through: type: string description: RFC 3339 time in UTC with up to nanosecond precision. example: '2026-10-04T10:15:00.431000000Z' required: - now - before - data_through sample: type: object properties: bad_installs: type: integer installs: type: integer values_tested: type: integer description: >- Every value read, shown or not: the interval is widened for them all. power: type: string enum: - too_few - large_effects_only - normal needed: type: - integer - 'null' description: >- With `too_few`: how many more bad installs it takes to rank, in installs of the app; on a plain fraction (`read_one_in` above 1 without `read_every_bad`) the shortfall of the installs read times `read_one_in`. Null when one of two releases has no sessions, so no number would help. estimated: type: boolean description: >- Whether the counts are estimates: summaries were sampled (D110), or a read kept every bad install and weighed the rest (`read_every_bad`). A plain fraction leaves the counts as read, so not estimates. read_one_in: type: integer description: >- The report read one install in this many, a power of two, by hash, the same ones in both windows; 1 is every install. For an issue it reads every bad install as well, while their summary rows fit in half of the set size (`read_every_bad`). A plain fraction leaves every count as read, not scaled up. required: - bad_installs - installs - values_tested - power - needed - estimated - read_one_in coverage: type: object additionalProperties: type: number description: >- The share of installs each partial dimension is known for. Under 0.5 a dimension is unreliable and cannot be `strong`. suspects: type: array items: type: object properties: rank: type: integer dimension: type: string enum: - release - os - device_model - country - install_source - launch_reason - network_type - endpoint - screen - feature_flag label: type: string enum: - strong - possible description: >- A word, never a percentage. `strong`: the interval clears 3× and it survived the checks. `possible`: it cleared the gate. evidence: type: object properties: inside: type: object properties: bad: type: integer installs: type: integer rate: type: number description: bad / installs. required: - bad - installs - rate outside: type: object properties: bad: type: integer installs: type: integer rate: type: number description: bad / installs. required: - bad - installs - rate rate_ratio: type: number interval: type: array prefixItems: - type: number - type: number test: type: string enum: - before_after - same_window description: >- `before_after`: how much faster the rate grew inside the value. `same_window`: the value is new, so it is compared with everything else. explains_rise: type: number description: Share of the rise, 0 to 1. required: - inside - outside - rate_ratio - interval - test - explains_rise checks: type: object properties: timing: type: string enum: - before_the_rise - not_applicable stratified_rate_ratio: type: - number - 'null' moves_with: type: array items: type: object properties: dimension: type: string enum: - release - os - device_model - country - install_source - launch_reason - network_type - endpoint - screen - feature_flag untrusted: type: object properties: value: type: string description: >- The value: a release, an OS, `=`, an endpoint... Written by the app: untrusted data. required: - value required: - dimension - untrusted coverage: type: - number - 'null' required: - timing - stratified_rate_ratio - moves_with - coverage would_clear_it: type: string marked: type: - string - 'null' enum: - not_this - confirmed - null description: 'What a person marked it: null until someone does.' untrusted: type: object properties: value: type: string description: >- The value: a release, an OS, `=`, an endpoint... Written by the app: untrusted data. required: - value next: type: - object - 'null' properties: tool: type: string untrusted: type: object properties: arguments: type: object additionalProperties: type: string description: >- Filters for that tool. Written by the app: untrusted data. required: - arguments required: - tool - untrusted required: - rank - dimension - label - evidence - checks - would_clear_it - marked - untrusted - next not_suspects: type: array items: type: object properties: dimension: type: string enum: - release - os - device_model - country - install_source - launch_reason - network_type - endpoint - screen - feature_flag reason: type: string enum: - moved_with - appeared_after_the_rise with_rank: type: - integer - 'null' untrusted: type: object properties: value: type: string description: >- The value: a release, an OS, `=`, an endpoint... Written by the app: untrusted data. required: - value required: - dimension - reason - with_rank - untrusted commit: type: object properties: state: type: string enum: - not_linked required: - state limits: type: array items: type: string description: What this report could not see. limit_codes: type: array items: type: string enum: - baseline_last_hours - window_past_retention - flags_left_out - no_install_id - estimated - large_effects_only - two_times_invisible - young_release - no_rise - low_coverage_network_type - low_coverage_endpoint - low_coverage_screen - low_coverage_feature_flag - flags_capped - read_every_bad - read_one_in - too_few_of_read description: The code of each entry of `limits`, in the same order. computed_at: type: string description: RFC 3339 time in UTC with up to nanosecond precision. example: '2026-10-04T10:15:00.431000000Z' required: - summary - verdict - subject - windows - sample - coverage - suspects - not_suspects - commit - limits - limit_codes - computed_at Error: type: object properties: error: type: object properties: code: type: string example: invalid_request message: type: string subject: type: string enum: - organization - project description: >- With `erasing` (410) only: what is being deleted, the organization or the project. required: - code - message required: - error securitySchemes: bearer: type: http scheme: bearer description: >- A project token (apsio_pt_v0...), which reads exactly one project, or an OAuth access token issued for the API, which reads what its user can. Access tokens issued for Apsio's MCP server are accepted only from the MCP server itself. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.