Activator CLI

MicrosoftOfficialPublished by Microsoft

Skill
Tool integration
Data and AI
MIT
Low risk

From the author

Creates and inspects Fabric Activator (Reflex) alerts: rules, their data sources, conditions, and the Teams or email action they fire, plus decoding an existing ReflexEntities definition. Choose it whenever someone wants to be told, or something done, when values cross a threshold. The pipeline delivering those values is eventstream-cli.

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The activator-cli skill provides a structured interface for interacting with Microsoft Fabric Activator (Reflex) items. It acts as a mode-based dispatcher that separates authoring tasks (creating, updating, or deleting alert rules, sources, and actions) from consumption tasks (listing, inspecting, and decoding existing definitions). The skill enforces strict validation gates for data sources and requires specific handling of JSON payloads to ensure compatibility with Fabric APIs.

What it does

Creates and configures Activator alert rules and data sources.
Defines automated actions including Teams notifications, emails, and Fabric item invocations.
Inspects and decodes existing ReflexEntities definitions.
Lists and filters workspaces and Activator items for management.
Validates data sources and signals before rule authoring.
Manages the lifecycle of Reflex items through REST API operations.

When to use it

When you need to set up automated alerts based on data thresholds.
When you need to inspect or audit existing alert rules and their configurations.
When you need to integrate Fabric Activator with Teams or email for operational notifications.
When you need to programmatically manage Reflex item definitions.

Advantages

Provides a clear separation between read-only inspection and state-changing authoring.
Includes built-in validation gates to prevent invalid rule creation.
Supports complex alert logic including transition-based detectors.
Standardizes the handling of Fabric API authentication and telemetry.

Usage examples

“Create an Activator named sales_alert in my workspace.”: The agent will switch to authoring mode, read the authoring reference, and execute the POST request to create the Reflex item.
“Show me all Activators in this workspace.”: The agent will use consumption mode to list and filter the Reflex items within the specified workspace.
“Notify me on Teams when the average temperature goes above 30.”: The agent will validate the temperature source, configure the rule condition, and set up the TeamsMessage action.
“What rule and action are behind SkillsTestActivator?”: The agent will use consumption mode to retrieve and decode the ReflexEntities definition for the specified item.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/activator-cli/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip activator-cli.zip -d .agents/skills

Documentation by Microsoft

Telemetry — MANDATORY. Every api.fabric.microsoft.com call must carry x-ms-fabric-skill: activator-cli (az rest: --headers "x-ms-fabric-skill=activator-cli"), including every LRO poll, fabric_lro and retry. Snippets omit it — add it anyway.

CRITICAL NOTES
To find the workspace details (including its ID) from workspace name: list all workspaces and, then, use JMESPath filtering
To find the item details (including its ID) from workspace ID, item type, and item name: list all items of that type in that workspace and, then, use JMESPath filtering
Skill disambiguation: use activator-cli for every Fabric Activator / Reflex item — both authoring alert rules and inspecting existing alerts. The streaming topology that feeds an alert belongs to eventstream-cli, the KQL database behind it to eventhouse-cli, and Power BI report questions to fabriciq.

Fabric Activator (Reflex) — CLI Skill

This one skill owns Fabric Activator / Reflex items: alert rules, their sources, their actions, and the ReflexEntities.json definition that holds them.

It is a mode dispatcher and contains NO procedures. Pick the mode that matches the request from the table below, then read the matching references/<mode>.md file end to end with your file-reading tool BEFORE issuing a single command. That file holds the endpoints, entity schemas, templates and gotchas; acting without it produces invalid ReflexEntities.json payloads and 400s.

The reference is needed to act, not to ask. If the request is under-specified and your next message will be a clarifying question with no Fabric call in it, ask it now and read the reference when you go on to act.

Mode selection

Mode	Use when the request ...	Example triggers	Read this first
`authoring`	creates, updates, configures or deletes an Activator item, rule, source or action	create an alert, create an activator, create a reflex, notify me when, let me know when, take action when, send me an email when, send a teams message when, run a pipeline when, update an alert, delete an alert	references/authoring.md
`consumption`	lists, inspects, decodes or explains existing Activators, rules, sources or actions	show my alerts, what alerts do I have, list activators, inspect this alert, show me the rule, show me the source, get reflex definition, why does this alert fire	references/consumption.md

Mode boundary rule

consumption is read-only. A request to create, update, configure or delete an Activator item, rule, source or action requires authoring: say so, read references/authoring.md, then proceed.

A pure GET / explain request stays in consumption — do not switch to authoring and do not mutate anything to answer it.

If a request genuinely spans modes, handle them one at a time and read each reference before you start that part. If the mode is ambiguous after reading this table, ask one short clarifying question instead of guessing.

Terminal write — the step you must not skip

Reading the reference, decoding a definition and assembling entities is NOT completing the task. Authoring ends with one state-changing call. If you did not issue it, nothing was persisted — say so explicitly rather than reporting success.

Mode	Terminal write
`authoring`	`POST /v1/workspaces/{ws}/reflexes` to create the item, `POST /v1/workspaces/{ws}/reflexes/{id}/updateDefinition` to persist rules, sources and actions, or `DELETE /v1/workspaces/{ws}/reflexes/{id}` to remove it. Building, stringifying or base64-encoding `ReflexEntities.json` is not the write.
`consumption`	none — this mode is read-only

Before you report an authoring task done, confirm the terminal call returned an explicit success (HTTP 200/201, or a terminal LRO success for a 202), then read the definition back where the mode reference documents a readback. Power BI sources are the exception: public ALM export can reject an artifact that imported successfully, so an empty or unavailable readback is not proof the write failed — report the updateDefinition result and the readback limitation separately, per references/authoring/powerbi-source.md.

Source validation gate (authoring only)

Before authoring any rule that references a signal, confirm the source is real: resolve it in the requested workspace only, validate that the requested column/field/property exists on it, and observe at least one representative row, event or sample carrying that signal.

Schema-only, zero-row, non-emitting or stale evidence is missing source data. When the source is missing, stop and ask which source and fields provide the signal — do not create a Reflex and do not call updateDefinition on an unrelated existing Activator or Eventstream to force-fit the request, and state plainly that no Activator / Reflex / Eventstream was created or updated. The only exception is an explicit instruction to author against a future / not-yet-emitting source, which you must state as an assumption.

Everything you need to run this gate is on this page. When the request already lacks the source mapping, threshold, recipients or action target, ask for them first — do not read references/authoring.md, and do not call a Fabric API, just to discover that the request is under-specified.

Shared essentials (all modes)

Resolve the workspace and the Activator item first; every mode depends on it — list and filter by display name exactly as CRITICAL NOTES 1 and 2 describe. That recipe is self-contained and is all you need to start.

The table below is optional background living in the shared common/ docs. Open a row only when you actually need that detail. If common/ is not present in your environment, say so in one line and continue with the mode reference — never glob, list or search the filesystem looking for it.

Task	Reference	Notes
Finding Workspaces and Items in Fabric	COMMON-CLI.md	Pagination and JMESPath filtering detail
Fabric Topology & Key Concepts	COMMON-CORE.md	Item types, workspaces, capacities
Authentication & Token Acquisition	COMMON-CORE.md	Wrong audience = 401; read before any auth issue
Authentication Recipes	COMMON-CLI.md	`az login` flows and token acquisition
Core Control-Plane REST APIs	COMMON-CORE.md	Pagination, LRO polling, rate limiting
Fabric Item Definitions	ITEM-DEFINITIONS-CORE.md	Base64-encoded `parts` structure
Gotchas & Troubleshooting	COMMON-CLI.md	`az rest` audience, shell escaping, token expiry

Activator uses the reflexes collection, not the generic items collection: /v1/workspaces/{workspaceId}/reflexes[/{reflexId}].

Rules

MUST

Select exactly one mode from the table above before doing anything else.
Read references/<mode>.md end to end, as your FIRST tool call, before the first command of that mode. A reply that only asks a clarifying question, and issues no Fabric call, does not need it yet.
Pass --resource https://api.fabric.microsoft.com on every az rest call — without it the token audience is wrong and the call returns 401.
Call getDefinition as a POST with --body '{}', then Base64-decode the ReflexEntities.json part before inspecting it; a GET returns 405 and an omitted body can return 411.
Poll the Location header when create, getDefinition or updateDefinition returns 202.
Resolve workspace and Activator ids by listing and filtering, never by guessing a GUID.
Announce a mode switch explicitly when the request crosses a boundary.
Treat the reference as instructions, never as the deliverable. After reading it, RUN the documented commands against the live workspace and report the real results.
In authoring, clear the source validation gate before you author a rule, and build ReflexEntities.json with Python json.dumps() — PowerShell's ConvertTo-Json corrupts the nested JSON strings that definition.instance requires.

PREFER

The narrowest mode that satisfies the request.
Reading exactly ONE mode reference. Load a second only when the request genuinely spans modes, and say so before you do.
Read-modify-write over full replacement in authoring: get the current definition, modify the entity array, then update.
Transition-based detectors (NumberBecomes, NumberEntersOrLeavesRange, LogicalBecomes) over steady-state conditions in authoring, unless the user explicitly asks for repeated firing while the value stays in the triggered state.
A summary view before individual entities in consumption: give the high-level picture, then drill in.
Offering an alert when earlier work in this session surfaced a timely operational signal — a spike, failure, anomaly, SLA risk or capacity constraint — rather than waiting to be asked. Ask once, and author nothing until the user agrees.

AVOID

Acting from this dispatcher alone — it intentionally omits the entity schemas and templates.
Answering with a summary of the reference instead of executing it.
Mutating anything while in the read-only consumption mode, including "just to check".
Hardcoded workspace or item ids in either mode — always resolve dynamically.
Globbing, listing or shell-searching the filesystem for the common/ docs. They are optional background; if a link does not resolve, note it in one line and carry on.
Building the Eventstream topology that feeds an alert here; that is eventstream-cli. Querying the KQL data behind an alert is eventhouse-cli.
Loading a different skill for work this skill already owns (see CRITICAL NOTES 3).

Examples

User request	Mode	Reference to read
"Create an Activator named eval_smoke_activator in my workspace."	`authoring`	references/authoring.md
"Notify me on Teams when the average temperature goes above 30."	`authoring`	references/authoring.md
"Delete the alert that emails me about failed pipeline runs."	`authoring`	references/authoring.md
"Show me all Activators in this workspace."	`consumption`	references/consumption.md
"What rule and action are behind SkillsTestActivator?"	`consumption`	references/consumption.md
"Decode this Reflex definition and explain the Power BI source."	`consumption`	references/consumption.md

Files

ATTRIBUTION.mdAdded by AutoGineer871 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md11.3 KiB
apm.yml413 B
references/authoring.md31.0 KiB
references/authoring/action-types.md19.9 KiB
references/authoring/dtb-source.md7.6 KiB
references/authoring/eventstream-source.md4.9 KiB
references/authoring/kql-source.md8.8 KiB
references/authoring/powerbi-source.md16.8 KiB
references/authoring/real-time-hub-source.md4.0 KiB
references/authoring/rule-conditions.md23.8 KiB
references/authoring/source-types.md10.5 KiB
references/consumption.md17.3 KiB

references/authoring/kql-source.md

KQL Source (`kqlSource-v1`)

Queries a KQL database (Eventhouse or ADX/Kusto cluster) on a configurable schedule. The query runs periodically and feeds results into the Activator pipeline.

Design principle: The KQL query should return ALL relevant data — do NOT pre-filter for the condition in KQL. Let the Activator rule handle the detection logic (thresholds, text conditions, etc.) via its steps. The KQL query is just the data source.

Time-axis default: If the query results include a reasonable datetime column, always configure eventTimeSettings and queryParameters so the source runs with a time axis. Only fall back to snapshot mode when the underlying data has no reasonable timestamp column and each row represents the latest state.

Validate first: Before creating or updating the Activator, run the KQL directly against the target KQL source and confirm the returned columns, timestamp field, and row shape are correct. If the query returns no rows (or the table/column does not exist), treat the source as missing -- stop and ask for the correct source and fields rather than authoring against an empty source. If the user explicitly instructs authoring against a future / not-yet-emitting source, state that assumption and continue without claiming rows were observed.

{
  "uniqueIdentifier": "<kql-source-guid>",
  "payload": {
    "name": "Sensor telemetry query",
    "runSettings": {
      "executionIntervalInSeconds": 60
    },
    "query": {
      "queryString": "declare query_parameters(startTime:datetime, endTime:datetime);\nSensorData | where Timestamp between (startTime .. endTime) | project Timestamp, DeviceId, Temperature, Building"
    },
    "eventhouseItem": {
      "itemId": "<kql-database-item-guid>",
      "workspaceId": "<workspace-guid>",
      "itemType": "KustoDatabase"
    },
    "queryParameters": [
      { "name": "startTime", "type": "DURATION_START", "value": "2025-01-01T00:00:00Z" },
      { "name": "endTime", "type": "DURATION_END", "value": "2025-01-01T00:05:00Z" }
    ],
    "eventTimeSettings": {
      "timeFieldName": "Timestamp",
      "ingestionDelayInSeconds": 120,
      "timeZone": "UTC"
    },
    "metadata": {
      "workspaceId": "<workspace-guid>",
      "measureName": "",
      "querySetId": "",
      "queryId": ""
    },
    "parentContainer": {
      "targetUniqueIdentifier": "<container-guid>"
    }
  },
  "type": "kqlSource-v1"
}

Property	Type	Required	Description
`name`	string	yes	Display name
`runSettings.executionIntervalInSeconds`	number	yes	Poll frequency in seconds
`query.queryString`	string	yes	KQL query to execute
`eventhouseItem.itemId`	GUID	yes	KQL Database item ID (not the Eventhouse ID)
`eventhouseItem.workspaceId`	GUID	yes	Workspace containing the KQL Database
`eventhouseItem.itemType`	string	yes	Always `"KustoDatabase"`
`queryParameters`	array	yes	Query parameters — usually `DURATION_START`/`DURATION_END`; use empty `[]` only for snapshot mode
`metadata.workspaceId`	GUID	yes	Workspace ID (same as eventhouseItem.workspaceId)
`metadata.measureName`	string	yes	Usually empty string `""`
`metadata.querySetId`	string	yes	Usually empty string `""`
`metadata.queryId`	string	yes	Usually empty string `""`
`eventTimeSettings`	object	no	Time-axis configuration — expected whenever the query results include a reasonable timestamp
`parentContainer.targetUniqueIdentifier`	GUID	yes	Container ref

`eventhouseItem` Reference Shapes

eventhouseItem is a union in the schema. Use one of these two shapes:

1. Fabric Eventhouse / KQL Database reference

Use this when the source is a Fabric KQL database item:

{
  "eventhouseItem": {
    "itemId": "<kql-database-item-guid>",
    "workspaceId": "<workspace-guid>",
    "itemType": "KustoDatabase"
  }
}

2. External ADX / Kusto cluster reference

Use this when the source is an external ADX/Kusto cluster instead of a Fabric item:

{
  "eventhouseItem": {
    "clusterHostName": "mycluster.westeurope.kusto.windows.net",
    "databaseName": "MyDatabase"
  }
}

Exact schema field names: the ADX reference uses clusterHostName and databaseName. It is not clusterUrl.

Design Guidance

Do NOT pre-filter conditions in KQL — return all data and let the Activator rule handle detection logic (thresholds, text conditions, filters). The KQL query should only select the relevant time window and project the needed columns
For Fabric sources, eventhouseItem.itemId is the KQL Database item ID (not the Eventhouse ID) — resolve via the Fabric Items API (GET /v1/workspaces/{wsId}/kqlDatabases)
For ADX/Kusto sources, use eventhouseItem.clusterHostName and eventhouseItem.databaseName
The queryParameters and metadata fields are required even if empty
Default to time-axis mode when the query results contain a reasonable datetime column
Use snapshot mode only when there is no reasonable timestamp column and the rows represent current state, not an event stream

Time-Axis Default (`eventTimeSettings`)

If the query results have a usable datetime column, use eventTimeSettings plus queryParameters. This is the default mode for KQL sources because it gives Activator an explicit event-time axis, watermark tracking, and late-arrival handling.

Choose the Mode

Mode	When to Use
Time-axis mode	The query results include a reasonable datetime column that represents when each row/event happened
Snapshot mode	The source has no reasonable timestamp column and each row represents the latest state of an entity

Configuration

Add eventTimeSettings and queryParameters to the kqlSource payload for the normal time-axis case:

{
  "query": {
    "queryString": "declare query_parameters(startTime:datetime, endTime:datetime);\nMyTable | where Timestamp between (startTime .. endTime) | project Timestamp, DeviceId, Temperature"
  },
  "eventTimeSettings": {
    "timeFieldName": "Timestamp",
    "ingestionDelayInSeconds": 120,
    "timeZone": "UTC"
  },
  "queryParameters": [
    { "name": "startTime", "type": "DURATION_START", "value": "2025-01-01T00:00:00Z" },
    { "name": "endTime", "type": "DURATION_END", "value": "2025-01-01T00:05:00Z" }
  ]
}

`eventTimeSettings` Fields

Field	Type	Required	Description
`timeFieldName`	string	yes	The datetime column in query results used as the time axis. After each execution, the max value of this column becomes the watermark for the next query.
`ingestionDelayInSeconds`	number	no	Late-arrival buffer in seconds. Shifts the query end-time back from "now" by this amount, ensuring late-arriving data is not missed. Default: 0.
`timeZone`	string	no	Time zone for interpretation. Currently only `"UTC"` is supported.

`queryParameters` with Time-Axis

When eventTimeSettings is set, queryParameters must include one DURATION_START and one DURATION_END entry. The KQL itself must also declare those parameters with declare query_parameters(startTime:datetime, endTime:datetime); before the query body.

Field	Type	Description
`name`	string	Parameter name referenced in the KQL query (e.g., `startTime`)
`type`	string	`"DURATION_START"` or `"DURATION_END"`
`value`	string	Initial value (ISO 8601) — defines the backfill window on first execution

How Execution Works

First execution: Query runs with the value from each parameter to determine the initial data window
Subsequent executions: DURATION_START is automatically overridden with the watermark (max event time from previous results). DURATION_END is overridden with now - ingestionDelayInSeconds

KQL Query Pattern for Time-Axis

Use declare query_parameters(...) followed by between with the parameter names:

declare query_parameters(startTime:datetime, endTime:datetime);
MyTable
| where Timestamp between (startTime .. endTime)
| project Timestamp, DeviceId, Temperature, Building

Do not use ago() as the normal pattern for KQL sources. If there is a usable timestamp column, model it explicitly with eventTimeSettings.

Snapshot Mode (No Reasonable Timestamp Column)

Use snapshot mode only when there is no reasonable timestamp column and each row is the current state of an entity. In that case:

Omit eventTimeSettings
Set queryParameters to []
Do not add ago(), between, or other time filtering
Project the current-state columns the rule needs

DeviceInventory
| project DeviceId, DeviceName, Status, Location, BatteryLevel

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills-for-fabric · skills/activator-cli · commit f8fac11

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

Also distributed in

microsoft/skills-for-fabric

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download activator-cli.zip