Critical-risk tools in Countly
20 of the 127 tools in Countly are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
ab_experiments_deleteDestructiveDelete an A/B testing experiment and all its collected data. Requires the ab-testing plugin. WARNING: irreversible. To temporarily halt without data loss use ab_experiments_stop.
-
alerts_deleteDestructiveDelete an alert configuration via /i/alert/delete. Requires the alerts plugin. WARNING: irreversible. To temporarily disable instead, update the alert with enabled=false via ale...
-
app_users_deleteDestructiveDelete app-user profiles matching a MongoDB query via /i/app_users/delete. By default rejects multi-match deletions unless force=true. WARNING: irreversible.
-
apps_deleteDestructivePermanently delete a Countly app and all its data via /i/apps/delete. Requires global admin privileges. WARNING: irreversible. To wipe analytics data but keep the app use apps_r...
-
apps_resetDestructiveDelete all analytics data for an app (sessions, events, users, crashes, etc.) while keeping the app record and keys intact, via /i/apps/reset. Requires global admin privileges. ...
-
cohorts_deleteDestructiveDelete a cohort definition via /i/cohorts/delete. Requires the cohorts plugin. WARNING: irreversible.
-
crashes_comment_deleteDestructiveDelete a single comment from a crash group via /i/crashes/delete_comment. Requires the crashes plugin. WARNING: irreversible.
-
crashes_unresolveDestructiveReopen a previously resolved crash group (clear the resolved flag) via /i/crashes/unresolve. Requires the crashes plugin. To resolve use crashes_resolve.
-
dashboards_deleteDestructiveDelete a custom dashboard and all its widgets via /i/dashboards/delete. Requires the dashboards plugin. WARNING: irreversible.
-
dashboards_widget_removeDestructiveRemove a single widget from a dashboard via /i/dashboards/remove-widget. Requires the dashboards plugin. WARNING: irreversible. To delete the whole dashboard use dashboards_delete.
-
drill_bookmarks_deleteDestructiveDelete a saved drill bookmark via /i/drill/delete_bookmark. Requires the drill plugin. WARNING: irreversible.
-
email_reports_deleteDestructiveDelete an email report configuration via /i/reports/delete. Requires the reports plugin. WARNING: irreversible. To disable temporarily set enabled=false via email_reports_update...
-
events_deleteDestructiveDelete one or more event definitions and all their historical data via /i/events/delete_events. WARNING: irreversible. For creating/updating definitions use events_create.
-
filtering_rules_deleteDestructivePermanently delete a filtering rule via /i/blocks/delete; matching requests will no longer be dropped. Requires the blocks plugin. WARNING: irreversible. To disable without dele...
-
formulas_deleteDestructiveDelete a saved calculated-metric formula by _id via /i/calculated_metrics/delete. Requires the formulas plugin. WARNING: irreversible.
-
funnels_deleteDestructiveDelete a funnel definition via /i/funnels/delete. Requires the funnels plugin. WARNING: irreversible.
-
hooks_deleteDestructiveDelete a hook by its _id via /i/hook/delete. Requires the hooks plugin. WARNING: irreversible. To disable without deleting set enabled=false via hooks_update.
-
notes_deleteDestructiveDelete a single note by its _id via /i/notes/delete. WARNING: irreversible. Unlike other tools in this file, this endpoint is app-agnostic and does not require app_id.
-
remote_config_conditions_deleteDestructiveDelete a remote-config segmentation condition via /i/remote-config/remove-condition. Fails if any parameter still references the condition. Requires the remote-config plugin. WA...
-
remote_config_parameters_deleteDestructiveDelete a remote-config parameter via /i/remote-config/remove-parameter. After deletion, SDKs will stop receiving it. Requires the remote-config plugin. WARNING: irreversible.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.