[seanghaeli]

There's no way to see what runs on the triggerers: GET /assets shows only a watcher's name and trigger id, so a failing watcher's status has no visibility. #76101 records each trigger's failures and owner on its row; this reads them.

• GET /api/v2/triggers and GET /api/v2/triggers/{trigger_id} list every trigger the caller can see, with its kind, status, triggerer, failures, last error, last event and owner. Kwargs, which can hold credentials, are never loaded or returned.
• status is worked out when read: pending if no triggerer has it, orphaned if its triggerer stopped heartbeating, failing while it has failures since it last recovered, otherwise running.
• Filters: kind, status, triggerer_hostname, dag_id, asset_id and teams.
• No new permission: each kind is gated like the routes that show its owner. A task's trigger needs Task Instance read on its Dag, a callback's trigger Dag Run read on its Dag, and a watcher's trigger read on one of its assets. A shared trigger only lists the watchers on assets you can read. If you can read none of those you get a 403.
• Watchers in GET /assets gain status.

How to review: get_triggers and _build_response in routes/public/triggers.py, then the access rule PermittedTriggerFilter in core_api/security.py and the status in Trigger.status / status_expression in models/trigger.py.

There is ~600 lines of source, the rest is generated code, docs and tests.

Breeze on Postgres, every kind of trigger running with one watcher crash-looping, then FAB users with one role each:

--- GET /api/v2/triggers -> HTTP 200
  total_entries=5
  id=1   kind=asset_watcher status=running  host=trig-a dag_id=None fails=0 last_event=None | watchers healthy_asset/healthy_watcher
  id=2   kind=asset_watcher status=running  host=trig-a dag_id=None fails=0 last_event=None | watchers shared_trigger_a_asset/shared_trigger_b_watcher,shared_trigger_b_asset/shared_trigger_b_watcher
  id=3   kind=asset_watcher status=failing  host=trig-a dag_id=None fails=38 last_event=None | watchers expired_credentials_asset/expired_credentials_watcher
         last_error='ConnectionError: the security token included in the request is expired'
  id=5   kind=callback      status=running  host=trig-a dag_id=example_deadline_callback fails=0 last_event=2026-10-29T12:11:17.236983Z | callback 01a18792 dag=example_deadline_callback run=manual__2026-10-29T12:11:03.871280+00:00 cb_state=running
  id=4   kind=task          status=running  host=trig-a dag_id=example_deferred_task fails=0 last_event=None | task example_deferred_task.wait_for_trigger try=1 ti_state=deferred
  ?kind=asset_watcher -> HTTP 200 ids=[1 2 3]
  ?status=failing -> HTTP 200 ids=[3]
  ?dag_id=example_deadline_callback -> HTTP 200 ids=[5]
  ?asset_id=3 -> HTTP 200 ids=[2]
  ?kind=sensor -> HTTP 422 ids=[]

# FAB auth manager, users named for what they can read
--- reads_deferred_task_dag: list HTTP 200
    total_entries=1 visible=4:task(wait_for_trigger)
--- reads_deadline_dag: list HTTP 200
    total_entries=1 visible=5:callback
--- reads_assets_only: list HTTP 200
    total_entries=3 visible=1:asset_watcher(kwargs_with_secret_watcher), 2:asset_watcher(healthy_watcher), 3:asset_watcher(expired_credentials_watcher)
--- no_access: list HTTP 403
    detail='Forbidden'

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Code (Opus 5.5) following the guidelines

[seanghaeli]

Tagging @fat-catTW and @potiuk since this follows #76101 which you reviewed