Skip to content

Commit 2aa3cb5

Browse files
committed
Move per-host query report into its own API endpoint
1 parent 6c638fe commit 2aa3cb5

File tree

1 file changed

+67
-1
lines changed

1 file changed

+67
-1
lines changed

docs/REST API/rest-api.md

Lines changed: 67 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5491,6 +5491,7 @@ Either `query` or `query_id` must be provided.
54915491
- [List queries](#list-queries)
54925492
- [Get query](#get-query)
54935493
- [Get query report](#get-query-report)
5494+
- [Get query report for one host](#get-query-report-for-one-host)
54945495
- [Create query](#create-query)
54955496
- [Modify query](#modify-query)
54965497
- [Delete query by name](#delete-query-by-name)
@@ -5679,7 +5680,6 @@ Returns the query report specified by ID.
56795680
| Name | Type | In | Description |
56805681
| --------- | ------- | ----- | ------------------------------------------ |
56815682
| id | integer | path | **Required**. The ID of the desired query. |
5682-
| host_id | integer | query | If provided, filters to only include results for the specified host. |
56835683

56845684
#### Example
56855685

@@ -5753,6 +5753,72 @@ If a query has no results stored, then `results` will be an empty array:
57535753

57545754
> Note: osquery scheduled queries do not return errors, so only non-error results are included in the report. If you suspect a query may be running into errors, you can use the [live query](#run-live-query) endpoint to get diagnostics.
57555755
5756+
### Get query report for one host
5757+
5758+
Returns a query report for a single host.
5759+
5760+
`GET /api/v1/fleet/hosts/{id}/query_report/{query_id}`
5761+
5762+
#### Parameters
5763+
5764+
| Name | Type | In | Description |
5765+
| --------- | ------- | ----- | ------------------------------------------ |
5766+
| id | integer | path | **Required**. The ID of the desired host. |
5767+
| query_id | integer | path | **Required**. The ID of the desired query. |
5768+
5769+
#### Example
5770+
5771+
`GET /api/v1/fleet/queries/31/report`
5772+
5773+
##### Default response
5774+
5775+
`Status: 200`
5776+
5777+
```json
5778+
{
5779+
"query_id": 31,
5780+
"host_id": 1,
5781+
"host_name": "foo",
5782+
"last_fetched": "2021-01-19T17:08:31Z",
5783+
"report_clipped": false,
5784+
"results": [
5785+
{
5786+
"columns": {
5787+
"model": "USB 2.0 Hub",
5788+
"vendor": "VIA Labs, Inc."
5789+
}
5790+
},
5791+
{
5792+
"columns": {
5793+
"model": "USB Keyboard",
5794+
"vendor": "VIA Labs, Inc."
5795+
}
5796+
},
5797+
{
5798+
"columns": {
5799+
"model": "USB Reciever",
5800+
"vendor": "Logitech"
5801+
}
5802+
}
5803+
]
5804+
}
5805+
```
5806+
5807+
If a query has no results stored for the specified host, then `results` will be an empty array:
5808+
5809+
```json
5810+
{
5811+
"query_id": 31,
5812+
"host_id": 1,
5813+
"host_name": "foo",
5814+
"last_fetched": "2021-01-19T17:08:31Z",
5815+
"report_clipped": false,
5816+
"results": []
5817+
}
5818+
```
5819+
5820+
> Note: osquery scheduled queries do not return errors, so only non-error results are included in the report. If you suspect a query may be running into errors, you can use the [live query](#run-live-query) endpoint to get diagnostics.
5821+
57565822
### Create query
57575823

57585824
Creates a global query or team query.

0 commit comments

Comments
 (0)