diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index 1ca2541d9166..3704fad35979 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -5536,6 +5536,7 @@ Either `query` or `query_id` must be provided. - [List queries](#list-queries) - [Get query](#get-query) - [Get query report](#get-query-report) +- [Get query report for one host](#get-query-report-for-one-host) - [Create query](#create-query) - [Modify query](#modify-query) - [Delete query by name](#delete-query-by-name) @@ -5721,9 +5722,9 @@ Returns the query report specified by ID. #### Parameters -| Name | Type | In | Description | -| ---- | ------- | ---- | ------------------------------------------ | -| id | integer | path | **Required**. The ID of the desired query. | +| Name | Type | In | Description | +| --------- | ------- | ----- | ------------------------------------------ | +| id | integer | path | **Required**. The ID of the desired query. | #### Example @@ -5797,6 +5798,72 @@ If a query has no results stored, then `results` will be an empty array: > Note: osquery scheduled queries do not return errors, so only non-error results are included in the report. If you suspect a query may be running into errors, you can use the [live query](#run-live-query) endpoint to get diagnostics. +### Get query report for one host + +Returns a query report for a single host. + +`GET /api/v1/fleet/hosts/:id/queries/:query_id` + +#### Parameters + +| Name | Type | In | Description | +| --------- | ------- | ----- | ------------------------------------------ | +| id | integer | path | **Required**. The ID of the desired host. | +| query_id | integer | path | **Required**. The ID of the desired query. | + +#### Example + +`GET /api/v1/fleet/hosts/123/queries/31` + +##### Default response + +`Status: 200` + +```json +{ + "query_id": 31, + "host_id": 1, + "host_name": "foo", + "last_fetched": "2021-01-19T17:08:31Z", + "report_clipped": false, + "results": [ + { + "columns": { + "model": "USB 2.0 Hub", + "vendor": "VIA Labs, Inc." + } + }, + { + "columns": { + "model": "USB Keyboard", + "vendor": "VIA Labs, Inc." + } + }, + { + "columns": { + "model": "USB Reciever", + "vendor": "Logitech" + } + } + ] +} +``` + +If a query has no results stored for the specified host, then `results` will be an empty array: + +```json +{ + "query_id": 31, + "host_id": 1, + "host_name": "foo", + "last_fetched": "2021-01-19T17:08:31Z", + "report_clipped": false, + "results": [] +} +``` + +> Note: osquery scheduled queries do not return errors, so only non-error results are included in the report. If you suspect a query may be running into errors, you can use the [live query](#run-live-query) endpoint to get diagnostics. + ### Create query Creates a global query or team query.