---
title: "Get observed values for an endpoint"
method: GET
path: "/session/{sessionID}/observations"
---

# Get observed values for an endpoint

`GET /session/{sessionID}/observations`

Per-endpoint observed values (raw facts): which credential used which concrete values for each parameter. Pulled on-demand when the UI expands an endpoint. Pass the endpoint's key_hash.

## Path parameters

- `sessionID` string, required

## Query parameters

- `directory` string
- `keyHash` string
- `id` string

## Response `200`

Observed-value tree

- unknown

## Other responses

- `400` — Bad request
- `404` — Not found

---

[API](https://skmtc.net/cyberstrikeus/apis/cyberstrike.md) · [All operations](https://skmtc.net/cyberstrikeus/apis/cyberstrike/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cyberstrikeus/cyberstrike/versions/4e11f1aed2fd/schema)