---
title: "Get unified query history"
method: GET
path: "/api/osquery/history"
tags: ["Security Osquery API"]
---

# Get unified query history

`GET /api/osquery/history`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/history</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.

## Query parameters

- `pageSize` integer — The number of results to return per page.
- `nextPage` string — A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
- `kuery` string — A search string to filter history entries by pack name, query text, or query ID.
- `userIds` string — Comma-separated list of user IDs to filter live query history.
- `sourceFilters` string — Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
- `startDate` string — The start of the time range filter (ISO 8601).
- `endDate` string — The end of the time range filter (ISO 8601).

## Response `200`

Indicates a successful call.

- SecurityOsqueryAPIGetUnifiedHistoryResponse
  - `data` SecurityOsqueryAPIUnifiedHistoryRow[], required — The list of unified history rows for the current page.
    - union
      - SecurityOsqueryAPILiveHistoryRow
        - `agentCount` integer, required — The number of agents targeted by the query.
        - `errorCount` integer, nullable — The number of agent responses with errors.
        - `id` string, required — Unique identifier for the history row.
        - `packId` string — The ID of the pack containing the query.
        - `packName` string — The name of the pack containing the query.
        - `queryName` string — The name of the query, if available.
        - `queryText` string, required — The SQL query that was executed.
        - `spaceId` string — The Kibana space ID where the query was executed.
        - `successCount` integer, nullable — The number of successful agent responses.
        - `timestamp` string, required — The timestamp of the query execution.
        - `totalRows` integer, nullable — The total number of result rows returned across all agents.
        - `actionId` string — The Fleet action ID for the live query.
        - `agentAll` boolean — Whether the query targeted all agents.
        - `agentIds` string[] — List of targeted agent IDs.
        - `agentPlatforms` string[] — List of targeted agent platforms.
        - `agentPolicyIds` string[] — List of targeted agent policy IDs.
        - `ecsMapping` object — ECS mapping configuration used for the query.
        - `queriesTotal` integer — The total number of sub-queries in the live action.
        - `queriesWithResults` integer — The number of sub-queries that returned results.
        - `savedQueryId` string — The saved query ID, if the live query was based on a saved query.
        - `source` 'Live' | 'Rule', required — Whether this was a manually run live query or triggered by a rule.
        - `sourceType` 'live', required — Identifies this as a live query history row.
        - `timeout` integer — The query timeout in seconds.
        - `userId` string — The ID of the user who ran the query.
        - `userProfileUid` string — The user profile UID of the user who ran the query.
      - SecurityOsqueryAPIScheduledHistoryRow
        - `agentCount` integer, required — The number of agents targeted by the query.
        - `errorCount` integer, nullable — The number of agent responses with errors.
        - `id` string, required — Unique identifier for the history row.
        - `packId` string — The ID of the pack containing the query.
        - `packName` string — The name of the pack containing the query.
        - `queryName` string — The name of the query, if available.
        - `queryText` string, required — The SQL query that was executed.
        - `spaceId` string — The Kibana space ID where the query was executed.
        - `successCount` integer, nullable — The number of successful agent responses.
        - `timestamp` string, required — The timestamp of the query execution.
        - `totalRows` integer, nullable — The total number of result rows returned across all agents.
        - `executionCount` integer — The execution count for this scheduled query run.
        - `plannedTime` string — The planned execution time for the scheduled query.
        - `scheduleId` string — The schedule ID for the scheduled query.
        - `source` 'Scheduled', required — Indicates this is a scheduled query execution.
        - `sourceType` 'scheduled', required — Identifies this as a scheduled query history row.
  - `hasMore` boolean, required — Whether there are more results beyond the current page.
  - `nextPage` string — A base64-encoded cursor to fetch the next page. Absent when there are no more results.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)