---
title: "Get live query details"
method: GET
path: "/api/osquery/live_queries/{id}"
tags: ["Security Osquery API"]
---

# Get live query details

`GET /api/osquery/live_queries/{id}`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get the details of a live query using the query ID.

## Path parameters

- `id` string, required — The ID of the live query result you want to retrieve.

## Response `200`

Indicates a successful call.

- SecurityOsqueryAPIFindLiveQueryDetailsResponse
  - `data` object
    - `@timestamp` string, date-time
    - `action_id` string
    - `agents` string[]
    - `expiration` string, date-time
    - `pack_id` string
    - `pack_name` string
    - `prebuilt_pack` boolean
    - `queries` object[] — The queries with their execution status.
      - `action_id` string
      - `agents` string[]
      - `docs` integer — Number of result documents.
      - `ecs_mapping` SecurityOsqueryAPIECSMapping — Map osquery results columns or static values to Elastic Common Schema (ECS) fields
      - `failed` integer — Number of failed queries.
      - `id` string
      - `pending` integer — Number of pending agents.
      - `query` string
      - `responded` integer — Total responded agents.
      - `saved_query_id` string
      - `status` 'completed' | 'running' — Status of this individual query.
      - `successful` integer — Number of successful agents.
    - `status` 'completed' | 'running' — Global status of the live query (completed, running).
    - `tags` string[]
    - `user_id` string
    - `user_profile_uid` string

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)