---
title: "Get packs"
method: GET
path: "/api/osquery/packs"
tags: ["Security Osquery API"]
---

# Get packs

`GET /api/osquery/packs`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get a list of all query packs.

## Query parameters

- `page` integer, nullable — The page number to return. The default is 1.
- `pageSize` integer, nullable — The number of results to return per page. The default is 20.
- `sort` string, nullable — The field that is used to sort the results.
- `sortOrder` 'asc' | 'desc' — Specifies the sort order.

## Response `200`

Indicates a successful call.

- SecurityOsqueryAPIFindPacksResponse — A paginated list of query packs.
  - `data` object[], required — An array of pack objects.
    - `created_at` string, date-time
    - `created_by` string, nullable
    - `created_by_profile_uid` string
    - `description` string — The pack description.
    - `enabled` boolean — Enables the pack.
    - `interval` integer — Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`.
    - `name` string, required — The pack name.
    - `policy_ids` string[] — A list of agents policy IDs.
    - `queries` object[] — Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.
      - `ecs_mapping` SecurityOsqueryAPIECSMappingArrayItem[] — ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping).
        - `key` string — The ECS field name.
        - `value` SecurityOsqueryAPIECSMappingItem
          - `field` string — The ECS field to map to.
          - `value` union — The value to map to the ECS field.
            - string
            - string[]
      - `id` string
      - `interval` integer
      - `platform` string
      - `query` string
      - `removed` boolean
      - `rrule_schedule` SecurityOsqueryAPIRRuleScheduleConfig — RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor.
        - `end_date` string, date-time — Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`.
        - `rrule` string, required — Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim).
        - `splay` string — Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
        - `start_date` string, date-time, required — RFC 3339 datetime string for the schedule's start.
        - `timeout` number — Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
      - `schedule_type` 'interval' | 'rrule' — Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.
      - `snapshot` boolean
      - `timeout` integer
      - `version` string
    - `read_only` boolean — Whether the pack is read-only (true for prebuilt packs).
    - `rrule_schedule` SecurityOsqueryAPIRRuleScheduleConfig — RRULE schedule configuration consumed by osquerybeat. Loose date forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT embedded in `rrule`; the separate `start_date` field is the schedule anchor.
      - `end_date` string, date-time — Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`.
      - `rrule` string, required — Fully serialized RFC 5545 RRULE string (e.g. `"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`, `BYMONTH` — but the server accepts and round-trips any well-formed parts (other recognized parts like `BYHOUR`, `BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved verbatim).
      - `splay` string — Optional Go duration string for splay (random execution delay), e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit values only; compound durations (`"1h30m"`) are tolerated on read for round-trip safety with osquerybeat's writer. Maximum 12 hours (43200 seconds).
      - `start_date` string, date-time, required — RFC 3339 datetime string for the schedule's start.
      - `timeout` number — Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
    - `saved_object_id` string, required — The saved object ID of the pack.
    - `schedule_type` 'interval' | 'rrule' — Discriminator for the pack's schedule mode. `interval` uses native osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's RRULE-based recurrence scheduling. Per-query overrides MUST use the same mode as the pack — cross-mode overrides are rejected with 400.
    - `updated_at` string, date-time
    - `updated_by` string, nullable
    - `updated_by_profile_uid` string
    - `version` integer — The pack version number.
  - `page` integer, required — The current page number.
  - `per_page` integer, required — The number of results per page.
  - `total` integer, required — The total number of packs.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)