Security Osquery API
Copy a saved query
Spaces method and path for this operation:
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}/copy</span></div>Refer to Spaces for more information.
Create a copy of a saved query with a unique name by appending a _copy suffix. If the name already exists, a numeric suffix is added (e.g., _copy_2).
post/api/osquery/saved_queries/{id}/copy
Path parameters
idstring required
The ID of a saved query.
Example:3c42c847-eb30-4452-80e0-728584042334
The ID of the saved query to copy.
Response
Indicates a successful call.
Example response
{
"data": {
"created_at": "2025-02-26T13:37:30.452Z",
"created_by": "elastic",
"description": "Saved query description",
"ecs_mapping": {
"host.uptime": {
"field": "total_seconds"
}
},
"id": "my_saved_query_copy",
"interval": "60",
"platform": "linux,darwin",
"query": "select * from uptime;",
"removed": false,
"saved_object_id": "42ba1280-2172-11ee-8523-5765fca79a3c",
"snapshot": true,
"timeout": 120,
"updated_at": "2025-02-26T13:37:30.452Z",
"updated_by": "elastic"
}
}