Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Osquery API

Get saved queries

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>

Refer to Spaces for more information.

Get a list of all saved queries.

get/api/osquery/saved_queries

Query parameters

pageinteger nullable

The page number to return. The default is 1.

Example:1

The page number to return.

pageSizeinteger nullable

The number of results to return per page. The default is 20.

Example:20

The number of results to return per page.

sortstring nullable

The field that is used to sort the results.

Example:createdAt

The field to sort results by.

sortOrder'asc' | 'desc'

Specifies the sort order.

Example:desc

The sort order.

Response

Indicates a successful call.

pageinteger required

The current page number.

per_pageinteger required

The number of results per page.

totalinteger required

The total number of saved queries.

Example response

{
  "data": [
    {
      "created_at": "2022-07-26T09:28:08.597Z",
      "created_by": "elastic",
      "created_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
      "description": "Saved query description",
      "ecs_mapping": {
        "host.uptime": {
          "field": "total_seconds"
        }
      },
      "id": "saved_query_id",
      "interval": "60",
      "platform": "linux,darwin",
      "prebuilt": false,
      "query": "select * from uptime;",
      "saved_object_id": "42ba9c50-0cc5-11ed-aa1d-2b27890bc90d",
      "updated_at": "2022-07-26T09:28:08.597Z",
      "updated_by": "elastic",
      "updated_by_profile_uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
      "version": "2.8.0"
    }
  ],
  "page": 1,
  "per_page": 100,
  "total": 11
}