v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB

Security Osquery API

Get scheduled query results

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results</span></div>

Refer to Spaces for more information.

Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.

get/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results

Path parameters

scheduleIdstring required

The schedule ID of the scheduled query.

Example:pack_my_pack_uptime

The schedule ID of the scheduled query.

executionCountinteger required

The execution count for this scheduled query run.

Example:3

The execution count for this scheduled query run.

Query parameters

kuerystring nullable

The kuery to filter the results by.

Example:agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13

The kuery to filter the results by.

pageinteger nullable

The page number to return. The default is 1.

Example:1

The page number to return. The default is 1.

pageSizeinteger nullable

The number of results to return per page. The default is 20.

Example:20

The number of results to return per page. The default is 20.

sortstring nullable

The field that is used to sort the results.

Example:createdAt

The field that is used to sort the results.

sortOrder'asc' | 'desc'

Specifies the sort order.

Example:desc

Specifies the sort order.

startDatestring

The start date filter (ISO 8601) to narrow down results.

Example:2024-01-01T00:00:00Z

The start date filter (ISO 8601) to narrow down results.

Response

Indicates a successful call.

Example response

{
  "data": {
    "edges": [
      {
        "_id": "row-001",
        "fields": {
          "host.uptime": [
            "12345"
          ]
        }
      },
      {
        "_id": "row-002",
        "fields": {
          "host.uptime": [
            "67890"
          ]
        }
      }
    ],
    "total": 2
  }
}