---
title: "Get scheduled action results"
method: GET
path: "/api/osquery/scheduled_results/{scheduleId}/{executionCount}"
tags: ["Security Osquery API"]
---

# Get scheduled action results

`GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).

## Path parameters

- `scheduleId` string, required — The schedule ID of the scheduled query.
- `executionCount` integer, required — The execution count for this scheduled query run.

## Query parameters

- `kuery` string, nullable — The kuery to filter the results by.
- `page` integer, nullable — The page number to return. The default is 1.
- `pageSize` integer, nullable — The number of results to return per page. The default is 20.
- `sort` string, nullable — The field that is used to sort the results.
- `sortOrder` 'asc' | 'desc' — Specifies the sort order.

## Response `200`

Indicates a successful call.

- SecurityOsqueryAPIGetScheduledActionResultsResponse
  - `aggregations` SecurityOsqueryAPIScheduledActionResultsAggregations
    - `failed` integer — The number of agents that returned errors.
    - `pending` integer — The number of agents with pending responses.
    - `successful` integer — The number of agents that completed successfully.
    - `totalResponded` integer — The total number of agents that responded.
    - `totalRowCount` integer — The total number of result rows across all agents.
  - `currentPage` integer — The current page number (zero-based).
  - `edges` object[] — The paginated list of per-agent action results.
  - `inspect` object — Debug/inspection data for the search query.
  - `metadata` SecurityOsqueryAPIScheduledExecutionMetadata — Execution metadata resolved from the pack saved object.
    - `executionCount` integer — The execution count for this scheduled query run.
    - `packId` string — The ID of the pack containing the query.
    - `packName` string — The name of the pack containing the query.
    - `queryName` string — The name of the query within the pack.
    - `queryText` string — The SQL query that was executed.
    - `scheduleId` string — The schedule ID for the scheduled query.
    - `timestamp` string — The timestamp of the most recent response for this execution.
  - `pageSize` integer — The number of results per page.
  - `total` integer — The total number of action results.
  - `totalPages` integer — The total number of pages.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)