--- title: "Fetch a list of Check failures" method: GET path: "/checks/{checkId}/failures" --- # Fetch a list of Check failures `GET /checks/{checkId}/failures` ## Path parameters - `checkId` string, required ## Query parameters - `cursor` string - `per_page` integer - `search` string ## Response `200` A paged array of Check failures - object - `page` integer — current page of data, as specified by the 'page' request parameter. This page number is 0-indexed. - `last_page` integer — the final page number for the dataset. This is zero-indexed, so that a dataset with a record count less than or equal to the page size will be 0. - `data` CheckFailure[] — Details about the Check failures - `id` string — The canonical identifier for this failure - `check_id` string — The canonical identifier of the check this failure is for - `failure_key` string — The name of the primary key that distinguishes one failure from another in the context of a single check failure definition. May not be applicable - `failure_value` string — The primary value of the failure. May not be applicable - `title` string — The short description of the failure - `value` object — The information that defines this failure - `ignored` boolean — Whether this failure has been ignored. Ignoring failures is useful to allowlist single instances of check failures when they are determined to be false positives or acceptable risk. - `escalation_status` string — Describes the escalation status of this failure. A failure may be escalated because user contact attempts were exhausted, the user asked for help, or because the device generating the failure does not have a device owner - `resolved_at` string, date-time — The timestamp when this failure was resolved. Will be null if the failure is ongoing. - `timestamp` string, date-time — When the failure was initially detected - `first_notified_owner_at` string, date-time — The timestamp the owner of the device was first notified. Can be null if no notification has been triggered - `device` object — The device that this failure originated from - `id` string — The canonical identifier for this device - `name` string — The canonical human name for the device. May be edited via the web interface. - `owned_by` string — The owner of the device (either: 'user' or 'organization') - `privacy` string — The administrator's visibility into the details of the device (either: 'details_visible' or 'details_hidden') - `platform` string — The basic operating system platform of the device - `enrolled_at` string, date-time — The timestamp that the device was first enrolled into K2 - `last_seen_at` string, date-time — The timestamp representing when the device last checked in to Kolide - `operating_system` string — The operating system installed on the device - `issue_count` integer — The number of currently unresolved issues for the device - `resolved_issue_count` integer — The number of issues for the device that have been resolved - `failure_count` integer — The number of currently unresolved issues for the device (DEPRECATED use issue_count instead) - `resolved_failure_count` integer — The number of issues for the device that have been resolved (DEPRECATED use resolved_issue_count instead) - `primary_user_name` string — The name of the device's main user account, as measured by number of logins. This field is now deprecated - `hardware_model` string — The specific hardware model of the device - `hardware_vendor` string — The manufacturer of the device - `launcher_version` string — The version of the kolide launcher agent running on the device - `osquery_version` string — The version of osquery running on the device - `serial` string — The hardware serial of the device. May not be applicable - `hardware_uuid` string — The hardware UUID/UDID for the device. May not be applicable for some devices - `assigned_owner` object — The person assigned to this device - `id` string — The canonical identifier for this device owner - `owner_type` string — Describes the type for this device owner. Either 'Person' or 'Device Group' - `name` string — The human-readable reference name - `email` string — The email associated with the device owner. Blank if 'owner_type' is not 'Person' - `kolide_mdm` string — This field is no longer used and will return nil. - `note` string — Notes provided by a Kolide administrator (in markdown) - `note_html` string — Notes provided by a Kolide administrator (in HTML format) - `operating_system_details` object — Details about the device's operating system - `device_id` string — The identifier for the device - `platform` string — The underlying OS platform - `name` string — The high-level name of the operating system - `codename` string — The code name for the operating system, may not be applicable to all operating systems - `version` string — The full version of the operating system - `build` string — The build number of the operating system, may not be applicable to all operating systems - `major_version` string — The major version of the operating system, may not be applicable to all operating systems - `minor_version` string — The minor version of the operating system, may not be applicable to all operating systems - `patch_version` string — The patch version of the operating system, may not be applicable to all operating systems - `ubr` string — The UBR (UpdateBuildRevision) number, only applicable for Windows - `release_id` string — The OS Release ID, only applicable for Windows - `remote_ip` string — The IP address the device last checked in with - `location` string — This field is no longer used and will return nil. - `product_image_url` string — The URL of the device's product image ## Other responses - `403` — An 'unauthorized' response may occur for features restricted by or unavailable to your organization --- [API](https://skmtc.net/kolide/apis/k2-api.md) · [All operations](https://skmtc.net/kolide/apis/k2-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kolide/k2-api/versions/7013d788398e/schema)