---
title: "Search Agent Information"
method: POST
path: "/api/v2/AgentInfo/search"
tags: ["AgentInfo"]
---

# Search Agent Information

`POST /api/v2/AgentInfo/search`

The Agent Information API enables you to retrieve information about all agents by invoking the following endpoint:

  > `POST /api/v2/AgentInfo/search`
 
 FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days.  To use the current time as the end time, exclude the endTime field.

 You can optionally filter the information returned by agent status, agent version, IP address, and more. For details about what agent information is available, see [AGENT_MANAGEMENT_V View](https://docs.fortinet.com/document/forticnapp/latest/administration-guide/901452/agent-management-v-view). 

  Here are some example `body` payloads: 
 * `{ "timeFilter": { "startTime" : "2022-04-28T00:00:00Z", "endTime": "2022-04-28T18:00:00Z"},` 
 * `{ "timeFilter": { "startTime": " 2022-04-28T00:00:00Z", "endTime": "2022-04-28T18:00:00Z"},`
 `"filters" : [ { "field": "status", "expression": "eq", "value": "ACTIVE" }, { "field": "tags.VmProvider", "expression": "eq", "value" : "AWS" } ],`  
 `"returns": [ "hostname", "ipAddr", "os" , "agentVersion", "status" ] }` 


 Within request bodies, nested field names that contain one or more special characters—e.g., dot ("."), colon (":"), or slash ("/")—must be enclosed in **escaped double quotes**. For example, the field name `aws:ec2launchtemplate:version` nested under the `tags` field would be rendered as follows: 

 `"tags.\"aws:ec2launchtemplate:version\""` 

 In a filter, the example would appear as follows: 

 `{ "field": "tags.\"aws:ec2launchtemplate:version\"", "expression": "eq", "value": "3" }` 

 In addition, forward slash characters within field names must be escaped with a backslash, as in the following example: 

 `"tags.\"kubernetes.io\/cluster\/prod1\""`

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- GETDATAREQUESTBODYTIMEFILTERS
  - `timeFilter` object — The date/time range during which actions occurred.
    - `startTime` string — Returns only recorded actions that occurred after this timestamp.
    - `endTime` string — Returns only recorded actions that occurred before this timestamp. If empty or missing, the current time is used.
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of Agent Information)

- object
  - `paging` PagingSchema — Details of the response's pagination
    - `rows` number — The number of rows displayed on each page
    - `totalRows` number — The number of rows returned from the query
    - `urls` object — Pagination-related URLs
      - `nextPage` string — The next page's URL
  - `data` AgentInfoResponseSchema[] — For details about what agent information is available, see [AGENT_MANAGEMENT_V View](https://docs.fortinet.com/document/forticnapp/latest/administration-guide/901452/agent-management-v-view).
    - `agentVersion` string
    - `createdTime` string
    - `hostname` string
    - `ipAddr` string
    - `lastUpdate` string
    - `mid` integer
    - `mode` string
    - `os` string
    - `status` string
    - `tags` object

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)