---
title: "Search Data Export Rules"
method: POST
path: "/api/v2/DataExportRules/search"
tags: ["DataExportRules"]
---

# Search Data Export Rules

`POST /api/v2/DataExportRules/search`

Search data export rules by invoking the following endpoint:

 `POST https://YourAccount.lacework.net/api/v2/DataExportRules/search`

 To limit the returned result, optionally specify one or more filters in the request
 body. 

 Here are some example `body` payloads:

  * `{ "filters": [ { "field": "mcGuid", "expression": "rlike", "value": "123ABC" } ] } ` 

  * `{ "filters": [ { "field": "mcGuid", "expression": "between", "values": [ "ABC_123", "DEC_456" ] } ] }` 

  * `{ "filters": [ { "field": "intgGuidList", "expression": "eq", "value": "ABC_123" } ] } ` 

  * `{ "filters": [ { "field": "intgGuidList", "expression": "in", "values": [ "ABC_123", "DEF_456" ] } ] } ` 

  * `{ "filters": [ { "field": "filters.name", "expression": "ilike", "value": "slack" } ] } ` 

  * `{ "filters": [ { "field": "filters.profileVersions", "expression": "eq", "value": "V1" } ] } `

  In the request body, optionally specify the list of fields to return in the response by specifying the list in the `returns` array.

## Headers

- `Authorization` string, required
- `Content-Type` string, required
- `Org-Access` boolean
- `Account-Name` string

## Request body

- GETDATAREQUESTBODYFILTERS
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of DataExportRules)

- object
  - `data` DataExportRulesResponseSchema[]
    - `filters` object, required — When sending a request, use this object to define the new data export rule. When included in a response, this object contains details of a data export rule. <br /> You can use these attributes when searching for existing data export rules by invoking a POST request.
      - `name` string, required — The data export rule's name.
      - `description` string — Summary of the data export rule.
      - `enabled` unknown, required
      - `profileVersions` string[] — A list of profile versions.
    - `intgGuidList` string[], required — The alert channels for the rule to use.
    - `type` 'Dataexport', required — The data export rule's type such as `Dataexport`.
    - `mcGuid` string — Data Export Rule ID

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)