---
title: "Search Applications"
method: POST
path: "/api/v2/Entities/Applications/search"
tags: ["Entities"]
---

# Search Applications

`POST /api/v2/Entities/Applications/search`

Search for applications running on the machine with an agent within the last 90 days. Get details such as the application name, username, machine, etc. by invoking the following endpoint:  

  > `POST https://YourAccount.lacework.net/api/v2/Entities/Applications/search` 

 FortiCNAPP highly recommends specifying a time range. Without a specified time range, the request uses the default time range of 24 hours prior to the current time. The maximum time range per API request is 7 days.  To use the current time as the end time, exclude the endTime field.

 You can optionally filter the returned applications by application name, username, machine, and more. For more information, see [APPLICATIONS_V View](https://docs.fortinet.com/document/forticnapp/latest/administration-guide/529927/applications-v-view).

 Here are some example `body` payloads: 
 * `{ "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"}}`
 * `{ "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"},` 
 `"filters": [ { "field": "mid", "expression": "eq", "value": "12345" } ] }` 
 * `{ "timeFilter": { "startTime": "2021-08-28T20:30:00Z", "endTime": "2021-08-28T22:30:00Z"},`
 `"filters": [ { "field": "mid", "expression": "eq", "value": "12345" }, { "field": "containerInfo.pod_type", "expression": "eq", "value": "lacework-agent" } ],`  
 `"returns": [ "appName", "exePath", "containerInfo", "mid", "username" ] }`

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- GETDATAREQUESTBODYTIMEFILTERS
  - `timeFilter` object — The date/time range during which actions occurred.
    - `startTime` string — Returns only recorded actions that occurred after this timestamp.
    - `endTime` string — Returns only recorded actions that occurred before this timestamp. If empty or missing, the current time is used.
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of Applications)

- object
  - `paging` PagingSchema — Details of the response's pagination
    - `rows` number — The number of rows displayed on each page
    - `totalRows` number — The number of rows returned from the query
    - `urls` object — Pagination-related URLs
      - `nextPage` string — The next page's URL
  - `data` EntitiesApplicationsResponseSchema[]
    - `startTime` string
    - `endTime` string
    - `mid` integer
    - `appName` string
    - `exePath` string
    - `username` object
    - `propsMachine` object
    - `containerInfo` object
    - `netStats` object
    - `props` object

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)