---
title: "Create Queries"
method: POST
path: "/api/v2/Queries"
tags: ["Queries"]
---

# Create Queries

`POST /api/v2/Queries`

Create a FortiCNAPP Query Language (LQL) query by specifying parameters in the request body when invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/Queries` 

 This creates the LQL query in your FortiCNAPP instance so you can use it in an LQL custom policy and view it in the FortiCNAPP Console. You can get the unique identifiers for the LQL queries (`queryIdList`) array by invoking the `GET /api/v2/Queries` endpoint.

For information on creating queries, including information on specifying data sources, filtering, and returning data with the DISTINCT operator, see [LQL Overview](https://docs.fortinet.com/document/forticnapp/latest/lql-reference/598361/lql-overview).

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- QueriesCreateSchema
  - `queryText` string, required — When sending a request, provide a human-readable text syntax for specifying selection, filtering, and manipulation of data.
  - `queryId` string, required — Identifier of the query that executes while running the policy.

## Response `201`

No Error

- object
  - `data` QueriesResponseSchema
    - `queryText` string, required — When sending a request, provide a human-readable text syntax for specifying selection, filtering, and manipulation of data.
    - `queryId` string, required — Identifier of the query that executes while running the policy.
    - `evaluatorId` string — Optional identifier of the evaluator where the query is run. This field is only for `CloudTrail` queries and policies.
    - `owner` string — User that created the query
    - `lastUpdateTime` string — Timestamp in the form yyyy-MM-dd'T'HH:mm:ss.SSS'Z'
    - `lastUpdateUser` string — User that last affected the state of this query
    - `resultSchema` object[] — A list of schemas that match your query.
      - `name` string — Name of the result column
      - `dataType` string — LQL type of the result column
      - `description` string — Description of the data that this column holds.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)