---
title: "Search Queries"
method: POST
path: "/api/v2/Queries/search"
tags: ["Queries"]
---

# Search Queries

`POST /api/v2/Queries/search`

Search for queries by specifying parameters in the request body when invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/Queries/search`

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- PASSTHROUGHAPIFILTERS
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match. To use wildcards with the `LIKE`, `ILIKE` `NOT_LIKE` OR `NOT_ILIKE` filters, use the % symbol to match any string. This allows you to perform more flexible and broad searches for text data. - `%` represents a wildcard to match zero or more characters - `_` (underscore) represents a wildcard match for a single character
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.

## Response `200`

No Error

- object
  - `data` QueriesResponseSchema
    - `queryText` string, required — When sending a request, provide a human-readable text syntax for specifying selection, filtering, and manipulation of data.
    - `queryId` string, required — Identifier of the query that executes while running the policy.
    - `evaluatorId` string — Optional identifier of the evaluator where the query is run. This field is only for `CloudTrail` queries and policies.
    - `owner` string — User that created the query
    - `lastUpdateTime` string — Timestamp in the form yyyy-MM-dd'T'HH:mm:ss.SSS'Z'
    - `lastUpdateUser` string — User that last affected the state of this query
    - `resultSchema` object[] — A list of schemas that match your query.
      - `name` string — Name of the result column
      - `dataType` string — LQL type of the result column
      - `description` string — Description of the data that this column holds.

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)