---
title: "Build Query"
method: GET
path: "/connect/query/{operation}"
tags: ["Query"]
---

# Build Query

`GET /connect/query/{operation}`

Requests the server provide a new query for the SOC client to show, given a particular change needed in the query.

## Path parameters

- `operation` string, required

## Response `200`

The job output stream was successfully saved and is being returned in the response body. Ex: somefield: somevalue | groupby anotherfield | groupby newfield

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)