# Elastic Stack (ELK Stack) Security Osquery API

**Canonical:** https://apis.io/apis/elk-stack/elk-stack-security-osquery-api-api/  
**Provider:** Elastic Stack (ELK Stack) — https://apis.io/providers/elk-stack/  
**Base URL:** https://{elasticsearch_endpoint}  
**Documentation:** https://www.elastic.co/docs/api/doc/elasticsearch/

Elastic Stack (ELK Stack) Security Osquery API is one of 132 APIs that [Elastic Stack (ELK Stack)](https://apis.io/providers/elk-stack/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Security Osquery API. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

Run live queries, manage packs and saved queries.

## Operations (21)

| Method | Path | Summary |
|---|---|---|
| GET | `/api/osquery/history` | Get unified query history |
| GET | `/api/osquery/live_queries` | Get live queries |
| POST | `/api/osquery/live_queries` | Create a live query |
| GET | `/api/osquery/live_queries/{id}` | Get live query details |
| GET | `/api/osquery/live_queries/{id}/results/{actionId}` | Get live query results |
| POST | `/api/osquery/live_queries/{id}/results/{actionId}/_export` | Export live query results |
| GET | `/api/osquery/packs` | Get packs |
| POST | `/api/osquery/packs` | Create a pack |
| DELETE | `/api/osquery/packs/{id}` | Delete a pack |
| GET | `/api/osquery/packs/{id}` | Get pack details |
| PUT | `/api/osquery/packs/{id}` | Update a pack |
| POST | `/api/osquery/packs/{id}/copy` | Copy a pack |
| GET | `/api/osquery/saved_queries` | Get saved queries |
| POST | `/api/osquery/saved_queries` | Create a saved query |
| DELETE | `/api/osquery/saved_queries/{id}` | Delete a saved query |
| GET | `/api/osquery/saved_queries/{id}` | Get saved query details |
| PUT | `/api/osquery/saved_queries/{id}` | Update a saved query |
| POST | `/api/osquery/saved_queries/{id}/copy` | Copy a saved query |
| GET | `/api/osquery/scheduled_results/{scheduleId}/{executionCount}` | Get scheduled action results |
| POST | `/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export` | Export scheduled query results |
| GET | `/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results` | Get scheduled query results |

## Machine-readable artifacts (8)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-osquery-api-api-openapi.yml
- **Documentation** — https://www.elastic.co/docs/reference/elasticsearch
- **APIReference** — https://www.elastic.co/docs/api/doc/elasticsearch/
- **SourceCode** — https://github.com/elastic/elasticsearch-specification
- **Documentation** — https://www.elastic.co/docs/reference/kibana
- **APIReference** — https://www.elastic.co/docs/api/doc/kibana/
- **SourceCode** — https://github.com/elastic/kibana
- **ToolCrosswalk** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

## Other Elastic Stack (ELK Stack) APIs (12)

- [Elastic Cloud API](https://apis.io/apis/elk-stack/elastic-cloud-api/)
- [Elastic Stack (ELK Stack) Accounts API](https://apis.io/apis/elk-stack/elk-stack-accounts-api/)
- [Elastic Stack (ELK Stack) Actions API](https://apis.io/apis/elk-stack/elk-stack-actions-api/)
- [Elastic Stack (ELK Stack) agent builder API](https://apis.io/apis/elk-stack/elk-stack-agent-builder-api/)
- [Elastic Stack (ELK Stack) Alerting API](https://apis.io/apis/elk-stack/elk-stack-alerting-api/)
- [Elastic Stack (ELK Stack) Alerting V2 API](https://apis.io/apis/elk-stack/elk-stack-alerting-v2-api/)
- [Elastic Stack (ELK Stack) Analytics API](https://apis.io/apis/elk-stack/elk-stack-analytics-api/)
- [Elastic Stack (ELK Stack) APM agent configuration API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-configuration-api/)
- [Elastic Stack (ELK Stack) APM agent keys API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-keys-api/)
- [Elastic Stack (ELK Stack) APM annotations API](https://apis.io/apis/elk-stack/elk-stack-apm-annotations-api/)
- [Elastic Stack (ELK Stack) APM server schema API](https://apis.io/apis/elk-stack/elk-stack-apm-server-schema-api/)
- [Elastic Stack (ELK Stack) APM sourcemaps API](https://apis.io/apis/elk-stack/elk-stack-apm-sourcemaps-api/)

## Tags

Security Osquery API

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/elk-stack/elk-stack-security-osquery-api-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/elk-stack/.