Kibana Security Osquery API API

openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Osquery API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: Run live queries, manage packs and saved queries.
  name: Security Osquery API
  x-displayName: Security Osquery
paths:
  /api/osquery/history:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/history</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.

        '
      operationId: OsqueryGetUnifiedHistory
      parameters:
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          default: 20
          description: The number of results to return per page.
          maximum: 100
          minimum: 1
          type: integer
      - description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
        in: query
        name: nextPage
        required: false
        schema:
          description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
          type: string
      - description: A search string to filter history entries by pack name, query text, or query ID.
        in: query
        name: kuery
        required: false
        schema:
          description: A search string to filter history entries by pack name, query text, or query ID.
          type: string
      - description: Comma-separated list of user IDs to filter live query history.
        in: query
        name: userIds
        required: false
        schema:
          description: Comma-separated list of user IDs to filter live query history.
          example: elastic,admin
          type: string
      - description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
        in: query
        name: sourceFilters
        required: false
        schema:
          description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
          example: live,scheduled
          type: string
      - description: The start of the time range filter (ISO 8601).
        in: query
        name: startDate
        required: false
        schema:
          description: The start of the time range filter (ISO 8601).
          example: '2024-01-01T00:00:00Z'
          type: string
      - description: The end of the time range filter (ISO 8601).
        in: query
        name: endDate
        required: false
        schema:
          description: The end of the time range filter (ISO 8601).
          example: '2024-12-31T23:59:59Z'
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                unifiedHistoryExample:
                  summary: Example unified history response
                  value:
                    data:
                    - actionId: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                      agentCount: 5
                      errorCount: 0
                      id: 3c42c847-eb30-4452-80e0-728584042334
                      queryName: uptime_query
                      queryText: select * from uptime;
                      source: Live
                      sourceType: live
                      successCount: 5
                      timestamp: '2024-07-26T09:59:32.220Z'
                      totalRows: 42
                      userId: elastic
                    - agentCount: 10
                      errorCount: 1
                      executionCount: 3
                      id: pack_my_pack_uptime_3
                      packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                      packName: My Pack
                      plannedTime: '2024-07-26T09:00:00.000Z'
                      queryName: uptime
                      queryText: select * from uptime;
                      scheduleId: pack_my_pack_uptime
                      source: Scheduled
                      sourceType: scheduled
                      successCount: 9
                      timestamp: '2024-07-26T09:00:00.000Z'
                      totalRows: 100
                    hasMore: true
                    nextPage: eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3...
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetUnifiedHistoryResponse'
          description: Indicates a successful call.
      summary: Get unified query history
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/live_queries:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all live queries.'
      operationId: OsqueryFindLiveQueries
      parameters:
      - description: A KQL search string to filter live queries.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryResponse'
          description: Indicates a successful call.
      summary: Get live queries
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create and run a live query.'
      operationId: OsqueryCreateLiveQuery
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse'
          description: Indicates a successful call.
      summary: Create a live query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/live_queries/{id}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a live query using the query ID.'
      operationId: OsqueryGetLiveQueryDetails
      parameters:
      - description: The ID of the live query.
        in: path
        name: id
        required: true
        schema:
          description: The ID of the live query result you want to retrieve.
          example: 3c42c847-eb30-4452-80e0-728584042334
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse'
          description: Indicates a successful call.
      summary: Get live query details
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/live_queries/{id}/results/{actionId}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the results of a live query using the query action ID.'
      operationId: OsqueryGetLiveQueryResults
      parameters:
      - description: The ID of the live query.
        in: path
        name: id
        required: true
        schema:
          description: The ID of the live query result you want to retrieve.
          example: 3c42c847-eb30-4452-80e0-728584042334
          type: string
      - description: The ID of the query action.
        in: path
        name: actionId
        required: true
        schema:
          description: The ID of the query action that generated the live query results.
          example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
          type: string
      - description: A KQL search string to filter results.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse'
          description: Indicates a successful call.
      summary: Get live query results
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/packs:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all query packs.'
      operationId: OsqueryFindPacks
      parameters:
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPacksResponse'
          description: Indicates a successful call.
      summary: Get packs
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a query pack.'
      operationId: OsqueryCreatePacks
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreatePacksRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreatePacksResponse'
          description: Indicates a successful call.
      summary: Create a pack
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/packs/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a query pack using the pack ID.'
      operationId: OsqueryDeletePacks
      parameters:
      - description: The pack ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              schema:
                example: {}
                type: object
                properties: {}
          description: Indicates a successful call.
      summary: Delete a pack
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a query pack using the pack ID.'
      operationId: OsqueryGetPacksDetails
      parameters:
      - description: The pack ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPackResponse'
          description: Indicates a successful call.
      summary: Get pack details
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update a query pack using the pack ID.

        > info

        > You cannot update a prebuilt pack.

        '
      operationId: OsqueryUpdatePacks
      parameters:
      - description: The pack ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksResponse'
          description: Indicates a successful call.
      summary: Update a pack
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/packs/{id}/copy:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}/copy</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a copy of a query pack with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). The copied pack is always created with `enabled` set to `false`.'
      operationId: OsqueryCopyPacks
      parameters:
      - description: The ID of the pack to copy.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              examples:
                copyPackExample:
                  summary: Example response for copying a pack
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: false
                      name: my_pack_copy
                      policy_ids: []
                      queries:
                      - ecs_mapping:
                        - key: client.port
                          value:
                            field: port
                        id: ports
                        interval: 60
                        query: SELECT * FROM listening_ports;
                        removed: false
                        snapshot: true
                        timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: []
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopyPacksResponse'
          description: Indicates a successful call.
      summary: Copy a pack
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/saved_queries:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a list of all saved queries.'
      operationId: OsqueryFindSavedQueries
      parameters:
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field to sort results by.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: The sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryResponse'
          description: Indicates a successful call.
      summary: Get saved queries
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create and save a query for later use.'
      operationId: OsqueryCreateSavedQuery
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryResponse'
          description: Indicates a successful call.
      summary: Create a saved query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/saved_queries/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a saved query using the query ID.'
      operationId: OsqueryDeleteSavedQuery
      parameters:
      - description: The saved query ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_DefaultSuccessResponse'
          description: Indicates a successful call.
      summary: Delete a saved query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a saved query using the query ID.'
      operationId: OsqueryGetSavedQueryDetails
      parameters:
      - description: The saved query ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryDetailResponse'
          description: Indicates a successful call.
      summary: Get saved query details
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update a saved query using the query ID.

        > info

        > You cannot update a prebuilt saved query.

        '
      operationId: OsqueryUpdateSavedQuery
      parameters:
      - description: The saved query ID.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryResponse'
          description: Indicates a successful call.
      summary: Update a saved query
      tags:
      - Security Osquery API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/saved_queries/{id}/copy:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}/copy</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a copy of a saved query with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`).'
      operationId: OsqueryCopySavedQuery
      parameters:
      - description: The ID of the saved query to copy.
        in: path
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              examples:
                copySavedQueryExample:
                  summary: Example response for copying a saved query
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query_copy
                      interval: '60'
                      platform: linux,darwin
                      query: select * from uptime;
                      removed: false
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      snapshot: true
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopySavedQueryResponse'
          description: Indicates a successful call.
      summary: Copy a saved query
      tags:
      - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/osquery/scheduled_results/{scheduleId}/{executionCount}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).

        '
      operationId: OsqueryGetScheduledActionResults
      parameters:
      - description: The schedule ID of the scheduled query.
        in: path
        name: scheduleId
        required: true
        schema:
          description: The schedule ID of the scheduled query.
          example: pack_my_pack_uptime
          type: string
      - description: The execution count for this scheduled query run.
        in: path
        name: executionCount
        required: true
        schema:
          description: The execution count for this scheduled query run.
          example: 3
          type: integer
      - description: The kuery to filter the results by.
        in: query
        name: kuery
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
      - description: The page number to return. The default is 1.
        in: query
        name: page
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
      - description: The number of results to return per page. The default is 20.
        in: query
        name: pageSize
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
      - description: The field that is used to sort the results.
        in: query
        name: sort
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
      - description: Specifies the sort order.
        in: query
        name: sortOrder
        required: false
        schema:
          $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              examples:
                scheduledActionResultsExample:
                  su

# --- truncated at 32 KB (98 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-security-osquery-api-api-openapi.yml