Kolide

Kolide Reporting API

The Reporting API from Kolide — 6 operation(s) for reporting.

GitHub OpenAPI

Documentation

📖
Documentation
https://www.kolide.com/docs/developers/api
📖
APIReference
https://kolideapi.readme.io/reference
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/kolide/refs/heads/main/authentication/kolide-authentication.yml

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/kolide/refs/heads/main/openapi/kolide-reporting-api-openapi.yml

Other Resources

🔗
Conventions
https://raw.githubusercontent.com/api-evangelist/kolide/refs/heads/main/conventions/kolide-conventions.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/kolide/refs/heads/main/errors/kolide-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/kolide/refs/heads/main/data-model/kolide-data-model.yml
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/kolide/refs/heads/main/asyncapi/kolide-events.yml

OpenAPI Specification

kolide-reporting-api-openapi.yml Raw ↑ 
openapi: 3.0.0
info:
  version: '2023-05-26'
  title: K2 Admin Users Reporting API
servers:
- url: https://api.kolide.com/
security:
- api_key: []
tags:
- name: Reporting
paths:
  /reporting/tables/{tableName}/table_records:
    get:
      summary: Fetch a list of Table records
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: cursor
        in: query
        description: Specify the cursor to begin returning results from
        required: false
        schema:
          type: string
          default: ''
      - name: per_page
        in: query
        description: Specify the number of records to return in each response.
        required: false
        schema:
          type: integer
          format: int32
          maximum: 100
          minimum: 1
          default: 25
      - name: tableName
        in: path
        required: true
        description: The table name of the table record
        schema:
          type: string
      responses:
        '200':
          description: A paginated collection of Table records
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    description: 'There are many tables of data collected by Kolide that are available

                      via the API and reporting interfaces. The attributes included in

                      each Table Record will vary based on the table: you can examine

                      each table''s [documentation](https://app.kolide.com/x/reporting/tables), which will describe the

                      structure of that table''s results.

                      '
                    type: array
                    items:
                      $ref: '#/components/schemas/table_record'
                  pagination:
                    type: object
                    description: Information about the current and next pages of results
                    properties:
                      next:
                        type: string
                        format: uri
                        description: The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch
                        example: https://api.kolide.com/table_records?per_page=10&cursor=Imyw
                      current_cursor:
                        type: string
                        description: the pagination cursor used to fetch this page of results
                        example: Miwy
                      next_cursor:
                        type: string
                        description: 'the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch '
                        example: NCw0
                      count:
                        type: integer
                        description: the number of records in the current page of results
                        example: 10
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Reporting
  /reporting/tables:
    get:
      summary: Fetch a list of Reporting tables
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: cursor
        in: query
        description: Specify the cursor to begin returning results from
        required: false
        schema:
          type: string
          default: ''
      - name: per_page
        in: query
        description: Specify the number of records to return in each response.
        required: false
        schema:
          type: integer
          format: int32
          maximum: 100
          minimum: 1
          default: 25
      responses:
        '200':
          description: A paginated collection of Reporting tables
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    description: 'There are many tables of data collected by Kolide that are available via the API and reporting interfaces. More information about these tables can be found at: https://www.kolide.com/features/device-inventory/properties'
                    type: array
                    items:
                      $ref: '#/components/schemas/reporting_table'
                  pagination:
                    type: object
                    description: Information about the current and next pages of results
                    properties:
                      next:
                        type: string
                        format: uri
                        description: The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch
                        example: https://api.kolide.com/tables?per_page=10&cursor=Imyw
                      current_cursor:
                        type: string
                        description: the pagination cursor used to fetch this page of results
                        example: Miwy
                      next_cursor:
                        type: string
                        description: 'the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch '
                        example: NCw0
                      count:
                        type: integer
                        description: the number of records in the current page of results
                        example: 10
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Reporting
  /reporting/tables/{name}:
    get:
      summary: Fetch information for a specific Reporting table
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: name
        in: path
        required: true
        description: The name of the reporting table
        schema:
          type: string
      responses:
        '200':
          description: 'There are many tables of data collected by Kolide that are available via the API and reporting interfaces. More information about these tables can be found at: https://www.kolide.com/features/device-inventory/properties'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/reporting_table'
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Reporting
  /reporting/queries/{queryId}/results:
    get:
      summary: Fetch a list of Report query results
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: cursor
        in: query
        description: Specify the cursor to begin returning results from
        required: false
        schema:
          type: string
          default: ''
      - name: per_page
        in: query
        description: Specify the number of records to return in each response.
        required: false
        schema:
          type: integer
          format: int32
          maximum: 100
          minimum: 1
          default: 25
      - name: queryId
        in: path
        required: true
        description: The query ID of the report query result
        schema:
          type: string
      responses:
        '200':
          description: A paginated collection of Report query results
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    description: Resultset from executing the reporting query. Schema is dependent on the query projections.
                    type: array
                    items:
                      $ref: '#/components/schemas/report_query_result'
                  pagination:
                    type: object
                    description: Information about the current and next pages of results
                    properties:
                      next:
                        type: string
                        format: uri
                        description: The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch
                        example: https://api.kolide.com/results?per_page=10&cursor=Imyw
                      current_cursor:
                        type: string
                        description: the pagination cursor used to fetch this page of results
                        example: Miwy
                      next_cursor:
                        type: string
                        description: 'the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch '
                        example: NCw0
                      count:
                        type: integer
                        description: the number of records in the current page of results
                        example: 10
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Reporting
  /reporting/queries:
    get:
      summary: Fetch a list of Report queries
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: omit_results
        in: query
        schema:
          type: string
        description: 'In version `2023-05-26` of the API, query results are included by default in the reporting query `results` field.

          However, this can lead to timeouts when retrieving queries with large resultsets.


          To improve performance and prevent timeouts, exclude results by adding the query parameter: `omit_results=true` and fetch results from the paginated endpoint (see below).


          > Note: The results field is deprecated and will be removed in a future API version.


          For paginated access to query results, use the dedicated endpoint:


          ```

          /reporting/queries/{queryId}/results

          ```

          '
      - name: cursor
        in: query
        description: Specify the cursor to begin returning results from
        required: false
        schema:
          type: string
          default: ''
      - name: per_page
        in: query
        description: Specify the number of records to return in each response.
        required: false
        schema:
          type: integer
          format: int32
          maximum: 100
          minimum: 1
          default: 25
      responses:
        '200':
          description: A paginated collection of Report queries
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    description: 'A Report Query is a SQL query run against the Reporting Database

                      feature of Kolide.

                      '
                    type: array
                    items:
                      $ref: '#/components/schemas/report_query'
                  pagination:
                    type: object
                    description: Information about the current and next pages of results
                    properties:
                      next:
                        type: string
                        format: uri
                        description: The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch
                        example: https://api.kolide.com/queries?per_page=10&cursor=Imyw
                      current_cursor:
                        type: string
                        description: the pagination cursor used to fetch this page of results
                        example: Miwy
                      next_cursor:
                        type: string
                        description: 'the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch '
                        example: NCw0
                      count:
                        type: integer
                        description: the number of records in the current page of results
                        example: 10
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Reporting
  /reporting/queries/{id}:
    get:
      summary: Fetch information for a specific Report query
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: omit_results
        in: query
        schema:
          type: string
        description: 'In version `2023-05-26` of the API, query results are included by default in the reporting query `results` field.

          However, this can lead to timeouts when retrieving queries with large resultsets.


          To improve performance and prevent timeouts, exclude results by adding the query parameter: `omit_results=true` and fetch results from the paginated endpoint (see below).


          > Note: The results field is deprecated and will be removed in a future API version.


          For paginated access to query results, use the dedicated endpoint:


          ```

          /reporting/queries/{queryId}/results

          ```

          '
      - name: id
        in: path
        required: true
        description: The ID of the report query
        schema:
          type: string
      responses:
        '200':
          description: 'A Report Query is a SQL query run against the Reporting Database

            feature of Kolide.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/report_query'
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Reporting
components:
  schemas:
    table_record:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier for this table record
    report_query_result:
      type: object
      properties: {}
    reporting_table:
      type: object
      properties:
        name:
          type: string
          description: The name of the table
        category:
          type: string
          description: The category of the table
        description:
          type: string
          description: The description of the table
        column_names:
          description: The names of the columns in the table
          type: array
          items:
            type: integer
        searchable_fields:
          description: Fields that can be filtered using the query parameter on the table_records endpoint
          type: array
          items:
            type: integer
        documentation_url:
          type: string
          description: A link to the detailed documentation for this table
    report_query:
      type: object
      properties:
        id:
          type: integer
          description: The canonical identifier for this report query
        name:
          type: string
          description: The human-readable name for this report query
        osquery_sql:
          type: string
          description: The SQL query used to generate the report
        result_count:
          type: integer
          description: Number of rows returned in the result set
        created_at:
          type: string
          description: when the report query was created
          format: date-time
        results:
          description: 'In version `2023-05-26` of the API, query results are included by default in the reporting query `results` field. However, this can lead to timeouts when retrieving queries with large resultsets. To improve performance and prevent timeouts, exclude results by adding the query parameter: `omit_results=true` and fetch results from the paginated endpoint: `/reporting/queries/{queryId}/results`.'
          type: array
          items:
            type: object
  securitySchemes:
    api_key:
      type: http
      scheme: bearer