Trellix Queries API

openapi: 3.2.0
info:
  title: Trellix ePO SaaS Queries API
  description: The Trellix ePO SaaS API provides cloud-based access to ePolicy Orchestrator management capabilities. It enables programmatic control of devices, events, tags, queries, and response actions through the Trellix cloud management platform. Authentication uses OAuth 2.0 client credentials with scoped permissions for each resource type.
  version: '2.0'
  contact:
    name: Trellix Support
    url: https://www.trellix.com/support/
  termsOfService: https://www.trellix.com/en-us/about/legal/terms-of-use.html
servers:
- url: https://api.manage.trellix.com
  description: Trellix Cloud Management Platform
security:
- bearerAuth: []
tags:
- name: Queries
  description: Execute and manage saved queries against the ePO SaaS data store for reporting and analysis.
paths:
  /epo/v2/queries:
    get:
      operationId: listQueries
      summary: List saved queries
      description: Retrieve a list of saved queries available in ePO SaaS. Queries can be executed against the data store for reporting and analysis of managed endpoints and security events.
      tags:
      - Queries
      parameters:
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      responses:
        '200':
          description: List of saved queries
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Query'
                  meta:
                    $ref: '#/components/schemas/PaginationMeta'
        '401':
          description: Unauthorized - invalid or expired access token
  /epo/v2/queries/{queryId}/run:
    post:
      operationId: executeQuery
      summary: Execute a saved query
      description: Execute a saved query and return its results. Queries run against the ePO SaaS data store and can return device, event, or policy compliance information.
      tags:
      - Queries
      parameters:
      - $ref: '#/components/parameters/queryId'
      responses:
        '200':
          description: Query results returned
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      type: object
                  meta:
                    $ref: '#/components/schemas/PaginationMeta'
        '401':
          description: Unauthorized - invalid or expired access token
        '404':
          description: Query not found
components:
  schemas:
    Query:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the saved query
        name:
          type: string
          description: Display name of the query
        description:
          type: string
          description: Description of what the query returns
        targetType:
          type: string
          description: The data type targeted by the query
        visibility:
          type: string
          enum:
          - public
          - private
          description: Whether the query is shared or private
    PaginationMeta:
      type: object
      properties:
        totalItems:
          type: integer
          description: Total number of items matching the query
        limit:
          type: integer
          description: Number of items per page
        offset:
          type: integer
          description: Number of items skipped
  parameters:
    queryId:
      name: queryId
      in: path
      required: true
      description: Unique identifier of the saved query
      schema:
        type: string
    offset:
      name: offset
      in: query
      description: Number of items to skip for pagination
      schema:
        type: integer
        default: 0
        minimum: 0
    limit:
      name: limit
      in: query
      description: Maximum number of items to return per page
      schema:
        type: integer
        default: 25
        minimum: 1
        maximum: 100
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 access token obtained through the client credentials flow. Requires appropriate scope permissions such as epo.device.r, epo.device.w, epo.tags.r, epo.tags.w, epo.evt.r, epo.qery.g, epo.qery.u, epo.resp.ra, and epo.resp.ru.
externalDocs:
  description: Trellix ePO SaaS Product Guide
  url: https://docs.trellix.com/bundle/epolicy-orchestrator-saas-product-guide