Live Endpoint Search GraphQL API types¶
Every named type reachable from a query or mutation in this schema, grouped by kind.
Jump to: Objects · Enums · Input objects · Scalars
Objects¶
CategoryObjectReference¶
Category object reference for execution
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Category ID |
name | String | Category name |
code | String | Identifier for category name (available only for pre-defined categories) |
DeletionResponse¶
Response for deletion operations
Fields¶
| Field | Type | Description |
|---|---|---|
result | DeletionResult | Deletion result |
DeletionResult¶
Result of a deletion operation
Fields¶
| Field | Type | Description |
|---|---|---|
deleted | Boolean! | Whether the deletion was successful |
EndpointCountByData¶
Count of endpoints by data status
Fields¶
| Field | Type | Description |
|---|---|---|
total | Int! | Total number of endpoints |
withData | Int! | Number of endpoints that have returned some data |
withoutData | Int! | Number of endpoints that have returned no data |
EndpointCountByStatuses¶
Counts grouped by status
Fields¶
| Field | Type | Description |
|---|---|---|
pending | EndpointCountInPendingStatus | Counts for pending endpoints |
started | EndpointCountByData | Counts for started endpoints |
finished | EndpointCountInFinishedStatus | Counts for finished endpoints |
EndpointCountInFinishedStatus¶
Count of endpoints in finished status
Fields¶
| Field | Type | Description |
|---|---|---|
succeeded | EndpointCountByData | Counts for succeeded endpoints |
failed | EndpointCountByData | Counts for failed endpoints |
timedOut | EndpointCountByData | Counts for timed out endpoints |
EndpointCountInPendingStatus¶
Count of endpoints in pending status
Fields¶
| Field | Type | Description |
|---|---|---|
total | Int! | Total number of endpoints |
offline | Int! | Number of endpoints that are offline |
online | Int! | Number of endpoints that are online |
EndpointCounts¶
Endpoint counts grouped by various attributes
Fields¶
| Field | Type | Description |
|---|---|---|
total | Int! | Total number of endpoints |
types | JSON | Number of endpoints of each type (map: endpoint type -> count) |
platforms | JSON | Number of endpoints by platform (map: platform -> count) |
statuses | EndpointCountByStatuses | Counts grouped by status |
EndpointExecutionSummary¶
Endpoint execution summary
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Endpoint ID (required) |
type | LiveDiscoverEndpointType! | Endpoint type (required) |
hostname | String! | Endpoint hostname (required) |
os | OS | OS information |
ipv4Addresses | [String!] | List of IPv4 addresses |
ipv6Addresses | [String!] | List of IPv6 addresses |
status | ExecutionStatus! | Execution status (required) |
result | ExecutionResult! | Execution result (required) |
statusCode | String | Status code returned by the query |
statusMessage | String | Message returned by the query |
performance | EndpointPerformance | Query run metrics |
resultCount | Int64 | Number of rows of results returned |
createdAt | String | When the endpoint sent the first status |
finishedAt | String | When the endpoint finished running the query |
EndpointFilter¶
Endpoint filter criteria
Fields¶
| Field | Type | Description |
|---|---|---|
healthStatus | [LiveDiscoverHealthStatus!] | Find endpoints by health status |
type | [LiveDiscoverEndpointType!] | Find endpoints by type |
tamperProtectionEnabled | Boolean | Find endpoints by whether Tamper Protection is turned on |
lockdownStatus | [LiveDiscoverLockdownStatus!] | Find endpoints by lockdown status |
ids | [ID!] | Find endpoints with the specified IDs |
lastSeenBefore | String | Find endpoints that were last seen before the given date/time |
lastSeenAfter | String | Find endpoints that were last seen after the given date/time |
hostnameContains | String | Find endpoints where the hostname contains the given string |
associatedPersonContains | String | Find endpoints where the associated person name contains the given string |
groupNameContains | String | Find endpoints where the group name contains the given string |
os | [OperatingSystemMatch!] | Matches endpoints with any of the supplied operating system versions |
ipAddresses | [String!] | Find endpoints by IP addresses |
search | String | Term to search for in the specified search fields |
searchFields | [SearchField!] | List of search fields for finding the given search term |
EndpointGroupReference¶
Endpoint group reference
Fields¶
| Field | Type | Description |
|---|---|---|
name | String | Endpoint group name |
id | ID | Unique ID for endpoint group |
EndpointPerformance¶
Endpoint performance metrics
Fields¶
| Field | Type | Description |
|---|---|---|
score | PerformanceScore | Performance score |
dataTransferredInBytes | Int64 | Total size of query results returned |
executionTimeInMillis | Int64 | Time the query took to execute |
EndpointSessionsResponse¶
Response for endpoint sessions mutation
Fields¶
| Field | Type | Description |
|---|---|---|
requestedAt | String! | Time when the session change was requested |
completedAt | String! | Time when the session change was completed |
ExecutionPerformance¶
Execution performance metrics
Fields¶
| Field | Type | Description |
|---|---|---|
score | PerformanceScore | Overall query performance score |
dataTransferredInBytes | MinMax | Statistics for data transferred in bytes |
executionTimeInMillis | MinMax | Statistics for execution time in milliseconds |
ExecutionResultItem¶
Execution result item Represents a single row in the query run results. Has endpointId and hostname as required fields, plus any additional columns from the SQL query.
Fields¶
| Field | Type | Description |
|---|---|---|
endpointId | ID! | Endpoint ID (required) |
hostname | String! | Endpoint hostname (required) |
additionalColumns | JSON | Additional columns from the SQL query as a JSON object. The keys are column names and values are the column values. Use the metadata.columns to understand the structure and types. |
ExecutionResultsColumnMetadata¶
Column metadata for execution results
Fields¶
| Field | Type | Description |
|---|---|---|
name | String! | Column name |
type | ResultDataType! | Column data type |
ExecutionResultsMetadata¶
Metadata for execution results
Fields¶
| Field | Type | Description |
|---|---|---|
columns | [ExecutionResultsColumnMetadata!]! | Column metadata |
ExecutionSummary¶
Execution summary
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Execution ID |
category | CategoryObjectReference | Category reference |
query | QueryObjectReference | Query reference |
name | String | Execution name (optional) |
template | String | Query template (optional) |
variables | [QueryVariable!]! | Query variables |
status | ExecutionStatus! | Execution status |
result | ExecutionResult! | Execution result |
createdAt | String | Creation timestamp |
createdBy | PrincipalReference | Principal who created this execution |
finishedAt | String | Finish timestamp |
maxDurationInSeconds | Int! | Maximum duration in seconds |
timeRemainingInSeconds | Int! | Time remaining in seconds |
performance | ExecutionPerformance | Execution performance metrics |
resultCount | Int64 | Number of results |
sessionId | ID | Session ID (API-only, not exposed in the Central Admin UI) |
endpointIds | [ID!] | Endpoint IDs (API-only, not exposed in the Central Admin UI) |
matchEndpoints | MatchEndpoints! | Match endpoints criteria (required) |
endpointCounts | EndpointCounts! | Endpoint counts (required) |
LiveDiscoverAssociatedPerson¶
Person associated with the endpoint
Fields¶
| Field | Type | Description |
|---|---|---|
name | String | Person's name |
viaLogin | String | Person's login on the endpoint |
id | ID | Unique ID for the person |
internalId | String | Internal ID for the person used by the Sophos UI |
LiveDiscoverCategories¶
Live Discover categories response
Fields¶
| Field | Type | Description |
|---|---|---|
items | [LiveDiscoverCategory!]! | List of categories |
LiveDiscoverCategory¶
Live Discover query category
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Category ID |
name | String! | Category name |
code | String | Category code |
description | String | Category description |
icon | String | Category icon |
tenant | ObjectReference | Associated tenant |
type | CategoryType! | Category type |
queryCount | Int! | Number of queries in this category |
createdAt | String | Creation timestamp |
createdBy | ObjectReference | Principal who created this category |
updatedAt | String | Last update timestamp |
updatedBy | ObjectReference | Principal who last updated this category |
LiveDiscoverCategoryResponse¶
Live Discover category response
Fields¶
| Field | Type | Description |
|---|---|---|
category | LiveDiscoverCategory | The category |
LiveDiscoverEndpoint¶
Endpoint
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Endpoint ID |
type | LiveDiscoverEndpointType! | Endpoint type |
tenant | ObjectReference | Associated tenant |
hostname | String! | Endpoint hostname |
health | JSON | Endpoint health status |
os | OS! | Operating system information |
liveDiscoverAssociatedPerson | LiveDiscoverAssociatedPerson | Associated person information |
liveDiscoverGroup | EndpointGroupReference | Endpoint group information |
ipv4Addresses | [String!] | List of IPv4 addresses |
ipv6Addresses | [String!] | List of IPv6 addresses |
lastSeenAt | String! | Last time the endpoint was seen (UTC) |
lastOsUpdateAt | String! | Last OS update timestamp (UTC) |
serialNumber | String | Endpoint serial number |
online | Boolean | Whether the endpoint is currently online |
registeredAt | String! | Endpoint registration timestamp (UTC) |
LiveDiscoverEndpointExecutionPage¶
Live Discover endpoint execution page response
Fields¶
| Field | Type | Description |
|---|---|---|
items | [EndpointExecutionSummary!]! | List of endpoint executions |
pages | PagesByOffset! | Pagination information |
LiveDiscoverEndpointsPaged¶
Paged response containing endpoints
Fields¶
| Field | Type | Description |
|---|---|---|
items | [LiveDiscoverEndpoint!]! | List of endpoints |
pages | PagesByKey! | Pagination information (key-based) |
LiveDiscoverExecutionPage¶
Live Discover execution page response
Fields¶
| Field | Type | Description |
|---|---|---|
items | [ExecutionSummary!]! | List of executions |
pages | PagesByOffset! | Pagination information |
LiveDiscoverExecutionResultsPaged¶
Live Discover execution results paged response
Fields¶
| Field | Type | Description |
|---|---|---|
items | [ExecutionResultItem!]! | List of execution results |
pages | PagesByKey! | Pagination information (key-based pagination) |
metadata | ExecutionResultsMetadata | Metadata for tabular data |
LiveDiscoverExecutionSummaryResponse¶
Live Discover execution summary response
Fields¶
| Field | Type | Description |
|---|---|---|
executionSummary | ExecutionSummary | The execution summary |
LiveDiscoverQuery¶
Live Discover query
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Query ID |
name | String! | Query name |
code | String | Query code |
description | String | Query description |
template | String! | Query template |
variables | [QueryVariable!]! | Query variables |
supportedOSes | [SupportedPlatformAndType!]! | Supported operating systems |
categories | [ObjectReference!]! | Query categories |
performance | QueryPerformance | Query performance metrics |
type | QueryType! | Query type |
tenant | ObjectReference | Associated tenant |
createdAt | String | Creation timestamp |
createdBy | PrincipalReference | Principal who created this query |
updatedAt | String | Last update timestamp |
updatedBy | PrincipalReference | Principal who last updated this query |
dataSource | QueryDataSource | Query data source (private) |
LiveDiscoverQueryPage¶
Live Discover query page response
Fields¶
| Field | Type | Description |
|---|---|---|
items | [LiveDiscoverQuery!]! | List of queries |
pages | PagesByOffset! | Pagination information |
LiveDiscoverQueryResponse¶
Live Discover query response
Fields¶
| Field | Type | Description |
|---|---|---|
query | LiveDiscoverQuery | The query |
LiveDiscoverSession¶
Live Discover session
Fields¶
| Field | Type | Description |
|---|---|---|
name | String! | Session tag name |
LiveDiscoverSessionResponse¶
Live Discover session response
Fields¶
| Field | Type | Description |
|---|---|---|
session | LiveDiscoverSession | The session |
MatchEndpoints¶
Match endpoints criteria
Fields¶
| Field | Type | Description |
|---|---|---|
all | Boolean | Whether to include all endpoints (default: false) |
filters | [EndpointFilter!] | Filters to select specific endpoints (1-5 items) |
MinMax¶
Statistics with min, max, total, median, and average values
Fields¶
| Field | Type | Description |
|---|---|---|
total | Int64 | Total value |
min | Int64 | Minimum value |
max | Int64 | Maximum value |
median | Int64 | Median value |
average | Int64 | Average value |
OS¶
OS information
Fields¶
| Field | Type | Description |
|---|---|---|
isServer | Boolean | Whether the OS is a server OS |
platform | OsPlatform! | OS platform (required) |
name | String! | OS name as reported by the endpoint (required) |
majorVersion | Int | OS major version |
minorVersion | Int | OS minor version |
build | Int | OS build |
ObjectReference¶
Object reference
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Object ID |
OperatingSystemMatch¶
Operating system match criteria
Fields¶
| Field | Type | Description |
|---|---|---|
platform | OsPlatform | OS platform |
type | LiveDiscoverEndpointType | Endpoint type |
version | VersionMatch | Version match criteria |
PagesByKey¶
Pagination information for key-based pagination
Fields¶
| Field | Type | Description |
|---|---|---|
fromKey | String | The key of the first item in the returned page |
nextKey | String | The key to use when fetching the next page |
size | Int! | The size of the page being returned |
maxSize | Int! | The maximum page size that can be requested |
total | Int | The total number of pages that exist (only returned if pageTotal=true in request) |
items | Int | The total number of items on all the pages (only returned if pageTotal=true in request) |
PagesByOffset¶
Pagination information for offset-based pagination
Fields¶
| Field | Type | Description |
|---|---|---|
current | Int! | The 1-based page number being returned |
size | Int! | The size of the page being returned |
maxSize | Int! | The maximum page size that can be requested |
total | Int | The total number of pages that exist (only returned if pageTotal=true in request) |
items | Int | The total number of items across all pages (only returned if pageTotal=true in request) |
PrincipalReference¶
Reference to a principal (user or service)
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Unique principal identifier |
type | String! | Type of principal |
name | String | Optional principal name |
accountType | String | Optional account type |
QueryObjectReference¶
Query object reference for execution
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Query ID |
name | String | Query name |
code | String | Localization code of the query |
QueryPerformance¶
Query performance metrics
Fields¶
| Field | Type | Description |
|---|---|---|
score | PerformanceScore | Performance score |
averageExecutionTimeInMillis | Int | Average execution time in milliseconds |
averageDataTransferredInBytes | Int | Average data transferred in bytes |
QueryVariable¶
Query variable definition
Fields¶
| Field | Type | Description |
|---|---|---|
name | String! | Variable name |
dataType | QueryDataType! | Data type of the variable (required) |
value | String | String value of the variable (used during execution) |
description | String | Variable description (private) |
pivotType | QueryPivotType | Meaning of an input parameter (private) |
VersionMatch¶
Version match criteria
Fields¶
| Field | Type | Description |
|---|---|---|
match | String | Exact version match (takes precedence over from/to range options) |
from | String | Match versions greater than or equal to this value |
to | String | Match versions less than or equal to this value |
liveDiscoverQueryRunResultsCsvResponse¶
Live Discover query result CSV by ID response
Fields¶
| Field | Type | Description |
|---|---|---|
csvData | String! | CSV string of the query results |
Enums¶
CategoryType¶
Category type enumeration
Values¶
| Value | Description |
|---|---|
canned | Canned/built-in category |
custom | Custom user-defined category |
EndpointSessionsAction¶
Action for endpoint sessions request
Values¶
| Value | Description |
|---|---|
add | Add sessions to endpoints |
remove | Remove sessions from endpoints |
ExecutionResult¶
Execution result enumeration
Values¶
| Value | Description |
|---|---|
notAvailable | Not available |
succeeded | Successful execution |
failed | Failed execution |
timedOut | Timed out execution |
ExecutionStatus¶
Execution status enumeration
Values¶
| Value | Description |
|---|---|
pending | Pending execution |
started | Started execution |
finished | Finished execution |
LiveDiscoverEndpointType¶
Live Discover endpoint type enumeration
Values¶
| Value | Description |
|---|---|
computer | Computer endpoint |
server | Server endpoint |
securityVm | Security VM endpoint (deprecated) |
LiveDiscoverHealthStatus¶
Live Discover health status of the endpoint
Values¶
| Value | Description |
|---|---|
good | Good health status |
suspicious | Suspicious health status |
bad | Bad health status |
unknown | Unknown health status |
LiveDiscoverLockdownStatus¶
Live Discover endpoint lockdown status
Values¶
| Value | Description |
|---|---|
creatingWhitelist | Creating whitelist |
installing | Installing |
locked | Locked |
notInstalled | Not installed |
registering | Registering |
starting | Starting |
stopping | Stopping |
unavailable | Unavailable |
uninstalled | Uninstalled |
unlocked | Unlocked |
locking | Locking |
OsPlatform¶
OS platform enumeration
Values¶
| Value | Description |
|---|---|
windows | Windows platform |
linux | Linux platform |
macOS | macOS platform |
PerformanceScore¶
Performance score enumeration
Values¶
| Value | Description |
|---|---|
excellent | Excellent performance |
good | Good performance |
fair | Fair performance |
poor | Poor performance |
notEvaluated | Not evaluated |
PrincipalType¶
Principal type enumeration
Values¶
| Value | Description |
|---|---|
user | User principal |
service | Service principal |
QueryDataSource¶
Query data source enumeration (private)
Values¶
| Value | Description |
|---|---|
endpoints | Endpoints data source |
dataLake | Data lake data source |
QueryDataType¶
Query data type enumeration
Values¶
| Value | Description |
|---|---|
boolean | Boolean value |
dateTime | Date and time value |
double | Double precision floating point number |
integer | Integer number |
text | Text/string value |
QueryPivotType¶
Query pivot type enumeration (private)
Values¶
| Value | Description |
|---|---|
deviceId | Device ID |
deviceName | Device name |
sophosPid | Sophos PID |
ipAddress | IP address |
username | Username |
sha256 | SHA256 hash |
filePath | File path |
registryKey | Registry key |
url | URL |
QueryType¶
Enumeration for query types
Values¶
| Value | Description |
|---|---|
canned | Canned/built-in query |
custom | Custom user-defined query |
ResultDataType¶
Result data type enumeration
Values¶
| Value | Description |
|---|---|
boolean | Boolean value |
dateTime | Date and time value |
double | Double precision floating point number |
integer | Integer number |
text | Text/string value |
SearchField¶
Field that supports searching
Values¶
| Value | Description |
|---|---|
hostname | Hostname |
groupName | Group name |
associatedPersonName | Associated person name |
ipAddresses | IP addresses |
osName | OS name |
SupportedPlatformAndType¶
Supported platform and type enumeration
Values¶
| Value | Description |
|---|---|
linuxServer | Linux server |
macOSComputer | macOS computer |
windowsComputer | Windows computer |
windowsServer | Windows server |
Input objects¶
AdHocQueryInput¶
Ad hoc query input for execution
Fields¶
| Field | Type | Description |
|---|---|---|
template | String! | Query template |
name | String | Query name (optional) |
EndpointFilterInput¶
Endpoint filter input criteria
Fields¶
| Field | Type | Description |
|---|---|---|
healthStatus | [LiveDiscoverHealthStatus!] | Find endpoints by health status |
type | [LiveDiscoverEndpointType!] | Find endpoints by type |
tamperProtectionEnabled | Boolean | Find endpoints by whether Tamper Protection is turned on |
lockdownStatus | [LiveDiscoverLockdownStatus!] | Find endpoints by lockdown status |
ids | [ID!] | Find endpoints with the specified IDs |
lastSeenBefore | String | Find endpoints that were last seen before the given date/time |
lastSeenAfter | String | Find endpoints that were last seen after the given date/time |
hostnameContains | String | Find endpoints where the hostname contains the given string |
associatedPersonContains | String | Find endpoints where the associated person name contains the given string |
groupNameContains | String | Find endpoints where the group name contains the given string |
os | [OperatingSystemMatchInput!] | Matches endpoints with any of the supplied operating system versions |
ipAddresses | [String!] | Find endpoints by IP addresses |
search | String | Term to search for in the specified search fields |
searchFields | [SearchField!] | List of search fields for finding the given search term |
EndpointSessionsFilter¶
Endpoint query filter for sessions request Full specification matching api-store/apis/endpoint/v1/types/endpointsQueryRequest.yaml
Fields¶
| Field | Type | Description |
|---|---|---|
pageFromKey | String | Page from key for pagination |
pageSize | Int | Page size for pagination |
pageTotal | Boolean | Whether to calculate total pages |
sort | [EndpointSessionsSort!] | Sort criteria (array of sort specifications) |
healthStatus | [String!] | List of Health status to include |
updatingHealthStatus | [String!] | List of updating health statuses (internal) |
runningHealthStatus | [String!] | List of running health statuses (internal) |
threatHealthStatus | [String!] | List of threat health statuses (internal) |
communicationHealthStatus | [String!] | List of communication health statuses (internal) |
operationHealthStatus | [String!] | List of operation health statuses (internal) |
systemHealthStatus | [String!] | List of system health statuses (internal) |
syncsecHealthStatus | [String!] | List of syncsec health statuses (internal) |
type | [String!] | List of Endpoint types to include |
tamperProtection | [Boolean!] | List of Tamper Protection statuses |
tamperProtectionSupported | [Boolean!] | List of Tamper Protection supported statuses (preview) |
capabilities | [String!] | List of Capabilities to include (preview) |
lockdownStatus | [String!] | List of Server Lockdown statuses |
overallEncryptionStatus | [String!] | List of encryption statuses (preview) |
ids | [ID!] | List of Endpoint IDs to include |
isolationStatus | [String!] | List of Isolation statuses |
lastSeenBefore | String | Last seen before date and time (UTC) exclusive |
lastSeenAfter | String | Last seen after date and time (UTC) inclusive |
lastOsUpdateBefore | String | Last operating system update before date and time (UTC) exclusive |
lastOsUpdateAfter | String | Last operating system update after date and time (UTC) inclusive |
registeredBefore | String | Endpoints registered before date and time (UTC) exclusive |
registeredAfter | String | Endpoints registered after date and time (UTC) inclusive |
lastAgentUpdateBefore | String | Last agent update before date and time (UTC) exclusive |
lastAgentUpdateAfter | String | Last agent update after date and time (UTC) inclusive |
hostnameContains | String | Match endpoints where the hostname contains the given string |
serialNumberContains | String | Match endpoints where the serial number contains the given string |
associatedPersonContains | String | Match endpoints where the person associated with the endpoint contains the given string |
groupNameContains | String | Match endpoints where the name of the group the endpoint is in contains the given string |
tags | [String!] | List of tags (preview) |
sessions | [String!] | List of sessions (internal) |
includeTags | JSON | Finds endpoints with the specified tags (complex type - passed as JSON) |
excludeTags | JSON | Finds endpoints without the specified tags (complex type - passed as JSON) |
hasTags | Boolean | Finds endpoints that either have no tags or any tags assigned |
fields | [String!] | Fields to return in a partial response |
view | String | Type of view to be returned in response (basic, summary, full) |
os | JSON | Matches endpoints with any of the supplied operating system versions (complex type - passed as JSON) |
ipAddresses | [String!] | Match endpoints by IP addresses |
macAddresses | [String!] | Find endpoints by MAC Addresses |
search | String | Term to search for in the specified search fields |
searchFields | [String!] | List of search fields for matching given search term |
online | Boolean | Whether endpoint is currently online |
assignedToGroup | Boolean | Whether endpoint is assigned to a group |
mdrManaged | Boolean | Whether the endpoint is managed by MDR (preview) |
cloud | JSON | Match endpoints by cloud providers (complex type - passed as JSON) |
groupIds | [ID!] | Match endpoints by assigned group |
protectionStatus | [String!] | Find endpoints by protection package status (internal) |
encryptionStatus | [String!] | Find endpoints by encryption package status (internal) |
ztnaStatus | [String!] | Find endpoints by ZTNA package status (internal) |
protectionPackage | [String!] | Find endpoints by protection package (internal) |
coreAgent | [String!] | Find endpoints by Core Agent module version (internal, max 50 items) |
deviceEncryption | [String!] | Find endpoints by Device Encryption module version (internal, max 50 items) |
interceptX | [String!] | Find endpoints by Intercept X module version (internal, max 50 items) |
EndpointSessionsInput¶
Input for endpoint sessions mutation
Fields¶
| Field | Type | Description |
|---|---|---|
sessions | [String!]! | Case insensitive list of session names |
action | EndpointSessionsAction! | Action to perform (add or remove) |
filter | EndpointSessionsFilter | Optional filter criteria for endpoints |
EndpointSessionsSort¶
Sort specification for endpoint query
Fields¶
| Field | Type | Description |
|---|---|---|
field | String | Field to sort by |
direction | String | Sort direction (asc/desc) |
LiveDiscoverCategoryInput¶
Live Discover category input
Fields¶
| Field | Type | Description |
|---|---|---|
name | String! | Category name |
description | String | Category description |
icon | String | Category icon |
LiveDiscoverEndpointParams¶
Live Discover endpoint parameters
Fields¶
| Field | Type | Description |
|---|---|---|
pageSize | Int | Page size |
page | Int | Page number |
pageTotal | Boolean | Include page total |
sort | [String!] | Sort order (array of sort fields, e.g., ["field1:asc", "field2:desc"]) |
fields | [String!] | Fields to include (array of field names) |
match | [String!] | Match criteria (array of combinations: status:result:withData, e.g., ["finished:succeeded:withData"]) |
LiveDiscoverExecutionRequest¶
Live Discover execution request input
Fields¶
| Field | Type | Description |
|---|---|---|
savedQuery | SavedQueryInput | Saved query to run (required if adHocQuery not supplied) |
adHocQuery | AdHocQueryInput | Ad hoc query to run (required if savedQuery not supplied) |
variables | [QueryVariableInput!] | Query variables |
matchEndpoints | MatchEndpointsInput! | Match endpoints criteria (required) |
sessionId | ID | Session ID (API-only, not exposed in the Central Admin UI) |
endpointIds | [ID!] | Endpoint IDs (API-only, not exposed in the Central Admin UI) |
LiveDiscoverQueryInput¶
Live Discover query input for creating a new query
Fields¶
| Field | Type | Description |
|---|---|---|
name | String! | Query name |
description | String | Query description |
template | String! | Query template |
variables | [QueryVariableInput!] | Query variables |
supportedOSes | [SupportedPlatformAndType!]! | Supported operating systems (required, minItems: 1) |
categories | [ObjectReferenceInput!]! | Categories this query belongs to (required, minItems: 1) |
LiveDiscoverQueryParams¶
Live Discover query parameters
Fields¶
| Field | Type | Description |
|---|---|---|
categoryId | ID | Category ID filter |
search | String | Search term |
searchFields | [String!] | Search fields (array of field names to search within) |
pageSize | Int | Page size |
page | Int | Page number |
pageTotal | Boolean | Include page total |
fields | [String!] | Fields to include (array of field names) |
dataSource | [QueryDataSource!] | Data source for the query (array: endpoints, dataLake) |
LiveDiscoverQueryRunByIdParams¶
Live Discover query run by ID parameters
Fields¶
| Field | Type | Description |
|---|---|---|
fields | [String!] | Fields to include (array of field names) |
LiveDiscoverQueryRunParams¶
Live Discover query run parameters
Fields¶
| Field | Type | Description |
|---|---|---|
pageSize | Int | Page size |
page | Int | Page number |
pageTotal | Boolean | Include page total |
sort | [String!] | Sort order (array of sort fields, e.g., ["field1:asc", "field2:desc"]) |
fields | [String!] | Fields to include (array of field names) |
queryId | ID | Query ID filter |
categoryId | ID | Category ID filter |
executionStatus | [ExecutionStatus!] | Execution status filter (array: pending, started, finished) |
executionResult | [ExecutionResult!] | Execution result filter (array: notAvailable, succeeded, failed, timedOut) |
createdByPrincipalType | [PrincipalType!] | Created by principal type filter (array: service, user) |
LiveDiscoverQueryRunResultsParams¶
Live Discover query run results parameters
Fields¶
| Field | Type | Description |
|---|---|---|
pageSize | Int | Page size |
pageTotal | Boolean | Include page total |
pageFromKey | String | Page from key |
sort | [String!] | Sort order (array of sort fields, e.g., ["field1:asc", "field2:desc"]) |
LiveDiscoverUpdateQueryInput¶
Live Discover update query input
Fields¶
| Field | Type | Description |
|---|---|---|
name | String | Query name |
description | String | Query description |
template | String | Query template |
variables | [QueryVariableInput!] | Query variables |
supportedOSes | [SupportedPlatformAndType!] | Supported operating systems (minItems: 1 if provided) |
categories | [ObjectReferenceInput!] | Categories this query belongs to (minItems: 1 if provided) |
MatchEndpointsInput¶
Match endpoints input criteria
Fields¶
| Field | Type | Description |
|---|---|---|
all | Boolean | Whether to include all endpoints (default: false) |
filters | [EndpointFilterInput!] | Filters to select specific endpoints (1-5 items) |
ObjectReferenceInput¶
Object reference input
Fields¶
| Field | Type | Description |
|---|---|---|
id | ID! | Object ID |
OperatingSystemMatchInput¶
Operating system match input criteria
Fields¶
| Field | Type | Description |
|---|---|---|
platform | OsPlatform | OS platform |
type | LiveDiscoverEndpointType | Endpoint type |
version | VersionMatchInput | Version match criteria |
QueryVariableInput¶
Query variable input
Fields¶
| Field | Type | Description |
|---|---|---|
name | String! | Variable name |
dataType | QueryDataType! | Data type of the variable (required) |
value | String | String value of the variable (used during execution) |
description | String | Variable description (private) |
pivotType | QueryPivotType | Meaning of an input parameter (private) |
SavedQueryInput¶
Saved query input for execution
Fields¶
| Field | Type | Description |
|---|---|---|
queryId | ID! | Query ID |
categoryId | ID | Category ID (optional) |
VersionMatchInput¶
Version match input criteria
Fields¶
| Field | Type | Description |
|---|---|---|
match | String | Exact version match (takes precedence over from/to range options) |
from | String | Match versions greater than or equal to this value |
to | String | Match versions less than or equal to this value |
liveDiscoverQueryRunResultsCsvRequestParams¶
Live Discover query run result CSV request parameters
Fields¶
| Field | Type | Description |
|---|---|---|
sort | [String!] | Value of the request's sort query param |
Scalars¶
Int64¶
The Int64 scalar type represents a signed 64-bit integer.
JSON¶
The JSON scalar type represents JSON values as specified by ECMA-404.