getOrCreateSearch¶

API under active development

Introspection may show fields or types that this reference does not document. Use this documentation to identify officially supported fields and types.

MUTATIONgetOrCreateSearch

Search GraphQL API · Mutations

Create and execute a new search if a matching one doesn't exist. Otherwise, retrieve search information and its current state. Searches are matched on their input data, with queries compared for equivalency via their canonical structured representations, not byte-wise textual representations.

Arguments¶

Argument	Type	Description
`input`	`CreateSearchInput`	The query and optional settings used to create a new search or match on an existing search already in flight or completed.

Returns¶

SearchV2!

Request samples¶

cURLPythonPowerShellGoJavaScript

curl -X POST "https://api.taegis.sophos.com/graphql" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"query\": \"mutation GetOrCreateSearch(\$input: CreateSearchInput) { getOrCreateSearch(input: \$input) { urn status overThreshold errors outcome { success } queryText searchPartitions { urn searchURN schemaType status overThreshold errors } createTime startTime endTime expireTime metadata } }\",
  \"variables\": {
    \"input\": {
      \"text\": \"<text>\"
    }
  }
}"

import requests

response = requests.post(
    "https://api.taegis.sophos.com/graphql",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'query': 'mutation GetOrCreateSearch($input: CreateSearchInput) { '
             'getOrCreateSearch(input: $input) { urn status overThreshold '
             'errors outcome { success } queryText searchPartitions { urn '
             'searchURN schemaType status overThreshold errors } createTime '
             'startTime endTime expireTime metadata } }',
    'variables': {'input': {'text': '<text>'}}},
)
print(response.json())

$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "query": "mutation GetOrCreateSearch($input: CreateSearchInput) { getOrCreateSearch(input: $input) { urn status overThreshold errors outcome { success } queryText searchPartitions { urn searchURN schemaType status overThreshold errors } createTime startTime endTime expireTime metadata } }",
  "variables": {
    "input": {
      "text": "<text>"
    }
  }
}'
Invoke-RestMethod -Method POST -Uri "https://api.taegis.sophos.com/graphql" -Headers $headers -Body $body -ContentType "application/json"

package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("POST", "https://api.taegis.sophos.com/graphql", strings.NewReader(`{
  "query": "mutation GetOrCreateSearch($input: CreateSearchInput) { getOrCreateSearch(input: $input) { urn status overThreshold errors outcome { success } queryText searchPartitions { urn searchURN schemaType status overThreshold errors } createTime startTime endTime expireTime metadata } }",
  "variables": {
    "input": {
      "text": "<text>"
    }
  }
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}

const response = await fetch("https://api.taegis.sophos.com/graphql", {
  method: "POST",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "query": "mutation GetOrCreateSearch($input: CreateSearchInput) { getOrCreateSearch(input: $input) { urn status overThreshold errors outcome { success } queryText searchPartitions { urn searchURN schemaType status overThreshold errors } createTime startTime endTime expireTime metadata } }",
  "variables": {
    "input": {
      "text": "<text>"
    }
  }
}),
});
const data = await response.json();
console.log(data);