Skip to content

Get detections run

GET/queries/detections/{runId}

Detections API · Detections

Return the detections query run with the given ID.

Required permissiondetections.queries.detections:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
runId path string (uuid) Yes Run ID of a query.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/detections/v1/queries/detections/<runId>", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Successful retrieval of the detections query run.

Response fields

idstring (uuid)
ID of the run.
createdAtstring (date-time)
Timestamp when the run started.
expiresAtstring (date-time)
Timestamp when the run expired.
finishedAtstring (date-time)
Timestamp when the run finished.
resultCountinteger
The total number of items across all pages.
resultstring
Result of a query run on groups or detections.
Must be one of: succeeded, canceled, failed, notAvailable, timedOut.
statusstring
Status of a query run on groups or detections.
Must be one of: finished, pending, started.

Errors

Status Meaning
401 Unauthorized.
403 Forbidden.
404 Not found.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "id": "4a9bb69a-c7f1-4a59-b912-7fe4ba70b751",
  "createdAt": "2023-11-22T18:55:33.811Z",
  "expiresAt": "2023-11-23T18:55:33.811Z",
  "finishedAt": "2023-11-22T18:55:35.716Z",
  "resultCount": 100,
  "result": "succeeded",
  "status": "finished"
}

See the guide for a narrative walkthrough of this API.