Skip to content

Get results

GET/queries/runs/{runId}/results

Live Discover API · Query Run Results

Get the results of a query run.

Required permissionlive-discover.query:execute

Parameters

Name In Type Required Description
X-Correlation-ID header string (uuid) No Response header to correlate requests.
X-Tenant-ID header string (uuid) Yes Tenant ID.
runId path string (uuid) Yes Query run ID.
pageSize query integer No Page size for Live Discover query run results. Default is 1000; max is 1000.
pageTotal query boolean No Whether the number of pages should be calculated and returned in the response.
pageFromKey query string No The key of the item from where to fetch a page.
sort query array of string No Defines how to sort the data.
Each item must match the pattern (^[^:]+$)|(^[^:]+:(asc|desc)$).

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/live-discover/v1/queries/runs/<runId>/results" -H "Authorization: Bearer <access-token>" -H "X-Correlation-ID: <X-Correlation-ID>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/live-discover/v1/queries/runs/<runId>/results",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Correlation-ID": "<X-Correlation-ID>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Correlation-ID" = "<X-Correlation-ID>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/live-discover/v1/queries/runs/<runId>/results" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/live-discover/v1/queries/runs/<runId>/results", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Correlation-ID", "<X-Correlation-ID>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/live-discover/v1/queries/runs/<runId>/results", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Correlation-ID": "<X-Correlation-ID>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Query run results.

Response fields

pagesobjectrequired
Show child attributesHide child attributes
fromKeystring
The key of the first item in the returned page.
nextKeystring
The key to use when fetching the next page.
sizeintegerrequired
The size of the page being returned.
totalinteger
(Optional) The total number of pages that exist, if pageTotal=true in the request.
itemsinteger
(Optional) The total number of items on all the pages, if pageTotal=true was passed into the request.
maxSizeintegerrequired
The maximum page size that can be requested.
metadataobjectrequired
Metadata for tabular data in items.
Show child attributesHide child attributes
columnsarray of objectrequired
List of columns.
Column metadata.
Show child attributesHide child attributes
namestringrequired
Column name.
typestringrequired
Data types of values returned in query results.
Must be one of: boolean, dateTime, double, integer, text.
itemsarray of objectrequired
Ordered list of JSON objects, one for each row in the results for the SQL query. A row JSON object has one field for each column in the SQL query. The value of the field is the value of the column.
Single row in the query run results.
Show child attributesHide child attributes
endpointIdstring (uuid)required
Endpoint ID.
hostnamestringrequired
Endpoint name.

Errors

Status Meaning
403 Forbidden.
404 Can't find query run.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "pages": {
    "fromKey": "string",
    "nextKey": "string",
    "size": 0,
    "total": 0,
    "items": 0,
    "maxSize": 0
  },
  "metadata": {
    "columns": [
      {
        "name": "string",
        "type": "boolean"
      }
    ]
  },
  "items": [
    {
      "endpointId": "00000000-0000-0000-0000-000000000000",
      "hostname": "string"
    }
  ]
}

See the guide for a narrative walkthrough of this API.