Skip to content

Get a category

GET/queries/categories/{categoryId}

XDR Query API · Category

Get the details of a category.

Required permissionxdr.query-catalog:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
categoryId path string (uuid) Yes Category ID.
fields query array of string No The fields to return in a partial response.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/categories/<categoryId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/categories/<categoryId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/categories/<categoryId>" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/categories/<categoryId>", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/categories/<categoryId>", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Details of the requested Query.

Response fields

idstring (uuid)required
Category ID.
namestringrequired
Category name.
codestring
Identifier for category name. This is available only for 'canned' categories.
descriptionstring
Category description.
iconstring
Category icon name.
tenantobject
Represents a referenced object.
Show child attributesHide child attributes
idstring (uuid)required
The ID of the referenced object.
typestringrequired
Query category type.
Must be one of: canned, custom.
queryCountintegerrequired
Number of queries in this category.
createdAtstring (datetime)
When the category was created.
createdByobject
Represents a referenced object.
Show child attributesHide child attributes
idstring (uuid)required
The ID of the referenced object.
updatedAtstring (datetime)
When the category was last updated.
updatedByobject
Represents a referenced object.
Show child attributesHide child attributes
idstring (uuid)required
The ID of the referenced object.

Errors

Status Meaning
403 Forbidden.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "id": "00000000-0000-0000-0000-000000000000",
  "name": "string",
  "code": "string",
  "description": "string",
  "icon": "string",
  "tenant": {
    "id": "00000000-0000-0000-0000-000000000000"
  },
  "type": "canned",
  "queryCount": 0,
  "createdAt": "string",
  "createdBy": {
    "id": "00000000-0000-0000-0000-000000000000"
  },
  "updatedAt": "string",
  "updatedBy": {
    "id": "00000000-0000-0000-0000-000000000000"
  }
}

See the guide for a narrative walkthrough of this API.