Skip to content

Get results

GET/queries/runs/{runId}/results

XDR Query API · Runs

Get the paged results for a query run.

Required permissionxdr.query:read

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) No Tenant ID.
runId path string (uuid) Yes Query run ID.
pageFromKey query string No The key of the item from where to fetch a page.
pageSize query integer No The size of the page requested.
page query integer No The page number to fetch, starting with 1.

Request samples

curl -X GET "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/runs/<runId>/results" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/runs/<runId>/results",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/runs/<runId>/results" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/runs/<runId>/results", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/xdr-query/v1/queries/runs/<runId>/results", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Query run results.

Response fields

itemsarray of object
Ordered list of JSON objects, one for each row in the results for the SQL query. A row JSON object has one field for each column in the SQL query. The value of the field is the value of the column.
metadataobject
Metadata for tabular data in items.
Show child attributesHide child attributes
columnsarray of object
List of columns.
Column metadata.
Show child attributesHide child attributes
namestring
Column name.
typestring
Column value type.
pagesobject
Page information.
Show child attributesHide child attributes
fromKeystring
(Optional) The key of the first item in the returned page, returned only if the request was by key (the default if unspecified in the request).
nextKeystring
(Optional) The key to use when fetching the next page.
sizeintegerrequired
The size of the page being returned.
maxSizeintegerrequired
The maximum page size that can be requested.
currentinteger
(Optional) The 1-based page number being returned, returned only if the request was by offset.
totalinteger
(Optional) The total number of pages that exist.
itemsinteger
(Optional) The total number of items across all pages.

Errors

Status Meaning
403 Forbidden.
404 Can't find query run.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {}
  ],
  "metadata": {
    "columns": [
      {
        "name": "string",
        "type": "string"
      }
    ]
  },
  "pages": {
    "fromKey": "string",
    "nextKey": "string",
    "size": 0,
    "maxSize": 0,
    "current": 0,
    "total": 0,
    "items": 0
  }
}

See the guide for a narrative walkthrough of this API.