Queries

REST API operations for saved and scheduled queries

Overview

The /queries REST API operations are in open beta starting with Panther version 1.101, and are available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with Saved and Scheduled Searches in Panther.

To call the API, see the How to use the Panther REST API instructions—including directions for how to invoke it directly from this documentation page.

Queries managed via the API must be written in SQL; they cannot use PantherFlow.

Required permissions

• For GET operations, your API token must have the Query Data Lake permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Saved Searches permission.

Operations

create query

post

/queries

Authorizations

Body

descriptionstring

The description of the query

namestringrequired

The name of the query

scheduleobject

sqlstringrequired

The raw sql of the query

Responses

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://your-api-host/queries' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"name":"text","schedule":{},"sql":"text"}'

200

400

409

200

{
  "createdAt": "text",
  "description": "text",
  "id": "text",
  "managed": true,
  "name": "text",
  "schedule": {
    "cron": "text",
    "disabled": true,
    "rateMinutes": 1,
    "timeoutMinutes": 1
  },
  "sql": "text",
  "updatedAt": "text"
}

OK response.

get query

get

/queries/{id}

Authorizations

Path parameters

idstringrequired

ID of the query to fetch

Responses

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url 'https://your-api-host/queries/{id}' \
  --header 'X-API-Key: YOUR_API_KEY'

200

404

200

{
  "createdAt": "text",
  "description": "text",
  "id": "text",
  "managed": true,
  "name": "text",
  "schedule": {
    "cron": "text",
    "disabled": true,
    "rateMinutes": 1,
    "timeoutMinutes": 1
  },
  "sql": "text",
  "updatedAt": "text"
}

OK response.

update query

put creates or updates a query

post

/queries/{id}

Authorizations

Path parameters

idstringrequired

Body

descriptionstring

The description of the query

namestringrequired

The name of the query

scheduleobject

sqlstringrequired

The raw sql of the query

Responses

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request POST \
  --url 'https://your-api-host/queries/{id}' \
  --header 'X-API-Key: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"name":"text","schedule":{},"sql":"text"}'

200

400

404

200

{
  "createdAt": "text",
  "description": "text",
  "id": "text",
  "managed": true,
  "name": "text",
  "schedule": {
    "cron": "text",
    "disabled": true,
    "rateMinutes": 1,
    "timeoutMinutes": 1
  },
  "sql": "text",
  "updatedAt": "text"
}

OK response.

delete query

delete

/queries/{id}

Authorizations

Path parameters

idstringrequired

ID of the query to delete

Responses

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --request DELETE \
  --url 'https://your-api-host/queries/{id}' \
  --header 'X-API-Key: YOUR_API_KEY'

204

400

404

204

No body

No Content response.

list queries

get

/queries

Authorizations

Query parameters

cursorstring

the pagination token

limitinteger · int64 · default: 100

the maximum results to return

Responses

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url 'https://your-api-host/queries' \
  --header 'X-API-Key: YOUR_API_KEY'

200

200

{
  "next": "text",
  "results": [
    {
      "createdAt": "text",
      "description": "text",
      "id": "text",
      "managed": true,
      "name": "text",
      "schedule": {
        "cron": "text",
        "disabled": true,
        "rateMinutes": 1,
        "timeoutMinutes": 1
      },
      "sql": "text",
      "updatedAt": "text"
    }
  ]
}

OK response.