Queries

REST API operations for saved and scheduled queries

Overview

The /queries REST API operations are in open beta starting with Panther version 1.101, and are available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with Saved and Scheduled Searches in Panther.

To call the API, see the How to use the Panther REST API instructions—including directions for how to invoke it directly from this documentation page.

Queries managed via the API must be written in SQL; they cannot use PantherFlow.

Required permissions

• For GET operations, your API token must have the Query Data Lake permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Saved Searches permission.

Operations

create query

POSThttps://your-api-host/queries

Body

application/json

descriptionstring

The description of the query

name*string

The name of the query

scheduleQueryAPI.Schedule (object)

sql*string

The raw sql of the query

Response

200400409

OK response.

Body

application/json

createdAtstring

descriptionstring

The description of the query

idstring

The generated ID of the query

managedboolean

Determines if the query is managed by panther

namestring

The name of the query

scheduleQueryAPI.Schedule (object)

sqlstring

The raw sql of the query

updatedAtstring

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/queries', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "sql": "text",
      "name": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "createdAt": "text",
  "description": "text",
  "id": "text",
  "managed": false,
  "name": "text",
  "schedule": {
    "cron": "text",
    "disabled": false
  },
  "sql": "text",
  "updatedAt": "text"
}

get query

GEThttps://your-api-host/queries/{id}

Path parameters

id*string

ID of the query to fetch

Response

200404

OK response.

Body

application/json

createdAtstring

descriptionstring

The description of the query

idstring

The generated ID of the query

managedboolean

Determines if the query is managed by panther

namestring

The name of the query

scheduleQueryAPI.Schedule (object)

sqlstring

The raw sql of the query

updatedAtstring

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/queries/{id}', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200404

{
  "createdAt": "text",
  "description": "text",
  "id": "text",
  "managed": false,
  "name": "text",
  "schedule": {
    "cron": "text",
    "disabled": false
  },
  "sql": "text",
  "updatedAt": "text"
}

update query

put creates or updates a query

POSThttps://your-api-host/queries/{id}

Path parameters

id*string

Body

application/json

descriptionstring

The description of the query

name*string

The name of the query

scheduleQueryAPI.Schedule (object)

sql*string

The raw sql of the query

Response

200400404

OK response.

Body

application/json

createdAtstring

descriptionstring

The description of the query

idstring

The generated ID of the query

managedboolean

Determines if the query is managed by panther

namestring

The name of the query

scheduleQueryAPI.Schedule (object)

sqlstring

The raw sql of the query

updatedAtstring

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/queries/{id}', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "sql": "text",
      "name": "text"
    }),
});
const data = await response.json();

Response

200400404

{
  "createdAt": "text",
  "description": "text",
  "id": "text",
  "managed": false,
  "name": "text",
  "schedule": {
    "cron": "text",
    "disabled": false
  },
  "sql": "text",
  "updatedAt": "text"
}

delete query

DELETEhttps://your-api-host/queries/{id}

Path parameters

id*string

ID of the query to delete

Response

204400404

No Content response.

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/queries/{id}', {
    method: 'DELETE',
    headers: {},
});
const data = await response.json();

Response

400404

{
  "message": "text"
}

list queries

GEThttps://your-api-host/queries

Query parameters

Response

200

OK response.

Body

application/json

nextstring

Pagination token for the next page of results

resultsarray of QueryAPI.Query (object)

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/queries', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200

{
  "next": "text",
  "results": [
    {
      "createdAt": "text",
      "description": "text",
      "id": "text",
      "managed": false,
      "name": "text",
      "schedule": {
        "cron": "text",
        "disabled": false
      },
      "sql": "text",
      "updatedAt": "text"
    }
  ]
}