Execute an advanced query

POST

/advanced-query

Execute an advanced query using AQL with full statements.

This is an experimental API and is not ready for production use. DO NOT USE.

Instead of specifying pagination, filtering, and sorting options separately, you specify a complete SQL-like query.
The following are supported:

"SELECT *"

"SELECT field1 [AS alias], field2 [AS alias], ..."

FROM table-name [AS alias]

[LEFT|INNER] JOIN other_table [AS alias] ON condition

WHERE, subject to the same restrictions as normal AQL

ORDER BY, subject to the same restrictions as normal AQL

LIMIT and OFFSET

Table names are documented with each queryable endpoint.

For example, a query against "list devices" that looks like:

{
  "query": "name='WINPC-4291' AND apps_installed > 10",
  "sort": "name desc, id",
  "limit": 10,
}

would be expressed here as:

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Successful operation

Body

🟠400

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST '/advanced-query' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "query": "string"
}'

Response Example

200 - Example 1

{
    "rows": [
        {
            "property1": "string",
            "property2": "string"
        }
    ]
}

Modified at 2026-02-10 23:10:01

Query all Shadow IT instances

List security events