Query raw events

POST

/sources/raw-events/{other_id}

This is a pre-release API and is guaranteed to change in the future.
Query raw events from a data source for a specific id.
It accepts most ids used by other endpoints with the exception of people ids.

Request

Authorization

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/sources/raw-events/' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

200 - Example 1

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "data": "string",
            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
            "recorded_at": "2019-08-24T14:15:22.123Z",
            "timestamp": "2019-08-24T14:15:22.123Z"
        }
    ]
}

Modified at 2026-07-28 15:47:54

Execute an advanced query

Query all allowlists