> ## Documentation Index > Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt > Use this file to discover all available pages before exploring further. # CreateQuery > Queries metrics for specific values. It returns back a list of metric UUIDs. The caller must call the List or Get metric to retrieve the individual metric values. ## OpenAPI ````yaml /api-reference/openapi.v3.json post /v1/namespaces/{tenant_meta.namespace}/queries openapi: 3.0.3 info: description: Integrate your application with Endor Labs using the REST API. title: Endor Labs REST API Reference version: '1.0' servers: - url: https://api.endorlabs.com/ security: [] tags: - name: AISastCustomerContextService - name: APIKeyService - name: APIKeyValidatorService - name: ArtifactSignatureService - name: AuditLogService - name: AuthenticationLogService - name: AuthenticationService - name: AuthorizationPolicyService - name: BatchFileSegmentsService - name: BatchNotificationService - name: CallGraphDataService - name: CodeOwnersService - name: DependencyMetadataService - name: EndorIgnoreEntryService - name: ExporterService - name: FindingLogService - name: FindingService - name: HuggingFaceModelService - name: HuggingFaceOrganizationService - name: IPAddressPolicyService - name: IdentityProviderService - name: InstallationService - name: InvitationService - name: LicenseDependencyService - name: LicenseNoticesReportService - name: LicenseSummaryService - name: LinterResultService - name: MalwareService - name: MetricService - name: NamespaceService - name: NotificationService - name: NotificationTargetService - name: OnPremSchedulerService - name: PRCommentConfigService - name: PackageFirewallLogService - name: PackageLicenseOverrideService - name: PackageLicenseQueryService - name: PackageLicenseService - name: PackageManagerService - name: PackageVersionService - name: PluginBinaryService - name: PolicyService - name: PolicyTemplateService - name: ProjectService - name: ProvisioningResultService - name: QueryMalwareService - name: QueryService - name: QuerySimilarPackagesService - name: QueryVulnerabilityService - name: RegistryIngestionCheckpointService - name: RepositoryService - name: RepositoryVersionService - name: RuleSetImportService - name: SBOMExportService - name: SBOMImportService - name: SCMCredentialService - name: SavedQueryService - name: ScanLogRequestService - name: ScanProfileService - name: ScanResultService - name: ScanWorkflowResultService - name: ScanWorkflowService - name: SecretRuleService - name: SemgrepRuleService - name: SystemConfigService - name: TenantService - name: VEXExportService - name: VectorStoreService - name: VersionUpgradeService - name: VulnerabilityService paths: /v1/namespaces/{tenant_meta.namespace}/queries: post: tags: - QueryService summary: CreateQuery description: |- Queries metrics for specific values. It returns back a list of metric UUIDs. The caller must call the List or Get metric to retrieve the individual metric values. operationId: QueryService_CreateQuery parameters: - description: >- Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". in: path name: tenant_meta.namespace required: true schema: type: string x-endor-name: Namespace requestBody: content: application/json: schema: $ref: '#/components/schemas/QueryServiceCreateQueryBody' required: true x-originalParamName: body responses: '200': content: application/json: schema: $ref: '#/components/schemas/v1Query' description: A successful response. default: content: application/json: schema: $ref: '#/components/schemas/googlerpcStatus' description: An unexpected error response. components: schemas: QueryServiceCreateQueryBody: description: Query implements the metric query requests. properties: meta: $ref: '#/components/schemas/v1Meta' spec: $ref: '#/components/schemas/v1QuerySpec' tenant_meta: description: The Tenant Metadata restricts access to a specific tenant. title: The Tenant Metadata restricts access to a specific tenant. type: object uuid: description: The UUID of the resource. readOnly: true type: string required: - meta type: object v1Query: description: Query implements the metric query requests. properties: meta: $ref: '#/components/schemas/v1Meta' spec: $ref: '#/components/schemas/v1QuerySpec' tenant_meta: $ref: '#/components/schemas/v1TenantMeta' uuid: description: The UUID of the resource. readOnly: true type: string required: - tenant_meta - meta type: object googlerpcStatus: description: >- The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). properties: code: description: |- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. format: int32 type: integer details: description: >- A list of messages that carry the error details. There is a common set of message types for APIs to use. items: $ref: '#/components/schemas/googleprotobufAny' type: array message: description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. type: string type: object v1Meta: description: Common fields for all Endor Labs resources. properties: annotations: additionalProperties: type: string description: >- Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. type: object create_time: description: |- Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string created_by: description: |- Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. readOnly: true type: string description: description: Resource description. Must be less than 1024 bytes. type: string index_data: $ref: '#/components/schemas/v1IndexData' kind: description: >- Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). readOnly: true type: string name: description: Resource name. Must be 63 characters or less. type: string parent_kind: description: Parent object resource kind, for example, Project. type: string parent_uuid: description: Parent object UUID. type: string references: additionalProperties: $ref: '#/components/schemas/googleprotobufAny' description: Map of objects referenced in a query API. readOnly: true type: object tags: description: >- List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. items: type: string type: array update_time: description: |- Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string updated_by: description: >- Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. readOnly: true type: string upsert_time: description: |- Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string version: description: Message version. readOnly: true type: string required: - name type: object v1QuerySpec: properties: query_response: $ref: '#/components/schemas/googleprotobufAny' query_spec: $ref: '#/components/schemas/QueryQuerySpec' type: object v1TenantMeta: description: Tenant related data for the tenant containing the resource. properties: namespace: description: >- Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". type: string required: - namespace type: object googleprotobufAny: additionalProperties: {} description: >- `Any` contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message. Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type. Example 1: Pack and unpack a message in C++. Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo)) { ... } Example 2: Pack and unpack a message in Java. Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) { foo = any.unpack(Foo.class); } // or ... if (any.isSameTypeAs(Foo.getDefaultInstance())) { foo = any.unpack(Foo.getDefaultInstance()); } Example 3: Pack and unpack a message in Python. foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ... Example 4: Pack and unpack a message in Go foo := &pb.Foo{...} any, err := anypb.New(foo) if err != nil { ... } ... foo := &pb.Foo{} if err := any.UnmarshalTo(foo); err != nil { ... } The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z". JSON ==== The JSON representation of an `Any` value uses the regular representation of the deserialized, embedded message, with an additional field `@type` which contains the type URL. Example: package google.profile; message Person { string first_name = 1; string last_name = 2; } { "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": } If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field `value` which holds the custom JSON in addition to the `@type` field. Example (for message [google.protobuf.Duration][]): { "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" } properties: '@type': description: >- A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics. type: string type: object v1IndexData: description: |- IndexData is used to index the resource for search. It's an internal object. properties: data: items: type: string readOnly: true type: array search_score: description: >- search_score is the score of the resource for search. Internal use only. format: float readOnly: true type: number tenant: readOnly: true type: string will_be_deleted_at: description: Time that the resource will be deleted. format: date-time readOnly: true type: string type: object QueryQuerySpec: properties: kind: description: The parent object kind of the metric. type: string list_parameters: $ref: '#/components/schemas/v1ListParameters' references: items: $ref: '#/components/schemas/v1QueryReference' type: array return_as: description: |- Determines the alias name for reference that should be returned. If not specified, the value of kind is used. This field can be used to query a same kind several times. For instance, you can use this field to list and do a count on a same kind. type: string with: description: >- A list of join filters that identify the kind + filter of the other collections that should be joined. For example, if we are looking for projects that are also have repositories with specific attributes, we can use "with" : [{ "Kind" : "Repository", "Filter" : "filter for the repository", }] With is only available for the PackageVersion and Project resource kinds at this time. items: $ref: '#/components/schemas/QueryJoinFilters' type: array required: - kind type: object v1ListParameters: description: Parameters for a list request. properties: action: description: >- Action to be executed with a request. Not supported for all endpoints. type: string ci_run_uuid: description: Only return objects from PR scans that match this context id. type: string count: description: |- Return the number of objects matching the given list parameters. If count is set to true, the response is a CountResponse. Can be used together with filter and traverse. type: boolean disable_pagination: description: |- If true, the results will not be paginated and only the first page will be returned. The order of the results is not guaranteed. type: boolean filter: description: >- String of conditions to filter resources by. Filters may include any attribute along with the following operators: "==", "!=", ">", ">=", "<", "<=", "Contains", "In", "Matches", and "Exists". The logical operators "And" and "Or" are also supported. Expressions may be combined and grouped with parentheses. Examples: "spec.value == 5", "spec.value in ["a", "b", "c"]", "(meta.name == "xyz" and "spec.value in ["a","b"]) or (spec.value == "c")". type: string group: $ref: '#/components/schemas/ListParametersGroup' group_by_time: $ref: '#/components/schemas/ListParametersGroupByTime' mask: description: List of fields to return (all fields are returned by default). type: string page_id: description: Page ID to retrieve. type: string page_size: description: |- Set the page size to limit the number of results returned. Default: 100. Max: 500. format: int32 type: integer page_token: description: |- Set the page token to start from. Use page tokens to page through list results or list specific pages. format: int32 type: integer search_query: $ref: '#/components/schemas/v1SearchQuery' sort: $ref: '#/components/schemas/ListParametersSortEntry' traverse: description: Get data from any child namespaces as well. type: boolean type: object v1QueryReference: properties: connect_from: description: The parent field from which we are connecting. If emtpy, it is UUID. type: string connect_operator: description: |- The operation that should be used to connect parent and child. If empty it is the equal operator. Only supporting scalar value operators at this time. type: string connect_to: description: The child field to connect to. If empty, it is parent_uuid. type: string query_spec: $ref: '#/components/schemas/QueryQuerySpec' type: object QueryJoinFilters: properties: filter: type: string kind: type: string required: - kind type: object ListParametersGroup: description: Contains the group parameters. properties: aggregation_paths: description: |- Group the objects based on this field. If there are multiple fields then the objects are grouped based on the uniqueness of all fields. Supports composite paths. Supports arrays and maps. type: string show_aggregation_uuids: description: |- Return the UUID of each object in each group as specified by aggregation_paths. type: boolean unique_count_paths: description: |- List of fields for which we want the unique count. Supports arrays and maps. type: string unique_value_paths: description: |- List of fields for which we want the unique values. Supports arrays and maps. type: string type: object ListParametersGroupByTime: description: Contains the group_by_time parameters. properties: aggregation_operator: title: |- The aggreation_operator is the operator that we should use for the aggregation. Allowed values are: min, max, sum, avg type: string aggregation_paths: description: |- Group the objects based on this time field, for example, meta.create_time. type: string aggregation_value_field: title: >- The aggregation_field is a field on the matched objects that we want to perform some operation in each interval (example : min, max, avg) type: string end_time: description: |- End of the time period to group objects. Defaults to the current time. format: date-time type: string group_size: description: |- Size of the time interval to group the objects by, for example, to group objects by 2-week intervals, set interval to GROUP_BY_TIME_INTERVAL_WEEK and group_size to 2. format: int32 type: integer interval: $ref: '#/components/schemas/GroupByTimeGroupByTimeInterval' mode: description: >- The mode determines how the matching objects are counted in the produced time-series. Values allowed are: count (default) : is the number of items matching in every interval. sum: is the total number of items matching since the beginning of the aggregation time. type: string show_aggregation_uuids: description: Return the UUIDs of the objects in each group. type: boolean start_time: description: |- Beginning of the time period to group objects. Defaults to the beginning of time. format: date-time type: string type: object v1SearchQuery: description: SearchQuery is the top level message for search queries. properties: filters: description: filters are used to filter the results. items: $ref: '#/components/schemas/v1SearchClause' type: array must: description: must clauses must be satisfied. items: $ref: '#/components/schemas/v1SearchClause' type: array must_not: description: must_not clauses must not be satisfied for a result to be returned. items: $ref: '#/components/schemas/v1SearchClause' type: array should: description: |- should clauses should be satisfied for a result to be returned. Mainly used for partial matching. items: $ref: '#/components/schemas/v1SearchClause' type: array type: object ListParametersSortEntry: description: Contains the sort parameters. properties: order: $ref: '#/components/schemas/SortEntrySortEntryOrder' path: description: Field to sort objects by, for example, meta.name. type: string type: object GroupByTimeGroupByTimeInterval: default: GROUP_BY_TIME_INTERVAL_UNSPECIFIED enum: - GROUP_BY_TIME_INTERVAL_UNSPECIFIED - GROUP_BY_TIME_INTERVAL_YEAR - GROUP_BY_TIME_INTERVAL_QUARTER - GROUP_BY_TIME_INTERVAL_MONTH - GROUP_BY_TIME_INTERVAL_WEEK - GROUP_BY_TIME_INTERVAL_DAY - GROUP_BY_TIME_INTERVAL_HOUR - GROUP_BY_TIME_INTERVAL_MINUTE - GROUP_BY_TIME_INTERVAL_SECOND type: string v1SearchClause: description: SearchClause defines the search criteria. properties: autocomplete: $ref: '#/components/schemas/v1SearchClauseAutocomplete' compound: $ref: '#/components/schemas/v1SearchQuery' equals: $ref: '#/components/schemas/v1SearchClauseEquals' in: $ref: '#/components/schemas/v1SearchClauseIn' phrase: $ref: '#/components/schemas/v1SearchClausePhrase' query_string: $ref: '#/components/schemas/v1SearchClauseQueryString' range: $ref: '#/components/schemas/v1SearchClauseRange' regex: $ref: '#/components/schemas/v1SearchClauseRegex' text: $ref: '#/components/schemas/v1SearchClauseText' wildcard: $ref: '#/components/schemas/v1SearchClauseWildcard' type: object SortEntrySortEntryOrder: default: SORT_ENTRY_ORDER_UNSPECIFIED enum: - SORT_ENTRY_ORDER_UNSPECIFIED - SORT_ENTRY_ORDER_ASC - SORT_ENTRY_ORDER_DESC type: string v1SearchClauseAutocomplete: description: Search clause for the autocomplete operator. properties: fuzzy: $ref: '#/components/schemas/v1Fuzzy' path: type: string query: type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' token_order: title: '"sequential" or "any"' type: string required: - path - query type: object v1SearchClauseEquals: description: Search clause for equals operator. Field must be indexed as token. properties: path: description: The path to the field to search. type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' value: $ref: '#/components/schemas/v1SearchValue' required: - path - value type: object v1SearchClauseIn: description: Search clause for in operator. Field must be indexed as token. properties: path: type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' values: items: $ref: '#/components/schemas/v1SearchValue' type: array required: - path - values type: object v1SearchClausePhrase: description: Search clause for phrase operator. Field must be indexed as text. properties: path: type: string query: type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' required: - path - query type: object v1SearchClauseQueryString: description: Search clause for query string operator. Field must be indexed as text. properties: path: type: string query: type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' required: - path - query type: object v1SearchClauseRange: description: Search clause for the range operator. Field must be indexed as number. properties: gt: $ref: '#/components/schemas/v1SearchValue' gte: $ref: '#/components/schemas/v1SearchValue' lt: $ref: '#/components/schemas/v1SearchValue' lte: $ref: '#/components/schemas/v1SearchValue' path: type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' required: - path type: object v1SearchClauseRegex: description: Regex is used to search for a string that matches a regular expression. properties: allow_analyzed: description: 'Default: false.' type: boolean path: type: string query: type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' required: - path - query type: object v1SearchClauseText: description: Search clause for text operator. Field must be indexed as text. properties: full_match: description: 'Default: false.' type: boolean fuzzy: $ref: '#/components/schemas/v1Fuzzy' path: description: The path to the field to search. type: string query: description: The text to search for. type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' required: - path - query type: object v1SearchClauseWildcard: description: Search clause for the wildcard operator. properties: allow_analyzed: description: 'Default: false.' type: boolean path: type: string query: type: string score_options: $ref: '#/components/schemas/v1ScoreOptions' required: - path - query type: object v1Fuzzy: description: |- Fuzzy is used to search for a similar string. Parameters determine the deviation. properties: max_edits: format: int32 type: integer max_expansion: format: int32 type: integer prefix_length: format: int32 type: integer score_options: $ref: '#/components/schemas/v1ScoreOptions' type: object v1ScoreOptions: description: >- ScoreOptions is used to score the result and potentially adjust the score. properties: boost: description: boost is used to boost the score of the result. format: float type: number constant: description: constant is to used to replace the score of the result. format: float type: number type: object v1SearchValue: description: Search value is used to search for a value. This needs to be typed. properties: bool_value: type: boolean double_value: format: double type: number int64_value: format: int64 type: string string_value: type: string timestamp_value: format: date-time type: string type: object ````