https://github.com/osquery/osquery logo
#fleet
Title
# fleet
r

Rajesh Kumar

05/23/2023, 7:10 PM
Hi everyone, glad to be here. I have a question. I am trying to run a live query using rest API. But I am getting error 400. I am making a request to https://internal_fleet_instance/api/v1/fleet/queries/run and my payload is
Copy code
{
  "query_ids": [
    "<<create_query.body.query.id>>"
  ],
  "host_ids": [
    "<<get_hosts.body.host.id>>"
  ]
}
And error message is -
"name": "base", "reason":"Expected JSON Body"
. I do have correct host id and query id but the result says json body is needed I have even tried with hard coded values in payload but live query api call is failing for me. Has anyone any insights on what am I missing here?
Tried by hard coding my query ID and even host id. and the query exists in fleet (cross checked from UI as well)