Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I noticed the latest FleetDM API docs have changed how running a live query works.  There is no mention of using the websocket connection to get results.  Is the websocket method being depreciated?

Hi David! The method of running live queries via websockets still exists (used by the Fleet UI). The new non-websocket approach was added so that people could easily run live queries with e.g. curl command. Can you point me to the documentation? We can take a look and see if it needs updating

<https://fleetdm.com/docs/using-fleet/rest-api#run-live-query>

My PowerShell modules for FleetDM uses websockets and the previous syntax to start the queries via the /queries/run API call, it all still works, just didn't want to be caught off guard if that was going to change.

```$Header = @{'Authorization'="Bearer " + $Session.Token}
    Write-Verbose $Header.Authorization

    $Body = (@{'query'="$Query";'selected'=@{'hosts'=$Hosts;'labels'=$Labels}} | ConvertTo-Json -Compress)
    Write-Verbose $Body

    $ComputerFullURI = ($Session.ServerHTTP + '/queries/run')
    Write-Verbose $ComputerFullURI

    $QueryID = Invoke-RestMethod -Method 'POST' -ContentType 'application/json' -Uri $ComputerFullURI -Headers $Header -Body $Body
    Write-Verbose $QueryID
    
    If ($null -eq $QueryID) {Return $null}```


No need to worry, websocket API is not going away. I've found the docs: <https://github.com/fleetdm/fleet/blob/main/docs/03-Contributing/07-API-for-contributors.md#retrieve-live-query-results-standard-websocket-api>

I'll talk with the team about adding the websocket API to the main docs.

Also, the difference is in the method:
• `POST /api/v1/fleet/queries/run` is the websocket API.
• `GET /api/v1/fleet/queries/run`  is the new synchronous (non-websocket) API.

<https://github.com/fleetdm/fleet/issues/3512>
Added your comment as quote. Thank you for catching this!