RSQL Filtering
Collection and export endpoints support RSQL (REST structured query language) based data filtration. This provides a powerful way to surface data of interest.
Tip: While leading or trailing wildcards are generally supported, do not use surrounding wildcard filters (e.g. *...*). This style of API query is not officially supported, and in select locations where it returns results it is likely to perform poorly, and may trigger API rate limiting or restrictions.
For automation and agents: Prefer explicit predicates, small time ranges, and export endpoints for large datasets rather than unbounded scan-style filters across collection pages. Leverage audit_created>={last_export_timestamp} style RSQL filters to obtain deltas since the last extraction.
Search Type | Operator | Examples |
Equal | == |
|
Not Equal | != |
|
Wildcard | == |
|
Greater Than | > |
|
Greater Than or Equal | >= |
|
Less Than | < |
|
Less Than or Equal | <= |
|
In | =in= |
|
Not In | =out= |
|
Null | =isnull= |
|
Not Null | =notnull= |
|
Conjunctions | N/A |
|
Precedence | N/A |
|
Error Handling
A malformed RSQL filter is expected to throw a 400 Bad Request, with error context MX.InvalidCollectionFilter, e.g.:
{
"timestamp": "2020-01-06T15:03:47.106+0000",
"status": 400,
"error": "Bad Request",
"message": "MX.InvalidCollectionFilter",
"path": "/v1/enterprise/d6288400-3f2e-4a28-9c9a-ab4c9d7a6eff/agent-file"
}