For the complete documentation index, see llms.txt. This page is also available as Markdown.

Widgets

APIs for managing widgets

Reset ROI widget

delete

Reset ROI widget

Authorizations
AuthorizationstringRequired
Responses
200

ROI widget has been reset

No content

delete/statistics/application/roi
DELETE /statistics/application/roi HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200

ROI widget has been reset

No content

[Deprecated] Get Widget Statistics

post

Get a given widget object statistics result. Note: This route has many return types based on the widget type and data. Each 200X represent a 200 OK request of specific widget type and data

Deprecated - use "/v2/statistics/widgets/query

Authorizations
AuthorizationstringRequired
Responses
200

Response differ according to the widget type

  • Incident data type of a "table" or "list" widget returns incidentSearchResponse total: type: integer data: type: array items: "$ref": "#/definitions/Incident" - Indicators data type of a "table" or "list" widget returns IoCsResponse total: type: integer data: type: array items: "$ref": "#/definitions/IocObject" - Number widget returns a simple number type: integer - Trend widget returns a trend object "$ref": "#/definitions/StatsTrendsResponse" - Text widget returns a text object, describing the final text and the placeholders values. "$ref": "#/definitions/StatsTextResponse" - A chart data array by groups. When requesting a date, the key is the date string, according to the specified time frame. Empty groups (dates) are also returned. type: array items: "$ref": "#/definitions/Group"
application/json
objectOptional
post/statistics/widgets/query
POST /statistics/widgets/query HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200

Response differ according to the widget type

  • Incident data type of a "table" or "list" widget returns incidentSearchResponse total: type: integer data: type: array items: "$ref": "#/definitions/Incident" - Indicators data type of a "table" or "list" widget returns IoCsResponse total: type: integer data: type: array items: "$ref": "#/definitions/IocObject" - Number widget returns a simple number type: integer - Trend widget returns a trend object "$ref": "#/definitions/StatsTrendsResponse" - Text widget returns a text object, describing the final text and the placeholders values. "$ref": "#/definitions/StatsTextResponse" - A chart data array by groups. When requesting a date, the key is the date string, according to the specified time frame. Empty groups (dates) are also returned. type: array items: "$ref": "#/definitions/Group"
{}

Get Widget Statistics

post

Get the statistics for the specified widget. Note: This endpoint has many return types depending on the widget type and data. Each 200X represents a 200 OK request of specific widget type and data.

Authorizations
AuthorizationstringRequired
Body
idstringOptional
namestringOptional
dataTypestringOptional
widgetTypestringOptional
querystringOptional
categorystringOptional
Responses
200

Response differ according to the widget type

  • Incident data type of a "table" or "list" widget returns incidentSearchResponse total: type: integer data: type: array items: "$ref": "#/definitions/Incident" - Indicators data type of a "table" or "list" widget returns IoCsResponse total: type: integer data: type: array items: "$ref": "#/definitions/IocObject" - Number widget returns a simple number type: integer - Trend widget returns a trend object "$ref": "#/definitions/StatsTrendsResponse" - Text widget returns a text object, describing the final text and the placeholders values. "$ref": "#/definitions/StatsTextResponse" - Line chart widget or Column chart widget returns StatsResponseWithReferenceLine "$ref": "#/definitions/StatsResponseWithReferenceLine" - A chart data array by groups. When requesting a date, the key is the date string, according to the specified time frame. Empty groups (dates) are also returned. type: array items: "$ref": "#/definitions/Group"
application/json
objectOptional
post/v2/statistics/widgets/query
POST /v2/statistics/widgets/query HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 176

{
  "id": "text",
  "name": "text",
  "dataType": "text",
  "widgetType": "text",
  "query": "text",
  "dateRange": {
    "fromDate": "text",
    "toDate": "text"
  },
  "params": {
    "groupBy": [
      "text"
    ]
  },
  "category": "text"
}
200

Response differ according to the widget type

  • Incident data type of a "table" or "list" widget returns incidentSearchResponse total: type: integer data: type: array items: "$ref": "#/definitions/Incident" - Indicators data type of a "table" or "list" widget returns IoCsResponse total: type: integer data: type: array items: "$ref": "#/definitions/IocObject" - Number widget returns a simple number type: integer - Trend widget returns a trend object "$ref": "#/definitions/StatsTrendsResponse" - Text widget returns a text object, describing the final text and the placeholders values. "$ref": "#/definitions/StatsTextResponse" - Line chart widget or Column chart widget returns StatsResponseWithReferenceLine "$ref": "#/definitions/StatsResponseWithReferenceLine" - A chart data array by groups. When requesting a date, the key is the date string, according to the specified time frame. Empty groups (dates) are also returned. type: array items: "$ref": "#/definitions/Group"
{}
get

Get all widgets

Authorizations
AuthorizationstringRequired
Responses
200

Return all the widgets in the system.

application/json

Widget describe a widget component used to get statistics requests, based on parameters such as dataType and widgetType. A widget can be a part of widgets collection inside a dashboard.

cacheVersninteger · int64Optional
categorystringOptional

Category the widget is related to. Used to display in widget library under category or dataType if empty.

commitMessagestringOptional
createdstring · date-timeOptional
dataTypestringOptional

Data type of the widget. Describes what data does the widget query. supporting data types "incidents","messages","system","entries","tasks", "audit".

definitionIdstringOptional
descriptionstringOptional

The description of the widget's usage and data representation.

idstringOptional
ignoreWorkersbooleanOptional

Do not use workers mechanism while searching bleve

indexNamestringOptional
isPredefinedbooleanOptional

Is the widget a system widget.

lockedbooleanOptional

Is the widget locked for editing.

modifiedstring · date-timeOptional
namestringRequired

Default name of the widget.

numericIdinteger · int64Optional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
pageinteger · int64Optional

0-based page

prevNamestringOptional

The previous name of the widget.

primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
querystringOptional

Query to search on the dataType.

remotebooleanOptional
searchAfterstring[]Optional

Efficient next page, pass max sort value from previous page

searchAfterElasticstring[]Optional

Efficient next page, pass max ES sort value from previous page

searchBeforestring[]Optional

Efficient prev page, pass min sort value from next page

searchBeforeElasticstring[]Optional

Efficient prev page, pass min ES sort value from next page

sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeinteger · int64Optional

Size is limited to 1000, if not passed it defaults to 0, and no results will return

sizeInBytesinteger · int64Optional
skipAggregateAccountsbooleanOptional

SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results

sortValuesstring[]Optional
syncHashstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
widgetTypestringRequired

Widget type describes how does the widget should recieve the data, and display it. Supporting types: "bar", "column", "pie", "list", "number", "trend", "text", "duration", "image", "line", and "table".

get/widgets
GET /widgets HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200

Return all the widgets in the system.

[
  {
    "Cache": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "accounts": {
      "ANY_ADDITIONAL_PROPERTY": {}
    },
    "cacheVersn": 1,
    "category": "text",
    "commitMessage": "text",
    "created": "2026-01-01T00:00:00.000Z",
    "dataType": "text",
    "dateRange": {
      "fromDate": "2026-01-01T00:00:00.000Z",
      "fromDateLicense": "2026-01-01T00:00:00.000Z",
      "period": {
        "by": "text",
        "byFrom": "text",
        "byTo": "text",
        "field": "text",
        "fromValue": "text",
        "toValue": "text"
      },
      "toDate": "2026-01-01T00:00:00.000Z"
    },
    "definition": {
      "auditable": true,
      "cacheVersn": 1,
      "commitMessage": "text",
      "created": "2026-01-01T00:00:00.000Z",
      "definitionId": "text",
      "fromServerVersion": {
        "Digits": [
          1
        ],
        "Label": "text"
      },
      "highlight": {
        "ANY_ADDITIONAL_PROPERTY": [
          "text"
        ]
      },
      "id": "text",
      "indexName": "text",
      "itemVersion": {
        "Digits": [
          1
        ],
        "Label": "text"
      },
      "locked": true,
      "modified": "2026-01-01T00:00:00.000Z",
      "name": "text",
      "numericId": 1,
      "packID": "text",
      "packName": "text",
      "packPropagationLabels": [
        "text"
      ],
      "partitioned": true,
      "pluralName": "text",
      "prevName": "text",
      "primaryTerm": 1,
      "propagationLabels": [
        "text"
      ],
      "rbacSupport": true,
      "remote": true,
      "sequenceNumber": 1,
      "shouldCommit": true,
      "sizeInBytes": 1,
      "sortValues": [
        "text"
      ],
      "syncHash": "text",
      "system": true,
      "toServerVersion": {
        "Digits": [
          1
        ],
        "Label": "text"
      },
      "vcShouldIgnore": true,
      "vcShouldKeepItemLegacyProdMachine": true,
      "version": 1
    },
    "definitionId": "text",
    "description": "text",
    "fromServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "highlight": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "id": "text",
    "ignoreWorkers": true,
    "indexName": "text",
    "isPredefined": true,
    "itemVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "locked": true,
    "modified": "2026-01-01T00:00:00.000Z",
    "name": "text",
    "numericId": 1,
    "packID": "text",
    "packName": "text",
    "packPropagationLabels": [
      "text"
    ],
    "page": 1,
    "params": {
      "ANY_ADDITIONAL_PROPERTY": {}
    },
    "prevName": "text",
    "primaryTerm": 1,
    "propagationLabels": [
      "text"
    ],
    "query": "text",
    "remote": true,
    "searchAfter": [
      "text"
    ],
    "searchAfterElastic": [
      "text"
    ],
    "searchAfterMap": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "searchAfterMapOrder": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "searchBefore": [
      "text"
    ],
    "searchBeforeElastic": [
      "text"
    ],
    "sequenceNumber": 1,
    "shouldCommit": true,
    "size": 1,
    "sizeInBytes": 1,
    "skipAggregateAccounts": true,
    "sort": [
      {
        "asc": true,
        "field": "text",
        "fieldType": "text"
      }
    ],
    "sortValues": [
      "text"
    ],
    "syncHash": "text",
    "toServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "vcShouldIgnore": true,
    "vcShouldKeepItemLegacyProdMachine": true,
    "version": 1,
    "widgetType": "text"
  }
]

Add or update a widget

post

Add or update a given widget based on Id.

Authorizations
AuthorizationstringRequired
Body

Widget describe a widget component used to get statistics requests, based on parameters such as dataType and widgetType. A widget can be a part of widgets collection inside a dashboard.

cacheVersninteger · int64Optional
categorystringOptional

Category the widget is related to. Used to display in widget library under category or dataType if empty.

commitMessagestringOptional
createdstring · date-timeOptional
dataTypestringOptional

Data type of the widget. Describes what data does the widget query. supporting data types "incidents","messages","system","entries","tasks", "audit".

definitionIdstringOptional
descriptionstringOptional

The description of the widget's usage and data representation.

idstringOptional
ignoreWorkersbooleanOptional

Do not use workers mechanism while searching bleve

indexNamestringOptional
isPredefinedbooleanOptional

Is the widget a system widget.

lockedbooleanOptional

Is the widget locked for editing.

modifiedstring · date-timeOptional
namestringRequired

Default name of the widget.

numericIdinteger · int64Optional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
pageinteger · int64Optional

0-based page

prevNamestringOptional

The previous name of the widget.

primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
querystringOptional

Query to search on the dataType.

remotebooleanOptional
searchAfterstring[]Optional

Efficient next page, pass max sort value from previous page

searchAfterElasticstring[]Optional

Efficient next page, pass max ES sort value from previous page

searchBeforestring[]Optional

Efficient prev page, pass min sort value from next page

searchBeforeElasticstring[]Optional

Efficient prev page, pass min ES sort value from next page

sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeinteger · int64Optional

Size is limited to 1000, if not passed it defaults to 0, and no results will return

sizeInBytesinteger · int64Optional
skipAggregateAccountsbooleanOptional

SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results

sortValuesstring[]Optional
syncHashstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
widgetTypestringRequired

Widget type describes how does the widget should recieve the data, and display it. Supporting types: "bar", "column", "pie", "list", "number", "trend", "text", "duration", "image", "line", and "table".

Responses
200

The saved widget newest version.

application/json

Widget describe a widget component used to get statistics requests, based on parameters such as dataType and widgetType. A widget can be a part of widgets collection inside a dashboard.

cacheVersninteger · int64Optional
categorystringOptional

Category the widget is related to. Used to display in widget library under category or dataType if empty.

commitMessagestringOptional
createdstring · date-timeOptional
dataTypestringOptional

Data type of the widget. Describes what data does the widget query. supporting data types "incidents","messages","system","entries","tasks", "audit".

definitionIdstringOptional
descriptionstringOptional

The description of the widget's usage and data representation.

idstringOptional
ignoreWorkersbooleanOptional

Do not use workers mechanism while searching bleve

indexNamestringOptional
isPredefinedbooleanOptional

Is the widget a system widget.

lockedbooleanOptional

Is the widget locked for editing.

modifiedstring · date-timeOptional
namestringRequired

Default name of the widget.

numericIdinteger · int64Optional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
pageinteger · int64Optional

0-based page

prevNamestringOptional

The previous name of the widget.

primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
querystringOptional

Query to search on the dataType.

remotebooleanOptional
searchAfterstring[]Optional

Efficient next page, pass max sort value from previous page

searchAfterElasticstring[]Optional

Efficient next page, pass max ES sort value from previous page

searchBeforestring[]Optional

Efficient prev page, pass min sort value from next page

searchBeforeElasticstring[]Optional

Efficient prev page, pass min ES sort value from next page

sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeinteger · int64Optional

Size is limited to 1000, if not passed it defaults to 0, and no results will return

sizeInBytesinteger · int64Optional
skipAggregateAccountsbooleanOptional

SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results

sortValuesstring[]Optional
syncHashstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
widgetTypestringRequired

Widget type describes how does the widget should recieve the data, and display it. Supporting types: "bar", "column", "pie", "list", "number", "trend", "text", "duration", "image", "line", and "table".

post/widgets
POST /widgets HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 2345

{
  "Cache": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "accounts": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "cacheVersn": 1,
  "category": "text",
  "commitMessage": "text",
  "created": "2026-01-01T00:00:00.000Z",
  "dataType": "text",
  "dateRange": {
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "toDate": "2026-01-01T00:00:00.000Z"
  },
  "definition": {
    "auditable": true,
    "cacheVersn": 1,
    "commitMessage": "text",
    "created": "2026-01-01T00:00:00.000Z",
    "definitionId": "text",
    "fromServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "highlight": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "id": "text",
    "indexName": "text",
    "itemVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "locked": true,
    "modified": "2026-01-01T00:00:00.000Z",
    "name": "text",
    "numericId": 1,
    "packID": "text",
    "packName": "text",
    "packPropagationLabels": [
      "text"
    ],
    "partitioned": true,
    "pluralName": "text",
    "prevName": "text",
    "primaryTerm": 1,
    "propagationLabels": [
      "text"
    ],
    "rbacSupport": true,
    "remote": true,
    "sequenceNumber": 1,
    "shouldCommit": true,
    "sizeInBytes": 1,
    "sortValues": [
      "text"
    ],
    "syncHash": "text",
    "system": true,
    "toServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "vcShouldIgnore": true,
    "vcShouldKeepItemLegacyProdMachine": true,
    "version": 1
  },
  "definitionId": "text",
  "description": "text",
  "fromServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "highlight": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "id": "text",
  "ignoreWorkers": true,
  "indexName": "text",
  "isPredefined": true,
  "itemVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "locked": true,
  "modified": "2026-01-01T00:00:00.000Z",
  "name": "text",
  "numericId": 1,
  "packID": "text",
  "packName": "text",
  "packPropagationLabels": [
    "text"
  ],
  "page": 1,
  "params": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "prevName": "text",
  "primaryTerm": 1,
  "propagationLabels": [
    "text"
  ],
  "query": "text",
  "remote": true,
  "searchAfter": [
    "text"
  ],
  "searchAfterElastic": [
    "text"
  ],
  "searchAfterMap": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "searchAfterMapOrder": {
    "ANY_ADDITIONAL_PROPERTY": 1
  },
  "searchBefore": [
    "text"
  ],
  "searchBeforeElastic": [
    "text"
  ],
  "sequenceNumber": 1,
  "shouldCommit": true,
  "size": 1,
  "sizeInBytes": 1,
  "skipAggregateAccounts": true,
  "sort": [
    {
      "asc": true,
      "field": "text",
      "fieldType": "text"
    }
  ],
  "sortValues": [
    "text"
  ],
  "syncHash": "text",
  "toServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "vcShouldIgnore": true,
  "vcShouldKeepItemLegacyProdMachine": true,
  "version": 1,
  "widgetType": "text"
}
200

The saved widget newest version.

{
  "Cache": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "accounts": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "cacheVersn": 1,
  "category": "text",
  "commitMessage": "text",
  "created": "2026-01-01T00:00:00.000Z",
  "dataType": "text",
  "dateRange": {
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "toDate": "2026-01-01T00:00:00.000Z"
  },
  "definition": {
    "auditable": true,
    "cacheVersn": 1,
    "commitMessage": "text",
    "created": "2026-01-01T00:00:00.000Z",
    "definitionId": "text",
    "fromServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "highlight": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "id": "text",
    "indexName": "text",
    "itemVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "locked": true,
    "modified": "2026-01-01T00:00:00.000Z",
    "name": "text",
    "numericId": 1,
    "packID": "text",
    "packName": "text",
    "packPropagationLabels": [
      "text"
    ],
    "partitioned": true,
    "pluralName": "text",
    "prevName": "text",
    "primaryTerm": 1,
    "propagationLabels": [
      "text"
    ],
    "rbacSupport": true,
    "remote": true,
    "sequenceNumber": 1,
    "shouldCommit": true,
    "sizeInBytes": 1,
    "sortValues": [
      "text"
    ],
    "syncHash": "text",
    "system": true,
    "toServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "vcShouldIgnore": true,
    "vcShouldKeepItemLegacyProdMachine": true,
    "version": 1
  },
  "definitionId": "text",
  "description": "text",
  "fromServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "highlight": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "id": "text",
  "ignoreWorkers": true,
  "indexName": "text",
  "isPredefined": true,
  "itemVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "locked": true,
  "modified": "2026-01-01T00:00:00.000Z",
  "name": "text",
  "numericId": 1,
  "packID": "text",
  "packName": "text",
  "packPropagationLabels": [
    "text"
  ],
  "page": 1,
  "params": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "prevName": "text",
  "primaryTerm": 1,
  "propagationLabels": [
    "text"
  ],
  "query": "text",
  "remote": true,
  "searchAfter": [
    "text"
  ],
  "searchAfterElastic": [
    "text"
  ],
  "searchAfterMap": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "searchAfterMapOrder": {
    "ANY_ADDITIONAL_PROPERTY": 1
  },
  "searchBefore": [
    "text"
  ],
  "searchBeforeElastic": [
    "text"
  ],
  "sequenceNumber": 1,
  "shouldCommit": true,
  "size": 1,
  "sizeInBytes": 1,
  "skipAggregateAccounts": true,
  "sort": [
    {
      "asc": true,
      "field": "text",
      "fieldType": "text"
    }
  ],
  "sortValues": [
    "text"
  ],
  "syncHash": "text",
  "toServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "vcShouldIgnore": true,
  "vcShouldKeepItemLegacyProdMachine": true,
  "version": 1,
  "widgetType": "text"
}

Import a widget

post

Import a widget to the system, ignoring ID or version, used to import new widgets.

Authorizations
AuthorizationstringRequired
Body
filestringOptional

The JSON file of the widget to import.

Responses
200

The saved widget

application/json

Widget describe a widget component used to get statistics requests, based on parameters such as dataType and widgetType. A widget can be a part of widgets collection inside a dashboard.

cacheVersninteger · int64Optional
categorystringOptional

Category the widget is related to. Used to display in widget library under category or dataType if empty.

commitMessagestringOptional
createdstring · date-timeOptional
dataTypestringOptional

Data type of the widget. Describes what data does the widget query. supporting data types "incidents","messages","system","entries","tasks", "audit".

definitionIdstringOptional
descriptionstringOptional

The description of the widget's usage and data representation.

idstringOptional
ignoreWorkersbooleanOptional

Do not use workers mechanism while searching bleve

indexNamestringOptional
isPredefinedbooleanOptional

Is the widget a system widget.

lockedbooleanOptional

Is the widget locked for editing.

modifiedstring · date-timeOptional
namestringRequired

Default name of the widget.

numericIdinteger · int64Optional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
pageinteger · int64Optional

0-based page

prevNamestringOptional

The previous name of the widget.

primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
querystringOptional

Query to search on the dataType.

remotebooleanOptional
searchAfterstring[]Optional

Efficient next page, pass max sort value from previous page

searchAfterElasticstring[]Optional

Efficient next page, pass max ES sort value from previous page

searchBeforestring[]Optional

Efficient prev page, pass min sort value from next page

searchBeforeElasticstring[]Optional

Efficient prev page, pass min ES sort value from next page

sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeinteger · int64Optional

Size is limited to 1000, if not passed it defaults to 0, and no results will return

sizeInBytesinteger · int64Optional
skipAggregateAccountsbooleanOptional

SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results

sortValuesstring[]Optional
syncHashstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
widgetTypestringRequired

Widget type describes how does the widget should recieve the data, and display it. Supporting types: "bar", "column", "pie", "list", "number", "trend", "text", "duration", "image", "line", and "table".

post/widgets/import
POST /widgets/import HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: multipart/form-data
Accept: */*
Content-Length: 15

{
  "file": "text"
}
200

The saved widget

{
  "Cache": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "accounts": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "cacheVersn": 1,
  "category": "text",
  "commitMessage": "text",
  "created": "2026-01-01T00:00:00.000Z",
  "dataType": "text",
  "dateRange": {
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "toDate": "2026-01-01T00:00:00.000Z"
  },
  "definition": {
    "auditable": true,
    "cacheVersn": 1,
    "commitMessage": "text",
    "created": "2026-01-01T00:00:00.000Z",
    "definitionId": "text",
    "fromServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "highlight": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "id": "text",
    "indexName": "text",
    "itemVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "locked": true,
    "modified": "2026-01-01T00:00:00.000Z",
    "name": "text",
    "numericId": 1,
    "packID": "text",
    "packName": "text",
    "packPropagationLabels": [
      "text"
    ],
    "partitioned": true,
    "pluralName": "text",
    "prevName": "text",
    "primaryTerm": 1,
    "propagationLabels": [
      "text"
    ],
    "rbacSupport": true,
    "remote": true,
    "sequenceNumber": 1,
    "shouldCommit": true,
    "sizeInBytes": 1,
    "sortValues": [
      "text"
    ],
    "syncHash": "text",
    "system": true,
    "toServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "vcShouldIgnore": true,
    "vcShouldKeepItemLegacyProdMachine": true,
    "version": 1
  },
  "definitionId": "text",
  "description": "text",
  "fromServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "highlight": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "id": "text",
  "ignoreWorkers": true,
  "indexName": "text",
  "isPredefined": true,
  "itemVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "locked": true,
  "modified": "2026-01-01T00:00:00.000Z",
  "name": "text",
  "numericId": 1,
  "packID": "text",
  "packName": "text",
  "packPropagationLabels": [
    "text"
  ],
  "page": 1,
  "params": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "prevName": "text",
  "primaryTerm": 1,
  "propagationLabels": [
    "text"
  ],
  "query": "text",
  "remote": true,
  "searchAfter": [
    "text"
  ],
  "searchAfterElastic": [
    "text"
  ],
  "searchAfterMap": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "searchAfterMapOrder": {
    "ANY_ADDITIONAL_PROPERTY": 1
  },
  "searchBefore": [
    "text"
  ],
  "searchBeforeElastic": [
    "text"
  ],
  "sequenceNumber": 1,
  "shouldCommit": true,
  "size": 1,
  "sizeInBytes": 1,
  "skipAggregateAccounts": true,
  "sort": [
    {
      "asc": true,
      "field": "text",
      "fieldType": "text"
    }
  ],
  "sortValues": [
    "text"
  ],
  "syncHash": "text",
  "toServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "vcShouldIgnore": true,
  "vcShouldKeepItemLegacyProdMachine": true,
  "version": 1,
  "widgetType": "text"
}

Get widget by ID

get

Get a widget object by a given ID.

Authorizations
AuthorizationstringRequired
Path parameters
idstringRequired

The ID of widget to get.

Responses
200

Return the widget if found.

application/json

Widget describe a widget component used to get statistics requests, based on parameters such as dataType and widgetType. A widget can be a part of widgets collection inside a dashboard.

cacheVersninteger · int64Optional
categorystringOptional

Category the widget is related to. Used to display in widget library under category or dataType if empty.

commitMessagestringOptional
createdstring · date-timeOptional
dataTypestringOptional

Data type of the widget. Describes what data does the widget query. supporting data types "incidents","messages","system","entries","tasks", "audit".

definitionIdstringOptional
descriptionstringOptional

The description of the widget's usage and data representation.

idstringOptional
ignoreWorkersbooleanOptional

Do not use workers mechanism while searching bleve

indexNamestringOptional
isPredefinedbooleanOptional

Is the widget a system widget.

lockedbooleanOptional

Is the widget locked for editing.

modifiedstring · date-timeOptional
namestringRequired

Default name of the widget.

numericIdinteger · int64Optional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
pageinteger · int64Optional

0-based page

prevNamestringOptional

The previous name of the widget.

primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
querystringOptional

Query to search on the dataType.

remotebooleanOptional
searchAfterstring[]Optional

Efficient next page, pass max sort value from previous page

searchAfterElasticstring[]Optional

Efficient next page, pass max ES sort value from previous page

searchBeforestring[]Optional

Efficient prev page, pass min sort value from next page

searchBeforeElasticstring[]Optional

Efficient prev page, pass min ES sort value from next page

sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeinteger · int64Optional

Size is limited to 1000, if not passed it defaults to 0, and no results will return

sizeInBytesinteger · int64Optional
skipAggregateAccountsbooleanOptional

SkipAggregateAccounts flag that indicates whether to skip aggregate accounts results

sortValuesstring[]Optional
syncHashstringOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
widgetTypestringRequired

Widget type describes how does the widget should recieve the data, and display it. Supporting types: "bar", "column", "pie", "list", "number", "trend", "text", "duration", "image", "line", and "table".

get/widgets/{id}
GET /widgets/{id} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200

Return the widget if found.

{
  "Cache": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "accounts": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "cacheVersn": 1,
  "category": "text",
  "commitMessage": "text",
  "created": "2026-01-01T00:00:00.000Z",
  "dataType": "text",
  "dateRange": {
    "fromDate": "2026-01-01T00:00:00.000Z",
    "fromDateLicense": "2026-01-01T00:00:00.000Z",
    "period": {
      "by": "text",
      "byFrom": "text",
      "byTo": "text",
      "field": "text",
      "fromValue": "text",
      "toValue": "text"
    },
    "toDate": "2026-01-01T00:00:00.000Z"
  },
  "definition": {
    "auditable": true,
    "cacheVersn": 1,
    "commitMessage": "text",
    "created": "2026-01-01T00:00:00.000Z",
    "definitionId": "text",
    "fromServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "highlight": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    },
    "id": "text",
    "indexName": "text",
    "itemVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "locked": true,
    "modified": "2026-01-01T00:00:00.000Z",
    "name": "text",
    "numericId": 1,
    "packID": "text",
    "packName": "text",
    "packPropagationLabels": [
      "text"
    ],
    "partitioned": true,
    "pluralName": "text",
    "prevName": "text",
    "primaryTerm": 1,
    "propagationLabels": [
      "text"
    ],
    "rbacSupport": true,
    "remote": true,
    "sequenceNumber": 1,
    "shouldCommit": true,
    "sizeInBytes": 1,
    "sortValues": [
      "text"
    ],
    "syncHash": "text",
    "system": true,
    "toServerVersion": {
      "Digits": [
        1
      ],
      "Label": "text"
    },
    "vcShouldIgnore": true,
    "vcShouldKeepItemLegacyProdMachine": true,
    "version": 1
  },
  "definitionId": "text",
  "description": "text",
  "fromServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "highlight": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "id": "text",
  "ignoreWorkers": true,
  "indexName": "text",
  "isPredefined": true,
  "itemVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "locked": true,
  "modified": "2026-01-01T00:00:00.000Z",
  "name": "text",
  "numericId": 1,
  "packID": "text",
  "packName": "text",
  "packPropagationLabels": [
    "text"
  ],
  "page": 1,
  "params": {
    "ANY_ADDITIONAL_PROPERTY": {}
  },
  "prevName": "text",
  "primaryTerm": 1,
  "propagationLabels": [
    "text"
  ],
  "query": "text",
  "remote": true,
  "searchAfter": [
    "text"
  ],
  "searchAfterElastic": [
    "text"
  ],
  "searchAfterMap": {
    "ANY_ADDITIONAL_PROPERTY": [
      "text"
    ]
  },
  "searchAfterMapOrder": {
    "ANY_ADDITIONAL_PROPERTY": 1
  },
  "searchBefore": [
    "text"
  ],
  "searchBeforeElastic": [
    "text"
  ],
  "sequenceNumber": 1,
  "shouldCommit": true,
  "size": 1,
  "sizeInBytes": 1,
  "skipAggregateAccounts": true,
  "sort": [
    {
      "asc": true,
      "field": "text",
      "fieldType": "text"
    }
  ],
  "sortValues": [
    "text"
  ],
  "syncHash": "text",
  "toServerVersion": {
    "Digits": [
      1
    ],
    "Label": "text"
  },
  "vcShouldIgnore": true,
  "vcShouldKeepItemLegacyProdMachine": true,
  "version": 1,
  "widgetType": "text"
}

Remove existing widget

delete

Remove a given widget Id from the system.

Authorizations
AuthorizationstringRequired
Path parameters
idstringRequired

Widget id to remove (returned from widget save or widgets get)

Responses
200

widget deleted

No content

delete/widgets/{id}
DELETE /widgets/{id} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200

widget deleted

No content

Last updated

Was this helpful?