Add or update data in a lookup dataset.
When updating data, any field not specified in the data
field, but specified on at least one of the rows, will be set to None
.
You can send a maximum of 10 lookup API calls per second.
**Note: ** The maximum size of a lookup dataset is 50 MB. Attemping to exceed this limit will fail.
Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB
Authorization
String
required
authorization_example
x-xdr-auth-id
String
required
xXdrAuthId_example
requestObjectrequired
dataset_nameString
Unique dataset name
key_fieldsArray[string]
The fields used to identify existing records. If there is not an exact match to the key_fields specified, a new row is created.
When you specify key_fields
, these fields are mandatory in data entries. When key_fields
are not specified, existing data entries are not updated, and new entries are added with the specified data.
dataObject
Key-value pairs of data entries.
{
"request": {
"dataset_name": "users",
"key_fields": [
"uid",
"username"
],
"data": [
{
"uid": "123abc",
"username": "john",
"zipcode": 58672,
"salary": 5.1,
"is_admin": false,
"birthday": "31-05-1982T10:22:45Z"
},
{
"uid": "124abc",
"username": "jane",
"zipcode": 58642,
"salary": 5000000,
"is_admin": true,
"birthday": "31-03-1982T10:22:45Z"
}
]
}
}
curl -X 'POST'
-H
'Accept: application/json'
-H
'Content-Type: application/json'
-H
'Authorization: authorization_example'
-H
'x-xdr-auth-id: xXdrAuthId_example'
'https://api-yourfqdn/public_api/v1/xql/lookups/add_data'
-d
''