Add or update data in a lookup dataset

Cortex XDR REST API

post /public_api/v1/xql/lookups/add_data

Add or update data in a lookup dataset.

When updating data, any field not specified in the data field, but specified on at least one of the rows, will be set to None.

You can send a maximum of 10 lookup API calls per second.

**Note: ** The maximum size of a lookup dataset is 50 MB. Attemping to exceed this limit will fail.

Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB

Request headers
Authorization
String
required
{api_key}
Example: authorization_example
x-xdr-auth-id
String
required
{api_key_id}
Example: xXdrAuthId_example
Body parameters
requestObjectrequired
dataset_nameString

Unique dataset name

key_fieldsArray[string]

The fields used to identify existing records. If there is not an exact match to the key_fields specified, a new row is created. When you specify key_fields, these fields are mandatory in data entries. When key_fields are not specified, existing data entries are not updated, and new entries are added with the specified data.

dataObject

Key-value pairs of data entries.

REQUEST BODY
{ "request": { "dataset_name": "users", "key_fields": [ "uid", "username" ], "data": [ { "uid": "123abc", "username": "john", "zipcode": 58672, "salary": 5.1, "is_admin": false, "birthday": "31-05-1982T10:22:45Z" }, { "uid": "124abc", "username": "jane", "zipcode": 58642, "salary": 5000000, "is_admin": true, "birthday": "31-03-1982T10:22:45Z" } ] } }
CURL
curl -X 'POST'
-H 'Accept: application/json'
-H 'Content-Type: application/json'
-H 'Authorization: authorization_example' -H 'x-xdr-auth-id: xXdrAuthId_example'
'https://api-yourfqdn/public_api/v1/xql/lookups/add_data'
-d ''
Responses

OK

Body
addedInteger
updatedInteger
skippedInteger
RESPONSE
{ "added": 0, "updated": 0, "skipped": 0 }

ad Request. Got an invalid JSON.

Body
err_codeString

HTTP response code.

err_msgString

Error message.

Example:"{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}"
err_extraString

Additional information describing the error.

RESPONSE
{ "err_code": "err_code_example", "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}", "err_extra": "err_extra_example" }

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters.

Body
err_codeString

HTTP response code.

err_msgString

Error message.

Example:"{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}"
err_extraString

Additional information describing the error.

RESPONSE
{ "err_code": "err_code_example", "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}", "err_extra": "err_extra_example" }

Unauthorized access. User does not have the required license type to run this API.

Body
err_codeString

HTTP response code.

err_msgString

Error message.

Example:"{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}"
err_extraString

Additional information describing the error.

RESPONSE
{ "err_code": "err_code_example", "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}", "err_extra": "err_extra_example" }

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

Body
err_codeString

HTTP response code.

err_msgString

Error message.

Example:"{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}"
err_extraString

Additional information describing the error.

RESPONSE
{ "err_code": "err_code_example", "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}", "err_extra": "err_extra_example" }

Internal server error. A unified status for API communication type errors.

Body
err_codeString

HTTP response code.

err_msgString

Error message.

Example:"{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}"
err_extraString

Additional information describing the error.

RESPONSE
{ "err_code": "err_code_example", "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}", "err_extra": "err_extra_example" }