---
type: api
title: Get pack details
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osquerygetpacksdetails
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-osquerygetpacksdetails
products:
  - Kibana
---

# Get pack details

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/osquery/packs/{id}`
- `GET` `/s/{space_id}/api/osquery/packs/{id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

#### Path Parameters

- `id` (string)
  The pack ID.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get the details of a query pack using the pack ID.

## Response

Indicates a successful call.

`application/json`

- `data` (object)
  The pack details.
  - `created_at` (string)
  - `created_by` (string) — nullable
  - `created_by_profile_uid` (string)
  - `description` (string)
    The pack description.
  - `enabled` (boolean)
    Enables the pack.
  - `interval` (integer · min: 1)
    Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`.
  - `name` (string)
    The pack name.
  - `namespaces` ([] string)
    The namespaces the pack belongs to.
  - `policy_ids` ([] object)
    A list of agents policy IDs.
  - `queries` (object)
    An object of queries.
  - `read_only` (boolean)
    Whether the pack is read-only (true for prebuilt packs).
  - `rrule_schedule` ({})
    RRULE schedule configuration consumed by osquerybeat. Loose date
forms like `"2024-01-01"` are rejected with 400. DTSTART is NOT
embedded in `rrule`; the separate `start_date` field is the
schedule anchor.
    - `end_date` (string · max: 64)
      Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`.
    - `rrule` (string · max: 2048)
      Fully serialized RFC 5545 RRULE string (e.g.
`"FREQ=WEEKLY;BYDAY=MO,WE,FR"`). The Kibana UI writes only a
subset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`,
`BYMONTH` — but the server accepts and round-trips any
well-formed parts (other recognized parts like `BYHOUR`,
`BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved
verbatim).
    - `splay` (string · max: 64)
      Optional Go duration string for splay (random execution delay),
e.g. `"30s"`, `"5m"`, `"1h"`. The Kibana form writes single-unit
values only; compound durations (`"1h30m"`) are tolerated on
read for round-trip safety with osquerybeat's writer. Maximum
12 hours (43200 seconds).
    - `start_date` (string · max: 64)
      RFC 3339 datetime string for the schedule's start.
    - `timeout` (number)
      Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.
  - `saved_object_id` (string)
    The saved object ID of the pack.
  - `schedule_type` (enum)
    Discriminator for the pack's schedule mode. `interval` uses native
osqueryd interval scheduling (seconds). `rrule` uses osquerybeat's
RRULE-based recurrence scheduling. Per-query overrides MUST use the
same mode as the pack — cross-mode overrides are rejected with 400.
    Values: `interval`, `rrule`
  - `shards` (object)
    An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
  - `type` (string)
    The saved object type.
  - `updated_at` (string)
  - `updated_by` (string) — nullable
  - `updated_by_profile_uid` (string)
  - `version` (integer)
    The pack version number.
## Code Examples

#### Console

```console
GET /api/osquery/packs/{id}
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/osquery/packs/{id}"
```

## Response Examples

#### Pack details

```json
{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id"
    ],
    "queries": {
      "ports": {
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": {},
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic",
    "version": 1
  }
}
```