---
title: "Get observed values for an endpoint"
method: GET
path: "/session/{sessionID}/observations"
---

# Get observed values for an endpoint

`GET /session/{sessionID}/observations`

Per-endpoint observed values (raw facts): which credential used which concrete values for each parameter. Pulled on-demand when the UI expands an endpoint. Pass the endpoint's key_hash.

## Path parameters

- `sessionID` string, required

## Query parameters

- `directory` string
- `keyHash` string
- `id` string

## Response `200`

Observed-value tree

- unknown

## Other responses

- `400` — Bad request
- `404` — Not found

## Changes

- **2026-06-29** `e7837fb0de8f` — 1 info
  - endpoint added
- **2026-01-20** `c7ae6a68e4fb` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/cyberstrikeus/apis/cyberstrike/changes/session/:sessionID/observations/get.md)

---

[API](https://skmtc.dev/cyberstrikeus/apis/cyberstrike.md) · [All operations](https://skmtc.dev/cyberstrikeus/apis/cyberstrike/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cyberstrikeus/cyberstrike/revisions/60718ff578c8/schema)