---
title: "Get a list of security signals"
method: POST
path: "/api/v2/security_monitoring/signals/search"
tags: ["Security Monitoring"]
---

# Get a list of security signals

`POST /api/v2/security_monitoring/signals/search`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/signals/search`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_signals_read`

Returns security signals that match a search query.
Both this endpoint and the GET endpoint can be used interchangeably for listing
security signals.

## Request body

- SecurityMonitoringSignalListRequest: The request for a security signal list.
  - `filter` SecurityMonitoringSignalListRequestFilter: Search filters for listing security signals.
    - `from` string, date-time: The minimum timestamp for requested security signals.
    - `query` string: Search query for listing security signals.
    - `to` string, date-time: The maximum timestamp for requested security signals.
  - `page` SecurityMonitoringSignalListRequestPage: The paging attributes for listing security signals.
    - `cursor` string: A list of results using the cursor provided in the previous query.
    - `limit` integer: The maximum number of security signals in the response.
  - `sort` 'timestamp' | '-timestamp': The sort parameters used for querying security signals.

## Response `200`

OK

- SecurityMonitoringSignalsListResponse: The response object with all security signals matching the request and pagination information.
  - `data` SecurityMonitoringSignal[]: An array of security signals matching the request.
    - `attributes` SecurityMonitoringSignalAttributes: The object containing all signal attributes and their associated values.
      - `custom` object: A JSON object of attributes in the security signal.
      - `message` string: The message in the security signal defined by the rule that generated the signal.
      - `tags` string[]: An array of tags associated with the security signal.
      - `timestamp` string, date-time: The timestamp of the security signal.
    - `id` string: The unique ID of the security signal.
    - `type` 'signal': The type of event.
  - `links` SecurityMonitoringSignalsListResponseLinks: Links attributes.
    - `next` string: The link for the next set of results. **Note**: The request can also be made using the POST endpoint.
  - `meta` SecurityMonitoringSignalsListResponseMeta: Meta attributes.
    - `page` SecurityMonitoringSignalsListResponseMetaPage: Paging attributes.
      - `after` string: The cursor used to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)