---
title: "Get resource details for a specific threat hunt"
method: GET
path: "/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}"
tags: ["Threat Hunting"]
---

# Get resource details for a specific threat hunt

`GET /threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}`
- Auth: API key in header `Authorization`

Displays the selected device ID details and resource type for a specific threat hunt.

## Path parameters

- `threatHuntID` integer, required
- `deviceID` integer, required

## Query parameters

- `resourceType` 'VMware' | 'EC2' | 'AzureVM' | 'OneDrive' | 'SharePoint' | 'ExchangeOnline', required

## Response `200`

Success

- ThreatHuntGetDeviceDetailsResponse
  - `threatHuntID` integer: The unique identifier for a threat hunt.
  - `deviceID` integer: Unique identifier for a device.
  - `orgID` integer: The unique identifier of the Phoenix (Enterprise Workloads) organization for the resource.
  - `resourceParentID` integer: Unique identifier for the parent resource.In the context of VMware, this is the unique identifier for the ESXi FQDN.
  - `resourceName` string: Name of the resource. In case of VMware, resource name will be VM name. Example - Ernie Carter's VM.
  - `resourceType` string: Name of resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or 'Exchange Online'.
  - `resourceParentName` string: Resource Parent Name. In case of VMware, this will be vCenter/ESXi name.
  - `orgName` string: Organization Name for Enterprise Workloads. This field is empty if the organization has been deleted.
  - `payload` object: All other fields that belong to the selected resource. Example - {'type':'EBS'}.
  - `resourceIDs` integer[]: List of resource IDs for the selected device ID.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)