---
title: "Get Packet Capture"
method: POST
path: "/packet-capture/{id}/get-item"
tags: ["Packet Capture"]
---

# Get Packet Capture

`POST /packet-capture/{id}/get-item`

## Request

- Base URL: `https://oneuptime.com/api`
- URL: `https://oneuptime.com/api/packet-capture/{id}/get-item`
- Auth: API key in header `APIKey`
- TypeScript: <https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/docs/packet-capture/:id/get-item/post.ts> (a function with typed inputs; its response is checked against the schema)

Endpoint to retrieve a single Packet Capture by ID

## Path parameters

- `id` string, uuid, required

## Request body

- object
  - `select` PacketCaptureSelectSchema: Select schema for PacketCapture. Set fields to true to include them in the response.
    - `_id` boolean
    - `createdAt` boolean
    - `updatedAt` boolean
    - `deletedAt` boolean
    - `projectId` boolean
    - `probeId` boolean
    - `networkDeviceId` boolean
    - `name` boolean
    - `interfaceName` boolean
    - `bpfFilter` boolean
    - `maxDurationInSeconds` boolean
    - `maxPackets` boolean
    - `maxFileSizeInMB` boolean
    - `status` boolean
    - `statusMessage` boolean
    - `endReason` boolean
    - `startedAt` boolean
    - `completedAt` boolean
    - `stopRequestedAt` boolean
    - `packetCount` boolean
    - `fileSizeInBytes` boolean
    - `createdByUserId` boolean
    - `deletedByUserId` boolean

## Response `200`

Successful response

- object
  - `data` PacketCapture
    - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `version` number: Object version
    - `projectId` string, uuid, required: ID of your OneUptime Project in which this object belongs. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `probeId` string, uuid, required: ID of the probe that runs the capture: one of the project's own probes, with packet capture turned on. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `networkDeviceId` string, uuid: ID of the network device the capture was started from, if it was started from a device's page. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `name` string: The interface and the filter of the capture, written by OneUptime: eth0: host 10.0.0.5. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `interfaceName` string, required: The network interface the probe captures on, as the probe reported it: "eth0", or "any" for every interface at once. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `bpfFilter` string: A BPF filter expression - the capture-filter language of tcpdump and Wireshark - that decides which packets are kept: host 10.0.0.5 and tcp port 443. Empty keeps every packet. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `maxDurationInSeconds` number, required: How long the capture runs, in seconds, at most: from 5 seconds to 30 minutes, and no longer than the probe allows. It stops earlier when it reaches its packet or file size limit. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `maxPackets` number, required: The capture stops after this many packets: from 1 to 1,000,000. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `maxFileSizeInMB` number, required: The capture stops when its file reaches this many megabytes: from 1 to 25, and no more than the probe allows. The file is cut at the last whole packet. Permissions - Create: [Project Owner, Project Admin, Start Packet Capture], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `status` 'Pending' | 'Running' | 'Completed' | 'Failed', required: Where the capture is: "Pending" (waiting for the probe), "Running" (the probe is capturing), "Completed" (the file is ready) or "Failed" (see Status Message). Managed by OneUptime and the probe. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `statusMessage` string: Why a capture failed - the interface is gone, the probe may not capture, the filter did not compile - or what the capture tool said when it stopped by itself. Managed by OneUptime and the probe. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `endReason` string: Why a completed capture stopped: "DurationReached", "PacketLimitReached", "FileSizeLimitReached", "StoppedFromDashboard" or "CaptureToolStopped". Managed by the probe. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `startedAt` object: When the probe started capturing. Managed by OneUptime. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `completedAt` object: When the capture completed or failed. Managed by OneUptime. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `stopRequestedAt` object: When someone pressed Stop on the running capture. The probe stops at its next check, within about ten seconds, and uploads what it captured. Managed by OneUptime. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `packetCount` number: How many packets the file holds, counted by OneUptime from the file. Managed by OneUptime. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `fileSizeInBytes` number: The size of the pcap file in bytes. Managed by OneUptime. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `createdByUserId` string, uuid: User ID who created this object (if this object was created by a User). Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]
    - `deletedByUserId` string, uuid: User ID who deleted this object (if this object was deleted by a User). Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Project Member, Viewer, Read Packet Capture], Update: [No access - you don't have permission for this operation]

## Other responses

- `400`: Bad request. This response indicates that the request was malformed or contained invalid data.
- `401`: Unauthorized. This response indicates that the request requires user authentication.
- `402`: Payment Required. This response indicates that the request requires payment or a valid subscription.
- `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it.
- `404`: Not found. The record does not exist, belongs to another project, or is one you may not read - the same answer for each.
- `405`: Project not found. This response indicates that the requested project does not exist or is not accessible.
- `408`: Request Timeout. This response indicates that the server timed out waiting for the request.
- `415`: Unable to reach server. This response indicates that the server is currently unreachable or down.
- `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource.
- `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.

---

[API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)