--- title: "List Security Playbook Run" method: POST path: "/security-playbook-run/get-list" tags: ["Security Playbook Run"] --- # List Security Playbook Run `POST /security-playbook-run/get-list` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-playbook-run/get-list` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to list all Security Playbook Run items ## Request body - object - `query` SecurityPlaybookRunQuerySchema: Query schema for SecurityPlaybookRun. A field takes a value, which it matches exactly, or an operator its type allows. A relation is filtered by the fields of the record it names, {"": {"": }}, and a resource with owners by who owns it, {"owners": {"_type": "OwnedBy", "userIds": [...], "teamIds": [...]}}. - `_id` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `createdAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `updatedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `deletedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `projectId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `securityCaseId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `securityPlaybookId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `playbookName` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `trigger` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `triggeredByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `status` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `steps` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `stepResults` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `currentStepIndex` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `threatIntelMatched` union: A filter on a Boolean field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull. - boolean - object - `_type` 'EqualTo', required - `value` boolean, required - object - `_type` 'NotEqual', required - `value` boolean, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` boolean, required - `startedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `completedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `errorMessage` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `createdByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `deletedByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `select` SecurityPlaybookRunSelectSchema: Select schema for SecurityPlaybookRun. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `securityCaseId` boolean - `securityPlaybookId` boolean - `playbookName` boolean - `trigger` boolean - `triggeredByUserId` boolean - `status` boolean - `steps` boolean - `stepResults` boolean - `currentStepIndex` boolean - `threatIntelMatched` boolean - `startedAt` boolean - `completedAt` boolean - `errorMessage` boolean - `createdByUserId` boolean - `deletedByUserId` boolean - `sort` SecurityPlaybookRunSortSchema: Sort schema for SecurityPlaybookRun. Only sortable fields are included. - `_id` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `updatedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `projectId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `securityCaseId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `securityPlaybookId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `playbookName` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `trigger` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `triggeredByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `status` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `currentStepIndex` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `threatIntelMatched` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `startedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `completedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `errorMessage` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `limit` number: Maximum number of items to return. Defaults to 10. - `skip` number: Number of items to skip for pagination. Defaults to 0. ## Response `200` Successful response - object - `data` SecurityPlaybookRun[] - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Run Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [Project Owner, Project Admin, Security Admin, Security Member, Approve Security Playbook Steps] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Run Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [Project Owner, Project Admin, Security Admin, Security Member, Approve Security Playbook Steps] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Run Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [Project Owner, Project Admin, Security Admin, Security Member, Approve Security Playbook Steps] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Run Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [Project Owner, Project Admin, Security Admin, Security Member, Approve Security Playbook Steps] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this run belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Run Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `securityCaseId` string, uuid, required: ID of the case the playbook runs on. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Run Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `securityPlaybookId` string, uuid, required: ID of the playbook being run. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Run Security Playbook], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `playbookName` string: The playbook's name when the run started, kept if the playbook is renamed or deleted. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `trigger` 'Case Opened' | 'Detection Added' | 'Triaged as Likely Malicious' | 'Manual': What started the run: Case Opened, Detection Added, or Manual for a person. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `triggeredByUserId` string, uuid: ID of the person who ran the playbook. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `status` 'Queued' | 'Running' | 'Waiting for Approval' | 'Succeeded' | 'Failed' | 'Cancelled': Queued, Running, Waiting for Approval, Succeeded, Failed or Cancelled. Set it to Cancelled to stop a run that has not finished. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [Project Owner, Project Admin, Security Admin, Security Member, Approve Security Playbook Steps] - `steps` object: The playbook's steps as they were when the run started. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `stepResults` object: What each step did: its status, when it started and finished, what it reported, and who decided on its approval. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `currentStepIndex` number: The step the run is on, counting from 0. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `threatIntelMatched` boolean: Whether a Check Threat Intel step of this run found a known-bad entity. Steps set to run only on a match read it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `startedAt` object: When the run started its first step. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `completedAt` object: When the run finished, failed or was cancelled. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `errorMessage` string: Why the run failed, when it did. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `createdByUserId` string, uuid: ID of the person who started the run. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: Unused: runs are not deleted. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Playbook Run], Update: [No access - you don't have permission for this operation] - `count` number ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)