---
title: "GET /search"
method: GET
path: "/search"
---

# GET /search

`GET /search`

## Query parameters

- `q` string, required

## Response `200`

Search results

- object
  - `items` SearchResult[], required
    - `kind` 'entity' | 'flow' | 'detector_hit', required
    - `id` string, required
    - `type` string
    - `canonical_id` string
    - `display_name` string
    - `title` string
    - `latest_status` string
    - `message_count` integer
    - `first_seen` string, date-time
    - `last_seen` string, date-time
    - `detector_id` string
    - `severity` string
    - `source` string
    - `attrs` object
    - `score` number, required
  - `next` string, nullable, required

## Changes

- **2026-07-17** `d56f871e544e` — 15 info
  - added the optional property `items/items/attrs` to the response with the `200` status
  - added the optional property `items/items/canonical_id` to the response with the `200` status
  - added the optional property `items/items/detector_id` to the response with the `200` status
  - added the optional property `items/items/display_name` to the response with the `200` status
  - …11 more
- **2026-04-21** `9925ce6b6def` — 3 breaking, 12 warning
  - removed the required property `items/items/id` from the response with the `200` status
  - removed the required property `items/items/kind` from the response with the `200` status
  - removed the required property `items/items/score` from the response with the `200` status
  - removed the optional property `items/items/attrs` from the response with the `200` status
  - …11 more

[Change history](https://skmtc.dev/scalytics/apis/kafsiem-analyst-api/changes/search/get.md)

---

[API](https://skmtc.dev/scalytics/apis/kafsiem-analyst-api.md) · [All operations](https://skmtc.dev/scalytics/apis/kafsiem-analyst-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/scalytics/kafsiem-analyst-api/revisions/d56f871e544e/schema)