---
title: "Get Active Queries"
method: GET
path: "/connect/query/active"
tags: ["Query"]
---

# Get Active Queries

`GET /connect/query/active`

Returns a list of active event/data queries within the grid. Users will only see their
queries unless they have privileged access to see active queries across all users.
Requires a Security Onion Pro license.

## Query parameters

- `filter` boolean

## Response `200`

The list of active queries

- ModelQueryTask[]
  - `cancelable` boolean — True if this task can be canceled
  - `details` string — Details of the task
  - `elapsedMs` integer — Elapsed runtime of this task
  - `gridId` string — Grid ID on which this task is running, or empty for the local grid
  - `startTime` string — Start time of this task
  - `taskId` string — Unique Task ID representing this active task

## Other responses

- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `500` — Internal SOC error; review SOC logs

## Changes

- **2025-08-25** `4e3bdeaab6cb` — 1 warning, 1 info
  - removed the optional property `items/cancellable` from the response with the `200` status
  - added the optional property `items/cancelable` to the response with the `200` status
- **2025-02-28** `8da2b65d362f` — 1 breaking
  - the response's body type/format changed from `object`/`` to `array`/`` for status `200`
- **2025-02-28** `75a372f68ede` — 1 info
  - endpoint added
- **2024-12-10** `ee1120fd1e20` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/changes/connect/query/active/get.md)

---

[API](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.dev/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/revisions/0576ce393f8d/schema)