Insights

Reports, SbQL queries, dashboards and logs. Use it to run the reports you built in Sessionboard, query your data, or export activity to a SIEM.

Guides

• Reports & Dashboards
• SbQL Reference

Reports & SbQL

Endpoint	Level	Needs
POST Execute a SbQL query/v1/insights/execute	Organization	read:insights
POST Generate a SbQL query from natural language/v1/insights/ai/generate	Organization	read:insights
GET Get insights schema/v1/insights/schema	Organization	read:insights
GET Get event-specific insights schema/v1/insights/events/{eventId}/schema	Organization	read:insights
GET Get query suggestions/v1/insights/suggestions	Organization	read:insights
GET List saved queries/v1/insights/queries	Organization	read:insights
POST Run a saved query/v1/insights/queries/{queryId}/run	Organization	read:insights
GET Get a dashboard/v1/insights/dashboards/{id}	Organization	read:insights
POST Execute a SbQL query (event-scoped)/v1/event/{eventId}/insights/execute	Event	read:insights
POST Generate a SbQL query from natural language (event-scoped)/v1/event/{eventId}/insights/ai/generate	Event	read:insights
GET Get event-scoped insights schema/v1/event/{eventId}/insights/schema	Event	read:insights
GET Get event-scoped query suggestions/v1/event/{eventId}/insights/suggestions	Event	read:insights
GET List saved queries (event-scoped insights)/v1/event/{eventId}/insights/queries	Event	read:insights
POST Run a saved query (event-scoped insights)/v1/event/{eventId}/insights/queries/{queryId}/run	Event	read:insights
GET Get a dashboard (event-scoped insights)/v1/event/{eventId}/insights/dashboards/{id}	Event	read:insights

Saved reports

Endpoint	Level	Needs
GET List saved queries for an event/v1/event/{eventId}/queries	Event	read:insights
POST Create a saved query/v1/event/{eventId}/queries/create	Event	write:events
POST Run a saved query for an event/v1/event/{eventId}/queries/{queryId}/run	Event	write:events
PUT Update a saved query/v1/event/{eventId}/queries/{queryId}	Event	write:events
DELETE Delete a saved query/v1/event/{eventId}/queries/{queryId}	Event	write:events

Dashboards & widgets

Endpoint	Level	Needs
GET List dashboards/v1/event/{eventId}/dashboards	Event	read:insights
GET Get a dashboard/v1/event/{eventId}/dashboards/{id}	Event	read:insights
POST Create a dashboard/v1/event/{eventId}/dashboards/create	Event	write:events
PUT Update a dashboard/v1/event/{eventId}/dashboards/{id}	Event	write:events
DELETE Delete a dashboard/v1/event/{eventId}/dashboards/{id}	Event	write:events
POST Create a widget/v1/event/{eventId}/dashboards/{dashboardId}/widgets/create	Event	write:events
PUT Update a widget/v1/event/{eventId}/widgets/{widgetId}	Event	write:events
DELETE Delete a widget/v1/event/{eventId}/widgets/{widgetId}	Event	write:events
GET List org dashboards (convenience)/v1/dashboards	Organization	read:insights
GET Get an org dashboard (convenience)/v1/dashboards/{id}	Organization	read:insights
POST Create an org dashboard (convenience)/v1/dashboards/create	Organization	write:events
PUT Update an org dashboard (convenience)/v1/dashboards/{id}	Organization	write:events
DELETE Delete an org dashboard (convenience)/v1/dashboards/{id}	Organization	write:events
POST Create an org widget (convenience)/v1/dashboards/{dashboardId}/widgets/create	Organization	write:events
PUT Update an org widget (convenience)/v1/widgets/{widgetId}	Organization	write:events
DELETE Delete an org widget (convenience)/v1/widgets/{widgetId}	Organization	write:events
GET List org saved queries (convenience)/v1/queries	Organization	read:insights
POST Create an org saved query (convenience)/v1/queries/create	Organization	write:events
POST Run an org saved query (convenience)/v1/queries/{queryId}/run	Organization	write:events
PUT Update an org saved query (convenience)/v1/queries/{queryId}	Organization	write:events
DELETE Delete an org saved query (convenience)/v1/queries/{queryId}	Organization	write:events

Log export

Endpoint	Level	Needs
GET List API request logs/v1/logs/api-requests	Organization	—
GET List security events/v1/logs/security-events	Organization	—
GET List audit trail/v1/logs/audit-trail	Organization	—