Knowledge Bases

Operations for the Knowledge Bases service collection.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
CombinedKnowledgeBasesV1 combined_knowledge_bases_v1	Search for knowledge bases with filtering and return full entity details in a single response.
EntitiesKnowledgeBasesCreateV1 entities_knowledge_bases_create_v1	Create or update a knowledge base.
EntitiesKnowledgeBasesUpdateV1 entities_knowledge_bases_update_v1	Update an existing knowledge base.
EntitiesKnowledgeBasesV1 entities_knowledge_bases_v1	Retrieve knowledge base entities for the provided id.
QueriesKnowledgeBasesV1 queries_knowledge_bases_v1	Query knowledge bases based on the provided filters.

---

CombinedKnowledgeBasesV1

Search for knowledge bases with filtering and return full entity details in a single response.

Method GET

Route /agentic-studio/combined/knowledge_bases/v1

Scope Charlotte AI Agent Definition: READ

PEP 8 combined_knowledge_bases_v1

Parameters

offset query · integer

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return. Offset + limit should NOT be above 10K.

sort query · string

Possible order by fields:

Available values (2)

name

created_at

filter query · string

FQL query specifying the filter parameters.

include_deleted query · boolean

Include deleted knowledge bases in the result. Defaults to false.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.combined_knowledge_bases_v1(offset=integer,
                                              limit=integer,
                                              sort="string",
                                              filter="string",
                                              include_deleted=boolean)
print(response)

Operation ID

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.CombinedKnowledgeBasesV1(offset=integer,
                                           limit=integer,
                                           sort="string",
                                           filter="string",
                                           include_deleted=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CombinedKnowledgeBasesV1",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          include_deleted=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  includeDeleted := boolean

  response, err := client.KnowledgeBases.CombinedKnowledgeBasesV1(
    &knowledge_bases.CombinedKnowledgeBasesV1Params{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.combinedKnowledgeBasesV1(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  boolean  // includeDeleted
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

response = api.combined_knowledge_bases_v1(offset: integer,
                                           limit: integer,
                                           sort: 'string',
                                           filter: 'string',
                                           include_deleted: boolean)

puts response

Responses

200 Successfully retrieved

[
  {
    "created_at": "string",
    "created_by": {},
    "description": "string",
    "embedding_model": "string",
    "files_count": 0,
    "id": "string",
    "is_deleted": false,
    "name": "string",
    "updated_at": "string",
    "updated_by": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

EntitiesKnowledgeBasesCreateV1

Create or update a knowledge base.

Method POST

Route /agentic-studio/entities/knowledge_bases/v1

Scope Charlotte AI Agent Definition: WRITE

PEP 8 entities_knowledge_bases_create_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

created_at body · string

The created_at value.

created_by body · object

The created_by value.

description body · string

The description value.

embedding_model body · string

The embedding_model value.

files_count body · integer

The files_count value.

id body · string

The id value.

is_deleted body · boolean

The is_deleted value.

name body · string

The name value.

updated_at body · string

The updated_at value.

updated_by body · object

The updated_by value.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

created_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

updated_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

response = falcon.entities_knowledge_bases_create_v1(created_at="string",
                                                     created_by=created_by,
                                                     description="string",
                                                     embedding_model="string",
                                                     files_count=integer,
                                                     id="string",
                                                     is_deleted=boolean,
                                                     name="string",
                                                     updated_at="string",
                                                     updated_by=updated_by)
print(response)

Operation ID

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

created_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

updated_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

response = falcon.EntitiesKnowledgeBasesCreateV1(created_at="string",
                                                 created_by=created_by,
                                                 description="string",
                                                 embedding_model="string",
                                                 files_count=integer,
                                                 id="string",
                                                 is_deleted=boolean,
                                                 name="string",
                                                 updated_at="string",
                                                 updated_by=updated_by)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "created_at": "string",
    "created_by": {
        "access_granted_at": "string",
        "cid": "string",
        "created_at": "string",
        "factors": ["string"],
        "first_name": "string",
        "last_login_at": "string",
        "last_name": "string",
        "status": "string",
        "uid": "string",
        "updated_at": "string",
        "user_type": "string",
        "uuid": "string"
    },
    "description": "string",
    "embedding_model": "string",
    "files_count": integer,
    "id": "string",
    "is_deleted": boolean,
    "name": "string",
    "updated_at": "string",
    "updated_by": {
        "access_granted_at": "string",
        "cid": "string",
        "created_at": "string",
        "factors": ["string"],
        "first_name": "string",
        "last_login_at": "string",
        "last_name": "string",
        "status": "string",
        "uid": "string",
        "updated_at": "string",
        "user_type": "string",
        "uuid": "string"
    }
}

response = falcon.command("EntitiesKnowledgeBasesCreateV1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_at := "string"
  description := "string"
  embedding_model := "string"
  files_count := integer
  id := "string"
  is_deleted := boolean
  name := "string"
  updated_at := "string"

  response, err := client.KnowledgeBases.EntitiesKnowledgeBasesCreateV1(
    &knowledge_bases.EntitiesKnowledgeBasesCreateV1Params{
      Body: &models.DomainKnowledgeBase{
        CreatedAt: &created_at,
        CreatedBy: &struct{}{},
        Description: &description,
        EmbeddingModel: &embedding_model,
        FilesCount: &files_count,
        ID: &id,
        IsDeleted: &is_deleted,
        Name: &name,
        UpdatedAt: &updated_at,
        UpdatedBy: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.entitiesKnowledgeBasesCreateV1(
  {
    createdAt: "string",
    createdBy: {
      accessGrantedAt: "string",
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    },
    description: "string",
    embeddingModel: "string",
    filesCount: integer,
    id: "string",
    isDeleted: boolean,
    name: "string",
    updatedAt: "string",
    updatedBy: {
      accessGrantedAt: "string",
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    }
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

body = Falcon::DomainKnowledgeBase.new(
  created_at: 'string',
  created_by: {
    access_granted_at: 'string',
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  },
  description: 'string',
  embedding_model: 'string',
  files_count: integer,
  id: 'string',
  is_deleted: boolean,
  name: 'string',
  updated_at: 'string',
  updated_by: {
    access_granted_at: 'string',
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  }
)

response = api.entities_knowledge_bases_create_v1(body)

puts response

Responses

200 Successfully created/updated

[
  {
    "created_at": "string",
    "created_by": {},
    "description": "string",
    "embedding_model": "string",
    "files_count": 0,
    "id": "string",
    "is_deleted": false,
    "name": "string",
    "updated_at": "string",
    "updated_by": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

EntitiesKnowledgeBasesUpdateV1

Update an existing knowledge base.

Method PATCH

Route /agentic-studio/entities/knowledge_bases/v1

Scope Charlotte AI Agent Definition: WRITE

PEP 8 entities_knowledge_bases_update_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

created_at body · string

The created_at value.

created_by body · object

The created_by value.

description body · string

The description value.

embedding_model body · string

The embedding_model value.

files_count body · integer

The files_count value.

id body · string

The id value.

is_deleted body · boolean

The is_deleted value.

name body · string

The name value.

updated_at body · string

The updated_at value.

updated_by body · object

The updated_by value.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

created_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

updated_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

response = falcon.entities_knowledge_bases_update_v1(created_at="string",
                                                     created_by=created_by,
                                                     description="string",
                                                     embedding_model="string",
                                                     files_count=integer,
                                                     id="string",
                                                     is_deleted=boolean,
                                                     name="string",
                                                     updated_at="string",
                                                     updated_by=updated_by)
print(response)

Operation ID

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

created_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

updated_by = {
    "cid": "string",
    "created_at": "string",
    "factors": [
        "string"
    ],
    "first_name": "string",
    "last_login_at": "string",
    "last_name": "string",
    "status": "string",
    "uid": "string",
    "updated_at": "string",
    "user_type": "string",
    "uuid": "string"
}

response = falcon.EntitiesKnowledgeBasesUpdateV1(created_at="string",
                                                 created_by=created_by,
                                                 description="string",
                                                 embedding_model="string",
                                                 files_count=integer,
                                                 id="string",
                                                 is_deleted=boolean,
                                                 name="string",
                                                 updated_at="string",
                                                 updated_by=updated_by)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "created_at": "string",
    "created_by": {
        "access_granted_at": "string",
        "cid": "string",
        "created_at": "string",
        "factors": ["string"],
        "first_name": "string",
        "last_login_at": "string",
        "last_name": "string",
        "status": "string",
        "uid": "string",
        "updated_at": "string",
        "user_type": "string",
        "uuid": "string"
    },
    "description": "string",
    "embedding_model": "string",
    "files_count": integer,
    "id": "string",
    "is_deleted": boolean,
    "name": "string",
    "updated_at": "string",
    "updated_by": {
        "access_granted_at": "string",
        "cid": "string",
        "created_at": "string",
        "factors": ["string"],
        "first_name": "string",
        "last_login_at": "string",
        "last_name": "string",
        "status": "string",
        "uid": "string",
        "updated_at": "string",
        "user_type": "string",
        "uuid": "string"
    }
}

response = falcon.command("EntitiesKnowledgeBasesUpdateV1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  created_at := "string"
  description := "string"
  embedding_model := "string"
  files_count := integer
  id := "string"
  is_deleted := boolean
  name := "string"
  updated_at := "string"

  response, err := client.KnowledgeBases.EntitiesKnowledgeBasesUpdateV1(
    &knowledge_bases.EntitiesKnowledgeBasesUpdateV1Params{
      Body: &models.DomainKnowledgeBase{
        CreatedAt: &created_at,
        CreatedBy: &struct{}{},
        Description: &description,
        EmbeddingModel: &embedding_model,
        FilesCount: &files_count,
        ID: &id,
        IsDeleted: &is_deleted,
        Name: &name,
        UpdatedAt: &updated_at,
        UpdatedBy: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.entitiesKnowledgeBasesUpdateV1(
  {
    createdAt: "string",
    createdBy: {
      accessGrantedAt: "string",
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    },
    description: "string",
    embeddingModel: "string",
    filesCount: integer,
    id: "string",
    isDeleted: boolean,
    name: "string",
    updatedAt: "string",
    updatedBy: {
      accessGrantedAt: "string",
      cid: "string",
      createdAt: "string",
      factors: [],
      firstName: "string",
      lastLoginAt: "string",
      lastName: "string",
      status: "string",
      uid: "string",
      updatedAt: "string",
      userType: "string",
      uuid: "string"
    }
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

body = Falcon::DomainKnowledgeBase.new(
  created_at: 'string',
  created_by: {
    access_granted_at: 'string',
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  },
  description: 'string',
  embedding_model: 'string',
  files_count: integer,
  id: 'string',
  is_deleted: boolean,
  name: 'string',
  updated_at: 'string',
  updated_by: {
    access_granted_at: 'string',
    cid: 'string',
    created_at: 'string',
    factors: [],
    first_name: 'string',
    last_login_at: 'string',
    last_name: 'string',
    status: 'string',
    uid: 'string',
    updated_at: 'string',
    user_type: 'string',
    uuid: 'string'
  }
)

response = api.entities_knowledge_bases_update_v1(body)

puts response

Responses

200 Successfully updated

[
  {
    "created_at": "string",
    "created_by": {},
    "description": "string",
    "embedding_model": "string",
    "files_count": 0,
    "id": "string",
    "is_deleted": false,
    "name": "string",
    "updated_at": "string",
    "updated_by": {}
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

EntitiesKnowledgeBasesV1

Retrieve knowledge base entities for the provided id.

Method GET

Route /agentic-studio/entities/knowledge_bases/v1

Scope Charlotte AI Agent Definition: READ

PEP 8 entities_knowledge_bases_v1

Parameters

ids query · string or list of strings

IDs of entities to retrieve.

include_deleted query · boolean

Include deleted knowledge bases in the result. Defaults to false.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_knowledge_bases_v1(ids=id_list,
                                              include_deleted=boolean)
print(response)

Operation ID

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.EntitiesKnowledgeBasesV1(ids=id_list, include_deleted=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("EntitiesKnowledgeBasesV1",
                          ids=id_list,
                          include_deleted=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  includeDeleted := boolean

  response, err := client.KnowledgeBases.EntitiesKnowledgeBasesV1(
    &knowledge_bases.EntitiesKnowledgeBasesV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.entitiesKnowledgeBasesV1(
  ["ID1", "ID2", "ID3"],  // ids
  boolean  // includeDeleted
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

response = api.entities_knowledge_bases_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 Successfully retrieved

[
  {
    "created_at": "string",
    "created_by": {},
    "description": "string",
    "embedding_model": "string",
    "files_count": 0,
    "id": "string",
    "is_deleted": false,
    "name": "string",
    "updated_at": "string",
    "updated_by": {}
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

QueriesKnowledgeBasesV1

Query knowledge bases based on the provided filters.

Method GET

Route /agentic-studio/queries/knowledge_bases/v1

Scope Charlotte AI Agent Definition: READ

PEP 8 queries_knowledge_bases_v1

Parameters

offset query · integer

Starting index of overall result set from which to return ids.

limit query · integer

Number of IDs to return. Offset + limit should NOT be above 10K.

sort query · string

asc’.

filter query · string

FQL query specifying the filter parameters.

include_deleted query · boolean

Include deleted knowledge bases in the result. Defaults to false.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.queries_knowledge_bases_v1(offset=integer,
                                             limit=integer,
                                             sort="string",
                                             filter="string",
                                             include_deleted=boolean)
print(response)

Operation ID

from falconpy import KnowledgeBases

falcon = KnowledgeBases(client_id=CLIENT_ID,
                        client_secret=CLIENT_SECRET
                        )

response = falcon.QueriesKnowledgeBasesV1(offset=integer,
                                          limit=integer,
                                          sort="string",
                                          filter="string",
                                          include_deleted=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueriesKnowledgeBasesV1",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          include_deleted=boolean)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/knowledge_bases"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  includeDeleted := boolean

  response, err := client.KnowledgeBases.QueriesKnowledgeBasesV1(
    &knowledge_bases.QueriesKnowledgeBasesV1Params{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      IncludeDeleted: &includeDeleted,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.knowledgeBases.queriesKnowledgeBasesV1(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  boolean  // includeDeleted
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::KnowledgeBases.new

response = api.queries_knowledge_bases_v1(offset: integer,
                                          limit: integer,
                                          sort: 'string',
                                          filter: 'string',
                                          include_deleted: boolean)

puts response

Responses

200 Successfully retrieved

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

404 Not Found

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Internal Server Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}