Lookup API Operation

The find_operation function provides a simple way to search for any currently supported CrowdStrike API operation by operation ID, route, or service collection.

Introduced in FalconPy v1.5.3.

Result format

Results are returned as a dictionary (or list of dictionaries for multiple matches):

{
    "operation": "GetDeviceDetails",
    "method": "POST",
    "route": "/devices/entities/devices/v2",
    "description": "Get details on one or more hosts by providing host IDs in a POST body. Supports up to a maximum 5000 IDs.",
    "collection": "hosts"
}

Keyword arguments

Keyword	Data type	Default	Allowed values
search_for	String	None	Any
search_by	String	id	id, route, or collection
exact	Boolean	True	True or False

Lookup by operation ID

The first argument is assumed to be search_for, and the default search_by is id.

from falconpy import find_operation

result = find_operation("GetDeviceDetails")
print(result)

For fuzzy matching, set exact to False (case insensitive):

from falconpy import find_operation

result = find_operation("Device", exact=False)
print(result)

Lookup by route

from falconpy import find_operation

result = find_operation("/devices/entities/devices/v1", search_by="route")
print(result)

Fuzzy matching:

from falconpy import find_operation

result = find_operation("/devices/", search_by="route", exact=False)
print(result)

Lookup by service collection

from falconpy import find_operation

result = find_operation("hosts", search_by="collection")
print(result)

Errors

Error	Cause
InvalidOperationSearch	Invalid value for search_by.
InvalidOperation	No matching operation ID found.
InvalidRoute	No matching route found.
InvalidServiceCollection	No matching service collection found.