curl -X POST "https://app.cotool.ai/api/detection-rules/execute-query" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"string","platform":"string","platformConfig":{"version":1,"platform":"datadog","queries":[{"name":"string","query":"string","aggregation":"count","dataSource":null,"groupByFields":["string"],"distinctFields":["string"]}],"cases":[{"status":"info","condition":"string","name":"string"}],"options":{"detectionMethod":"threshold","evaluationWindow":0,"keepAlive":0,"maxSignalDuration":0,"decreaseCriticalityBasedOnEnv":true},"isEnabled":true},"timeRangeHours":0,"maxRows":0}'

import requests

url = "https://app.cotool.ai/api/detection-rules/execute-query"

payload = {
    "query": "<string>",
    "platform": "<string>",
    "platformConfig": {
        "version": 123,
        "platform": "<string>",
        "queries": [
            {
                "name": "<string>",
                "query": "<string>",
                "dataSource": "logs",
                "groupByFields": ["<string>"],
                "distinctFields": ["<string>"]
            }
        ],
        "cases": [
            {
                "condition": "<string>",
                "name": "<string>"
            }
        ],
        "options": {
            "evaluationWindow": 123,
            "keepAlive": 123,
            "maxSignalDuration": 123,
            "decreaseCriticalityBasedOnEnv": True
        },
        "isEnabled": True
    },
    "timeRangeHours": 84.5,
    "maxRows": 50.5
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    query: '<string>',
    platform: '<string>',
    platformConfig: {
      version: 123,
      platform: '<string>',
      queries: [
        {
          name: '<string>',
          query: '<string>',
          dataSource: 'logs',
          groupByFields: ['<string>'],
          distinctFields: ['<string>']
        }
      ],
      cases: [{condition: '<string>', name: '<string>'}],
      options: {
        evaluationWindow: 123,
        keepAlive: 123,
        maxSignalDuration: 123,
        decreaseCriticalityBasedOnEnv: true
      },
      isEnabled: true
    },
    timeRangeHours: 84.5,
    maxRows: 50.5
  })
};

fetch('https://app.cotool.ai/api/detection-rules/execute-query', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

HttpResponse<String> response = Unirest.post("https://app.cotool.ai/api/detection-rules/execute-query")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"query\": \"<string>\",\n  \"platform\": \"<string>\",\n  \"platformConfig\": {\n    \"version\": 123,\n    \"platform\": \"<string>\",\n    \"queries\": [\n      {\n        \"name\": \"<string>\",\n        \"query\": \"<string>\",\n        \"dataSource\": \"logs\",\n        \"groupByFields\": [\n          \"<string>\"\n        ],\n        \"distinctFields\": [\n          \"<string>\"\n        ]\n      }\n    ],\n    \"cases\": [\n      {\n        \"condition\": \"<string>\",\n        \"name\": \"<string>\"\n      }\n    ],\n    \"options\": {\n      \"evaluationWindow\": 123,\n      \"keepAlive\": 123,\n      \"maxSignalDuration\": 123,\n      \"decreaseCriticalityBasedOnEnv\": true\n    },\n    \"isEnabled\": true\n  },\n  \"timeRangeHours\": 84.5,\n  \"maxRows\": 50.5\n}")
  .asString();

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.cotool.ai/api/detection-rules/execute-query"

	payload := strings.NewReader("{\n  \"query\": \"<string>\",\n  \"platform\": \"<string>\",\n  \"platformConfig\": {\n    \"version\": 123,\n    \"platform\": \"<string>\",\n    \"queries\": [\n      {\n        \"name\": \"<string>\",\n        \"query\": \"<string>\",\n        \"dataSource\": \"logs\",\n        \"groupByFields\": [\n          \"<string>\"\n        ],\n        \"distinctFields\": [\n          \"<string>\"\n        ]\n      }\n    ],\n    \"cases\": [\n      {\n        \"condition\": \"<string>\",\n        \"name\": \"<string>\"\n      }\n    ],\n    \"options\": {\n      \"evaluationWindow\": 123,\n      \"keepAlive\": 123,\n      \"maxSignalDuration\": 123,\n      \"decreaseCriticalityBasedOnEnv\": true\n    },\n    \"isEnabled\": true\n  },\n  \"timeRangeHours\": 84.5,\n  \"maxRows\": 50.5\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "success": true,
  "rows": 123,
  "executionTimeMs": 123,
  "results": [
    {}
  ],
  "bytesScanned": 123,
  "error": "<string>",
  "datadogRulePreview": {
    "validation": {
      "valid": true,
      "error": "<string>"
    },
    "historicalPreview": {
      "lookbackHours": 2,
      "estimatedSignals": 1,
      "windowsEvaluated": 1,
      "windowsTriggered": 1,
      "severityBreakdown": {},
      "topGroups": [
        {
          "group": {},
          "estimatedSignals": 1
        }
      ],
      "notes": [
        "<string>"
      ]
    }
  },
  "bestEstimate": {
    "count": 1,
    "timeRangeHours": 2,
    "source": "<string>"
  }
}

{
  "error": "<string>",
  "issues": [
    {}
  ]
}

{
  "error": "<string>"
}

{
  "error": "<string>",
  "missingPerms": [
    "<string>"
  ]
}

{
  "error": "<string>"
}