> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Test a detection query

> Execute a detection query and return sample results. Uses limited time range and row count.



## OpenAPI

````yaml https://app.cotool.ai/api/docs/openapi.json post /api/detection-rules/proposals/{id}/test-query
openapi: 3.1.0
info:
  title: Cotool API
  version: 1.0.0
  description: >-
    # Cotool API Documentation


    The Cotool API allows you to interact with the Cotool platform
    programmatically, enabling you to build powerful integrations and automate
    your workflows.


    ## Getting an API Key


    Follow these steps to generate your API key:


    1. **Log in** to the Cotool web interface

    2. **Navigate** to `/settings/api-keys`

    3. **Click** "Generate Key"

    4. **Copy and store** your API key securely ⚠️ *It won't be shown again*


    ## API Key Authentication


    For programmatic access and integrations, use your API key with the
    Authorization header:


    ```http

    Authorization: Bearer your_api_key_here

    ```


    ```bash

    curl -X GET "https://app.cotool.ai/api/endpoint" \
      -H "Authorization: Bearer your_api_key_here" \
      -H "Content-Type: application/json"
    ```
servers:
  - url: https://app.cotool.ai
    description: Production server
security:
  - ApiKeyAuth: []
paths:
  /api/detection-rules/proposals/{id}/test-query:
    post:
      tags:
        - Detection Rules
      summary: Test a detection query
      description: >-
        Execute a detection query and return sample results. Uses limited time
        range and row count.
      parameters:
        - in: path
          name: id
          schema:
            type: string
            format: uuid
          required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  rows:
                    type: number
                    description: >-
                      Total matching rows in the test time window (may exceed
                      returned sample size)
                  bytesScanned:
                    type: number
                  executionTimeMs:
                    type: number
                  results:
                    type: array
                    items:
                      type: object
                      additionalProperties: {}
                  error:
                    type: string
                  datadogRulePreview:
                    type: object
                    properties:
                      validation:
                        type: object
                        properties:
                          valid:
                            type: boolean
                          error:
                            type: string
                        required:
                          - valid
                      historicalPreview:
                        type: object
                        properties:
                          fidelity:
                            type: string
                            enum:
                              - full
                              - partial
                              - query_only
                          lookbackHours:
                            type: integer
                            minimum: 1
                          estimatedSignals:
                            type: integer
                            minimum: 0
                          windowsEvaluated:
                            type: integer
                            minimum: 0
                          windowsTriggered:
                            type: integer
                            minimum: 0
                          severityBreakdown:
                            type: object
                            additionalProperties:
                              type: integer
                              minimum: 0
                          topGroups:
                            type: array
                            items:
                              type: object
                              properties:
                                group:
                                  type: object
                                  additionalProperties:
                                    type: string
                                estimatedSignals:
                                  type: integer
                                  minimum: 0
                              required:
                                - group
                                - estimatedSignals
                          notes:
                            type: array
                            items:
                              type: string
                        required:
                          - fidelity
                          - lookbackHours
                  bestEstimate:
                    type: object
                    properties:
                      count:
                        type: number
                        minimum: 0
                        description: Estimated hit count in the sample window
                      timeRangeHours:
                        type: number
                        minimum: 1
                        description: Time window in hours used for the estimate
                      basis:
                        type: string
                        enum:
                          - estimated_detection_noisiness
                          - sample_query_results
                        description: Source category
                      quality:
                        type: string
                        enum:
                          - authoritative
                          - sampled
                          - fallback
                        description: Estimate confidence
                      source:
                        type: string
                        description: Platform-specific source identifier
                    required:
                      - count
                      - timeRangeHours
                      - basis
                      - quality
                    description: >-
                      Single best platform-specific estimate used to display
                      hits/hr
                required:
                  - success
                  - rows
                  - executionTimeMs
                  - results
        '400':
          description: Bad request — input validation failed or the request was malformed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationError'
        '401':
          description: Unauthorized — missing or invalid API key / session
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Forbidden — the authenticated user lacks the required permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionError'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      x-codeSamples:
        - lang: shell
          label: cURL
          source: >-
            curl -X POST
            "https://app.cotool.ai/api/detection-rules/proposals/:id/test-query"
            \
              -H "Authorization: Bearer YOUR_API_KEY" \
              -H "Content-Type: application/json"
components:
  schemas:
    ValidationError:
      type: object
      properties:
        error:
          type: string
          description: Error message describing what went wrong
        issues:
          type: array
          description: >-
            Detailed validation issues, present when request or response schema
            validation fails
          items:
            type: object
            additionalProperties: true
      required:
        - error
    Error:
      type: object
      properties:
        error:
          type: string
          description: Error message describing what went wrong
      required:
        - error
    PermissionError:
      type: object
      properties:
        error:
          type: string
          description: Error message describing what went wrong
        missingPerms:
          type: array
          description: Permissions the authenticated user is missing for this operation
          items:
            type: string
      required:
        - error
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: >-
        API Key authentication for programmatic access. Include your API key in
        the Authorization header as: `Bearer your_api_key_here`

````