---
title: "Working with the Lookups API"
canonical: "https://docs.devo.com/space/latest/127500334/Working%20with%20the%20Lookups%20API"
format: markdown
---
> Macro (toc)

> Macro (excerpt-include)



## Overview

Check the list of available endpoints and methods in the Lookups API:

| **Endpoints and methods** | **Description** |
| --- | --- |
| [GET]`/lookup/{domain}` <sup>[see below](#path1)</sup> | Display information on the lookups existing on a given domain. |
| [GET]`/lookup/{domain}/{name}` <sup>[see below](#path2)</sup> | Return information of a specific lookup. |
| [GET]`/lookup/{domain}/{name}/job`<sup>[see below](#path3)</sup> | Query the job UUIDs of a specific lookup. |
| [GET] `/lookup/{domain}/{name}/job/{id}`<sup>[see below](#path4)</sup> | Query the statuses of a lookup job. |
| <u>Advanced mode</u><br>[POST]`lookup/{domain}/{name}/deploy-config`<sup>[see below](#path5)</sup> | <u>Advanced mode</u><br>Create a new lookup. |
| [POST]`lookup/{domain}/{name}/deploy-csv`<sup>[see below](#path6)</sup> | Create a new lookup using a CSV (application/json request body) |
| [POST]`lookup/{domain}/{name}/deploy-csv`<sup>[see below](#path7)</sup> | Create a new lookup using a CSV (multipart/form-data request body) |
| [POST]`lookup/{domain}/{name}/deploy-static-query`<sup>[see below](#path8)</sup> | Create a new lookup based on a static query. |
| [POST]`lookup/{domain}/{name}/deploy-periodic-query`<sup>[see below](#path9)</sup> | Create a new lookup based on a periodic query. |
| [POST]`lookup/{domain}/{name}/deploy-sliding-window-query`<sup>[see below](#path10)</sup> | Create a new lookup based on a sliding window query. |
| <u>Advanced mode</u><br>[PUT] `lookup/{domain}/{name}/deploy-config`<sup>[see below](#path11)</sup> | <u>Advanced mode</u><br>Update a specific lookup. |
| [PUT] `lookup/{domain}/{name}/deploy-csv`<sup>[see below](#path12)</sup> | Update a CSV lookup (application/json request body) |
| [PUT] `lookup/{domain}/{name}/deploy-csv`<sup>[see below](#path13)</sup> | Update a CSV lookup (multipart/form-data request body) |
| [PUT] `lookup/{domain}/{name}/deploy-static-query`<sup>[see below](#path14)</sup> | Update a lookup based on a static query. |
| [PUT] `lookup/{domain}/{name}/deploy-periodic-query`<sup>[see below](#path15)</sup> | Update a lookup based on a periodic query. |
| [PUT] `lookup/{domain}/{name}/deploy-sliding-window-query`<sup>[see below](#path16)</sup> | Update a lookup based on a sliding window query. |
| [DELETe]`/lookup/{domain}/{name}`<sup>[see below](#path17)</sup> | Send a request to delete a specific lookup. |

## Endpoints and methods

### > Macro (anchor)

<span style="color: #ff991f">**GET**</span>`/lookup/{domain}`

Display information on the lookups existing on a given domain.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| **Parameter** | **Type ** | **Description** |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain that contains the lookups you want to list. |

#### Query string parameters

Query string parameters are optionally added after the path parameters, preceded by a question mark (`?`) and separated by an ampersand (`&`)

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `max_length` | `integer` | Maximum number of values to return. The default value is `100`. The maximum value is `1000` and the minimum value is `1`.<br>Lookups are shown from oldest to newest. |
| `pageToken` | `integer` | Use this parameter to consider a previously requested list on your next request. This should be set to the value shown in the `nextPageToken` parameter included in the response you want to consider, if successful.<br>For example, you may perform a request and ask for information about the oldest 5 lookups in your domain. Then, you can perform a second request including the value in the `nextPageToken` parameter returned with the previous response and requesting only 2 lookups. This will return the 2 lookups created after the first 5 previously requested.<br>The default and minimum value is `0`. |
| `owner` | `string` | You can filter the lookups in the response based on their domain owner, that is, the domain where the lookup was created. Supported values are:<br>- `THIS_DOMAIN` - Returns only lookups created in the domain indicated in the request URL.
- `OTHER_DOMAINS` - Returns only lookups owned by other domains but visible by the domain indicated in the request URL. This might be the case of domains that belong to a [multitenant structure](https://devodocs.atlassian.net/wiki/spaces/latest/pages/144474118) and have access to lookups defined in other domains that belong to that structure. You can decide the visibility level of a new lookup upon its creation.
- `ANY_DOMAIN` - Returns both lookups owned by the domain indicated in the request URL and those visible by them in other domains.<br>The default value is `THIS_DOMAIN`<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can decide to make a lookup visible in all the domains within the structure when you create it using <span style="color: #36b37e">**POST**</span><span style="color: #ff991f"> </span>`/lookup/{domain}/{name}/deploy-config`. See how to do it [here](#). |

#### Example

Find below a request example in cURL language. This request will return information about the 10 oldest lookups created in the domain indicated. Learn how to authorize your request [in this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500308).

```
curl -H "standAloneToken:YOUR_TOKEN" -X GET https://api-us.devo.com/lookup-api/lookup/myDomain?max_length=10
```

And this request will return information about all the lookups owned by the user domain and also the ones visible to them in other domains:

```
curl -H "standAloneToken:YOUR_TOKEN" -X GET https://api-us.devo.com/lookup-api/lookup/myDomain?owner=ANY_DOMAIN
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. The response includes the list of lookups in the given domain with their details.<br>```
{
  "type": "LookupMetaInfoListResponse",
  "cid": "72078e04ee84",
  "code": 200,
  "context": null,
  "id": "xxxxxxxxxx-0f74-11ee-b13b-4fc634871e5f",
  "msg": "tutorial lookups.",
  "lookups": [
    {
      "name": "Lookup_test_t",
      "domain": "tutorial",
      "fileSize": 12288,
      "numEntries": 136,
      "creationDate": "2023-03-15T13:45:57.63",
      "keyType": {
        "type": "first",
        "columns": null,
        "hasher": null
      },
      "deployConfig": null,
      "lastStatus": null,
      "fields": [
        {
          "column": "domain",
          "type": "str",
          "key": true
        },
        {
          "column": "CDNProvider",
          "type": "str",
          "key": false
        }
      ],
      "owner": "user@devo.com"
    },
    {
      "name": "CDN_Providers",
      "domain": "tutorial",
      "fileSize": 12288,
      "numEntries": 136,
      "creationDate": "2023-03-15T13:45:57.806",
      "keyType": {
        "type": "first",
        "columns": null,
        "hasher": null
      },
      "deployConfig": null,
      "lastStatus": null,
      "fields": [
        {
          "column": "domain",
          "type": "str",
          "key": true
        },
        {
          "column": "CDNProvider",
          "type": "str",
          "key": false
        }
      ],
      "shared": false,
      "owner": "user@devo.com"
    },
    {
      "name": "test_101",
      "domain": "tutorial",
      "fileSize": 40960,
      "numEntries": 307,
      "creationDate": "2023-03-15T13:45:58.338",
      "keyType": {
        "type": "first",
        "columns": null,
        "hasher": null
      },
      "deployConfig": null,
      "lastStatus": null,
      "fields": [
        {
          "column": "alertName",
          "type": "str",
          "key": true
        },
        {
          "column": "alertType",
          "type": "str",
          "key": false
        },
        {
          "column": "alertMitreTactics",
          "type": "str",
          "key": false
        },
        {
          "column": "alertMitreTechniques",
          "type": "str",
          "key": false
        },
        {
          "column": "alertPriority",
          "type": "int4",
          "key": false
        }
      ],
      "owner": "user@devo.com"
    },
    {
      "name": "d14022023api",
      "domain": "tutorial",
      "fileSize": 8192,
      "numEntries": 1,
      "creationDate": "2023-03-15T13:46:58.05",
      "keyType": {
        "type": "first",
        "columns": null,
        "hasher": null
      },
      "deployConfig": null,
      "lastStatus": null,
      "fields": [
        {
          "column": "key",
          "type": "int4",
          "key": true
        },
        {
          "column": "fbool",
          "type": "bool",
          "key": false
        }
      ],
      "owner": null
    }
  ],
  "nextPageToken": -1
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupMetaInfoResponseError",
  "cid": "046ead1c8323",
  "code": 400,
  "context": null,
  "id": "xxxxxx-4fbb-11ed-859a-f19049cfd717"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to list the domain's lookups.<br>```
{
  "error": {
    "code": 401,
    "message": "Unauthorized"
  }
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupMetaInfoResponseError",
  "cid": "e33f677a6981",
  "code": 404,
  "context": null,
  "id": "xxxxxx-504c-11ed-859a-99d2d0713c21",
  "msg": "Not Found"
}
``` |

### > Macro (anchor)

<span style="color: #ff991f">**GET**</span> `/lookup/{domain}/{name}`

Return information of a specific lookup.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain that contains the lookup you want to retrieve. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to get information about. |

#### Example

Find below a request example in cURL language. This request will return information about the lookup called *myLookup* created in the domain indicated. Learn how to authorize your request [in this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500308).

```
curl -H "standAloneToken:YOUR_TOKEN" -X GET https://api-us.devo.com/lookup-api/lookup/myDomain/myLookup
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. The response includes information about the requested lookup.<br>```
{
  "type": "LookupMetaInfoResponse",
  "cid": "3c9bb672512c",
  "code": 200,
  "context": null,
  "id": "xxxxxxxxx-0f75-11ee-b13b-636d49ade562",
  "msg": "tutorial/test_101 meta information.",
  "lookupMetaInfo": {
    "name": "test_101",
    "domain": "tutorial",
    "fileSize": 40960,
    "numEntries": 307,
    "creationDate": "2023-03-15T13:45:58.14",
    "keyType": {
      "type": "first",
      "columns": null,
      "hasher": null
    },
    "deployConfig": null,
    "lastStatus": null,
    "fields": [
      {
        "column": "alertName",
        "type": "str",
        "key": true
      },
      {
        "column": "alertType",
        "type": "str",
        "key": false
      },
      {
        "column": "alertMitreTactics",
        "type": "str",
        "key": false
      },
      {
        "column": "alertMitreTechniques",
        "type": "str",
        "key": false
      },
      {
        "column": "alertPriority",
        "type": "int4",
        "key": false
      }
    ],
    "owner": "user@devo.com"
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupMetaInfoResponseError",
  "cid": "4b6cdd188a82",
  "code": 400,
  "context": null,
  "id": "xxxxxx-5052-11ed-859a-910aa97972a3",
  "msg": "Unsuccessful response. Bad Request."
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to get information about the lookup.<br>```
{
  "error": {
    "code": 401,
    "message": "Unauthorized"
  }
}
``` |
| 404 | Unsuccessful response. Lookup not found.<br>```
{
  "type": "LookupMetaInfoResponseError",
  "cid": "e33f677a6981",
  "code": 404,
  "context": null,
  "id": "xxxxxx-504c-11ed-859a-99d2d0713c21",
  "msg": "Not Found"
}
``` |

### > Macro (anchor)

<span style="color: #ff991f">**GET**</span> `/lookup/{domain}/{name}/job`

Query the job UUIDs (Universally Unique IDentifier) of a specific lookup. A new job is created for each create, update or delete process that is initiated. Each job is identified by a unique ID, or UUID.

You will get the last 10 UUIDs for the requested lookup. The list is ordered chronologically being the first job UUID the oldest and the last one the newest.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain that contains the required lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the required lookup. |

#### Example

Find below a request example in cURL language. This request will return information about the last jobs generated by the lookup called *myLookup* created in the domain indicated. Learn how to authorize your request [in this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500308).

```
curl -H "standAloneToken:YOUR_TOKEN" -X GET https://api-us.devo.com/lookup-api/lookup/myDomain/myLookup/job
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. Returns the job UUIDs of the given lookup.<br>```
{
  "cid": "e47f4ab72ded",
  "code": 200,
  "context": null,
  "id": "xxxxxxxx-e37c-11ed-b5ea-0242ac120002",
  "msg": "Lookup job uuids",
  "jobs": [
    "xxxxxxx-c9a2-489c-8794-ea656a19b822",
    "xxxxxxx-9714-48a7-9976-73e41523edfd",
    "xxxxxxx-48a8-46ea-ab22-e0a5458e302b",
    "xxxxxxx-ad7e-4fe6-bb43-89f93e629d76"
  ]
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupMetaInfoResponseError",
  "cid": "6cde7fd6a1f4",
  "code": 400,
  "context": null,
  "id": "xxxxxxx-53a2-11ed-859a-33f9a0bb845a",
  "msg": "Unsuccessful response. Bad Request."
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to access the lookup<br>```
{
  "error": {
    "code": 401,
    "message": "Unauthorized"
  }
}
``` |

### > Macro (anchor)

<span style="color: #ff991f">**GET**</span> `/lookup/{domain}/{name}/job/{id}`

Query the statuses of a lookup job given its UUID. You can get a job UUID using the request explained above.

You will get the last 50 statuses for the requested lookup job. The list is ordered chronologically being the first status the oldest and the last one the newest.

 These are the possible status codes you may get in your response:

| **Code** | **Status** |
| --- | --- |
| `create.start` | Lookup creation started. |
| `create.ok` | Lookup successfully created. |
| `create.err` | Error creating lookup. |
| `push.start` | Lookup synchronous upload started. |
| `push.ok` | Successful lookup synchronous upload. |
| `push.err` | Lookup synchronous upload failed. |
| `deploy.start` | Lookup asynchronous upload started. |
| `deploy.ok` | Successful lookup asynchronous upload started. |
| `deploy.err` | Lookup asynchronous upload failed. |
| `del.start` | Lookup deletion started. |
| `del.ok` | Lookup successfully deleted. |
| `del.err` | Error deleting lookup. |

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain that contains the required lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the required lookup. |
| `id` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the UUID of the required lookup job. You can get a job UUID using the request explained above, under the `jobs` parameter in the response. |

#### Example

Find below a request example in cURL language. This request will return information about the lookup called *myLookup* created in the domain indicated. Learn how to authorize your request [in this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500308).

```
curl -H "standAloneToken:YOUR_TOKEN" -X GET https://api-us.devo.com/lookup-api/lookup/myDomain/myLookup/job/123456
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. Returns the job statuses.<br>```
{
  "cid": "e47f4ab72ded",
  "code": 200,
  "context": null,
  "id": null,
  "msg": "Lookup job's statuses",
  "status": [
    {
      "eventdata": "2021-09-29T10:18:10.805",
      "domain": "galactic_empire",
      "lookup": "ImperialIntranetActivity",
      "msg": "Lookup successfully created"
      "code": "create.ok"
    },
    {
      "eventdata": "2021-09-29T10:18:12.472",
      "domain": "ImperialIntranetActivity",
      "lookup": "test-schedule",
      "msg": "Lookup ready to be executed"
      "code": "deploy.ok"
    }
  ]
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupJobsError",
  "cid": "4d1eb85a908d",
  "code": 400,
  "context": null,
  "id": "xxxxxx-53a4-11ed-859a-2d69d242a54f",
  "msg": "Unsuccessful response. Bad Request."
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to access the lookup<br>```
{
  "error": {
    "code": 401,
    "message": "Unauthorized"
  }
}
``` |

### > Macro (anchor)

<span style="color: #36b37e">**POST**</span><span style="color: #ff991f"> </span>`/lookup/{domain}/{name}/deploy-config`

Create a new lookup.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the new lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the new lookup. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

- [id](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#post.id)
- [visibility](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#post.visibility)
- [recipe](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#post.recipe)
- [notifyStatus](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#post.status)

---

> Macro (anchor)



`id` - Lookup ID object.

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `creator` | `string` | Domain of the lookup. |
| `name` | `string` | Name of the lookup. |

Example value:

```
"id": {
  "creator": "demo",
  "name": "ForceSensitiveBeings"
}
```

---

> Macro (anchor)



`visibility` - `(string)` Visibility level of the lookup. Allowed values are:

- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.

> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure.

---

> Macro (anchor)

  

`recipe` <sup><span style="color: #ff5630">required </span></sup>- Recipe of the lookup to be created.

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `recipeType` <sup><span style="color: #ff5630">required</span></sup> | `string` | Type of the lookup recipe. Allowed values are `once` (static lookup) and `periodic` (periodic lookup). Learn more about lookup types [in this article](https://docs.devo.com/space/latest/95203983/Data+enrichment). |
| `source` <sup><span style="color: #ff5630">required</span></sup> | `object` | Source data of the lookup to be created. This object states if the lookup will be created using a query (using the `query` field), or through a CSV file stored in AWS S3 (using the `fileProvider` field).<br>> ⚠️ Check more about uploading a lookup using a CSV through S3, see [this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/216825984).<br>- `columns` - (`array`) Array of lookup column descriptors. Only used and required in CSV sources with `fileProvider` parameter informed and `query` parameter empty. Each column object may contain the following parameters:
  - `name` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Name of the column.
  - `from` - (`integer`) 0-based index of the column in the CSV.
  - `type` - (`string`) Data type of the column. Possible values are:
    - `BOOLEAN`
    - `STRING`
    - `INT4`
    - `INT8`
    - `FLOAT4`
    - `FLOAT8`
    - `HEX4`
    - `HEX8`
    - `IP4`
    - `IP6`
    - `TIMESTAMP`
    - `DURATION`
- `skipPreface` - (`string`) Enter a regular expression to ignore rows of data in a CSV used as source that follow the structure indicated in the regex. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `hasHeader` - (`boolean`) Indicate if the source CSV file has a header row or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `skipEmptyLines` - (`boolean`) Indicate if you want to skip empty lines in the source CSV or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `fileProvider` - (`array`) Info to get the CSV file from S3.
  - `bucketName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Name of the S3 bucket where the CSV is located.
  - `keyName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Path of the CSV in the bucket.
  - `transferOwnership` <sup><span style="color: #ff5630">required</span></sup> (`boolean`) - Set this parameter to `true` if you want to transfer the CSV ownership to Devo and delete it from the bucket once the lookup is created.
  - `accessKey` - (`string`) - The access key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
  - `secretKey` - (`string`) - The secret key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
  - `host` - (`string`) - The S3 bucket host where the CSV is located.
  - `port` - (`integer`) - The S3 bucket port where the CSV is located.
  - `region` - (`string`) - The AWS region where the S3 bucket has been created.
- `query` - (`string`) Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:
  - `boolean`
  - `string`
  - `int4`
  - `int8`
  - `float4`
  - `float8`
  - `hex4`
  - `hex8`
  - `ip4`
  - `ip6`
  - `timestamp`
  - `duration` |
| `lookupType` | `object` | Indicate the lookup type.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Valid values are `normal` (regular lookups) and `historic` ([time range lookups](https://docs.devo.com/space/latest/95204060/Create+a+lookup+table+from+a+query#Time-range-lookups)).
- `instantPolicy` - (`string`) Defines how to calculate the instant of each row. Only used when the generated lookup type is `historic`. Possible values are:
  - `natural` - The associated source must be historical and the instant of each row will be used.
  - `const` - The instance of all rows will be the supplied constant value.
  - `column` - The instance will be extracted from the column with the given name. That column type must be `timestamp`.
- `instant` - (`number`) Only for `historic` lookups of type `const`.
- `columnName` - (`string`) Only for `historic` lookups of type `column`. |
| `append`<sup><span style="color: #bf2600"> </span></sup> | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation.<br>However, note that if there is no previous lookup or the recipe is updated (that is to say, the query is modified), this property will be ignored and the lookup will be recreated.<br>The default value is `false`. |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `columnFilter` | `array` | If not null, a white list of columns will be projected. All elements of the list must be defined by the source. Columns whose name is not on this list won't be projected. |
| `contribution` | `object` | Defines how a row contributes to the final result, normally used on incremental lookups.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the contribution policy. Values can be `add`, `del`or `col`. The default value is `add`.
- `name` - (`string`) The contribution will be extracted from the column with the given name. That column type must be `string` and its valid values are `add` and `delete`. |
| `secondaryIndexes` | `object` | Columns of a lookup indexed as secondary indexes.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the secondary indexes to be applied to the lookup. Values can be `all`, `none` or `by-name`. The default value is `none`.
- `map` - Map of column names to be applied as secondary indexes when the type selected is `by-name`. |
| `refreshMillis` | `number` | Refresh time of the lookup. Can only be used and is required if the recipe `type` chosen is `periodic`. |
| `startMillis` | `number` | Millis since Epoch. Can only be used and is required if the recipe `type` chosen is `periodic`. |
| `requiresDate` | `boolean` | If `true`, the source query will be enriched with a closed date range restriction. The lower bound will be the maximum between `startMillis` and the last job instant, and the upper bound will be always `now()`. Can only be used if the recipe type chosen is `periodic`. The default value is `false`. |

---

> Macro (anchor)

  

`notifyStatus`- (`boolean`) If `true`, a notification will be sent to the Devo app once the lookup is executed. If you do not include this parameter, it will be `false` by default.

---

Check below an example of request body:

```
{
  "id": {
    "creator": "rebel_alliance",
    "name": "TotallyNotFakeData"
  },
  "recipe": {
    "recipeType": "once",
    "source": {
      "query": "select 0 as key, false as IsDataFake, 2147483647 as RebelsImprisoned, 9223372036854775807 as CreditsOnImperialBanks, hex4('fffffff') as Hex4Emperor, hex8('fffffffffffffff') as Hex8Vader, 2.718281828459045 as EmperorClones, 3.141592653589793 as Pi, 87.219.9.157 as EmperorIP4, ip6('fe80::4492:bc4b:7a53:c0d5') as EmperorIP6, 0m as TimeAfterBattleOfYavin from siem.logtrust.web.navigation where now()-1m < eventdate < now() limit 1"
    },
    "lookupType": {
      "type": "normal"
    },
    "append": false,
    "key": {
      "type": "column",
      "column": "key"
    },
    "columnFilter": [
      "key",
      "IsDataFake",
      "RebelsImprisoned",
      "CreditsOnImperialBanks",
      "Hex4Emperor",
      "Hex8Vader",
      "EmperorClones",
      "Pi",
      "EmperorIP4",
      "EmperorIP6",
      "TimeAfterBattleOfYavin"
    ],
    "contribution": {
      "type": "add"
    },
    "requiresDate": false
  }
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the creation request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d41c91a21d56",
  "code": 201,
  "context": null,
  "id": "xxxxxx-2201-11ec-b04a-53c6289921cb",
  "msg": "Lookup sent to creation",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": "creator-only",
    "recipe": {
      "type": "once",
      "source": {
        "query": "select eventdate, level, domain, userid, sessionid, correlationId from siem.logtrust.web.activity where now()-1m < eventdate < now()"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": false,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": [
        "eventdate",
        "level",
        "domain",
        "userid",
        "sessionid",
        "correlationId"
      ],
      "contribution": {
        "type": "add"
      }
    }
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": "BAD_REQUEST",
  "id": "xxxxxx-5151-11ed-859a-5d2974203ed5",
  "message": "Bad Request"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to create a lookup.<br>```
{
  "error": {
    "code": 401,
    "message": "Unauthorized"
  }
}
``` |
| 403 | Unsuccessful response. User credentials are correct but does not have permission to create this lookup.<br>```
{
  "type": "LookupCreationError",
  "cid": "9a3eda1848d1",
  "code": 403,
  "context": "FORBIDDEN",
  "id": "xxxxxx5055-11ed-859a-7b524e50491a",
  "msg": "User is not authorized to perform operations in the domain."
}
``` |

### > Macro (anchor)

<span style="color: #36b37e">** POST**</span><span style="color: #ff991f"> </span>`/lookup/{domain}/{name}/deploy-csv`

Simplified endpoint to create a new lookup from a CSV file (application/json request body).

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to create. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure.<br>> Macro (excerpt-include) |
| `columns` <sup><span style="color: #ff5630">required</span></sup> | `array` | Array of lookup column descriptors. Each column object may contain the following parameters:<br>- `name` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Name of the column.
- `from` - (`integer`) 0-based index of the column in the CSV.
- `type` - (`string`) Data type of the column. Possible values are:
  - `BOOLEAN`
  - `STRING`
  - `INT4`
  - `INT8`
  - `FLOAT4`
  - `FLOAT8`
  - `HEX4`
  - `HEX8`
  - `IP4`
  - `IP6`
  - `TIMESTAMP`
  - `DURATION` |
| `fileProvider` | `array` | Info to get the CSV file from S3.<br>- `bucketName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Name of the S3 bucket where the CSV is located.
- `keyName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Path of the CSV in the bucket.
- `transferOwnership` <sup><span style="color: #ff5630">required</span></sup> (`boolean`) - Set this parameter to `true` if you want to transfer the CSV ownership to Devo and delete it from the bucket once the lookup is created.
- `accessKey` - (`string`) - The access key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
- `secretKey` - (`string`) - The secret key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
- `host` - (`string`) - The S3 bucket host where the CSV is located.
- `port` - (`integer`) - The S3 bucket port where the CSV is located.
- `region` - (`string`) - The AWS region where the S3 bucket has been created. |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `skipPreface` | `string` | Enter a regular expression to ignore rows of data in a CSV used as source that follow the structure indicated in the regex. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty. |
| `hasHeader` | `boolean` | Indicate if the source CSV file has a header row or not. Only used in CSV sources with fileProvider parameter informed and query parameter empty. Default value is `false`. |
| `skipEmptyLines` | `boolean` | Indicate if you want to skip empty lines in the source CSV or not. Only used in CSV sources with fileProvider parameter informed and query parameter empty. Default value is `false`. |
| `contribution` | `object` | Defines how a row contributes to the final result, normally used on incremental lookups.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the contribution policy. Values can be `add`, `del`or `col`. The default value is `add`.
- `name` - (`string`) The contribution will be extracted from the column with the given name. That column type must be `string` and its valid values are `add` and `delete` |
| `keepHistory` | `boolean` | If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the specified column as time instant reference for the data provided. |
| `append` | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |

Check below an example of request body:

```
{
  "columns": [
    {
      "name": "ID",
      "type": "INT8"
    },
    {
      "name": "Location",
      "type": "STRING"
    },
    {
      "name": "Age",
      "type": "FLOAT8"
    },
    {
      "name": "Species",
      "type": "STRING"
    },
    {
      "name": "MidiclorianLevel",
      "type": "FLOAT4"
    }
  ],
  "key": {
    "type": "column",
    "column": "ID"
  },
  "fileProvider": {
    "bucketName": "holocrons-bucket",
    "keyName": "secrets/data/force-sensitive-beings.csv",
    "transferOwnership": true
  }
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "columns": [
          {
            "name": "ID",
            "type": "INT8"
          },
          {
            "name": "Location",
            "type": "STRING"
          },
          {
            "name": "Age",
            "type": "FLOAT8"
          },
          {
            "name": "Species",
            "type": "STRING"
          },
          {
            "name": "MidiclorianLevel",
            "type": "FLOAT4"
          }
        ],
        "fileProvider": {
          "bucketName": "holocrons-bucket",
          "keyName": "secrets/data/force-sensitive-beings.csv",
          "transferOwnership": true
        },
        "skipPreface": null,
        "hasHeader": false,
        "skipEmptyLines": false
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": null,
      "startMillis": null,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "KeyAlgorithm values can be 'first-column', 'column', 'row-hash', 'col-hash' and 'seq'"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-csv' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |
| 409 | Unsuccessful response. Lookup already exists.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 409,
  "context": null,
  "id": "9b6b0f0e-b162-11ee-b3ab-77fd619670ef",
  "msg": "Lookup with domain galactic_empire and name destroyed_planets already exists"
}
``` |

### > Macro (anchor)

<span style="color: #36b37e">**POST**</span><span style="color: #ff991f"> </span>`/lookup/{domain}/{name}/deploy-csv`

Simplified endpoint to create a new lookup from a CSV file (multipart/form-data request body).

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to create. |

#### Request body

The request multipart/form-data body must include the CSV file and an associated JSON configuration object. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `deploy-config` | `object` | Deploy CSV configuration of the lookup to be created. This object states the `visibility` of the created lookup, the `fileProvider` indicating the CSV file stored in AWS S3, the `column` descriptors and `key`. It also includes metainfo from the CSV.<br>- `visibility` - (`string`) Visibility level of the lookup. Allowed values are:
  - `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
  - `all-subdomains` - (`string`) The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.
- `columns` <sup><span style="color: #bf2600">required </span></sup>- (`array`) Array of lookup column descriptors. Only used and required in CSV sources with `fileProvider` parameter informed and `query` parameter empty. Each column object may contain the following parameters:
  - `name` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Name of the column.
  - `from` - (`integer`) 0-based index of the column in the CSV.
  - `type` - (`string`) Data type of the column. Possible values are:
    - `BOOLEAN`
    - `STRING`
    - `INT4`
    - `INT8`
    - `FLOAT4`
    - `FLOAT8`
    - `HEX4`
    - `HEX8`
    - `IP4`
    - `IP6`
    - `TIMESTAMP`
    - `DURATION`
- `fileProvider` - (`array`) Info to get the CSV file from S3.
  - `bucketName`<sup><span style="color: #bf2600">required</span></sup> - (`string`) The name of the S3 bucket where the CSV is located.
  - `keyName`<sup><span style="color: #bf2600">required</span></sup><sup> </sup>- (`string`) The path of the CSV inside the bucket.
  - `transferOwnership`<sup><span style="color: #bf2600">required</span></sup> - (`boolean`) This parameter represents whether Lomana should act as the owner of the CSV and delete it from the bucket once it has finished creating the lookup.
  - `accessKey` - (`string`) The access key of a customers AWS user with permissions to access the bucket represented in bucketName.
  - `secretKey` - (`string`) The secret key of a customers AWS user with permissions to access the bucket represented in bucketName.
  - `host` - (`string`) The S3 bucket host where to find the CSV.
  - `port` - (`integer`) The S3 bucket port where to find the CSV.
  - `region` - (`string`) The AWS region whether the S3 bucket has been created.
- `key` - (`string`) In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.
  - `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
  - `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
  - `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`). Type of key algorithm. Values can be:
    - `first-column` - The first column of the lookup will be used as key. This is the default value.
    - `column` - The column indicated in the `column` parameter will be used as key.
    - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
    - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
    - `seq` - The key of the lookup will be generated sequentially.
- `skipPreface` - (`string`) Enter a regular expression to ignore rows of data in a CSV used as source that follow the structure indicated in the regex. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `hasHeader` - (`boolean`) Indicate if the source CSV file has a header row or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `skipEmptyLines` - (`boolean`) Indicate if you want to skip empty lines in the source CSV or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `contribution` - (`array`) Defines how a row contributes to the final result, normally used on incremental lookups.
  - `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the contribution policy. Values can be `add`, `del`or `col`. The default value is `add`.
  - `name` - (`string`) The contribution will be extracted from the column with the given name. That column type must be `string` and its valid values are `add` and `delete`
- `keepHistory` - (`boolean`) If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`.
- `columnTypeReference`- (`string`) If given, the Lookup Manager will use the specified column as time instant reference for the data provided.
- `append`- (`boolean`) If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |
| `csv` | `file` | CSV file to upload. Only needed if the file was not uploaded to S3.<br>> ⚠️ Check more about uploading a lookup using a CSV through S3, see [this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/216825984). |

Check below an example of request body:

```
{
  "deploy-config": {
    "externalValue": "https://devo.com/main/files/simple-lookup-with-header/deploy-csv.json"
  },
  "csv": {
    "externalValue": "https://devo.com/main/files/simple-lookup-with-header/simple_lookup.csv"
  }
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "columns": [
          {
            "name": "ID",
            "type": "INT8"
          },
          {
            "name": "Location",
            "type": "STRING"
          },
          {
            "name": "Age",
            "type": "FLOAT8"
          },
          {
            "name": "Species",
            "type": "STRING"
          },
          {
            "name": "MidiclorianLevel",
            "type": "FLOAT4"
          }
        ],
        "fileProvider": {
          "bucketName": "holocrons-bucket",
          "keyName": "secrets/data/force-sensitive-beings.csv",
          "transferOwnership": true
        },
        "skipPreface": null,
        "hasHeader": false,
        "skipEmptyLines": false
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": null,
      "startMillis": null,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "KeyAlgorithm values can be 'first-column', 'column', 'row-hash', 'col-hash' and 'seq'"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-csv' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |
| 409 | Unsuccessful response. Lookup already exists.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 409,
  "context": null,
  "id": "9b6b0f0e-b162-11ee-b3ab-77fd619670ef",
  "msg": "Lookup with domain galactic_empire and name destroyed_planets already exists"
}
``` |

### > Macro (anchor)

<span style="color: #36b37e">**POST**</span><span style="color: #ff991f"> </span>`/lookup/{domain}/{name}/deploy-static-query`

Simplified endpoint to create a new lookup based on a static query.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to create. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure. |
| `query` <sup><span style="color: #ff5630">required</span></sup> | `string` | Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:<br>- `boolean`
- `string`
- `int4`
- `int8`
- `float4`
- `float8`
- `hex4`
- `hex8`
- `ip4`
- `ip6`
- `timestamp`
- `duration` |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `keepHistory` | `boolean` | If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the specified column as time instant reference for the data provided. |
| `append` | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |

Check below an example of request body:

```
{
  "visibility": {
    "type": "creator-only"
  },
  "query": "select userid, domain from siem.logtrust.web.navigation where now()-1d < eventdate < now()",
  "key": {
    "type": "column",
    "column": "userid"
  },
  "keepHistory": false,
  "columnTimeReference": null
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "once",
      "source": {
        "query": "select eventdate, level, domain, userid, sessionid, correlationId from siem.logtrust.web.activity where now()-1m < eventdate < now()"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": false,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": [
        "eventdate",
        "level",
        "domain",
        "userid",
        "sessionid",
        "correlationId"
      ],
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      }
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "KeyAlgorithm values can be 'first-column', 'column', 'row-hash', 'col-hash' and 'seq'"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-static-query' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |
| 409 | Unsuccessful response. Lookup already exists.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 409,
  "context": null,
  "id": "9b6b0f0e-b162-11ee-b3ab-77fd619670ef",
  "msg": "Lookup with domain galactic_empire and name destroyed_planets already exists"
}
``` |

### > Macro (anchor)

<span style="color: #36b37e">** POST**</span><span style="color: #ff991f"> </span>`/lookup/{domain}/{name}/deploy-periodic-query`

Simplified endpoint to create a new lookup based on a periodic query.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to create. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queryable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure. |
| `query` <sup><span style="color: #ff5630">required</span></sup> | `string` | Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:<br>- `boolean`
- `string`
- `int4`
- `int8`
- `float4`
- `float8`
- `hex4`
- `hex8`
- `ip4`
- `ip6`
- `timestamp`
- `duration` |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `refreshPeriod` | `string` | Refresh period of the lookup. Defaults to grouping period of the query in case it is a grouping query, or 5 minutes if not. Accepted values are the ones accepted by Devo's duration type.<br>The minimum value accepted is 1 minute. |
| `startDate` | `string` | Lookup creation start date. Defaults to the time of the request. Can either be an ISO-8601 date time string or a number of milliseconds from Epoch. |
| `append` | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |
| `keepHistory` | `boolean` | If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the specified column as time instant reference for the data provided. |

Check below an example of request body:

```
{
  "visibility": {
    "type": "creator-only"
  },
  "query": "select userid, domain from siem.logtrust.web.navigation where now()-5m < eventdate < now()",
  "key": {
    "type": "column",
    "column": "userid"
  },
  "refreshPeriod": "5m",
  "startDate": "2023-12-12T00:00:00.00Z",
  "append": true
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "query": "select eventdate, level, domain, userid, sessionid, correlationId from siem.logtrust.web.activity where now()-1m < eventdate < now()"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": 300000,
      "startMillis": 1702339200000,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "refreshPeriod should be bigger than 1 minute"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-periodic-query' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |
| 409 | Unsuccessful response. Lookup already exists.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 409,
  "context": null,
  "id": "9b6b0f0e-b162-11ee-b3ab-77fd619670ef",
  "msg": "Lookup with domain galactic_empire and name destroyed_planets already exists"
}
``` |

### > Macro (anchor)

<span style="color: #36b37e">**POST**</span><span style="color: #ff991f"> </span>`/lookup/{domain}/{name}/deploy-sliding-window-query`

Simplified endpoint to create a new lookup based on a sliding window query.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to create. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure. |
| `query` <sup><span style="color: #ff5630">required</span></sup> | `string` | Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:<br>- `boolean`
- `string`
- `int4`
- `int8`
- `float4`
- `float8`
- `hex4`
- `hex8`
- `ip4`
- `ip6`
- `timestamp`
- `duration` |
| `key`<sup><span style="color: #bf2600">required</span></sup> | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `windowSize`<sup><span style="color: #bf2600">required</span></sup> | `string` | Size of the sliding window. Every time the query is executed, the lookup will contain the size of the window. Accepted values are the ones accepted by Devo duration type. The minimum value accepted is 1 hour (Example: Xh, Xd). |
| `refreshPeriod` <sup><span style="color: #bf2600">required</span></sup> | `string` | Lookup refresh period. Defaults to querys grouping period in case of a grouping query, or 5 minutes if not. Accepted values are the ones accepted by Devo duration type. The minimum value accepted is 1 minute (Example: Xm, Xh, Xd). |
| `startDate` | `string` | Lookup creation start date. Defaults to the time of the request. Can either be an ISO-8601 date time string or a number of milliseconds from Epoch. |
| `keepHistory` | `boolean` | If set to `true`, the Lookup Manager will store all historic data in the lookup, enabling historic search. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the column specified as time instant reference for the data provided. |

Check below an example of request body:

```
{
    "visibility": {
      "type": "creator-only"
    },
    "query": "from box.unix group by machine, srcIp",
    "key": {
        "type": "column",
        "column": "machine"
    },
    "windowSize": "30d",
    "refreshPeriod" : "5m"
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 200,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "query": "select userid, domain from siem.logtrust.web.activity"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "userid"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": 600000,
      "startMillis": 1702339200000,
      "slideWindow": 86400000,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "refreshPeriod should be bigger than 1 minute"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-sliding-window-query' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |
| 409 | Unsuccessful response. Lookup already exists.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 409,
  "context": null,
  "id": "9b6b0f0e-b162-11ee-b3ab-77fd619670ef",
  "msg": "Lookup with domain galactic_empire and name destroyed_planets already exists"
}
``` |

### > Macro (anchor)

<span style="color: #00b8d9">**PUT**</span><span style="color: #36b37e"> </span>`lookup/{domain}/{name}/deploy-config`

Update a specific lookup.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where that contains the lookup you want to update. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to update. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

- [id](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#put.id)
- [visibility](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#put.visibility)
- [recipe](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#put.recipe)
- [notifyStatus](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500334#put.status)

---

> Macro (anchor)



`id` - Lookup ID object.

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `creator` | `string` | Domain of the lookup. |
| `name` | `string` | Name of the lookup. |

Example value:

```
"id": {
  "creator": "demo",
  "name": "ForceSensitiveBeings"
}
```

---

> Macro (anchor)



`visibility` - `(string)` Visibility level of the lookup. Allowed values are:

- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain.. Only multitenant Admin users will be able to use this value.

---

> Macro (anchor)

  

`recipe` <sup><span style="color: #ff5630">required </span></sup>- Recipe of the lookup to be updated.

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `recipeType` <sup><span style="color: #ff5630">required</span></sup> | `string` | Type of the lookup recipe. Allowed values are `once` (static lookup) and `periodic` (periodic lookup). Learn more about lookup types [in this article](https://docs.devo.com/space/latest/95203983/Data+enrichment). |
| `source` <sup><span style="color: #ff5630">required</span></sup> | `object` | Source data of the lookup to be created. This object states if the lookup will be created using a query (using the `query` field), or through a CSV file stored in AWS S3 (using the `fileProvider` field).<br>- `columns` - (`array`) Array of lookup column descriptors. Only used and required in CSV sources with `fileProvider` parameter informed and `query` parameter empty. Each column object may contain the following parameters:
  - `name` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Name of the column.
  - `from` - (`integer`) 0-based index of the column in the CSV.
  - `type` - (`string`) Data type of the column. Possible values are:
    - `BOOLEAN`
    - `STRING`
    - `INT4`
    - `INT8`
    - `FLOAT4`
    - `FLOAT8`
    - `HEX4`
    - `HEX8`
    - `IP4`
    - `IP6`
    - `TIMESTAMP`
    - `DURATION`
- `skipPreface` - (`string`) Enter a regular expression to ignore rows of data in a CSV used as source that follow the structure indicated in the regex. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `hasHeader` - (`boolean`) Indicate if the source CSV file has a header row or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `skipEmptyLines` - (`boolean`) Indicate if you want to skip empty lines in the source CSV or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `fileProvider` - (`array`) Info to get the CSV file from S3.
  - `bucketName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Name of the S3 bucket where the CSV is located.
  - `keyName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Path of the CSV in the bucket.
  - `transferOwnership` <sup><span style="color: #ff5630">required</span></sup> (`boolean`) - Set this parameter to `true` if you want to transfer the CSV ownership to Devo and delete it from the bucket once the lookup is created.
  - `accessKey` - (`string`) - The access key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
  - `secretKey` - (`string`) - The secret key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
  - `host` - (`string`) - The S3 bucket host where the CSV is located.
  - `port` - (`integer`) - The S3 bucket port where the CSV is located.
  - `region` - (`string`) - The AWS region where the S3 bucket has been created.
- `query` - (`string`) Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:
  - `boolean`
  - `string`
  - `int4`
  - `int8`
  - `float4`
  - `float8`
  - `hex4`
  - `hex8`
  - `ip4`
  - `ip6`
  - `timestamp`
  - `duration` |
| `lookupType` | `object` | Indicate the lookup type.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Valid values are `normal` (regular lookups) and `historic` ([time range lookups](https://docs.devo.com/space/latest/95204060/Create+a+lookup+table+from+a+query#Time-range-lookups)).
- `instantPolicy` - (`string`) Defines how to calculate the instant of each row. Only used when the generated lookup type is `historic`. Possible values are:
  - `natural` - The associated source must be historical and the instant of each row will be used.
  - `const` - The instance of all rows will be the supplied constant value.
  - `column` - The instance will be extracted from the column with the given name. That column type must be `timestamp`.
- `instant` - (`number`) Only for `historic` lookups of type `const`.
- `columnName` - (`string`) Only for `historic` lookups of type `column`. |
| `append`<sup><span style="color: #bf2600"> </span></sup> | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation.<br>However, note that if there is no previous lookup or the recipe is updated (that is to say, the query is modified), this property will be ignored and the lookup will be recreated.<br>The default value is `false`. |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `columnFilter` | `array` | If not null, a white list of columns will be projected. All elements of the list must be defined by the source. Columns whose name is not on this list won't be projected. |
| `contribution` | `object` | Defines how a row contributes to the final result, normally used on incremental lookups.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the contribution policy. Values can be `add`, `del`or `col`. The default value is `add`.
- `name` - (`string`) The contribution will be extracted from the column with the given name. That column type must be `string` and its valid values are `add` and `delete`. |
| `secondaryIndexes` | `object` | Columns of a lookup indexed as secondary indexes.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the secondary indexes to be applied to the lookup. Values can be `all`, `none` or `by-name`. The default value is `none`.
- `map` - Map of column names to be applied as secondary indexes when the type selected is `by-name`. |
| `refreshMillis` | `number` | Refresh time of the lookup. Can only be used and is required if the recipe `type` chosen is `periodic`. |
| `startMillis` | `number` | Millis since Epoch. Can only be used and is required if the recipe `type` chosen is `periodic`. |
| `requiresDate` | `boolean` | If `true`, the source query will be enriched with a closed date range restriction. The lower bound will be the maximum between `startMillis` and the last job instant, and the upper bound will be always `now()`. Can only be used if the recipe type chosen is `periodic`. The default value is `false`. |

---

> Macro (anchor)

  

`notifyStatus`- (`boolean`) If `true`, a notification will be sent to the Devo app once the lookup is executed. If you do not include this parameter, it will be `false` by default.

---

Check below an example of request body:

```
{
  "id": {
    "creator": "rebel_alliance",
    "name": "TotallyNotFakeData"
  },
  "recipe": {
    "recipeType": "once",
    "source": {
      "query": "select 0 as key, false as IsDataFake, 2147483647 as RebelsImprisoned, 9223372036854775807 as CreditsOnImperialBanks, hex4('fffffff') as Hex4Emperor, hex8('fffffffffffffff') as Hex8Vader, 2.718281828459045 as EmperorClones, 3.141592653589793 as Pi, 87.219.9.157 as EmperorIP4, ip6('fe80::4492:bc4b:7a53:c0d5') as EmperorIP6, 0m as TimeAfterBattleOfYavin from siem.logtrust.web.navigation where now()-1m < eventdate < now() limit 1"
    },
    "lookupType": {
      "type": "normal"
    },
    "append": false,
    "key": {
      "type": "column",
      "column": "key"
    },
    "columnFilter": [
      "key",
      "IsDataFake",
      "RebelsImprisoned",
      "CreditsOnImperialBanks",
      "Hex4Emperor",
      "Hex8Vader",
      "EmperorClones",
      "Pi",
      "EmperorIP4",
      "EmperorIP6",
      "TimeAfterBattleOfYavin"
    ],
    "contribution": {
      "type": "add"
    },
    "requiresDate": false
  }
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d41c91a21d56",
  "code": 201,
  "context": null,
  "id": "xxxxxx-2201-11ec-b04a-53c6289921cb",
  "msg": "Lookup sent to creation",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": "creator-only",
    "recipe": {
      "type": "once",
      "source": {
        "query": "select eventdate, level, domain, userid, sessionid, correlationId from siem.logtrust.web.activity where now()-1m < eventdate < now()"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": false,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": [
        "eventdate",
        "level",
        "domain",
        "userid",
        "sessionid",
        "correlationId"
      ],
      "contribution": {
        "type": "add"
      }
    }
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": "BAD_REQUEST",
  "id": "xxxxxx-5151-11ed-859a-5d2974203ed5",
  "message": "Bad Request"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "error": {
    "code": 401,
    "message": "Unauthorized"
  }
}
``` |
| 403 | Unsuccessful response. User credentials are correct but does not have permission to update this lookup.<br>```
{
  "type": "LookupCreationError",
  "cid": "9a3eda1848d1",
  "code": 403,
  "context": "FORBIDDEN",
  "id": "xxxxxx5055-11ed-859a-7b524e50491a",
  "msg": "User is not authorized to perform operations in the domain."
}
``` |

### > Macro (anchor)

<span style="color: #00b8d9">**PUT**</span><span style="color: #36b37e"> </span>`lookup/{domain}/{name}/deploy-csv`

Update a CSV lookup (application/json request body).

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the domain name of the lookup you want to update. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to update. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure. |
| `columns` <sup><span style="color: #ff5630">required</span></sup> | `array` | Array of lookup column descriptors. Each column object may contain the following parameters:<br>- `name` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Name of the column.
- `from` - (`integer`) 0-based index of the column in the CSV.
- `type` - (`string`) Data type of the column. Possible values are:
  - `BOOLEAN`
  - `STRING`
  - `INT4`
  - `INT8`
  - `FLOAT4`
  - `FLOAT8`
  - `HEX4`
  - `HEX8`
  - `IP4`
  - `IP6`
  - `TIMESTAMP`
  - `DURATION` |
| `fileProvider` | `array` | Info to get the CSV file from S3.<br>- `bucketName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Name of the S3 bucket where the CSV is located.
- `keyName` <sup><span style="color: #ff5630">required</span></sup> (`string`) - Path of the CSV in the bucket.
- `transferOwnership` <sup><span style="color: #ff5630">required</span></sup> (`boolean`) - Set this parameter to `true` if you want to transfer the CSV ownership to Devo and delete it from the bucket once the lookup is created.
- `accessKey` - (`string`) - The access key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
- `secretKey` - (`string`) - The secret key of a customers AWS user with permissions to access the bucket represented in the `bucketName` parameter.
- `host` - (`string`) - The S3 bucket host where the CSV is located.
- `port` - (`integer`) - The S3 bucket port where the CSV is located.
- `region` - (`string`) - The AWS region where the S3 bucket has been created. |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `skipPreface` | `string` | Enter a regular expression to ignore rows of data in a CSV used as source that follow the structure indicated in the regex. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty. |
| `hasHeader` | `boolean` | Indicate if the source CSV file has a header row or not. Only used in CSV sources with fileProvider parameter informed and query parameter empty. Default value is `false`. |
| `skipEmptyLines` | `boolean` | Indicate if you want to skip empty lines in the source CSV or not. Only used in CSV sources with fileProvider parameter informed and query parameter empty. Default value is `false`. |
| `contribution` | `object` | Defines how a row contributes to the final result, normally used on incremental lookups.<br>- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the contribution policy. Values can be `add`, `del`or `col`. The default value is `add`.
- `name` - (`string`) The contribution will be extracted from the column with the given name. That column type must be `string` and its valid values are `add` and `delete` |
| `keepHistory` | `boolean` | If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the specified column as time instant reference for the data provided. |
| `append` | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |

Check below an example of request body:

```
{
  "columns": [
    {
      "name": "ID",
      "type": "INT8"
    },
    {
      "name": "Location",
      "type": "STRING"
    },
    {
      "name": "Age",
      "type": "FLOAT8"
    },
    {
      "name": "Species",
      "type": "STRING"
    },
    {
      "name": "MidiclorianLevel",
      "type": "FLOAT4"
    }
  ],
  "key": {
    "type": "column",
    "column": "ID"
  },
  "fileProvider": {
    "bucketName": "holocrons-bucket",
    "keyName": "secrets/data/force-sensitive-beings.csv",
    "transferOwnership": true
  },
  "contribution": {
    "type": "add"
  }
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupUpdateResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "columns": [
          {
            "name": "ID",
            "type": "INT8"
          },
          {
            "name": "Location",
            "type": "STRING"
          },
          {
            "name": "Age",
            "type": "FLOAT8"
          },
          {
            "name": "Species",
            "type": "STRING"
          },
          {
            "name": "MidiclorianLevel",
            "type": "FLOAT4"
          }
        ],
        "fileProvider": {
          "bucketName": "holocrons-bucket",
          "keyName": "secrets/data/force-sensitive-beings.csv",
          "transferOwnership": true
        },
        "skipPreface": null,
        "hasHeader": false,
        "skipEmptyLines": false
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": null,
      "startMillis": null,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "KeyAlgorithm values can be 'first-column', 'column', 'row-hash', 'col-hash' and 'seq'"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-csv' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |

### > Macro (anchor)

<span style="color: #00b8d9">**PUT**</span><span style="color: #36b37e"> </span>`lookup/{domain}/{name}/deploy-csv`

Update a CSV lookup (multipart/form-data request body).

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to create. |

#### Request body

The request multipart/form-data body must include the CSV file and an associated JSON configuration object. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `deploy-config` | `object` | Deploy CSV configuration of the lookup to be created. This object states the `visibility` of the created lookup, the `fileProvider` indicating the CSV file stored in AWS S3, the `column` descriptors and `key`. It also includes metainfo from the CSV.<br>- `visibility` - (`string`) Visibility level of the lookup. Allowed values are:
  - `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
  - `all-subdomains` - (`string`) The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.
- `columns` <sup><span style="color: #bf2600">required </span></sup>- (`array`) Array of lookup column descriptors. Only used and required in CSV sources with `fileProvider` parameter informed and `query` parameter empty. Each column object may contain the following parameters:
  - `name` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Name of the column.
  - `from` - (`integer`) 0-based index of the column in the CSV.
  - `type` - (`string`) Data type of the column. Possible values are:
    - `BOOLEAN`
    - `STRING`
    - `INT4`
    - `INT8`
    - `FLOAT4`
    - `FLOAT8`
    - `HEX4`
    - `HEX8`
    - `IP4`
    - `IP6`
    - `TIMESTAMP`
    - `DURATION`
- `fileProvider` - (`array`) Info to get the CSV file from S3.
  - `bucketName`<sup><span style="color: #bf2600">required</span></sup> - (`string`) The name of the S3 bucket where the CSV is located.
  - `keyName`<sup><span style="color: #bf2600">required</span></sup><sup> </sup>- (`string`) The path of the CSV inside the bucket.
  - `transferOwnership`<sup><span style="color: #bf2600">required</span></sup> - (`boolean`) This parameter represents whether Lomana should act as the owner of the CSV and delete it from the bucket once it has finished creating the lookup.
  - `accessKey` - (`string`) The access key of a customers AWS user with permissions to access the bucket represented in bucketName.
  - `secretKey` - (`string`) The secret key of a customers AWS user with permissions to access the bucket represented in bucketName.
  - `host` - (`string`) The S3 bucket host where to find the CSV.
  - `port` - (`integer`) The S3 bucket port where to find the CSV.
  - `region` - (`string`) The AWS region whether the S3 bucket has been created.
- `key` - (`string`) In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.
  - `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
  - `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
  - `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`). Type of key algorithm. Values can be:
    - `first-column` - The first column of the lookup will be used as key. This is the default value.
    - `column` - The column indicated in the `column` parameter will be used as key.
    - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
    - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
    - `seq` - The key of the lookup will be generated sequentially.
- `skipPreface` - (`string`) Enter a regular expression to ignore rows of data in a CSV used as source that follow the structure indicated in the regex. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `hasHeader` - (`boolean`) Indicate if the source CSV file has a header row or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `skipEmptyLines` - (`boolean`) Indicate if you want to skip empty lines in the source CSV or not. Only used in CSV sources with `fileProvider` parameter informed and `query` parameter empty.
- `contribution` - (`array`) Defines how a row contributes to the final result, normally used on incremental lookups.
  - `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of the contribution policy. Values can be `add`, `del`or `col`. The default value is `add`.
  - `name` - (`string`) The contribution will be extracted from the column with the given name. That column type must be `string` and its valid values are `add` and `delete`
- `keepHistory` - (`boolean`) If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`.
- `columnTypeReference`- (`string`) If given, the Lookup Manager will use the specified column as time instant reference for the data provided.
- `append`- (`boolean`) If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |
| `csv` | `file` | CSV file to upload. Only needed if the file was not uploaded to S3.<br>> ⚠️ Check more about uploading a lookup using a CSV through S3, see [this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/216825984). |

Check below an example of request body:

```
{
  "deploy-config": {
    "externalValue": "https://devo.com/main/files/simple-lookup-with-header/deploy-csv.json"
  },
  "csv": {
    "externalValue": "https://devo.com/main/files/simple-lookup-with-header/simple_lookup.csv"
  }
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "columns": [
          {
            "name": "ID",
            "type": "INT8"
          },
          {
            "name": "Location",
            "type": "STRING"
          },
          {
            "name": "Age",
            "type": "FLOAT8"
          },
          {
            "name": "Species",
            "type": "STRING"
          },
          {
            "name": "MidiclorianLevel",
            "type": "FLOAT4"
          }
        ],
        "fileProvider": {
          "bucketName": "holocrons-bucket",
          "keyName": "secrets/data/force-sensitive-beings.csv",
          "transferOwnership": true
        },
        "skipPreface": null,
        "hasHeader": false,
        "skipEmptyLines": false
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": null,
      "startMillis": null,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "KeyAlgorithm values can be 'first-column', 'column', 'row-hash', 'col-hash' and 'seq'"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-csv' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |
| 409 | Unsuccessful response. Lookup already exists.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 409,
  "context": null,
  "id": "9b6b0f0e-b162-11ee-b3ab-77fd619670ef",
  "msg": "Lookup with domain galactic_empire and name destroyed_planets already exists"
}
``` |

### > Macro (anchor)

<span style="color: #00b8d9">**PUT**</span><span style="color: #36b37e"> </span>`lookup/{domain}/{name}/deploy-static-query`

Update a lookup based on a static query.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the domain name of the lookup you want to update. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to update. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure. |
| `query` <sup><span style="color: #ff5630">required</span></sup> | `string` | Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:<br>- `boolean`
- `string`
- `int4`
- `int8`
- `float4`
- `float8`
- `hex4`
- `hex8`
- `ip4`
- `ip6`
- `timestamp`
- `duration` |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `keepHistory` | `boolean` | If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the specified column as time instant reference for the data provided. |
| `append` | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |

Check below an example of request body:

```
{
  "visibility": {
    "type": "creator-only"
  },
  "query": "select userid, domain from siem.logtrust.web.navigation where now()-1d < eventdate < now()",
  "key": {
    "type": "column",
    "column": "userid"
  }
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 201 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "once",
      "source": {
        "query": "select eventdate, level, domain, userid, sessionid, correlationId from siem.logtrust.web.activity where now()-1m < eventdate < now()"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": false,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": [
        "eventdate",
        "level",
        "domain",
        "userid",
        "sessionid",
        "correlationId"
      ],
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      }
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "KeyAlgorithm values can be 'first-column', 'column', 'row-hash', 'col-hash' and 'seq'"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-static-query' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |

### > Macro (anchor)

<span style="color: #00b8d9">**PUT**</span><span style="color: #36b37e"> </span>`lookup/{domain}/{name}/deploy-periodic-query`

Update a lookup based on a periodic query.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the domain name of the lookup you want to update. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to update. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queryable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure. |
| `query` <sup><span style="color: #ff5630">required</span></sup> | `string` | Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:<br>- `boolean`
- `string`
- `int4`
- `int8`
- `float4`
- `float8`
- `hex4`
- `hex8`
- `ip4`
- `ip6`
- `timestamp`
- `duration` |
| `key` | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `refreshPeriod` | `string` | Refresh period of the lookup. Defaults to grouping period of the query in case it is a grouping query, or 5 minutes if not. Accepted values are the ones accepted by Devo's duration type.<br>The minimum value accepted is 1 minute. |
| `startDate` | `string` | Lookup creation start date. Defaults to the time of the request. Can either be an ISO-8601 date time string or a number of milliseconds from Epoch. |
| `append`<sup><span style="color: #bf2600"> </span></sup> | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation.<br>However, note that if there is no previous lookup or the recipe is updated (that is to say, the query is modified), this property will be ignored and the lookup will be recreated.<br>The default value is `false`. |
| `append` | `boolean` | If `true`, when this recipe is evaluated, the content of its source will be appended to the lookup created on the previous evaluation. If there is no previous lookup, or if the recipe is updated, this property is ignored. The default value is `false`. |
| `keepHistory` | `boolean` | If `true`, the Lookup Manager will store in the lookup all historic data, enabling historic search. The default value is `false`. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the specified column as time instant reference for the data provided. |

Check below an example of request body:

```
{
  "visibility": {
    "type": "creator-only"
  },
  "query": "select userid, domain from siem.logtrust.web.navigation where now()-5m < eventdate < now()",
  "key": {
    "type": "column",
    "column": "userid"
  },
  "refreshPeriod": "5m",
  "startDate": "now",
  "append": true
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 201,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "query": "select eventdate, level, domain, userid, sessionid, correlationId from siem.logtrust.web.activity where now()-1m < eventdate < now()"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "key"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": 300000,
      "startMillis": 1702339200000,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "refreshPeriod should be bigger than 1 minute"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-periodic-query' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |

### > Macro (anchor)

<span style="color: #00b8d9">**PUT**</span><span style="color: #36b37e"> </span>`lookup/{domain}/{name}/deploy-sliding-window-query`

Update a lookup based on a sliding window query.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain where you want to create the lookup. |
| `name` <sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the lookup you want to create. |

#### Request body

The request JSON body must include the following objects and key-value pairs. Click them in the following list to see its details:

| **Parameter** | **Type** | **Description** |
| --- | --- | --- |
| `visibility` | `string` | Visibility level of the lookup. Allowed values are:<br>- `creator-only` - The lookup will be visible only in the creator's domain. This is the default value.
- `all-subdomains` - The lookup will be queriable in all the subdomains in a multitenant domain. It will only be visible in the lookup management web page in the source domain. Only multitenant Admin users will be able to use this value.<br>> ℹ️ **Lookup ownership VS visibility**
> ℹ️ 
> ℹ️ - <u>Lookup ownership</u> refers to the domain where the lookup is defined.
> ℹ️ - <u>Lookup visibility</u> refers to the domain(s) where a lookup is visible. Note that lookups are created in a specific Devo domain, but they can be visible in other domains as well. If your domain belongs to a multitenant structure, you can use the `all-subdomains` parameter defined above to make it visible in all the domains within the structure. |
| `query` <sup><span style="color: #ff5630">required</span></sup> | `string` | Query to generate the lookup from. It must be written using LINQ syntax. Allowed field data types are:<br>- `boolean`
- `string`
- `int4`
- `int8`
- `float4`
- `float8`
- `hex4`
- `hex8`
- `ip4`
- `ip6`
- `timestamp`
- `duration` |
| `key`<sup><span style="color: #bf2600">required</span></sup> | `object` | In case the key of the lookup is not the name of a column, it can be computed through an algorithm using the elements on this data type.<br>- `columns` - (`string`) List of columns to be used to generate the key for the lookup. This is only used when the `type` of the object is `col-hash`
- `column` - (`string`)Name of the column to be used as the key for the lookup. This is only used when the `type` of the object is `column`
- `type` <sup><span style="color: #ff5630">required</span></sup> - (`string`) Type of key algorithm. Values can be:
  - `first-column` - The first column of the lookup will be used as key. This is the default value.
  - `column` - The column indicated in the `column` parameter will be used as key.
  - `row-hash` - A hash of the elements on the first row of the lookup will be used as key.
  - `col-hash` - A hash of the columns stated in the `columns` parameter will be used as key.
  - `seq` - The key of the lookup will be generated sequentially. |
| `windowSize`<sup><span style="color: #bf2600">required</span></sup> | `string` | Size of the sliding window. Every time the query is executed, the lookup will contain the size of the window. Accepted values are the ones accepted by Devo duration type. The minimum value accepted is 1 hour (Example: Xh, Xd). |
| `refreshPeriod` <sup><span style="color: #bf2600">required</span></sup> | `string` | Lookup refresh period. Defaults to querys grouping period in case of a grouping query, or 5 minutes if not. Accepted values are the ones accepted by Devo duration type. The minimum value accepted is 1 minute (Example: Xm, Xh, Xd). |
| `startDate` | `string` | Lookup creation start date. Defaults to the time of the request. Can either be an ISO-8601 date time string or a number of milliseconds from Epoch. |
| `keepHistory` | `boolean` | If set to `true`, the Lookup Manager will store all historic data in the lookup, enabling historic search. |
| `columnTimeReference` | `string` | If given, the Lookup Manager will use the column specified as time instant reference for the data provided. |

Check below an example of request body:

```
{
    "visibility": {
      "type": "creator-only"
    },
    "query": "from box.unix group by machine, srcIp",
    "key": {
        "type": "column",
        "column": "machine"
    },
    "windowSize": "30d",
    "refreshPeriod" : "5m"
}
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. Request submitted. The response includes the ID of the update request.<br>```
{
  "type": "LookupCreationResponse",
  "cid": "d5ce4eb105b2",
  "code": 200,
  "context": null,
  "id": "c6b1e939-a57c-11ee-b1a9-a124bba45b9b",
  "msg": "Lookup sent to creation. You can check the creation status using the provided id: /lookup/{domain}/{name}/job/{id}",
  "lookupDeployConfig": {
    "id": {
      "creator": "rebel_alliance",
      "name": "GalacticEmpireActivity"
    },
    "visibility": {
      "type": "creator-only"
    },
    "recipe": {
      "recipeType": "periodic",
      "source": {
        "query": "select userid, domain from siem.logtrust.web.activity"
      },
      "lookupType": {
        "type": "normal"
      },
      "append": true,
      "key": {
        "type": "column",
        "column": "userid"
      },
      "columnFilter": null,
      "contribution": {
        "type": "add"
      },
      "secondaryIndexes": {
        "type": "none"
      },
      "refreshMillis": 600000,
      "startMillis": 1702339200000,
      "slideWindow": 86400000,
      "requiresDate": true
    },
    "notifyStatus": true
  }
}
``` |
| 400 | Unsuccessful response. Bad request.<br>```
{
  "type": "LookupCreationError",
  "cid": "0cd289fa1b63",
  "code": 400,
  "context": null,
  "id": "9f270aca-5151-11ed-859a-5d2974203ed5",
  "msg": "refreshPeriod should be bigger than 1 minute"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to update the lookup.<br>```
{
  "code": 401,
  "msg": "Access to 'https://api.us.devo.com/lookup-api/lookup/galactic_empire/destroyed_planets/deploy-sliding-window-query' requires valid auth",
  "cid": "29fda52318ae"
}
``` |
| 403 | Unsuccessful response. Forbidden access.<br>```
{
  "code": 5,
  "msg": "Token invalid or expired",
  "cid": "29fda52318ae"
}
``` |
| 404 | Unsuccessful response. Domain not found.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 404,
  "context": null,
  "id": "901c6154-b16b-11ee-b3ab-47fc28cf5888",
  "msg": "Domain not found."
}
``` |
| 409 | Unsuccessful response. Lookup already exists.<br>```
{
  "type": "LookupCreationError",
  "cid": "68e612d824a5",
  "code": 409,
  "context": null,
  "id": "9b6b0f0e-b162-11ee-b3ab-77fd619670ef",
  "msg": "Lookup with domain galactic_empire and name destroyed_planets already exists"
}
``` |

### > Macro (anchor)

<span style="color: #ff5630">**DELETE**</span><span style="color: #36b37e"> </span>`/lookup/{domain}/{name}`

Send a request to delete a specific lookup.

 

### Request

#### Path parameters

Add the following path parameters as part of the endpoint:

| Parameter | Type | Description |
| --- | --- | --- |
| `domain`<sup><span style="color: #ff5630">required</span></sup> | `string` | Enter the name of the domain that contains the lookup you want to delete. |
| `name`<sup><span style="color: #ff5630"> required</span></sup> | `string` | Enter the name of the lookup you want to delete. |

#### Example

Find below a request example in cURL language. This request will return information about the 10 oldest lookups created in the domain indicated. Learn how to authorize your request [in this article](https://devodocs.atlassian.net/wiki/spaces/latest/pages/127500308).

```
curl -H "standAloneToken:YOUR_TOKEN" -X DELETE   https://api-us.devo.com/lookup-api/lookup/myDomain/myLookup
```

 

### Responses

| **Code** | **Description** |
| --- | --- |
| 200 | Successful response. Deletion request sent. The response includes the ID of the request.<br>```
{
  "type": "LookupDeletionResponse",
  "cid": "f44f458f7c32",
  "code": 200,
  "context": null,
  "id": "xxxxxx-5052-11ed-b24b-85c623a0cbd8",
  "msg": "Lookup sent to deletion"
}
``` |
| 401 | Unsuccessful response. The user is unauthorized to delete this lookup.<br>```
{
  "error": {
    "code": 401,
    "message": "Unauthorized"
  }
}
``` |

## Troubleshooting

### Not enough privileges to set Visibility.

> Macro (excerpt-include)