Skip to main content
Falcon uses a unified JSON query system — every dataset uses the same POST request format and response schema. Once you understand this structure, you can query any Falcon endpoint without relearning the request format. All Falcon queries are sent to:

Request structure

Send a JSON body with each request. The agent_id determines which dataset is returned. All other fields are optional.

Request fields

Tips

All params values must be strings, even numbers (e.g. "900" not 900).
Omit optional fields entirely rather than passing null — the API ignores unknown fields.
Use limit:200 for bulk retrieval and check has_more in the response for pagination.

Response structure

All Falcon API endpoints use a single POST URL with a JSON body. The agent_id determines which data source to query.

Pagination

To paginate through results, check has_more in the response and increment offset by limit:

Timestamp Format

All timestamps in responses use ISO 8601 format in UTC: 2026-04-06T12:00:00Z. Some endpoints accept Unix timestamps as strings in params — check each endpoint’s documentation for details.