Schema Discovery

Discover available osquery tables and their schemas programmatically. This is essential for building tools that dynamically explore system data.

List Tables

Get all available osquery tables:

curl https://hyprwatch.cloud/api/v1/schema/tables \
-H "Authorization: Bearer hw_live_xxx"

Filter by platform:

curl "https://hyprwatch.cloud/api/v1/schema/tables?platform=linux" \
-H "Authorization: Bearer hw_live_xxx"

Search by name or description:

curl "https://hyprwatch.cloud/api/v1/schema/tables?search=process" \
-H "Authorization: Bearer hw_live_xxx"

Get Table Schema

Get the full schema for a specific table including columns and types:

curl https://hyprwatch.cloud/api/v1/schema/tables/processes \
-H "Authorization: Bearer hw_live_xxx"

Response:

{
"table": {
"name": "processes",
"description": "All running processes on the host system.",
"platforms": ["darwin", "linux", "windows"],
"evented": false,
"columns": [
  {"name": "pid", "type": "BIGINT", "description": "Process ID"},
  {"name": "name", "type": "TEXT", "description": "Process name"},
  {"name": "cmdline", "type": "TEXT", "description": "Complete command line"}
]
}
}

Platform Statistics

Get a summary of table availability per platform:

curl https://hyprwatch.cloud/api/v1/schema/platforms \
-H "Authorization: Bearer hw_live_xxx"

Response:

{
"platforms": [
{"name": "darwin", "table_count": 180},
{"name": "linux", "table_count": 200},
{"name": "windows", "table_count": 120}
],
"total_tables": 250
}

Common Tables

Table	Description	Platforms
`processes`	All running processes	All
`users`	Local user accounts	All
`listening_ports`	Processes with open listening ports	All
`system_info`	System information	All
`os_version`	Operating system version info	All
`crontab`	Scheduled jobs	Linux, macOS
`etc_hosts`	Hosts file entries	Linux, macOS