StartQuery - Amazon CloudTrail
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.


Starts a CloudTrail Lake query. The required QueryStatement parameter provides your SQL query, enclosed in single quotation marks.

Request Syntax

{ "QueryStatement": "string" }

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.


The SQL code of your query.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 10000.

Pattern: (?s).*

Required: Yes

Response Syntax

{ "QueryId": "string" }

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.


The ID of the started query.

Type: String

Length Constraints: Fixed length of 36.

Pattern: ^[a-f0-9\-]+$


For information about the errors that are common to all actions, see Common Errors.


The specified event data store ARN is not valid or does not map to an event data store in your account.

HTTP Status Code: 400


The specified event data store was not found.

HTTP Status Code: 400


The event data store is inactive.

HTTP Status Code: 400


The request includes a parameter that is not valid.

HTTP Status Code: 400


The query that was submitted has validation errors, or uses incorrect syntax or unsupported keywords. For more information about writing a query, see Create or edit a query in the Amazon CloudTrail User Guide.

HTTP Status Code: 400


You are already running the maximum number of concurrent queries. Wait a minute for some queries to finish, and then run the query again.

HTTP Status Code: 400


This exception is thrown when the requested operation is not permitted.

HTTP Status Code: 400


This exception is thrown when the requested operation is not supported.

HTTP Status Code: 400

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: