Search

Run an Elasticsearch query against the search indexes for a site, tenant, division, or organization. The request requires authentication and READ permission for the target.

This endpoint uses the Elasticsearch 8 Search API. Most search-body options supported by that API can be placed in body.query.

The outer query property is the Wombat request wrapper. The nested body.query.query property is the Elasticsearch Query DSL query. The service selects all search indexes belonging to the target identified by the request path.

Target Paths

Replace {targetPath} with one of the following paths:

target	path
Site	site/:siteId
Root tenant	tenant/:tenantId
Root tenant division	tenant/:tenantId/division/:divisionId
Organization	organization/:orgId
Organization tenant	organization/:orgId/tenant/:tenantId
Organization tenant division	organization/:orgId/tenant/:tenantId/division/:divisionId

Parameters

name * are required parameters	data type	description
body.query*	object	Elasticsearch search request.
body.query.query	object	Elasticsearch Query DSL query.
body.query.from	number	Zero-based result offset.
body.query.size	number	Maximum number of hits to return.
body.query.sort	string or array	Elasticsearch sort definition.
body.query._source	boolean, string, string[], or object	Controls which source fields are returned.
body.query.aggregations	object	Elasticsearch aggregation definitions. aggs is also accepted by Elasticsearch.
body.subTargets	object[]	Optional child targets to include in the search. Each child must belong to the target identified by the request path.

Return Value

The response wraps the Elasticsearch search response in the standard Wombat response envelope:

{
  "message": "search completed",
  "data": {
    "took": 4,
    "timed_out": false,
    "_shards": {
      "total": 1,
      "successful": 1,
      "skipped": 0,
      "failed": 0
    },
    "hits": {
      "total": {
        "value": 1,
        "relation": "eq"
      },
      "max_score": null,
      "hits": []
    }
  }
}

Examples

List the newest records

curl -X POST "https://app.wombat.software/s/organization/acme/tenant/north/_search" \
  -H "Authorization: Bearer ..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": {
      "size": 10,
      "track_total_hits": true,
      "query": { "match_all": {} },
      "sort": [{ "createdAt": { "order": "desc", "missing": "_last" } }]
    }
  }'

Filter active records

curl -X POST "https://app.wombat.software/s/organization/acme/tenant/north/_search" \
  -H "Authorization: Bearer ..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": {
      "size": 25,
      "_source": ["name", "type", "active", "createdAt"],
      "query": {
        "bool": {
          "filter": [{ "term": { "active": true } }],
          "must_not": [{ "exists": { "field": "removedAt" } }]
        }
      }
    }
  }'

Aggregate records by type

curl -X POST "https://app.wombat.software/s/organization/acme/tenant/north/_search" \
  -H "Authorization: Bearer ..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": {
      "size": 0,
      "aggregations": {
        "records_by_type": {
          "terms": { "field": "type", "size": 10 }
        }
      }
    }
  }'

Limitations

• This is a target-scoped proxy, not a direct Elasticsearch endpoint. Only POST requests using the Wombat request envelope are supported.
• The request path determines the search scope. A request searches every available index type for that exact target and cannot select another target's data.
• Queries, sorting, and aggregations must be compatible with every matching index. Available fields, keyword subfields, and analyzers depend on each index's mapping.
• Invalid Query DSL is returned as an Elasticsearch error.
• Elasticsearch limits from plus size pagination to 10,000 hits by default. Use search_after with a stable sort for deeper pagination.
• Search indexes are updated asynchronously from source records. A successful source write may not be visible in search immediately, so search results should not be used as an authoritative read-after-write check.
• Requests can run for up to 180 seconds. Disconnecting the HTTP client does not cancel the Elasticsearch request.
• subTargets supports user, object, and training indexes only, and every supplied child target must be owned by the URL target.