Skip to content

[9.3] [Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors (#258883)#259702

Merged
csr merged 3 commits intoelastic:9.3from
csr:backport/9.3/pr-258883
Apr 1, 2026
Merged

[9.3] [Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors (#258883)#259702
csr merged 3 commits intoelastic:9.3from
csr:backport/9.3/pr-258883

Conversation

@csr
Copy link
Copy Markdown
Member

@csr csr commented Mar 26, 2026

Backport

This will backport the following commits from main to 9.3:

Questions ?

Please refer to the Backport tool documentation

…for "not found" errors (elastic#258883)

I noticed while working on Scout API tests
(elastic#258534) that the GET endpoints
for packs and saved queries return a `500` Internal Server Error when
the resource doesn't exist, rather than the usual `404`. This PR fixes
it. Worth mentioning that the issue occurs in all surfaces (stateful
deployment, ECH, MKI). Some FTR API integration tests were added to
ensure coverage.

(cherry picked from commit 4301849)

# Conflicts:
#	x-pack/platform/plugins/shared/osquery/server/routes/pack/delete_pack_route.ts
#	x-pack/platform/plugins/shared/osquery/server/routes/pack/update_pack_route.ts
#	x-pack/platform/plugins/shared/osquery/server/routes/saved_query/update_saved_query_route.ts
#	x-pack/platform/test/api_integration/apis/osquery/saved_queries.ts
@csr csr requested a review from kibanamachine as a code owner March 26, 2026 08:59
@csr csr added the backport This PR is a backport of another PR label Mar 26, 2026
@csr csr enabled auto-merge (squash) March 26, 2026 08:59
@csr
Copy link
Copy Markdown
Member Author

csr commented Mar 31, 2026

Osquery Serverless tests were failing but were recently disabled by #259898. Rebasing.

@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

@csr csr merged commit 56eb2dd into elastic:9.3 Apr 1, 2026
14 checks passed
@csr csr deleted the backport/9.3/pr-258883 branch April 1, 2026 15:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants