Sort syntax

To order the results that are returned in an API retrieval request, HTTP GET, some IBM® QRadar® API endpoints that return lists of resources support the sort parameter.

The sort parameter syntax is consistent for all endpoints that support it. Refer to the documentation for the endpoint to determine if the sort parameter applies to it. Any limitations on the sort syntax are included in that endpoint's description. To ensure that spaces or special characters are encoded properly, remember that query parameters must be double URL encoded before they are sent.

Sort operators

Operator Description Example
+ Sort field is in ascending order. Sort add_time field in ascending order:


- Sort field is in descending order. Sort version field in descending order:


Sorting multiple fields

You can sort multiple fields by separating them with a comma. In the following example, the version field is sorted in descending order. Then, within each version group, the add_time field is sorted in ascending order.


Escaping characters in sort strings

Escape any character in the sort string by preceding it with a backslash (\). If any of the following characters are inside a field identifier, you must escape them:

  • ,
  • (
  • )
  • \