/Details Endpont - `count` optionnal query parameter seems broken

[Nicolas-Pellletier]

Hello @LegendEvent,

Thanks for taking the time to developped this tool and sharing it with the community. I'm encounter an issue when requesting the Details Endpoint , in order to get Detailed information about specific entities.

The count optional parameter when requesting the /Details endpoint seems broken.

Here is below my code:

    connection_events_bis = client.details.get(pbid=pbid, eventtype="connection", count=100)
    notice_events = client.details.get(pbid=pbid, eventtype="notice", count=800)
    all_event_types = client.details.get(pbid=pbid, count=100)
    print(f"Il y a un total de {len(connection_events)} connexions")
    print(f"Il y a un total de {len(connection_events_bis)} connexions bis")
    print(f"Il y a un total de {len(notice_events)} notice events")
    print(f"Il y a un total de {len(all_event_types)} events")

Here is the below result:

Il y a un total de 200 connexions
Il y a un total de 0 connexions bis
Il y a un total de 800 notice events
Il y a un total de 0 events

When i use the count parameter with notice eventTypes it looks fine, but then if i don't specify any eventTypes to return or i specify only connection eventTypes to return, i get no result.

Regards

[LegendEvent]

Validation Attempt

I tested this issue on a Darktrace instance with SDK v0.8.55.

Test Results

Test	Parameters	Result
1	eventtype='connection' WITHOUT count	200 connections ✓
2	eventtype='connection' WITH count=100	100 connections ✓
3	eventtype='notice' WITH count=800	1 notice ✓
4	NO eventtype WITH count=100	100 items ✓

Conclusion

Unable to reproduce the issue. The count parameter works correctly in all tested scenarios.

Could you provide:

1. Your SDK version: pip show darktrace-sdk
2. Your Darktrace instance version
3. A debug output with debug=True enabled

This will help identify if the issue is version-specific or related to specific data on your instance.

[LegendEvent]

Validation Update

I tested this issue across multiple SDK versions (v0.8.1 through v0.8.55) and was unable to reproduce the bug.

Test Results (SDK v0.8.55, Darktrace v6.3.18)

Test	Parameters	Result
1	`eventtype='connection'` without count	200 items ✓
2	`eventtype='connection'` with count=100	100 items ✓
3	`eventtype='notice'` with count=800	1 item ✓
4	no eventtype with count=100	100 items ✓

The `count` parameter works correctly in all scenarios on our instance.

Debug Script

Please run this with your credentials and share the output:

from darktrace import DarktraceClient

client = DarktraceClient(
    host="https://your-darktrace-instance",
    public_token="YOUR_PUBLIC_TOKEN",
    private_token="YOUR_PRIVATE_TOKEN",
    debug=True
)

pbid = 12345  # Use your pbid - try multiple different pbids if possible

for name, kwargs in [
    ("TEST 1: connection without count", {"pbid": pbid, "eventtype": "connection"}),
    (\"TEST 2: connection with count=100", {"pbid": pbid, "eventtype": "connection", "count": 100}),
    (\"TEST 3: notice with count=800", {"pbid": pbid, "eventtype": "notice", "count": 800}),
    (\"TEST 4: no eventtype with count=100", {"pbid": pbid, "count": 100}),
]:
    print(f"\n{name}")
    result = client.details.get(**kwargs)
    print(f"  Type: {type(result).__name__}")
    print(f"  len(): {len(result)}")

from darktrace import __version__
print(f"\nSDK version: {__version__}")
status = client.status.get()
print(f"Darktrace version: {status.get('version', 'unknown')}")

Info Needed

1. SDK version: pip show darktrace-sdk
2. Darktrace version (from /status endpoint)
3. Output from debug script above
4. Try multiple different pbids - the issue might be specific to certain model breaches

This will help determine if the issue is related to specific data, your Darktrace version, or something else.