# Deepinfo Docs: full documentation

> Documentation for the Deepinfo API and the Deepinfo Platform: authentication, endpoints, request and response examples, and a guide to the platform screen by screen.

Base URL: https://api.deepinfo.com/v1

Request and response examples are left out to keep this file small; every page links its .md version, which has them.

The worked example pages (`/reference/<module>/<endpoint>/examples/…`) are left out too: an endpoint's Worked Examples section below links its example index, and llms.txt lists every index; each example page has its own .md version.


---

# Build With Deepinfo Data, in Code or in the Platform

URL: https://docs.deepinfo.com/

The Deepinfo API reference and Platform Guide. Every endpoint with its parameters, code samples and saved example responses, and the Deepinfo Platform screen by screen.

Look up and search Deepinfo's internet-wide domain, DNS, WHOIS, SSL, dark web and vulnerability data,
and work with your External Attack Surface Management, Cyber Threat Intelligence and Brand Risk
Protection findings, from your own code or in the Deepinfo Platform.

- [API Reference](/reference/)
- [Platform Guide](/guide/)
- [Getting Started](/getting-started/)
- [Changelog](/changelog/)

## Your First Request

[Domain WHOIS](/reference/lookup/domain-whois/): `GET /lookup/whois`. Your API key goes in the `apikey` header.

```bash
curl 'https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json'
```

Response (200 OK · application/json), with the fields left out marked `…`:

```json
{
  "domain_name": "deepinfo.com",
  "parsed": {
    "create_date": "2001-06-05T02:57:08Z",
    "expiry_date": "2028-10-20T11:59:59Z",
    "registrar": "godaddy online services cayman islands ltd.",
    "name_servers": [
      "may.ns.cloudflare.com",
      "simon.ns.cloudflare.com"
    ],
    …
  },
  …
}
```

## Production or Demo?

Every account belongs to one environment: paid customer accounts use **Production**, demo accounts use
**Demo**. Open the API reference in yours below. The code samples and platform links follow it, and the
**Environment** switch at the top of the API Reference sidebar changes it.

| Environment | Account | Platform | API base URL |
|---|---|---|---|
| Production | Paid (customer) account | platform.deepinfo.com | https://api.deepinfo.com/v1 |
| Demo | Demo account | platform.deepinfodemo.com | https://api.deepinfodemo.com/v1 |

See [Environments & Base URL](/getting-started/environments-and-base-url/).

## Getting Started

What every request has in common: your API key, the base URL, rate limits, pagination, search filters
and errors.

- [Authentication](/getting-started/authentication/): Every Deepinfo API request is authenticated with your API key in the apikey header.
- [Environments & Base URL](/getting-started/environments-and-base-url/): Paid accounts use the Production addresses and demo accounts the Demo addresses; the version is the first path segment, bodies are JSON and timestamps UTC.
- [Rate Limits](/getting-started/rate-limits/): Limits apply per API key and per endpoint; responses carry ratelimit headers that show where you stand.
- [Pagination](/getting-started/pagination/): Paginated endpoints take page and page_size and share one response envelope.
- [Search & Filters](/getting-started/search-and-filters/): The filters body used by search endpoints, its operators, which operators each field accepts, the errors a filter returns, and query-parameter filters on list endpoints.
- [Errors](/getting-started/errors/): The Deepinfo error formats, the status codes they use, the forms a search filter error takes, and an example request and response for each one.
- [Postman Collection](/getting-started/postman/): Every Deepinfo API endpoint as a Postman collection. Download it with the Production environment, add your API key and send requests.

## Deep Search & Insights (DSI)

Deepinfo's internet-wide dataset: look up and search domains, IP addresses, DNS, WHOIS and SSL
records, dark web sources, vulnerabilities and domain registration statistics, or download it as data
feeds.

- [Lookup](/reference/lookup/): Look up a single domain, host, IP address or website, either in real time or from Deepinfo's history.
- [Discovery](/reference/discovery/): Search Deepinfo's internet-wide domain dataset: find subdomains, associated domains, domains registered at the same time, and domains that share a WHOIS email, name server, IP or mail server.
- [Darkweb](/reference/darkweb/): Search dark web sources (forums, markets, paste sites, chats, leaks).
- [Vulnerability](/reference/vulnerability/): Deepinfo's vulnerability (CVE) database: search, CVE details, EPSS history and global statistics.
- [Domain Intelligence](/reference/domain-intelligence/): Global domain registration statistics.
- [Feeds](/reference/feeds/): Download Deepinfo data feeds (all domains/subdomains, daily registered/updated/deleted domains, daily discovered subdomains).

## Platform APIs

Your organization's data in the Deepinfo Platform: its EASM, CTI and BRP findings, notifications and
reports.

- [EASM (External Attack Surface Management)](/reference/easm/): Your monitored assets (domains, subdomains, IPs, websites), what Deepinfo discovers around them, and the issues, vulnerabilities and technologies found on them.
- [CTI (Cyber Threat Intelligence)](/reference/cti/): Email breaches, compromised employee/client/payment credentials, compromised devices, threat actors and security news relevant to your organization.
- [BRP (Brand Risk Protection)](/reference/brp/): Domains that imitate your brand.
- [Platform](/reference/platform/): Notifications and reports.

## Latest Changes

- 2026-10-05: [The New Deepinfo Documentation Site](/changelog/the-new-documentation-site/). docs.deepinfo.com now documents every API endpoint, generated from the Deepinfo Postman collection, with Getting Started guides, search and a Markdown version of every page.
- 2026-09-27: [Operator Support per Field](/changelog/operator-support/). Search endpoints now list their searchable fields grouped by the operators each field accepts, measured against the API, and the docs show the forms a filter error takes.
- 2026-09-24: [A Guide to the Deepinfo Platform](/changelog/platform-guide/). A new section of the documentation explains the Deepinfo Platform screen by screen, from your first sign-in to reports and notification rules.

All changes: [/changelog/](/changelog/)

## Get Help From Deepinfo Support

Which endpoints you can call depends on your plan. For access, API keys and questions about a request,
email Deepinfo support. About a specific request? Include its `deepinfo-request-id` response header.

- Email support: [support@deepinfo.com](mailto:support@deepinfo.com)
- Get an API key: in the Deepinfo Platform under **Settings → Organization Settings → API Keys** ([Authentication](/getting-started/authentication/#get-an-api-key)).
- Docs for AI tools: every page has a Markdown version; [llms.txt](/llms.txt) lists them all, [llms-full.txt](/llms-full.txt) has them in one file.


---

# Postman Collection

URL: https://docs.deepinfo.com/getting-started/postman/

Every Deepinfo API endpoint as a Postman collection. Download it with the Production environment, add your API key and send requests.

Every endpoint of the [API Reference](/reference/) is in the Deepinfo Postman collection, in the same
modules and groups as on this site, with its parameters, request bodies and descriptions. Download the
collection and the Production environment, add your API key and send your first request in a few minutes.

## Set It Up

1. Download both files with the buttons above.
2. In Postman, choose **Import** and drop both files.
3. Select the **Deepinfo - Production** environment in Postman's environment menu.
4. Put your API key in that environment's `api_key` variable, in **Current value**, so it stays on your
   machine. No key yet? See [Get an API Key](/getting-started/authentication/#get-an-api-key).
5. Open a request, for example **Lookup › Domain WHOIS**, and select **Send**.

Authentication is set once on the collection (**Authorization** tab, *API Key*): every request sends your
key in the `apikey` header, so you never add it by hand.

## Variables

Every URL in the collection starts with `{{api_base_url}}/{{api_version}}`, so the host and the version
come from the selected environment.

| Variable | Value | Description |
|---|---|---|
| `api_base_url` | `https://api.deepinfo.com` | API host, without `/v1` |
| `api_version` | `v1` | API version, the first path segment of every endpoint |
| `api_key` | *your key* | Sent in the `apikey` header of every request |

The three variables are defined on the collection (defaults) and in the environment. The environment
wins, so keep your key there.

## Demo Accounts

With a demo account, set `api_base_url` to `https://api.deepinfodemo.com` in your environment. A copy of
the environment named Demo lets you keep both. See
[Environments & Base URL](/getting-started/environments-and-base-url/).

## What It Contains

- **Every request of the API Reference**, with its query and path parameters and, for searches and other
  `POST` requests, a request body to start from. [Search & Filters](/getting-started/search-and-filters/)
  explains the filter format.
- **Two checks after every request:** the response must not be a server error, and a 401 is reported as a
  missing API key. The `deepinfo-request-id` header of the last response is kept in the
  `last_request_id` collection variable: include it when you contact
  [support@deepinfo.com](mailto:support@deepinfo.com).
- **The requests behind the error examples** of [Errors](/getting-started/errors/), in the
  **Getting Started › Errors** folder.
- **No saved example responses.** Each endpoint's page on this site shows its example responses, and in
  Postman you see your own data.

## Updates

The collection is built from the same source as this site, so it changes when the reference does.
Download it again to get new endpoints and changes; the [Changelog](/changelog/) lists them.


---

# Getting Started

URL: https://docs.deepinfo.com/getting-started/

Authenticate with your API key, send your first Deepinfo API request and find your way around the reference.

The Deepinfo API gives you programmatic access to Deepinfo's internet-wide domain, DNS, WHOIS, SSL and
vulnerability data, and to your Deepinfo Platform modules: External Attack Surface Management (EASM), Cyber Threat Intelligence (CTI), Brand Risk Protection (BRP) and Platform.

Every endpoint is served over HTTPS, and the API version is the first path segment:

```text
https://api.deepinfo.com/v1/<module>/<endpoint>
```

> [!NOTE]
> **Demo account?** The examples use the Production addresses. Choose **Demo** in the **Environment**
> switch at the top of the API Reference sidebar (or open the API reference from the **Demo** card on
> the home page) to show the Demo addresses. See
> [Environments & Base URL](/getting-started/environments-and-base-url/).

## Quick Start

**1. Get an API key.** Your key authenticates every request and decides which endpoints you can call.
Generate one in the Deepinfo Platform under **Settings → Organization Settings → API Keys** (see
[Get an API key](/getting-started/authentication/#get-an-api-key)). No platform access? Contact
[support@deepinfo.com](mailto:support@deepinfo.com).

**2. Send it in the `apikey` header.** Every request carries it. See
[Authentication](/getting-started/authentication/).

**3. Make your first call.** [Domain WHOIS](/reference/lookup/domain-whois/) returns the current WHOIS registration
record of a domain:

```bash
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

A successful response returns the parsed WHOIS record together with the raw WHOIS text:

```json
{
  "domain_name": "deepinfo.com",
  "raw": "Domain Name: DEEPINFO.COM\n   Registry Domain ID: 71858956_DOMAIN_COM-VRSN\n   ...",
  "parsed": {
    "create_date": "2001-06-05T02:57:08Z",
    "update_date": "2025-08-19T07:33:45Z",
    "expiry_date": "2028-10-20T11:59:59Z",
    "registrar": "godaddy online services cayman islands ltd.",
    "name_servers": ["may.ns.cloudflare.com", "simon.ns.cloudflare.com"],
    "whois_server": "whois.uniregistrar.com"
  },
  "check_date": "2026-09-22T12:25:50Z",
  "parse_code": null
}
```

> [!NOTE]
> The response above is shortened: `raw` is truncated, and `parsed.uid`, the registrant contact and the
> domain status codes are left out. The full field list and the complete saved example are on the
> [Domain WHOIS](/reference/lookup/domain-whois/) reference page.

## What to Read Next

| Page | What it covers |
|---|---|
| [Authentication](/getting-started/authentication/) | Getting and replacing a key, the `apikey` header, and what 401 and 403 mean |
| [Environments & base URL](/getting-started/environments-and-base-url/) | Host, version, content types, date format, expiring download links |
| [Rate limits](/getting-started/rate-limits/) | Per-key and per-endpoint limits, the `ratelimit-*` headers, quota |
| [Pagination](/getting-started/pagination/) | `page`, `page_size` and the list envelope |
| [Search & filters](/getting-started/search-and-filters/) | The `filters` body used by `search` endpoints, and query-parameter filters for list endpoints |
| [Errors](/getting-started/errors/) | The error formats, the status codes and example responses |

## The Modules

| Module | What it covers |
|---|---|
| Lookup | Real-time and historical lookups for a single domain, IP, host or website: WHOIS, DNS, IP WHOIS, SSL, port scan, technologies, screenshots, web data |
| Discovery | Search Deepinfo's domain dataset: subdomains, associated domains, reverse WHOIS/NS/IP/MX, TLDs |
| Darkweb | Search dark web sources |
| Vulnerability | Vulnerability (CVE) search, details and insights |
| Domain Intelligence | Domain registration statistics |
| Feeds | Download domain and subdomain data feeds |
| EASM | Your assets, discovery, issues, vulnerabilities and technologies |
| CTI | Email breaches, compromised credentials and devices, threat actors, security news |
| BRP | Fraudulent and suspicious domains, detection rules |
| Platform | Notification rules, reports and scheduled reports |

Which endpoints you can call depends on your plan. Browse them all in the
[API reference](/reference/).

## In Postman

Every endpoint of this reference is also in the Deepinfo Postman collection: download it with the
buttons above, and [Postman Collection](/getting-started/postman/) shows how to set it up in a few steps.

## Support

When you contact [support@deepinfo.com](mailto:support@deepinfo.com) about a request, include the value of
the `deepinfo-request-id` response header. It identifies that exact call.


---

# Authentication

URL: https://docs.deepinfo.com/getting-started/authentication/

Every Deepinfo API request is authenticated with your API key in the apikey header.

Every request must include your API key in the `apikey` HTTP header.

```http
apikey: YOUR_API_KEY
```

The header goes on every call. A `GET` lookup:

```bash
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
  -H "apikey: YOUR_API_KEY"
```

A `POST` search with a JSON body carries the same header:

```bash
curl -X POST "https://api.deepinfo.com/v1/easm/assets/search" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"filters": {"must": [{"name": "asset_type", "type": "eq", "value": "domain"}]}}'
```

## Get an API Key

You create and manage API keys in the Deepinfo Platform ([platform.deepinfo.com](https://platform.deepinfo.com);
demo accounts: [platform.deepinfodemo.com](https://platform.deepinfodemo.com)),
under **Settings → Organization Settings → API Keys**. There you can generate a new key, rename a key,
choose the default key and delete a key. The Platform Guide shows each step:
[Create and manage API keys](/guide/settings/api-keys/).

No platform access? Contact [support@deepinfo.com](mailto:support@deepinfo.com).

## What Can Go Wrong

A missing or invalid key returns **401 Unauthorized**. A valid key that calls an endpoint outside your plan
returns **403 Forbidden**. See [Errors](/getting-started/errors/) for the exact responses.

| Status | Message | Cause |
|---|---|---|
| 401 | `No API key found in request` | The `apikey` header is missing |
| 401 | `Unauthorized` | The API key is not valid |
| 403 | `You cannot consume this service` | The endpoint is not included in your plan |

## Keep Your Key Secret

> [!WARNING]
> Keep your API key secret. Do not put it in client-side code or public repositories.

Call the API from your own backend and keep the key in an environment variable or a secret store. Anyone
holding the key can spend your quota and read your platform data.

If a key is exposed, replace it:

1. Generate a new key under **Settings → Organization Settings → API Keys**.
2. Switch your integration to the new key.
3. Delete the exposed key. The default key cannot be deleted, so if the exposed key is the default, set
   another key as default first.

## In Postman

The same key works in the Deepinfo [Postman collection](/getting-started/postman/). Authentication is
set once on the collection (**Authorization** tab, *API Key*), and every request inherits it from the
`{{api_key}}` variable, so you never add the header by hand. Put your key in the `api_key` variable of the
*Deepinfo - Production* environment, in **Current value**, so it stays on your machine.


---

# Environments & Base URL

URL: https://docs.deepinfo.com/getting-started/environments-and-base-url/

Paid accounts use the Production addresses and demo accounts the Demo addresses; the version is the first path segment, bodies are JSON and timestamps UTC.

## Paid and Demo Accounts

Deepinfo runs a Production and a Demo environment. **Paid customer accounts use the Production environment, on deepinfo.com
addresses. Demo accounts use the Demo environment, on deepinfodemo.com addresses**, for both the platform
and the API. Use the addresses that match your account: they are on the same domain as the platform you
sign in to.

| Environment | Account | Platform (web app, HTTPS) | API base URL (HTTPS) |
|---|---|---|---|
| Production | Paid (customer) account | platform.deepinfo.com | api.deepinfo.com/v1 |
| Demo | Demo account | platform.deepinfodemo.com | api.deepinfodemo.com/v1 |

## Show the Demo Addresses

By default, every example on this site uses the Production addresses. With a demo account, choose
**Demo** in the **Environment** switch at the top of the API Reference sidebar (or open the API reference
from the **Demo** card on the home page): every code example and platform link on the site then shows the
Demo addresses, and **Copy** copies them as shown. Choose **Production** to switch back. Your choice is
remembered in this browser.

The switch changes only what this site shows. The table above stays the reference, and the Markdown
versions of the pages and `llms.txt` always use the Production addresses. Without the switch (for example,
with JavaScript turned off), replace api.deepinfo.com with api.deepinfodemo.com and platform.deepinfo.com
with platform.deepinfodemo.com yourself.

## Base URL

All endpoints are served over HTTPS. The API version is the first path segment:

```text
https://api.deepinfo.com/v1/<module>/<endpoint>
```

In Postman, the host and the version come from variables: see [In Postman](#in-postman).

## Conventions

- Request and response bodies are JSON (`Content-Type: application/json`). Export endpoints can return
  CSV instead, depending on the format you request.
- Dates and times are ISO 8601 in UTC, for example `2026-09-22T12:25:50Z`.
- Some endpoints return download links (for example, feed files and exports). These are **pre-signed URLs
  that expire**. Download the file promptly, and call the endpoint again to get a fresh link.

For example, a [DNS](/reference/lookup/dns/) lookup of the A and MX records of a domain:

```bash
curl "https://api.deepinfo.com/v1/lookup/dns?domain=deepinfo.com&type=A,MX" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

## In Postman

In the Deepinfo Postman collection the host and the version come from the `api_base_url` and
`api_version` variables of the selected environment. With a demo account, set `api_base_url` to
`https://api.deepinfodemo.com` there. [Postman Collection](/getting-started/postman/) has the details.


---

# Rate Limits

URL: https://docs.deepinfo.com/getting-started/rate-limits/

Limits apply per API key and per endpoint; responses carry ratelimit headers that show where you stand.

Rate limits depend on your plan. Unless your plan says otherwise, the default limit is **1 request per
second**. Limits apply per API key and per endpoint.

## Rate-Limit Headers

Responses tell you where you stand:

| Header | Meaning |
|---|---|
| `ratelimit-limit` | Requests allowed in the current window |
| `ratelimit-remaining` | Requests left in the current window |
| `ratelimit-reset` | Seconds until the window resets |
| `x-ratelimit-limit-second` | The limit of the per-second window configured on your plan |
| `x-ratelimit-limit-minute` | The limit of the per-minute window configured on your plan |
| `x-ratelimit-limit-hour` | The limit of the per-hour window configured on your plan |
| `x-ratelimit-remaining-second` | Requests left in the per-second window |
| `x-ratelimit-remaining-minute` | Requests left in the per-minute window |
| `x-ratelimit-remaining-hour` | Requests left in the per-hour window |

The header values in the saved examples on this site come from the key that recorded them. Your plan's
limits can differ, so read the headers of your own responses.

## When You Go Over

When you exceed a limit, the API returns **429 Too Many Requests**:

```json
{
  "message": "API rate limit exceeded",
  "request_id": "9b1f3c5d7e9a1b3c5d7e9f1a3b5c7d9e"
}
```

Wait `ratelimit-reset` seconds before retrying. For bulk jobs, pace your requests to stay within
`ratelimit-limit`.

> [!TIP]
> Read `ratelimit-remaining` and `ratelimit-reset` from each response instead of hard-coding a delay: the
> limits configured on your plan can differ from the default.

## Quota

Some endpoints (for example, lookups) also count against a **quota** on your plan. Each request uses one
quota unit, regardless of how much data it returns. The platform shows your quota and how much of it is
used under **Settings → Organization Settings → API Usage** (see
[Check API usage and quota](/guide/settings/api-usage/) in the Platform Guide).

A 429 response is shown in full, with its headers, on the [Errors](/getting-started/errors/) page.


---

# Pagination

URL: https://docs.deepinfo.com/getting-started/pagination/

Paginated endpoints take page and page_size and share one response envelope.

Endpoints that accept the `page` and `page_size` query parameters are paginated. Most search endpoints
and many list endpoints do:

| Parameter | Description |
|---|---|
| `page` | Page number, starting at 1 |
| `page_size` | Results per page |

Other list endpoints, such as most history, timeline and statistics endpoints, return a plain JSON array
instead. Each endpoint's reference page lists the query parameters it accepts.

## The Envelope

Paginated responses share the same envelope:

```json
{
  "page": 1,
  "page_size": 25,
  "result_count": 1342,
  "results": [ ... ]
}
```

`result_count` is the total number of matches, not the number of items on the page.

## Limits

Allowed values differ per endpoint. Each endpoint documents its own `page` and `page_size` limits on its
reference page. Search-based endpoints return at most **10,000 results** per query. To go beyond that,
narrow the query with filters instead of paging further. See
[Search & filters](/getting-started/search-and-filters/).

> [!TIP]
> Many search endpoints have a matching `…/search:export` endpoint that returns the matches as CSV or a
> JSON array in one response instead of pages, for example [Asset Export](/reference/easm/asset-export/).
> Large exports can time out, so narrow them with filters too.


---

# Search & Filters

URL: https://docs.deepinfo.com/getting-started/search-and-filters/

The filters body used by search endpoints, its operators, which operators each field accepts, the errors a filter returns, and query-parameter filters on list endpoints.

Search endpoints (`POST …/search`) and bulk actions (`POST …/search:<action>`) take the same JSON body,
except for a few searches with a format of their own (see
[Searches With Another Filter Format](#searches-with-another-filter-format) below):

```json
{
  "filters": {
    "must":     [ { "name": "asset_type", "type": "eq", "value": "domain" } ],
    "should":   [ ],
    "must_not": [ { "name": "tags", "type": "in", "value": ["staging"] } ]
  },
  "sort": [ { "field": "added_date", "order": "desc" } ]
}
```

| Part | Meaning |
|---|---|
| `must` | Every filter must match (AND) |
| `should` | At least one filter must match (OR) |
| `must_not` | No filter may match (NOT) |
| `sort` | List of `{field, order}`; `order` is `asc` or `desc` |

A filter is `{ "name": <field>, "type": <operator>, "value": <value> }`. Each search endpoint lists the
fields it accepts on its reference page, under **Filtering**: the searchable fields, grouped by the
operators they accept, and the fields `sort` accepts where the endpoint has them. Unknown fields return
**400**.

## Operators

| Operator (type) | Value | Matches when the field… |
|---|---|---|
| `eq` | single value | equals the value |
| `in` | array | equals any of the values |
| `startswith` / `endswith` | string | starts / ends with the value |
| `wildcard` | string with `*` / `?` | matches the pattern |
| `fuzzy` | string | approximately matches the value |
| `contains_any` / `contains_all` | array | (array field) contains any / all of the values |
| `gte` / `lte` | number or date | is ≥ / ≤ the value |
| `gt` / `lt` | number, date or CVE ID | is > / < the value; only in Vulnerability Search of the CVE database (see below) |
| `exists` | `true` / `false` | has / has no value |

Not every field accepts every operator: see the next section.

## Which Operators a Field Accepts

Operator support is set per field. Neither the field's type nor its name tells you which operators it
accepts:

- Text fields of the same endpoint: in [Vulnerability Search](/reference/vulnerability/search/),
  the search of the CVE database, `id` accepts `eq`, `startswith`, `wildcard`, `gt`, `lt` and `exists`,
  while `descriptions.value` accepts `wildcard`, `contains_any`, `contains_all` and `exists`.
- The same field on different endpoints: `asset` accepts `wildcard` and `fuzzy` in
  [Asset Search](/reference/easm/asset-search/), and neither of them in
  [Deleted Asset Search](/reference/easm/deleted-asset-search/).
- True/false fields: in Asset Search they accept `eq` and `exists`; in
  [Domain Search](/reference/discovery/domain-search/) they accept `in` as well.
- Identifiers: `id` accepts only `eq` and `in` in [Issue Search](/reference/easm/issue-search/).
- `gt` and `lt`: among the searches with `must`, `should` and `must_not` lists, only Vulnerability Search
  of the CVE database accepts them, on each of its date and number fields and on `id`. Every other one
  returns **400** for them (see [An Operator the Search Does Not Know](#an-operator-the-search-does-not-know)),
  so use `gte` and `lte` there. `gt` and `lt` do work elsewhere in the API: the
  [searches with another filter format](#searches-with-another-filter-format) take them as keys of a range
  filter, and [Email Breach List](/reference/cti/email-breach-list/), a
  [list endpoint](#list-endpoints), as the `__gt` and `__lt` suffixes.

So check the field on the endpoint you call. Each search's **Filtering** section groups its searchable
fields by the operators they accept. The groups come from measurement: each operator was sent to each
field against the API, and the API's answer decided the field's group. They are not derived from the
field's type. A few fields could not be measured: they take a value from a fixed list, the API's error
message does not name the values they accept, and the demo account used for the measurement had no
records that use them. They are listed under **Operators: not measured**: `website.parent_asset.type` in Asset Search,
and `source_format` and `network` in Compromised Payment Credential Search. Any operator outside a
field's group returns **400** (see [Filter Errors](#filter-errors)).

| Search | Request |
|---|---|
| [Domain Search](/reference/discovery/domain-search/#ref-filtering) | `POST /discovery/domain-search` |
| [Vulnerability Search (CVE database)](/reference/vulnerability/search/#ref-filtering) | `POST /discovery/vulnerability-search` |
| [Asset Search](/reference/easm/asset-search/#ref-filtering) | `POST /easm/assets/search` |
| [Deleted Asset Search](/reference/easm/deleted-asset-search/#ref-filtering) | `POST /easm/deleted-assets/search` |
| [Discovered Asset Search](/reference/easm/discovered-asset-search/#ref-filtering) | `POST /easm/discovery/assets/search` |
| [Issue Search](/reference/easm/issue-search/#ref-filtering) | `POST /easm/issues/search` |
| [Vulnerability Search](/reference/easm/vulnerability-search/#ref-filtering) | `POST /easm/vulnerabilities/search` |
| [Vulnerability Asset Search](/reference/easm/vulnerability-asset-search/#ref-filtering) | `POST /easm/vulnerabilities/asset-search` |
| [Compromised Employee Account Search](/reference/cti/compromised-employee-account-search/#ref-filtering) | `POST /cti/compromised-employee-accounts/search` |
| [Compromised Employee Credential Search](/reference/cti/compromised-employee-credential-search/#ref-filtering) | `POST /cti/compromised-employee-credentials/search` |
| [Compromised Client Credential Search](/reference/cti/compromised-client-credential-search/#ref-filtering) | `POST /cti/compromised-client-credentials/search` |
| [Compromised Payment Credential Search](/reference/cti/compromised-payment-credential-search/#ref-filtering) | `POST /cti/compromised-payment-credentials/search` |
| [Compromised Device Search](/reference/cti/compromised-device-search/#ref-filtering) | `POST /cti/compromised-devices` |
| [Threat Actor Search](/reference/cti/threat-actor-search/#ref-filtering) | `POST /cti/threat-actors/search` |
| [Security News Search](/reference/cti/security-news-search/#ref-filtering) | `POST /cti/news/search` |
| [Fraudulent Domain Search](/reference/brp/fraudulent-domain-search/#ref-filtering) | `POST /brp/fraudulent-domains/search` |
| [Suspicious Domain Search](/reference/brp/suspicious-domain-search/#ref-filtering) | `POST /brp/suspicious-domains/search` |

Exports (`…/search:export`) and bulk actions (`…/search:<action>`) have a **Filtering** section of their
own on their reference pages.

Each of these searches, and each export and bulk action beside it, also shows a **Request Template**
among its examples: a request body that lists the endpoint's filters, each with an operator the field
accepts and a placeholder value, ready to copy and fill in. A template is a request only; it has no
response.

## Filter Errors

A filter with an operator the field does not accept returns **400 Bad Request**. Today the message comes
back in one of three forms, depending on the endpoint. An operator the search does not know at all, such
as `gt` outside Vulnerability Search of the CVE database, returns a fourth:

| Form | `code` | Message in | Message |
|---|---|---|---|
| Invalid query | `10400` | `parameters[].details` | `Invalid query: <field> does not support <operator> query` |
| Supported queries listed | `10400` | `parameters[].details` | `Field '<field>' does not support '<operator>' query. Supported queries are [...]` |
| Not supported yet | `30004` | `details` | `<operator> query type is not supported yet.` |
| Unknown operator | `10400` | `parameters[].details`, with `param` `type` | `Select a valid choice.` |

To catch them all in code, read the messages in both `parameters[].details` and `details`: the first
three forms say `does not support` or `is not supported`, and the unknown operator comes with `param`
set to `type`.

### Invalid Query

[Asset Search](/reference/easm/asset-search/) with `startswith` on `open_port_count`, a number field:

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "must",
      "path": "filters",
      "details": [
        "Invalid query: open_port_count does not support startswith query"
      ]
    }
  ]
}
```

### Supported Queries Listed

[Vulnerability Search](/reference/vulnerability/search/) of the CVE database with `gte` on
`id`, a text field that accepts `gt` and `lt` but not `gte`:

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "must",
      "path": "filters",
      "details": [
        "Field 'id' does not support 'gte' query. Supported queries are ['eq', 'exists', 'wildcard', 'startswith', 'lt', 'gt']."
      ]
    }
  ]
}
```

This form lists the operators the field does accept, which is the quickest way to correct the filter.

### Not Supported Yet

[Deleted Asset Search](/reference/easm/deleted-asset-search/) with `wildcard` on `asset`:

**400 Bad Request**

```json
{
  "code": 30004,
  "details": [
    "wildcard query type is not supported yet."
  ]
}
```

This form names the operator but not the field. Code `30004` also stands for a state change that is not
allowed (see [Errors](/getting-started/errors/)), so read the message as well as the code.

### An Operator the Search Does Not Know

[Asset Search](/reference/easm/asset-search/) with `gt` on `open_port_count`. Among the searches with
`must`, `should` and `must_not` lists, only Vulnerability Search of the CVE database knows `gt` and `lt`,
so here the filter's `type` itself is rejected:

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "type",
      "path": "filters.must",
      "details": [
        "Select a valid choice."
      ]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

This form names neither the field nor the operator: `param` is `type`, and `path` names the list the
filter is in. Use `gte` or `lte` instead.

### A Value of the Wrong Type

A value of the wrong type for the field also returns **400** with code `10400` and the message in
`parameters[].details`, but it reads differently. Here the operator is accepted and the value is not:

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "must",
      "path": "filters",
      "details": [
        "Invalid value true: $eq must be boolean."
      ]
    }
  ]
}
```

The message names the value you sent, the operator and the type the field needs: `boolean` here,
`numeric` for a number field. Keep the operator and send the value as that type.

## Always Send a Filter

An empty body `{}` matches everything. For **bulk actions** (delete, tag, state changes) that means **every
record**.

> [!WARNING]
> Always send a filter with a bulk action. An empty body `{}` applies the action to every record.

## A Complete Request

```bash
curl -X POST "https://api.deepinfo.com/v1/easm/assets/search" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [ { "name": "asset_type", "type": "eq", "value": "domain" } ]
    },
    "sort": [ { "field": "added_date", "order": "desc" } ]
  }'
```

See [Asset Search](/reference/easm/asset-search/) for the fields this endpoint accepts.

## Results and Exports

Search results are paginated: see [Pagination](/getting-started/pagination/). The matching
`…/search:export` endpoints return the matches as CSV or a JSON array (`format` query parameter), for
example [Asset Export](/reference/easm/asset-export/). Large exports can time out, so narrow them
with filters too.

## Searches With Another Filter Format

A few searches take `filters` as an object with one key per field instead of `must`, `should` and
`must_not` lists. Each field takes its operators as keys, the fields combine with AND, and `sort` is one
`{field, order}` object instead of a list. For example, [Technology Search](/reference/easm/technology-search/):

```json
{
  "filters": {
    "technology": { "equals": "nginx" }
  },
  "sort": { "field": "technology", "order": "desc" }
}
```

A number or date field takes a range filter, with `gt`, `gte`, `lt` and `lte` as its keys. Technologies
found on more than five of your assets:

```json
{
  "filters": {
    "affected_asset_count": { "gt": 5 }
  }
}
```

These searches use this format. The **Filtering** section of each one lists its fields and the operators
each field takes:

| Search | Request |
|---|---|
| [Technology Search](/reference/easm/technology-search/#ref-filtering) | `POST /easm/technologies/search` |
| [Technology Asset Search](/reference/easm/technology-asset-search/#ref-filtering) | `POST /easm/technologies/asset-search` |
| [Asset Discovery Custom Discovery Rule Search](/reference/easm/asset-discovery-custom-discovery-rule-search/#ref-filtering) | `POST /easm/discovery/custom-rules/search` |
| [Fraudulent Rule Search](/reference/brp/fraudulent-rule-search/#ref-filtering) | `POST /brp/fraudulent-rules/search` |
| [Report Search](/reference/platform/report-search/#ref-filtering) | `POST /platform/reports/search` |

The exports of the technology searches take the same format. [Report Search](/reference/platform/report-search/)
also requires `filters.type`, for example:

```json
{
  "filters": {
    "type": "easm_executive_summary"
  }
}
```

## List Endpoints

**List** endpoints (`GET`) filter with query parameters instead, for example:

```text
?email__contains=john&vip=true&ordering=-last_breach_date
```

The suffix sets the operator (`__contains`, `__not_contains`, `__icontains`, `__startswith`, `__in`,
`__nin`, `__gte`, `__lte`, `__gt`, `__lt`), and `ordering` sorts (prefix `-` for descending). Each list
endpoint's reference page shows the query parameters it accepts. Not every list endpoint takes every
suffix: [Email Breach List](/reference/cti/email-breach-list/) takes `__gt` and `__lt` on its dates and
counts, while [Breached Account List](/reference/cti/breached-account-list/),
[Notification Email List](/reference/platform/notification-email-list/),
[Notification Rule List](/reference/platform/notification-rule-list/) and
[Scheduled Report Rule List](/reference/platform/scheduled-report-rule-list/) take `__gte` and `__lte`. The
other list endpoints have no range suffix.


---

# Errors

URL: https://docs.deepinfo.com/getting-started/errors/

The Deepinfo error formats, the status codes they use, the forms a search filter error takes, and an example request and response for each one.

The API uses standard HTTP status codes. Errors come in one of the formats below, depending on where
the request stopped.

Errors from the API gateway and from the API service are JSON (`Content-Type: application/json`) and
carry a `deepinfo-request-id` header. Include that value when you contact
[support@deepinfo.com](mailto:support@deepinfo.com).

A few errors are not JSON. When a very large export runs too long, the request ends with **502 Bad
Gateway** and a plain-text body (`error code: 502`). Narrow large exports with filters to avoid it.

## 1. Gateway Errors

These are returned before the request reaches the API service: authentication, plan access, rate limiting
and unknown URLs.

```json
{
  "message": "Unauthorized",
  "request_id": "9b1f3c5d7e9a1b3c5d7e9f1a3b5c7d9e"
}
```

| Status | Message | Cause |
|---|---|---|
| 401 | `No API key found in request` | The `apikey` header is missing |
| 401 | `Unauthorized` | The API key is not valid |
| 403 | `You cannot consume this service` | The endpoint is not included in your plan |
| 404 | `no Route matched with those values` | The URL does not exist (check the path and version) |
| 429 | `API rate limit exceeded` | Rate limit exceeded (see [Rate limits](/getting-started/rate-limits/)) |

The `request_id` in a gateway error body is a different value from the `deepinfo-request-id` header.
When you contact support about a gateway error, include both.

## 2. Application Errors

These are returned by the API service itself: invalid input, missing resources and unexpected errors.

```json
{
  "code": 10400,
  "details": [],
  "parameters": [
    {
      "param": "domain",
      "subcode": 10001,
      "details": ["Domain extension is not given in the input."]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

| Field | Description |
|---|---|
| `code` | Error code (see below) |
| `details` | Human-readable messages about the error as a whole |
| `parameters` | Per-parameter validation errors, one object per parameter |
| `parameters[].param` | Name of the parameter |
| `parameters[].subcode` | Error subcode |
| `parameters[].path` | Path, when present |
| `parameters[].details` | Human-readable messages about this parameter |
| `solution` | Link to documentation that helps resolve the error |

| Status | Example code | Meaning |
|---|---|---|
| 400 | `10400` | Invalid or missing parameters or body, including a search filter with an operator or a value the field does not accept. See `parameters` for the field-level reason |
| 400 | `410005` | [Darkweb Search](/reference/darkweb/search/): none of the search fields was sent. `details` lists the fields you can send |
| 404 | e.g. `30003` | The requested resource does not exist |
| 400 | `30004` | The requested state change is not allowed for the record's current state. Some searches also return it for a filter operator they do not support (see [Filter Errors](#filter-errors)) |
| 500 | `-1` | Unexpected error. Retry later. If it persists, contact support with the `deepinfo-request-id` |

### Filter Errors

On a search endpoint, a filter with an operator the field does not accept returns **400**. Today the
message comes back in one of three forms, depending on the endpoint. An operator the search does not know
at all, such as `gt` outside Vulnerability Search of the CVE database, returns a fourth:

| Form | `code` | Message in | Message |
|---|---|---|---|
| Invalid query | `10400` | `parameters[].details` | `Invalid query: <field> does not support <operator> query` |
| Supported queries listed | `10400` | `parameters[].details` | `Field '<field>' does not support '<operator>' query. Supported queries are [...]` |
| Not supported yet | `30004` | `details` | `<operator> query type is not supported yet.` |
| Unknown operator | `10400` | `parameters[].details`, with `param` `type` | `Select a valid choice.` |

Invalid query, from [Asset Search](/reference/easm/asset-search/):

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "must",
      "path": "filters",
      "details": [
        "Invalid query: open_port_count does not support startswith query"
      ]
    }
  ]
}
```

Supported queries listed, from [Vulnerability Search](/reference/vulnerability/search/) of the CVE
database with `gte` on `id`. This form also lists the operators the field accepts:

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "must",
      "path": "filters",
      "details": [
        "Field 'id' does not support 'gte' query. Supported queries are ['eq', 'exists', 'wildcard', 'startswith', 'lt', 'gt']."
      ]
    }
  ]
}
```

Not supported yet, from [Deleted Asset Search](/reference/easm/deleted-asset-search/). This form names the
operator but not the field:

**400 Bad Request**

```json
{
  "code": 30004,
  "details": [
    "wildcard query type is not supported yet."
  ]
}
```

Unknown operator, from [Asset Search](/reference/easm/asset-search/) with `gt`. This form names neither the
field nor the operator: `param` is `type`, and `path` names the list the filter is in:

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "type",
      "path": "filters.must",
      "details": [
        "Select a valid choice."
      ]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

A filter value of the wrong type returns **400** with code `10400` as well, but its message reads
differently, for example `Invalid value true: $eq must be boolean.` There the operator is accepted and the
value is not: send the value as the type the message names.

[Search & Filters](/getting-started/search-and-filters/#filter-errors) shows the filter behind each of
these errors, and where each endpoint lists the operators its fields accept.

## Examples

Each example below shows a request and the response saved for it. The saved responses are anonymized:
the `request_id` and `deepinfo-request-id` values are placeholders.

### 401 Missing API Key

A request sent **without** the `apikey` header. The gateway rejects it with **401**.

```bash
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
  -H "Accept: application/json"
```

**401 Unauthorized**

```json
{
  "message": "No API key found in request",
  "request_id": "9b1f3c5d7e9a1b3c5d7e9f1a3b5c7d9e"
}
```

### 401 Invalid API Key

An **invalid** API key. The gateway rejects it with **401**.

```bash
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
  -H "apikey: invalid-api-key" \
  -H "Accept: application/json"
```

**401 Unauthorized**

```json
{
  "message": "Unauthorized",
  "request_id": "9b1f3c5d7e9a1b3c5d7e9f1a3b5c7d9e"
}
```

### 403 Endpoint Not in Plan

Returned when your API key is valid but the endpoint is **not included in your plan**. Whether you see it
depends on your plan.

```bash
curl "https://api.deepinfo.com/v1/discovery/vulnerability-finder?url=https://deepinfo.com" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

**403 Forbidden**

```json
{
  "message": "You cannot consume this service",
  "request_id": "9b1f3c5d7e9a1b3c5d7e9f1a3b5c7d9e"
}
```

### 404 Unknown URL

A URL that does not exist. The gateway returns **404**.

```bash
curl "https://api.deepinfo.com/v1/lookup/does-not-exist" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

**404 Not Found**

```json
{
  "message": "no Route matched with those values",
  "request_id": "9b1f3c5d7e9a1b3c5d7e9f1a3b5c7d9e"
}
```

### 429 Rate Limit Exceeded

Returned when you exceed your rate limit. Send the same request several times within one second to
reproduce it. See [Rate limits](/getting-started/rate-limits/).

```bash
curl "https://api.deepinfo.com/v1/lookup/ip-whois?ip=8.8.8.8" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

**429 Too Many Requests**

```http
content-type: application/json
ratelimit-limit: 1
ratelimit-remaining: 0
ratelimit-reset: 1
deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a
```

```json
{
  "message": "API rate limit exceeded",
  "request_id": "9b1f3c5d7e9a1b3c5d7e9f1a3b5c7d9e"
}
```

### 400 Validation Error

An invalid `domain`. The API returns **400** with a field-level reason in `parameters`.

```bash
curl "https://api.deepinfo.com/v1/lookup/whois?domain=not_a_domain" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

**400 Bad Request**

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "domain",
      "subcode": 10001,
      "details": [
        "Domain extension is not given in the input."
      ]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

### 404 Resource Not Found

An External Attack Surface Management (EASM) asset that does not exist. The API returns **404** with an application error code. Requires EASM
access.

```bash
curl "https://api.deepinfo.com/v1/easm/assets/ffffffffffffffffffffffff" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

**404 Not Found**

```json
{
  "code": 30003,
  "details": [
    "Asset does not exist."
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

### 500 Unexpected Error

The shape of an unexpected server error. This request normally succeeds; the example only shows what a
500 looks like. Retry later. If it persists, contact support with the `deepinfo-request-id` header value.

```bash
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
  -H "apikey: YOUR_API_KEY" \
  -H "Accept: application/json"
```

**500 Internal Server Error**

```json
{
  "code": -1,
  "details": [
    "An unexpected error has occurred."
  ]
}
```

> [!NOTE]
> The Deepinfo [Postman collection](/getting-started/postman/) has the requests behind these examples in
> its **Getting Started › Errors** folder.


---

# API Reference

URL: https://docs.deepinfo.com/reference/

Every Deepinfo API endpoint, with parameters, responses and ready-to-run examples.

The **Deepinfo API** gives you programmatic access to Deep Search & Insights (**DSI**), Deepinfo's internet-wide domain, DNS, WHOIS, SSL and vulnerability data, and to your Deepinfo Platform modules: External Attack Surface Management (**EASM**), Cyber Threat Intelligence (**CTI**), Brand Risk Protection (**BRP**) and **Platform** (notifications and reports).

- Base URL: `https://api.deepinfo.com/v1` (Production accounts)
- Demo accounts: `https://api.deepinfodemo.com/v1` (see [Environments & Base URL](/getting-started/environments-and-base-url/))
- Authentication: API key in the `apikey` header (see [Authentication](/getting-started/authentication/))
- Every response carries a `deepinfo-request-id` header (see [Errors](/getting-started/errors/))

## Before You Start

- [Authentication](/getting-started/authentication/)
- [Environments & Base URL](/getting-started/environments-and-base-url/)
- [Rate Limits](/getting-started/rate-limits/)
- [Pagination](/getting-started/pagination/)
- [Search & Filters](/getting-started/search-and-filters/)
- [Errors](/getting-started/errors/)

## Modules

### Deep Search & Insights (DSI)

| Module | About |
|---|---|
| [Lookup](/reference/lookup/) | Look up a single domain, host, IP address or website, either in real time or from Deepinfo's history. |
| [Discovery](/reference/discovery/) | Search Deepinfo's internet-wide domain dataset: find subdomains, associated domains, domains registered at the same time, and domains that share a WHOIS email, name server, IP or mail server. |
| [Darkweb](/reference/darkweb/) | Search dark web sources (forums, markets, paste sites, chats, leaks). Results are paged 25 per page, up to page 250. |
| [Vulnerability](/reference/vulnerability/) | Deepinfo's vulnerability (CVE) database: search, CVE details, EPSS history and global statistics. |
| [Domain Intelligence](/reference/domain-intelligence/) | Global domain registration statistics. |
| [Feeds](/reference/feeds/) | Download Deepinfo data feeds (all domains/subdomains, daily registered/updated/deleted domains, daily discovered subdomains). |

### Platform APIs

| Module | About |
|---|---|
| [EASM](/reference/easm/) | External Attack Surface Management: your monitored assets (domains, subdomains, IPs, websites), what Deepinfo discovers around them, and the issues, vulnerabilities and technologies found on them. |
| [CTI](/reference/cti/) | Cyber Threat Intelligence: email breaches, compromised employee/client/payment credentials, compromised devices, threat actors and security news relevant to your organization. |
| [BRP](/reference/brp/) | Brand Risk Protection: domains that imitate your brand. Suspicious domains are candidates for review; approved ones become fraudulent domains and are monitored. |
| [Platform](/reference/platform/) | Notifications and reports. |


---

# Lookup

URL: https://docs.deepinfo.com/reference/lookup/

Look up a single domain, host, IP address or website, either in real time or from Deepinfo's history.

Look up a **single** domain, host, IP address or website, either in real time or from Deepinfo's history.

| Request | Returns |
|---|---|
| **Domain WHOIS** | Current registration record of a domain |
| **DNS** | Current DNS records (up to 5 types per call) |
| **IP WHOIS** | Current registration details of an IP address |
| **SSL** | The certificate served by a host |
| **Port Scan** | Open ports and services of a host |
| **Technology** | Technologies a website runs on |
| **Screenshot** | A screenshot of a web page, with options in the query string |
| **Screenshot (POST)** | The same, with options in a JSON body |
| **Web Data** | Content, metadata, links, trackers, headers and cookies of a web page, optionally with a screenshot |
| **DNS History** | Every DNS value observed for a domain over time |
| **WHOIS History** | Every WHOIS record observed for a domain over time |

Each request uses one quota unit on your plan.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Domain WHOIS](/reference/lookup/domain-whois/) | `/lookup/whois` |
| GET | [DNS](/reference/lookup/dns/) | `/lookup/dns` |
| GET | [IP WHOIS](/reference/lookup/ip-whois/) | `/lookup/ip-whois` |
| GET | [SSL](/reference/lookup/ssl/) | `/lookup/ssl` |
| POST | [Port Scan](/reference/lookup/port-scan/) | `/lookup/port-scan` |
| GET | [Technology](/reference/lookup/technology/) | `/lookup/technology` |
| GET | [Screenshot](/reference/lookup/screenshot/) | `/lookup/screenshot` |
| POST | [Screenshot (POST)](/reference/lookup/screenshot-post/) | `/lookup/screenshot` |
| GET | [Web Data](/reference/lookup/web-data/) | `/lookup/webdata` |
| GET | [DNS History](/reference/lookup/dns-history/) | `/analyze/dns-history` |
| GET | [WHOIS History](/reference/lookup/whois-history/) | `/analyze/whois-history` |


---

# Domain WHOIS

URL: https://docs.deepinfo.com/reference/lookup/domain-whois/

Returns the current WHOIS registration record of a domain: registrar, registrant, creation, update and expiry dates, name servers and status codes.

`GET https://api.deepinfo.com/v1/lookup/whois`

Returns the **current** WHOIS registration record of a domain: registrar, registrant, creation, update and expiry dates, name servers and status codes. The record is queried in real time. The response includes both the raw WHOIS text and a parsed version.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required | Domain name, e.g. `deepinfo.com`. Subdomains are accepted (`www.deepinfo.com`); IP addresses are not. | `deepinfo.com` |

## Response Fields

| Field | Description |
|---|---|
| `domain_name` | The queried domain |
| `raw` | Raw WHOIS text as returned by the WHOIS server |
| `parsed` | Parsed record, with the `parsed.*` fields below. `null` if the record could not be parsed |
| `parsed.create_date` | Registration date |
| `parsed.update_date` | Date of the last update |
| `parsed.expiry_date` | Expiry date |
| `parsed.registrar` | Registrar |
| `parsed.registrant.name` | Registrant name |
| `parsed.registrant.organization` | Registrant organization |
| `parsed.registrant.street` | Registrant street address |
| `parsed.registrant.city` | Registrant city |
| `parsed.registrant.state` | Registrant state or province |
| `parsed.registrant.postal_code` | Registrant postal code |
| `parsed.registrant.country` | Registrant country |
| `parsed.registrant.phone` | Registrant phone number |
| `parsed.registrant.email` | Registrant e-mail address |
| `parsed.name_servers` | Name servers |
| `parsed.domain_status` | Domain status codes |
| `parsed.whois_server` | WHOIS server |
| `check_date` | When the lookup was performed (UTC) |
| `parse_code` | Parser status code; `null` when parsing succeeded |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `domain_name` | string |
| `raw` | string |
| `parsed` | object |
| `parsed.uid` | string |
| `parsed.create_date` | string |
| `parsed.update_date` | string |
| `parsed.expiry_date` | string |
| `parsed.registrar` | string |
| `parsed.registrant` | object |
| `parsed.registrant.name` | string |
| `parsed.registrant.organization` | string |
| `parsed.registrant.street` | string |
| `parsed.registrant.city` | string |
| `parsed.registrant.state` | string |
| `parsed.registrant.postal_code` | string |
| `parsed.registrant.country` | string |
| `parsed.registrant.phone` | string |
| `parsed.registrant.email` | string |
| `parsed.name_servers` | array<string> |
| `parsed.domain_status` | array<string> |
| `parsed.whois_server` | string |
| `check_date` | string |
| `parse_code` | null |

## Errors

`400` if `domain` is missing or not a valid domain. See [Getting Started → Errors](/getting-started/errors/).

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/domain-whois.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/domain-whois/examples/


---

# DNS

URL: https://docs.deepinfo.com/reference/lookup/dns/

GET /lookup/dns: Resolves the current DNS records of a domain or hostname in real time. Request up to five record types in one call.

`GET https://api.deepinfo.com/v1/lookup/dns`

Resolves the **current** DNS records of a domain or hostname in real time. Request up to five record types in one call. Each request uses **one quota unit**, whether you ask for one type or five.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required | Fully qualified domain name, e.g. `deepinfo.com` or `www.deepinfo.com`. IP addresses are not accepted. | `deepinfo.com` |
| `type` | Required | DNS record type names, comma-separated, for example `A,MX`. Up to **5** types per request. | `A,MX` |

## Response Fields

| Field | Description |
|---|---|
| `fqdn` | The queried name |
| `requested_types` | Record types that were requested |
| `responses[]` | One entry per requested type |
| `responses[].type` | Record type |
| `responses[].conn_status` | `success` or `timeout` |
| `responses[].rcode` | DNS response code, for example `NOERROR` or `NXDOMAIN` |
| `responses[].values` | Parsed record values |
| `responses[].raw` | The answer in zone-file format |
| `responses[].server` | Resolver used |
| `servers` | Resolvers used for the lookup |
| `check_date` | When the lookup was performed (UTC) |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `fqdn` | string |
| `requested_types` | array<string> |
| `responses` | array<object> |
| `responses[].type` | string |
| `responses[].conn_status` | string |
| `responses[].rcode` | string |
| `responses[].raw` | string |
| `responses[].values` | array<string> |
| `responses[].server` | string |
| `servers` | array<string> |
| `check_date` | string |

## Errors

`400` if `domain` is not a valid FQDN or `type` is missing.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/dns.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/dns/examples/


---

# IP WHOIS

URL: https://docs.deepinfo.com/reference/lookup/ip-whois/

GET /lookup/ip-whois: Returns the current registration details of an IP address from the regional internet registries (RDAP/WHOIS): the owning network and its…

`GET https://api.deepinfo.com/v1/lookup/ip-whois`

Returns the **current** registration details of an IP address from the regional internet registries (RDAP/WHOIS): the owning network and its range, the ASN, the registry, and contact entities.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `ip` | Required | IPv4 or IPv6 address. | `8.8.8.8` |

## Response Fields

| Field | Description |
|---|---|
| `ip` | The queried IP address |
| `ipwhois.asn` | Number of the autonomous system (AS) that announces the IP |
| `ipwhois.asn_cidr` | The announced IP range that contains the IP |
| `ipwhois.asn_description` | Name of the AS |
| `ipwhois.asn_country_code` | Country code of the AS |
| `ipwhois.asn_registry` | Regional internet registry of the AS |
| `ipwhois.asn_date` | Allocation date of the AS |
| `ipwhois.network` | The registered network that contains the IP, with the `ipwhois.network.*` fields below |
| `ipwhois.network.cidr` | Network range in CIDR notation |
| `ipwhois.network.name` | Network name |
| `ipwhois.network.country` | Country of the network |
| `ipwhois.network.start_address` | First address of the range |
| `ipwhois.network.end_address` | Last address of the range |
| `ipwhois.network.ip_version` | IP version, e.g. `v4` |
| `ipwhois.network.handle` | Registry handle of the network |
| `ipwhois.network.parent_handle` | Handle of the parent network |
| `ipwhois.network.type` | Allocation type |
| `ipwhois.network.status` | Registration status |
| `ipwhois.network.events[]` | Registration events of the network |
| `ipwhois.network.events[].action` | What happened, e.g. `registration` |
| `ipwhois.network.events[].actor` | Who did it, when the registry says |
| `ipwhois.network.events[].timestamp` | When it happened (UTC) |
| `ipwhois.network.notices[]` | Registry notices |
| `ipwhois.network.notices[].title` | Notice title |
| `ipwhois.network.notices[].description` | Notice text |
| `ipwhois.network.notices[].links` | Links given with the notice |
| `ipwhois.network.remarks[]` | Registry remarks |
| `ipwhois.network.remarks[].title` | Remark title |
| `ipwhois.network.remarks[].description` | Remark text |
| `ipwhois.network.remarks[].links` | Links given with the remark |
| `ipwhois.network.links` | RDAP and WHOIS links for the network |
| `ipwhois.network.raw` | Raw registry answer for the network, when available |
| `ipwhois.entities` | Handles of related entities (organizations, contacts) |
| `ipwhois.objects` | Details for each entity handle, keyed by the handle: contact details, roles and registration events |
| `ipwhois.nir` | National Internet Registry data, where applicable |
| `check_date` | When the lookup was performed (UTC) |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `ip` | string |
| `ipwhois` | object |
| `ipwhois.asn` | string |
| `ipwhois.asn_cidr` | string |
| `ipwhois.asn_description` | string |
| `ipwhois.asn_country_code` | string |
| `ipwhois.asn_registry` | string |
| `ipwhois.entities` | array<string> |
| `ipwhois.asn_date` | string |
| `ipwhois.nir` | null |
| `ipwhois.query` | string |
| `ipwhois.raw` | null |
| `ipwhois.network` | object |
| `ipwhois.network.cidr` | string |
| `ipwhois.network.name` | string |
| `ipwhois.network.country` | null |
| `ipwhois.network.start_address` | string |
| `ipwhois.network.end_address` | string |
| `ipwhois.network.handle` | string |
| `ipwhois.network.ip_version` | string |
| `ipwhois.network.links` | array<string> |
| `ipwhois.network.parent_handle` | string |
| `ipwhois.network.raw` | null |
| `ipwhois.network.status` | array<string> |
| `ipwhois.network.type` | string |
| `ipwhois.network.notices` | array<object> |
| `ipwhois.network.notices[].title` | string |
| `ipwhois.network.notices[].description` | string |
| `ipwhois.network.notices[].links` | array<string> |
| `ipwhois.network.remarks` | null |
| `ipwhois.network.events` | array<object> |
| `ipwhois.network.events[].action` | string |
| `ipwhois.network.events[].actor` | null |
| `ipwhois.network.events[].timestamp` | string |
| `ipwhois.objects` | object |
| `ipwhois.objects.GOGL` | object |
| `ipwhois.objects.GOGL.contact` | object |
| `ipwhois.objects.GOGL.contact.email` | null |
| `ipwhois.objects.GOGL.contact.address` | array<object> |
| `ipwhois.objects.GOGL.contact.address[].type` | null |
| `ipwhois.objects.GOGL.contact.address[].value` | string |
| `ipwhois.objects.GOGL.contact.phone` | null |
| `ipwhois.objects.GOGL.contact.kind` | string |
| `ipwhois.objects.GOGL.contact.name` | string |
| `ipwhois.objects.GOGL.contact.role` | null |
| `ipwhois.objects.GOGL.contact.title` | null |
| `ipwhois.objects.GOGL.entities` | array<string> |
| `ipwhois.objects.GOGL.events` | array<object> |
| `ipwhois.objects.GOGL.events[].action` | string |
| `ipwhois.objects.GOGL.events[].actor` | null |
| `ipwhois.objects.GOGL.events[].timestamp` | string |
| `ipwhois.objects.GOGL.events_actor` | null |
| `ipwhois.objects.GOGL.handle` | string |
| `ipwhois.objects.GOGL.links` | array<string> |
| `ipwhois.objects.GOGL.notices` | null |
| `ipwhois.objects.GOGL.raw` | null |
| `ipwhois.objects.GOGL.remarks` | array<object> |
| `ipwhois.objects.GOGL.remarks[].title` | string |
| `ipwhois.objects.GOGL.remarks[].description` | string |
| `ipwhois.objects.GOGL.remarks[].links` | null |
| `ipwhois.objects.GOGL.roles` | array<string> |
| `ipwhois.objects.GOGL.status` | null |
| `ipwhois.objects.ABUSE5250-ARIN` | object |
| `ipwhois.objects.ABUSE5250-ARIN.contact` | object |
| `ipwhois.objects.ABUSE5250-ARIN.contact.email` | array<object> |
| `ipwhois.objects.ABUSE5250-ARIN.contact.email[].type` | null |
| `ipwhois.objects.ABUSE5250-ARIN.contact.email[].value` | string |
| `ipwhois.objects.ABUSE5250-ARIN.contact.address` | array<object> |
| `ipwhois.objects.ABUSE5250-ARIN.contact.address[].type` | null |
| `ipwhois.objects.ABUSE5250-ARIN.contact.address[].value` | string |
| `ipwhois.objects.ABUSE5250-ARIN.contact.phone` | array<object> |
| `ipwhois.objects.ABUSE5250-ARIN.contact.phone[].type` | array<string> |
| `ipwhois.objects.ABUSE5250-ARIN.contact.phone[].value` | string |
| `ipwhois.objects.ABUSE5250-ARIN.contact.kind` | string |
| `ipwhois.objects.ABUSE5250-ARIN.contact.name` | string |
| `ipwhois.objects.ABUSE5250-ARIN.contact.role` | null |
| `ipwhois.objects.ABUSE5250-ARIN.contact.title` | null |
| `ipwhois.objects.ABUSE5250-ARIN.entities` | null |
| `ipwhois.objects.ABUSE5250-ARIN.events` | array<object> |
| `ipwhois.objects.ABUSE5250-ARIN.events[].action` | string |
| `ipwhois.objects.ABUSE5250-ARIN.events[].actor` | null |
| `ipwhois.objects.ABUSE5250-ARIN.events[].timestamp` | string |
| `ipwhois.objects.ABUSE5250-ARIN.events_actor` | null |
| `ipwhois.objects.ABUSE5250-ARIN.handle` | string |
| `ipwhois.objects.ABUSE5250-ARIN.links` | array<string> |
| `ipwhois.objects.ABUSE5250-ARIN.notices` | array<object> |
| `ipwhois.objects.ABUSE5250-ARIN.notices[].title` | string |
| `ipwhois.objects.ABUSE5250-ARIN.notices[].description` | string |
| `ipwhois.objects.ABUSE5250-ARIN.notices[].links` | array<string> |
| `ipwhois.objects.ABUSE5250-ARIN.raw` | null |
| `ipwhois.objects.ABUSE5250-ARIN.remarks` | array<object> |
| `ipwhois.objects.ABUSE5250-ARIN.remarks[].title` | string |
| `ipwhois.objects.ABUSE5250-ARIN.remarks[].description` | string |
| `ipwhois.objects.ABUSE5250-ARIN.remarks[].links` | null |
| `ipwhois.objects.ABUSE5250-ARIN.roles` | array<string> |
| `ipwhois.objects.ABUSE5250-ARIN.status` | array<string> |
| `ipwhois.objects.ZG39-ARIN` | object |
| `ipwhois.objects.ZG39-ARIN.contact` | object |
| `ipwhois.objects.ZG39-ARIN.contact.email` | array<object> |
| `ipwhois.objects.ZG39-ARIN.contact.email[].type` | null |
| `ipwhois.objects.ZG39-ARIN.contact.email[].value` | string |
| `ipwhois.objects.ZG39-ARIN.contact.address` | array<object> |
| `ipwhois.objects.ZG39-ARIN.contact.address[].type` | null |
| `ipwhois.objects.ZG39-ARIN.contact.address[].value` | string |
| `ipwhois.objects.ZG39-ARIN.contact.phone` | array<object> |
| `ipwhois.objects.ZG39-ARIN.contact.phone[].type` | array<string> |
| `ipwhois.objects.ZG39-ARIN.contact.phone[].value` | string |
| `ipwhois.objects.ZG39-ARIN.contact.kind` | string |
| `ipwhois.objects.ZG39-ARIN.contact.name` | string |
| `ipwhois.objects.ZG39-ARIN.contact.role` | null |
| `ipwhois.objects.ZG39-ARIN.contact.title` | null |
| `ipwhois.objects.ZG39-ARIN.entities` | null |
| `ipwhois.objects.ZG39-ARIN.events` | array<object> |
| `ipwhois.objects.ZG39-ARIN.events[].action` | string |
| `ipwhois.objects.ZG39-ARIN.events[].actor` | null |
| `ipwhois.objects.ZG39-ARIN.events[].timestamp` | string |
| `ipwhois.objects.ZG39-ARIN.events_actor` | null |
| `ipwhois.objects.ZG39-ARIN.handle` | string |
| `ipwhois.objects.ZG39-ARIN.links` | array<string> |
| `ipwhois.objects.ZG39-ARIN.notices` | array<object> |
| `ipwhois.objects.ZG39-ARIN.notices[].title` | string |
| `ipwhois.objects.ZG39-ARIN.notices[].description` | string |
| `ipwhois.objects.ZG39-ARIN.notices[].links` | array<string> |
| `ipwhois.objects.ZG39-ARIN.raw` | null |
| `ipwhois.objects.ZG39-ARIN.remarks` | null |
| `ipwhois.objects.ZG39-ARIN.roles` | array<string> |
| `ipwhois.objects.ZG39-ARIN.status` | array<string> |
| `check_date` | string |

## Errors

`400` if `ip` is not a valid IP address.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/ip-whois.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/ip-whois/examples/


---

# SSL

URL: https://docs.deepinfo.com/reference/lookup/ssl/

GET /lookup/ssl: Connects to a host in real time and returns the SSL/TLS certificate it serves: subject, issuer, validity, fingerprints, extensions (including…

`GET https://api.deepinfo.com/v1/lookup/ssl`

Connects to a host in real time and returns the SSL/TLS certificate it serves: subject, issuer, validity, fingerprints, extensions (including all DNS names in the Subject Alternative Name) and whether the signature and chain are valid.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `target` | Required | Domain name or IP address to connect to. | `deepinfo.com` |
| `port` | Optional | Port to connect to. Default `443`. | `443` |
| `proxy` | Optional | Optional proxy to connect through, in the form `scheme://user:password@host:port`. |  |

## Response Fields

| Field | Description |
|---|---|
| `target` | The host that was checked |
| `port` | The port that was checked |
| `connection_status` | `success`, `timeout`, `refused`, `reset`, `ssl_error`, `not_resolved` or `proxy_connection_error` |
| `parsed` | Parsed certificate, with the `parsed.*` fields below. `null` if no certificate was retrieved |
| `parsed.version.name` | Certificate version, e.g. `v3` |
| `parsed.version.value` | The version number as encoded in the certificate (`2` for v3) |
| `parsed.subject.dn` | Subject distinguished name |
| `parsed.subject.common_name` | Subject common name (CN) |
| `parsed.subject.organization` | Subject organization (O) |
| `parsed.subject.organizational_unit` | Subject organizational unit (OU) |
| `parsed.subject.locality` | Subject locality (L) |
| `parsed.subject.state` | Subject state or province (ST) |
| `parsed.subject.country_name` | Subject country (C) |
| `parsed.issuer.dn` | Issuer distinguished name |
| `parsed.issuer.common_name` | Issuer common name (CN) |
| `parsed.issuer.organization` | Issuer organization (O) |
| `parsed.issuer.organizational_unit` | Issuer organizational unit (OU) |
| `parsed.issuer.locality` | Issuer locality (L) |
| `parsed.issuer.state` | Issuer state or province (ST) |
| `parsed.issuer.country_name` | Issuer country (C) |
| `parsed.validity.start` | Start of the validity period |
| `parsed.validity.end` | End of the validity period |
| `parsed.validity.length` | Length of the validity period, in seconds |
| `parsed.signature.valid` | Whether the signature is valid |
| `parsed.signature.valid_chain` | Whether the certificate chain is valid |
| `parsed.signature.self_signed` | Whether the certificate is self-signed |
| `parsed.signature.invalid_reason` | Why the signature or the chain is not valid; `null` when both are valid |
| `parsed.signature.value` | The signature, base64-encoded |
| `parsed.signature.signature_algorithm.oid` | OID of the signature algorithm |
| `parsed.signature.signature_algorithm.name` | Name of the signature algorithm, e.g. `sha256` |
| `parsed.fingerprint_sha1` | SHA-1 fingerprint of the certificate |
| `parsed.fingerprint_sha256` | SHA-256 fingerprint of the certificate |
| `parsed.fingerprint_md5` | MD5 fingerprint of the certificate |
| `parsed.tbs_fingerprint` | Fingerprint of the signed part of the certificate (TBS certificate) |
| `parsed.serial_number` | Serial number |
| `parsed.subject_key_info` | The certificate's public key: its algorithm, fingerprint and key parameters |
| `parsed.extensions` | X.509 extensions. `parsed.extensions.subject_alt_name.dns_names` holds every DNS name in the Subject Alternative Name |
| `parsed.has_expired` | Whether the certificate has expired |
| `parsed.fqdn_list` | Host names the certificate is valid for |
| `certificate` | The certificate in base64 (DER) |
| `parse_errors` | Problems found while parsing the certificate |
| `check_date` | When the check was performed (UTC) |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `target` | string |
| `port` | number |
| `check_date` | string |
| `connection_status` | string |
| `parsed` | object |
| `parsed.version` | object |
| `parsed.version.name` | string |
| `parsed.version.value` | string |
| `parsed.fingerprint_sha1` | string |
| `parsed.fingerprint_sha256` | string |
| `parsed.fingerprint_md5` | string |
| `parsed.subject` | object |
| `parsed.subject.dn` | string |
| `parsed.subject.common_name` | string |
| `parsed.subject.country_name` | null |
| `parsed.subject.locality` | null |
| `parsed.subject.organization` | null |
| `parsed.subject.organizational_unit` | null |
| `parsed.subject.state` | null |
| `parsed.signature` | object |
| `parsed.signature.value` | string |
| `parsed.signature.self_signed` | boolean |
| `parsed.signature.valid` | boolean |
| `parsed.signature.valid_chain` | boolean |
| `parsed.signature.invalid_reason` | null |
| `parsed.signature.signature_algorithm` | object |
| `parsed.signature.signature_algorithm.oid` | string |
| `parsed.signature.signature_algorithm.name` | string |
| `parsed.validity` | object |
| `parsed.validity.start` | string |
| `parsed.validity.length` | number |
| `parsed.validity.end` | string |
| `parsed.issuer` | object |
| `parsed.issuer.dn` | string |
| `parsed.issuer.common_name` | string |
| `parsed.issuer.country_name` | string |
| `parsed.issuer.locality` | null |
| `parsed.issuer.organization` | string |
| `parsed.issuer.organizational_unit` | null |
| `parsed.issuer.state` | null |
| `parsed.extensions` | object |
| `parsed.extensions.key_usage` | object |
| `parsed.extensions.key_usage.digital_signature` | boolean |
| `parsed.extensions.key_usage.content_commitment` | boolean |
| `parsed.extensions.key_usage.key_agreement` | boolean |
| `parsed.extensions.key_usage.data_encipherment` | boolean |
| `parsed.extensions.key_usage.key_encipherment` | boolean |
| `parsed.extensions.key_usage.key_cert_sign` | boolean |
| `parsed.extensions.key_usage.crl_sign` | boolean |
| `parsed.extensions.extended_key_usage` | object |
| `parsed.extensions.extended_key_usage.server_auth` | boolean |
| `parsed.extensions.basic_constraints` | object |
| `parsed.extensions.basic_constraints.is_ca` | boolean |
| `parsed.extensions.subject_key_identifier` | object |
| `parsed.extensions.subject_key_identifier.digest` | string |
| `parsed.extensions.authority_key_identifier` | object |
| `parsed.extensions.authority_key_identifier.key_identifier` | string |
| `parsed.extensions.authority_info_access` | object |
| `parsed.extensions.authority_info_access.caissuers_urls` | string |
| `parsed.extensions.subject_alt_name` | object |
| `parsed.extensions.subject_alt_name.dns_names` | array<string> |
| `parsed.extensions.certificate_policies` | array<string> |
| `parsed.extensions.crl_distribution_points` | array<string> |
| `parsed.extensions.signed_certificate_timestamp` | array<object> |
| `parsed.extensions.signed_certificate_timestamp[].log_id` | string |
| `parsed.extensions.signed_certificate_timestamp[].timestamp` | number |
| `parsed.extensions.signed_certificate_timestamp[].version` | number |
| `parsed.extensions.signed_certificate_timestamp[].signature` | string |
| `parsed.extensions.other_extensions` | array |
| `parsed.serial_number` | string |
| `parsed.tbs_fingerprint` | string |
| `parsed.subject_key_info` | object |
| `parsed.subject_key_info.fingerprint` | object |
| `parsed.subject_key_info.fingerprint.hash_algorithm_name` | string |
| `parsed.subject_key_info.fingerprint.value` | string |
| `parsed.subject_key_info.key_algorithm` | object |
| `parsed.subject_key_info.key_algorithm.name` | string |
| `parsed.subject_key_info.ecdsa_public_key` | object |
| `parsed.subject_key_info.ecdsa_public_key.length` | string |
| `parsed.subject_key_info.ecdsa_public_key.x` | string |
| `parsed.subject_key_info.ecdsa_public_key.y` | string |
| `parsed.has_expired` | boolean |
| `parsed.fqdn_list` | array<string> |
| `certificate` | string |
| `parse_errors` | array |

## Errors

`400` if `target` is missing or invalid. Connection problems are **not** errors: they return `200` with the reason in `connection_status`.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/ssl.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/ssl/examples/


---

# Port Scan

URL: https://docs.deepinfo.com/reference/lookup/port-scan/

POST /lookup/port-scan: Scans a host in real time and returns its open TCP/UDP ports and the services running on them.

`POST https://api.deepinfo.com/v1/lookup/port-scan`

Scans a host in real time and returns its open TCP/UDP ports and the services running on them. Optionally detects service versions and the operating system.

> Only scan hosts you own or are authorized to test.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `target` | Required | Domain name or IP address to scan. | `deepinfo.com` |
| `timeout` | Optional | Scan timeout in seconds. Maximum and default: `85`. | `85` |
| `proxy` | Optional | Optional proxy to scan through, in the form `scheme://user:password@host:port`. |  |

## Request Body

| Parameter | Type | Description |
|---|---|---|
| `tcp_ports` | string | TCP ports to scan: a list (`"80,443"`), a range (`"440-445"`) or both. Omit to scan the default port set of `mode` |
| `udp_ports` | string | UDP ports to scan |
| `mode` | `light` \| `full` | Scan depth. Default `light` |
| `version` | boolean | Detect service versions. Default `false` |
| `os` | boolean | Detect the operating system. Default `false` |
| `scripts` | boolean | Run service detection scripts. Default `false` |

```json
{
  "tcp_ports": "80,443",
  "mode": "light",
  "version": true
}
```

## Response Fields

| Field | Description |
|---|---|
| `status` | `success`, or `host_down` if the host did not respond |
| `target` | The scanned host |
| `target_ip` | The IP address the host resolved to |
| `port_data.tcp[]` | One entry per TCP port in the result |
| `port_data.tcp[].port_number` | Port number |
| `port_data.tcp[].state` | Port state, e.g. `open` |
| `port_data.tcp[].service_name` | Name of the service, e.g. `https` |
| `port_data.tcp[].service_product` | Product that runs the service |
| `port_data.tcp[].service_version` | Version of that product |
| `port_data.tcp[].extra_data` | Additional data about the service |
| `port_data.udp[]` | One entry per UDP port in the result |
| `port_data.udp[].port_number` | Port number |
| `port_data.udp[].state` | Port state, e.g. `open` |
| `port_data.udp[].service_name` | Name of the service, e.g. `https` |
| `port_data.udp[].service_product` | Product that runs the service |
| `port_data.udp[].service_version` | Version of that product |
| `port_data.udp[].extra_data` | Additional data about the service |
| `os` | Operating system matches, when `os` is `true` |
| `check_date` | When the scan was performed (UTC) |

## Response Schema

_Inferred from examples._ Built from the 2 saved 2xx example responses: the fields they contain, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `status` | string |
| `target` | string |
| `target_ip` | string |
| `check_date` | string |
| `port_data` | object |
| `port_data.tcp` | array<object> |
| `port_data.tcp[].port_number` | number |
| `port_data.tcp[].service_name` | string |
| `port_data.tcp[].service_product` | null |
| `port_data.tcp[].service_version` | null |
| `port_data.tcp[].state` | string |
| `port_data.tcp[].extra_data` | object |
| `port_data.udp` | array |
| `os` | array |

## Errors

`400` if `target` is missing or the body is invalid.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/port-scan.md


---

# Technology

URL: https://docs.deepinfo.com/reference/lookup/technology/

Loads a website in real time and detects the technologies it runs on: CMS, web frameworks, JavaScript libraries, CDN, analytics, chat widgets and more.

`GET https://api.deepinfo.com/v1/lookup/technology`

Loads a website in real time and detects the technologies it runs on: CMS, web frameworks, JavaScript libraries, CDN, analytics, chat widgets and more. Each technology comes with its categories, the detected version (when the site reveals it) and a CPE name.

Use it to fingerprint a single site. The CPE name lets you match the result against vulnerability data (see **Vulnerability**). If you also need the page's HTML, links, headers and cookies, [Web Data](/reference/lookup/web-data/) returns the same technologies together with them in one call.

The site is loaded live, so a request takes a few seconds (about 5 s in our tests).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `url` | Required | Website to analyze, e.g. `https://www.deepinfo.com`. | `https://www.deepinfo.com` |
| `proxy` | Optional | Proxy to connect through, in the form `http://user:password@host:port`. |  |

## Response Fields

| Field | Description |
|---|---|
| `urls` | Every URL that was loaded, with the HTTP `status` it returned, e.g. `{"https://www.deepinfo.com/": {"status": 200}}`. `null` if nothing could be loaded |
| `technologies[]` | One entry per detected technology |
| `technologies[].slug` | Identifier of the technology |
| `technologies[].name` | Name of the technology |
| `technologies[].description` | What the technology is |
| `technologies[].categories` | Categories it belongs to |
| `technologies[].confidence` | Detection confidence (0–100) |
| `technologies[].version` | Detected version; empty when the site does not reveal it |
| `technologies[].clean_version` | The version as a number, or `null` |
| `technologies[].cpe` | CPE name |
| `technologies[].alternative_cpe_names` | Other CPE names of the technology |
| `technologies[].website` | The vendor's website |
| `technologies[].icon` | Icon file name |
| `connection_status` | `success` when the site was reached |
| `version` | Version of the result format (currently `1`) |
| `check_date` | When the lookup was performed (UTC) |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `check_date` | string |
| `connection_status` | string |
| `urls` | object |
| `urls.*` | object |
| `urls.*.status` | number |
| `technologies` | array<object> |
| `technologies[].slug` | string |
| `technologies[].name` | string |
| `technologies[].confidence` | number |
| `technologies[].icon` | string |
| `technologies[].website` | string |
| `technologies[].cpe` | string |
| `technologies[].version` | string |
| `technologies[].categories` | array<string> |
| `technologies[].alternative_cpe_names` | array |
| `technologies[].clean_version` | null |
| `technologies[].description` | string |
| `version` | number |

## Errors

`400` (`10400`) if `url` is missing or not a valid URL. The validation error currently names the parameter `domain`, although the request parameter is `url` (see the example). `500` for an unexpected error. `503` means the analyzer is busy and `504` that it timed out: retry after a short wait. See [Getting Started → Errors](/getting-started/errors/).

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/technology.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/technology/examples/


---

# Screenshot

URL: https://docs.deepinfo.com/reference/lookup/screenshot/

GET /lookup/screenshot: Opens a web page in a real browser and returns a link to a screenshot of it.

`GET https://api.deepinfo.com/v1/lookup/screenshot`

Opens a web page in a real browser and returns a link to a screenshot of it. Options control the viewport, full-page capture, mobile emulation, image format and how long to wait for the page.

Use it to see what a site shows right now, for example to review a suspicious or look-alike domain without visiting it yourself. A request takes a few seconds (about 5 s in our tests).

All options are query parameters; the defaults give a 1366 × 768 JPEG of the visible part of the page. To send the options as a JSON body instead (for long values such as `custom_html`), use [Screenshot (POST)](/reference/lookup/screenshot-post/).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `url` | Required | Web page to capture, e.g. `https://www.deepinfo.com`. It can be left out only when `custom_html` is sent. | `https://www.deepinfo.com` |
| `width` | Optional | Browser viewport width, in pixels. Range `100`–`3000`. Default `1366`. | `1366` |
| `height` | Optional | Browser viewport height, in pixels. Range `100`–`3000`. Default `768`. | `768` |
| `full_page` | Optional | Capture the whole page, not only the visible viewport. Default `false`. | `false` |
| `mobile` | Optional | Emulate a mobile device. The viewport then defaults to 360 × 740. Default `false`. | `false` |
| `landscape` | Optional | Emulate landscape orientation. Default `false`. | `false` |
| `touchscreen` | Optional | Emulate a touch screen. Default `false`. | `false` |
| `retina` | Optional | Render at twice the pixel density for a sharper image. Ignored when `scale` is set. Default `false`. | `false` |
| `scale` | Optional | Device pixel ratio: how many screen pixels draw one CSS pixel. Range `0.5`–`4`. |  |
| `image_output` | Optional | Image format. One of `jpeg`, `png`. Default `jpeg`. | `jpeg` |
| `quality` | Optional | JPEG quality. Used only when `image_output` is `jpeg`. Range `0`–`100`. |  |
| `thumbnail_width` | Optional | Resize the image to this width, keeping the aspect ratio. Must not be larger than the screenshot width. Minimum `50`. |  |
| `mode` | Optional | `fast` captures as soon as the HTML document has loaded (`domcontentloaded`); `slow` waits until network activity stops. One of `fast`, `slow`. Default `fast`. | `fast` |
| `timeout` | Optional | Maximum time to wait for the page to load, in milliseconds. Range `0`–`90000`. Default `30000`. | `30000` |
| `delay` | Optional | Extra wait after the page has loaded, in milliseconds, before the screenshot is taken. Maximum `30000`. Default `0`. | `0` |
| `lazy_load` | Optional | Scroll through the whole page first, so that lazy-loaded images are rendered. Default `false`. | `false` |
| `block_ads` | Optional | Block advertisements. Default `false`. | `false` |
| `no_cookie_banners` | Optional | Hide cookie consent banners. Default `false`. | `false` |
| `no_js` | Optional | Disable JavaScript on the page. Default `false`. | `false` |
| `selector` | Optional | CSS selector of one element, e.g. `body > .container > .logo`. When it matches, only that element is captured. |  |
| `scroll_to_element` | Optional | CSS selector of an element to scroll to before the screenshot, e.g. `body > .footer`. |  |
| `accept_languages` | Optional | Browser `Accept-Language` value. Default `en-US`. | `en-US` |
| `latitude` | Optional | Latitude reported by the browser's Geolocation API. Requires `longitude`. Range `-80`–`80`. |  |
| `longitude` | Optional | Longitude reported by the browser's Geolocation API. Requires `latitude`. Range `-180`–`180`. |  |
| `user_agent` | Optional | Browser user agent string. |  |
| `cookies` | Optional | Cookies to set in the browser, e.g. `name1=value1; name2=value2`. |  |
| `headers` | Optional | Extra request headers, e.g. `Header-1:value1; Header-2:value2`. |  |
| `css` | Optional | CSS code to inject into the page, e.g. `h1 { color: red }`. |  |
| `css_url` | Optional | URL of a stylesheet to inject into the page. |  |
| `custom_html` | Optional | HTML to render instead of loading `url`. For long HTML, use [Screenshot (POST)](/reference/lookup/screenshot-post/). |  |
| `proxy` | Optional | Proxy to load the page through, in the form `user:password@host:port`. |  |

## Response Fields

| Field | Description |
|---|---|
| `url` | The requested URL |
| `redirected_url` | The URL the browser ended up on after redirects |
| `screenshot_url` | Link to the image (JPEG, or PNG with `image_output=png`). It is a **signed link that expires after 7 days**: download the image if you need to keep it |
| `connection_status` | `success` when the page was loaded |
| `check_date` | When the screenshot was taken (UTC) |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `url` | string |
| `redirected_url` | string |
| `check_date` | string |
| `connection_status` | string |
| `screenshot_url` | string |

## Errors

`400` (`10400`) if `url` is missing or invalid (and no `custom_html` is sent), or an option is out of range. The validation error currently names the parameter `domain`, although the request parameter is `url` (see the example). `500` for an unexpected error. `503` means the service is busy or out of memory: retry shortly. See [Getting Started → Errors](/getting-started/errors/).

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/screenshot.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/screenshot/examples/


---

# Screenshot (POST)

URL: https://docs.deepinfo.com/reference/lookup/screenshot-post/

POST /lookup/screenshot: Same as Screenshot, with the options in a JSON body instead of the query string.

`POST https://api.deepinfo.com/v1/lookup/screenshot`

Same as [Screenshot](/reference/lookup/screenshot/), with the options in a JSON body instead of the query string. Use it when a value is too long for a URL, such as `custom_html`. The response is the same.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Description |
|---|---|---|
| `url` | string | **Required.** Web page to capture, e.g. `https://www.deepinfo.com`. It can be left out only when `custom_html` is sent. |
| `width` | integer | Browser viewport width, in pixels. Range `100`–`3000`. Default `1366`. |
| `height` | integer | Browser viewport height, in pixels. Range `100`–`3000`. Default `768`. |
| `full_page` | boolean | Capture the whole page, not only the visible viewport. Default `false`. |
| `mobile` | boolean | Emulate a mobile device. The viewport then defaults to 360 × 740. Default `false`. |
| `landscape` | boolean | Emulate landscape orientation. Default `false`. |
| `touchscreen` | boolean | Emulate a touch screen. Default `false`. |
| `retina` | boolean | Render at twice the pixel density for a sharper image. Ignored when `scale` is set. Default `false`. |
| `scale` | number | Device pixel ratio: how many screen pixels draw one CSS pixel. Range `0.5`–`4`. |
| `image_output` | `jpeg` \| `png` | Image format. Default `jpeg`. |
| `quality` | integer | JPEG quality. Used only when `image_output` is `jpeg`. Range `0`–`100`. |
| `thumbnail_width` | integer | Resize the image to this width, keeping the aspect ratio. Must not be larger than the screenshot width. Minimum `50`. |
| `mode` | `fast` \| `slow` | `fast` captures as soon as the HTML document has loaded (`domcontentloaded`); `slow` waits until network activity stops. Default `fast`. |
| `timeout` | integer | Maximum time to wait for the page to load, in milliseconds. Range `0`–`90000`. Default `30000`. |
| `delay` | integer | Extra wait after the page has loaded, in milliseconds, before the screenshot is taken. Maximum `30000`. Default `0`. |
| `lazy_load` | boolean | Scroll through the whole page first, so that lazy-loaded images are rendered. Default `false`. |
| `block_ads` | boolean | Block advertisements. Default `false`. |
| `no_cookie_banners` | boolean | Hide cookie consent banners. Default `false`. |
| `no_js` | boolean | Disable JavaScript on the page. Default `false`. |
| `selector` | string | CSS selector of one element, e.g. `body > .container > .logo`. When it matches, only that element is captured. |
| `scroll_to_element` | string | CSS selector of an element to scroll to before the screenshot, e.g. `body > .footer`. |
| `accept_languages` | string | Browser `Accept-Language` value. Default `en-US`. |
| `latitude` | number | Latitude reported by the browser's Geolocation API. Requires `longitude`. Range `-80`–`80`. |
| `longitude` | number | Longitude reported by the browser's Geolocation API. Requires `latitude`. Range `-180`–`180`. |
| `user_agent` | string | Browser user agent string. |
| `cookies` | string | Cookies to set in the browser, e.g. `name1=value1; name2=value2`. |
| `headers` | string | Extra request headers, e.g. `Header-1:value1; Header-2:value2`. |
| `css` | string | CSS code to inject into the page, e.g. `h1 { color: red }`. |
| `css_url` | string | URL of a stylesheet to inject into the page. |
| `custom_html` | string | HTML to render instead of loading `url`. |
| `proxy` | string | Proxy to load the page through, in the form `user:password@host:port`. |

```json
{
  "url": "https://www.deepinfo.com",
  "width": 1366,
  "height": 768,
  "full_page": false
}
```

## Response Fields

| Field | Description |
|---|---|
| `url` | The requested URL |
| `redirected_url` | The URL the browser ended up on after redirects |
| `screenshot_url` | Link to the image (JPEG, or PNG with `image_output=png`). It is a **signed link that expires after 7 days**: download the image if you need to keep it |
| `connection_status` | `success` when the page was loaded |
| `check_date` | When the screenshot was taken (UTC) |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `url` | string |
| `redirected_url` | string |
| `check_date` | string |
| `connection_status` | string |
| `screenshot_url` | string |

## Errors

`400` (`10400`) if `url` is missing or invalid (and no `custom_html` is sent), or an option is out of range. The validation error currently names the parameter `domain`, although the request parameter is `url` (see the example). `500` for an unexpected error. `503` means the service is busy or out of memory: retry shortly. See [Getting Started → Errors](/getting-started/errors/).

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/screenshot-post.md


---

# Web Data

URL: https://docs.deepinfo.com/reference/lookup/web-data/

GET /lookup/webdata: Loads a web page in a real browser and returns everything Deepinfo extracts from it, in one call: detected technologies, page metadata…

`GET https://api.deepinfo.com/v1/lookup/webdata`

Loads a web page in a real browser and returns everything Deepinfo extracts from it, in one call: detected technologies, page metadata (title, description, Open Graph tags, JSON-LD), the HTML source and visible text, links, scripts, trackers (Google Analytics, AdSense and Tag Manager IDs), e-mail addresses, favicons, `robots.txt`, and the HTTP response headers, cookies and redirects. Add `screenshot=true` to capture a screenshot as well.

Use it to profile a website in depth, for example to compare a look-alike domain's page with your own or to find the analytics IDs it shares with other sites. For technologies only, [Technology](/reference/lookup/technology/) is lighter; for an image only, use [Screenshot](/reference/lookup/screenshot/).

A request takes several seconds (about 10 s in our tests).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `url` | Required | Web page to analyze, e.g. `https://www.deepinfo.com`. | `https://www.deepinfo.com` |
| `screenshot` | Optional | Also capture a JPEG screenshot of the rendered page. The response then includes a `screenshot` object. Default `false`. | `true` |
| `wait_until` | Optional | Page load events to wait for before the page is parsed, comma-separated. Ignored when `screenshot` is `true`: the page is then always parsed after `load`. One or more of `load`, `domcontentloaded`, `networkidle0`, `networkidle2`. Default `networkidle2,load,domcontentloaded`. | `networkidle2,load,domcontentloaded` |
| `max_file_size` | Optional | Maximum size of `html.source_code`, in bytes. For a larger page, `source_code` holds a placeholder message instead of the HTML. Range `1`–`33554432`. Default `8388608`. | `8388608` |
| `proxy` | Optional | Proxy to load the page through, as a URL with an explicit port, e.g. `http://user:password@host:8080`. The proxy host must be a public IP address or an allowed domain. |  |

## Response Fields

| Field | Description |
|---|---|
| `url` | The requested URL |
| `technology.stacks[]` | One entry per detected technology |
| `technology.stacks[].slug` | Identifier of the technology |
| `technology.stacks[].name` | Name of the technology |
| `technology.stacks[].description` | What the technology is |
| `technology.stacks[].categories` | Categories it belongs to |
| `technology.stacks[].confidence` | Detection confidence (0–100) |
| `technology.stacks[].version` | Detected version; empty when the site does not reveal it |
| `technology.stacks[].clean_version` | The version as a number, or `null` |
| `technology.stacks[].cpe` | CPE name |
| `technology.stacks[].alternative_cpe_names` | Other CPE names of the technology |
| `technology.stacks[].website` | The vendor's website |
| `technology.stacks[].icon` | Icon file name |
| `html.meta.title` | Page title |
| `html.meta.name` | Site name given in the page metadata |
| `html.meta.description` | Meta description |
| `html.meta.keywords` | Meta keywords |
| `html.meta.language` | Language of the page |
| `html.meta.language_alternatives` | Other language versions the page declares |
| `html.meta.encoding` | Character encoding |
| `html.meta.noindex_status` | Whether the page asks search engines not to index it |
| `html.meta.canonical_url` | Canonical URL |
| `html.meta.og[]` | Open Graph and Twitter card tags, one entry per tag |
| `html.meta.og[].name` | Tag name |
| `html.meta.og[].value` | Tag value |
| `html.meta.json_ld` | Structured data blocks, in expanded JSON-LD form |
| `html.source_code` | The page HTML. For a page larger than `max_file_size`, a placeholder message instead of the HTML |
| `html.source_code_hash` | SHA-256 hash of `html.source_code` |
| `html.content` | The visible text of the page |
| `html.content_hash` | SHA-256 hash of `html.content` |
| `html.content_keywords` | The most frequent words of `html.content` |
| `html.internal_links_fqdns` | Host names on the site's own domain that the page links to |
| `html.external_links` | Links to other sites |
| `html.external_links_fqdns` | Host names of those links |
| `html.external_links_domains` | Registered domains of those links |
| `html.script_links` | Scripts the page loads |
| `html.iframe_links` | Iframes the page loads |
| `html.favicon_links` | Icons the page links to |
| `html.trackers[]` | Tracking IDs found in the page, one entry per tracker (e.g. Google Analytics) |
| `html.trackers[].name` | Tracker name |
| `html.trackers[].values` | IDs found for that tracker |
| `html.emails` | E-mail addresses found in the page |
| `html.emails_internal` | E-mail addresses found in the page that are on the site's own domain |
| `html.inspect_disabled` | Whether the page tries to block inspection of its content |
| `favicon[]` | One entry per icon |
| `favicon[].url` | Icon URL |
| `favicon[].hash` | Hash of the icon |
| `robots_txt.content` | Content of the site's `robots.txt` |
| `robots_txt.hash` | Hash of `robots_txt.content` |
| `robots_txt.disallowed_links` | The `Disallow` paths |
| `http.headers[]` | HTTP response headers, one entry per header |
| `http.headers[].name` | Header name |
| `http.headers[].value` | Header value |
| `http.cookies[]` | Cookies the page set, one entry per cookie |
| `http.cookies[].name` | Cookie name |
| `http.cookies[].value` | Cookie value |
| `http.cookies[].domain` | Domain the cookie applies to |
| `http.cookies[].path` | Path the cookie applies to |
| `http.cookies[].expires` | Expiry time |
| `http.cookies[].secure` | Whether the cookie is sent over HTTPS only |
| `http.cookies[].http_only` | Whether the cookie is hidden from JavaScript |
| `http.cookies[].same_site` | The cookie's `SameSite` attribute |
| `http.cookies[].same_party` | The cookie's `SameParty` attribute |
| `http.cookies[].priority` | The cookie's `Priority` attribute |
| `http.cookies[].size` | Size of the cookie, in bytes |
| `http.cookies[].session` | Whether it is a session cookie |
| `http.redirection_history[]` | Each URL on the way to the final page |
| `http.redirection_history[].url` | The URL |
| `http.redirection_history[].status_code` | The HTTP status it returned |
| `screenshot` | Only with `screenshot=true`: the capture, with the `screenshot.*` fields below |
| `screenshot.url` | The requested URL |
| `screenshot.redirected_url` | The URL the browser ended up on after redirects |
| `screenshot.screenshot_url` | Link to the JPEG image: a signed link that expires after 7 days. `null` if the capture was skipped |
| `screenshot.connection_status` | `success` when the page was loaded |
| `screenshot.check_date` | When the screenshot was taken (UTC) |
| `connection_status` | `success` when the page was loaded |
| `version` | Version of the result format (currently `1`) |
| `check_date` | When the lookup was performed (UTC) |

## Response Schema

_Inferred from examples._ Built from the 2 saved 2xx example responses: the fields they contain, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `html` | object |
| `html.meta` | object |
| `html.meta.name` | string |
| `html.meta.description` | string |
| `html.meta.language` | string |
| `html.meta.language_alternatives` | array |
| `html.meta.keywords` | array |
| `html.meta.noindex_status` | boolean |
| `html.meta.encoding` | string |
| `html.meta.canonical_url` | string |
| `html.meta.title` | string |
| `html.meta.json_ld` | array<object> |
| `html.meta.json_ld[].@id` | string |
| `html.meta.json_ld[].@type` | array<string> |
| `html.meta.json_ld[].*` | array<object> |
| `html.meta.json_ld[].*[].@value` | string |
| `html.meta.og` | array<object> |
| `html.meta.og[].name` | string |
| `html.meta.og[].value` | string |
| `html.internal_links_fqdns` | array<string> |
| `html.external_links_fqdns` | array<string> |
| `html.external_links_domains` | array<string> |
| `html.external_links` | array<string> |
| `html.script_links` | array<string> |
| `html.iframe_links` | array |
| `html.trackers` | array |
| `html.emails` | array |
| `html.emails_internal` | array |
| `html.favicon_links` | array<string> |
| `html.inspect_disabled` | boolean |
| `html.source_code` | string |
| `html.source_code_hash` | string |
| `html.content` | string |
| `html.content_keywords` | array<string> |
| `html.content_hash` | string |
| `http` | object |
| `http.redirection_history` | array<object> |
| `http.redirection_history[].url` | string |
| `http.redirection_history[].status_code` | number |
| `http.cookies` | array<object> |
| `http.cookies[].name` | string |
| `http.cookies[].value` | string |
| `http.cookies[].domain` | string |
| `http.cookies[].path` | string |
| `http.cookies[].same_party` | string |
| `http.cookies[].priority` | null |
| `http.cookies[].size` | number |
| `http.cookies[].expires` | string |
| `http.cookies[].secure` | boolean |
| `http.cookies[].http_only` | boolean |
| `http.cookies[].same_site` | string |
| `http.cookies[].session` | boolean |
| `http.headers` | array<object> |
| `http.headers[].name` | string |
| `http.headers[].value` | string |
| `url` | string |
| `favicon` | array<object> |
| `favicon[].url` | string |
| `favicon[].hash` | string |
| `robots_txt` | object |
| `robots_txt.content` | string |
| `robots_txt.hash` | string |
| `robots_txt.disallowed_links` | array<string> |
| `version` | number |
| `check_date` | string |
| `connection_status` | string |
| `technology` | object |
| `technology.stacks` | array<object> |
| `technology.stacks[].slug` | string |
| `technology.stacks[].name` | string |
| `technology.stacks[].confidence` | number |
| `technology.stacks[].icon` | string |
| `technology.stacks[].website` | string |
| `technology.stacks[].cpe` | string |
| `technology.stacks[].version` | string |
| `technology.stacks[].categories` | array<string> |
| `technology.stacks[].description` | string |
| `technology.stacks[].alternative_cpe_names` | array |
| `technology.stacks[].clean_version` | null |
| `screenshot` | object (in 1 of 2) |
| `screenshot.screenshot_url` | string (in 1 of 2) |
| `screenshot.check_date` | string (in 1 of 2) |
| `screenshot.connection_status` | string (in 1 of 2) |
| `screenshot.redirected_url` | string (in 1 of 2) |
| `screenshot.url` | string (in 1 of 2) |

## Errors

`400` (`10400`) if `url` is missing or invalid, or a parameter is out of range. The validation error currently names the parameter `domain`, although the request parameter is `url` (see the example). A `400` without `parameters` (only `details`, e.g. *"Target is not allowed."*) means the target cannot be analyzed. `500` for an unexpected error. `503` means the service or its browser is busy: retry after the number of seconds in the `Retry-After` header. See [Getting Started → Errors](/getting-started/errors/).

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/web-data.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/web-data/examples/


---

# DNS History

URL: https://docs.deepinfo.com/reference/lookup/dns-history/

Returns the historical DNS records Deepinfo has observed for a domain or FQDN, including values that have since changed or been removed (passive DNS).

`GET https://api.deepinfo.com/v1/analyze/dns-history`

Returns the **historical** DNS records Deepinfo has observed for a domain or FQDN, including values that have since changed or been removed (passive DNS). Use it to see how a domain's hosting, mail and name servers changed over time.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required | Domain name or FQDN, e.g. `deepinfo.com` or `www.deepinfo.com`. IP addresses are not accepted. | `deepinfo.com` |
| `type` | Optional | Record type to return, for example `A`. Omit to return every type. | `A` |

## Response Fields

| Field | Description |
|---|---|
| `fqdn` | The queried name |
| `dn` | Its registered domain |
| `subdomain` | Subdomain part, or `null` |
| `records[]` | One entry per record type |
| `records[].type` | Record type, in lower case, for example `a` or `mx` |
| `records[].values[]` | One entry per distinct value seen for that type |
| `records[].values[].value` | The value |
| `records[].values[].time` | Every time (UTC, newest first) that value was observed |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `fqdn` | string |
| `dn` | string |
| `subdomain` | null |
| `records` | array<object> |
| `records[].type` | string |
| `records[].values` | array<object> |
| `records[].values[].value` | string |
| `records[].values[].time` | array<string> |

## Errors

`400` if `domain` is not a valid FQDN.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/lookup/dns-history.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/dns-history/examples/


---

# WHOIS History

URL: https://docs.deepinfo.com/reference/lookup/whois-history/

Returns the historical WHOIS records of a domain: every distinct registration record Deepinfo has observed, with the dates it was seen.

`GET https://api.deepinfo.com/v1/analyze/whois-history`

Returns the **historical** WHOIS records of a domain: every distinct registration record Deepinfo has observed, with the dates it was seen. Use it to track ownership, registrar and name server changes.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required | Domain name, e.g. `deepinfo.com`. | `deepinfo.com` |

## Response Fields

An array. Each item is one distinct WHOIS record:

| Field | Description |
|---|---|
| `whois` | The record, with the `whois.*` fields below |
| `whois.check_date` | Check date of the record (UTC) |
| `whois.create_date` | Registration date |
| `whois.update_date` | Date of the last update |
| `whois.expiry_date` | Expiry date |
| `whois.registrar` | Registrar |
| `whois.registrant.name` | Registrant name |
| `whois.registrant.organization` | Registrant organization |
| `whois.registrant.street` | Registrant street address |
| `whois.registrant.city` | Registrant city |
| `whois.registrant.state` | Registrant state or province |
| `whois.registrant.postal_code` | Registrant postal code |
| `whois.registrant.country` | Registrant country |
| `whois.registrant.phone` | Registrant phone number |
| `whois.registrant.email` | Registrant e-mail address |
| `whois.name_servers` | Name servers |
| `whois.domain_status` | Domain status codes |
| `whois.whois_server` | WHOIS server |
| `check_dates` | Every time (UTC) this exact record was observed |

## Errors

`400` if `domain` is not a valid domain.

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/lookup/whois-history/examples/


---

# Discovery

URL: https://docs.deepinfo.com/reference/discovery/

Search Deepinfo's internet-wide domain dataset: find subdomains, associated domains, domains registered at the same time, and domains that share a WHOIS…

Search Deepinfo's internet-wide domain dataset: find subdomains, associated domains, domains registered at the same time, and domains that share a WHOIS email, name server, IP or mail server.

Finder endpoints support `export=true` to get a **download link** for the full result instead of a page (`export_format`: `json` or `csv`; `export_scope`: `basic`, `default` or `extended`).

Pagination: `page` ≤ 400, `page_size` 25–100. At most **10,000** results per query.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Domain Search](/reference/discovery/domain-search/) | `/discovery/domain-search` |
| GET | [Domain Detail](/reference/discovery/domain-detail/) | `/discovery/domain-detail` |
| GET | [All TLDs](/reference/discovery/all-tlds/) | `/discovery/all-tlds` |
| GET | [Associated Domain Finder](/reference/discovery/associated-domain-finder/) | `/discovery/associated-domain-finder` |
| GET | [Reverse IP](/reference/discovery/reverse-ip/) | `/discovery/reverse-ip` |
| GET | [Reverse MX](/reference/discovery/reverse-mx/) | `/discovery/reverse-mx` |
| GET | [Reverse NS](/reference/discovery/reverse-ns/) | `/discovery/reverse-ns` |
| GET | [Reverse WHOIS Email](/reference/discovery/reverse-whois-email/) | `/discovery/reverse-email` |
| GET | [Same-Time Registered Domain Finder](/reference/discovery/same-time-registered-domain-finder/) | `/discovery/sametime-domain-finder` |
| GET | [Subdomain Finder](/reference/discovery/subdomain-finder/) | `/discovery/subdomain-finder` |


---

# Domain Search

URL: https://docs.deepinfo.com/reference/discovery/domain-search/

POST /discovery/domain-search: Searches Deepinfo's whole domain dataset with filters on WHOIS, DNS, SSL, web data and more.

`POST https://api.deepinfo.com/v1/discovery/domain-search`

Searches Deepinfo's whole domain dataset with filters on WHOIS, DNS, SSL, web data and more. `result_count` is the true total; results page up to 10,000.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fqdn",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "punycode",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400). Example: a worked example that filters by the field, with the request and the response it returns.

Operators: `eq`, `in`, `startswith`, `wildcard`, `fuzzy`, `exists`

| Field | Description | Example |
|---|---|---|
| `fqdn` | The full host name (FQDN) of the record in its ASCII (punycode) form, such as `www.example.com`. Search results return it as `punycode`. | [Example 1](/reference/discovery/domain-search/examples/fqdn/)<br>[Example 2](/reference/discovery/domain-search/examples/startswith-login-hosts/) |
| `subdomain_last` | The leftmost label of the subdomain, compared in its ASCII (punycode) form: `a` in `a.b.example.com`, and `www` in `www.example.com`. | [Example](/reference/discovery/domain-search/examples/subdomain-last/) |
| `subdomain_root` | The subdomain label directly in front of the registrable domain, compared in its ASCII (punycode) form: `b` in `a.b.example.com`, and `www` in `www.example.com`. | [Example](/reference/discovery/domain-search/examples/subdomain-root/) |
| `domain` | The registrable domain the FQDN belongs to (`example.com` for `www.example.com`), compared in its ASCII (punycode) form. A filter on it matches the domain itself and all its subdomains. | [Example 1](/reference/discovery/domain-search/examples/domain/)<br>[Example 2](/reference/discovery/domain-search/examples/look-alikes-excluding-the-real-domain/)<br>[Example 3](/reference/discovery/domain-search/examples/new-look-alikes-with-mail-servers/) |
| `domain.name.language` | The language detected for the domain name, as a two-letter ISO 639-1 code such as `en`, `de` or `tr`. Search results return it as `domain.name.lang`. | [Example](/reference/discovery/domain-search/examples/domain-name-language/) |
| `domain.name.keywords` | The words detected in the domain name, such as `deep` and `info` for `deepinfo`, so `cybersecurity` and `cyber-security` both contain the word `cyber`. | [Example 1](/reference/discovery/domain-search/examples/domain-name-keywords/)<br>[Example 2](/reference/discovery/domain-search/examples/all-three-new-shops-without-whois-privacy/) |
| `domain.extension` | The extension of the registrable domain, everything after the name, such as `com`, `io` or `co.uk`, compared in its ASCII (punycode) form. | [Example 1](/reference/discovery/domain-search/examples/domain-extension/)<br>[Example 2](/reference/discovery/domain-search/examples/in-one-of-several-extensions/)<br>[Example 3](/reference/discovery/domain-search/examples/range-name-length-between-3-and-4/)<br>[Example 4](/reference/discovery/domain-search/examples/must-and-should-together/)<br>[Example 5](/reference/discovery/domain-search/examples/must-not-registrable-domains-outside-com/)<br>[Example 6](/reference/discovery/domain-search/examples/sort-by-name/)<br>[Example 7](/reference/discovery/domain-search/examples/soonest-to-expire-first/)<br>[Example 8](/reference/discovery/domain-search/examples/latest-whois-changes-first/)<br>[Example 9](/reference/discovery/domain-search/examples/second-page-of-results/)<br>[Example 10](/reference/discovery/domain-search/examples/larger-pages/)<br>[Example 11](/reference/discovery/domain-search/examples/last-reachable-page/) |
| `domain.extension_root` | The top-level part of the extension, compared in its ASCII (punycode) form: `uk` for both `uk` and `co.uk`. | [Example](/reference/discovery/domain-search/examples/domain-extension-root/) |
| `domain.extension_sub` | The second-level part of a two-part extension, compared in its ASCII (punycode) form: `co` in `co.uk`. Single-part extensions such as `com` have none. | [Example](/reference/discovery/domain-search/examples/domain-extension-sub/) |
| `domain.whois.registrar` | The registrar the domain is registered through, as named in its WHOIS record and stored in lower case, such as `godaddy.com, llc`. | [Example 1](/reference/discovery/domain-search/examples/domain-whois-registrar/)<br>[Example 2](/reference/discovery/domain-search/examples/exists-false-domains-without-a-registrar/)<br>[Example 3](/reference/discovery/domain-search/examples/should-either-of-two-registrars/)<br>[Example 4](/reference/discovery/domain-search/examples/most-recently-updated-whois-first/) |
| `domain.whois.registrant.name` | The registrant's name (person or organization) from the domain's WHOIS record, stored in lower case. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-name/) |
| `domain.whois.registrant.organization` | The registrant's organization from the domain's WHOIS record, stored in lower case, such as `cloudflare, inc.`. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-organization/) |
| `domain.whois.registrant.street` | The registrant's street address from the domain's WHOIS record, stored in lower case. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-street/) |
| `domain.whois.registrant.city` | The registrant's city from the domain's WHOIS record, stored in lower case. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-city/) |
| `domain.whois.registrant.state` | The registrant's state or region from the domain's WHOIS record, stored in lower case. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-state/) |
| `domain.whois.registrant.postal_code` | The registrant's postal code from the domain's WHOIS record. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-postal-code/) |
| `domain.whois.registrant.country` | The registrant's country from the domain's WHOIS record, usually a two-letter ISO 3166-1 alpha-2 code in lower case, such as `de`. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-country/) |
| `domain.whois.registrant.phone` | The registrant's phone number as written in the domain's WHOIS record. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-phone/) |
| `domain.whois.registrant.email` | The registrant's e-mail address from the domain's WHOIS record; it can be the relay address of a privacy service instead of the owner's own. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-email/) |
| `domain.whois.name_servers` | The name servers listed in the domain's WHOIS record, as host names such as `ns1.example.com`. | [Example](/reference/discovery/domain-search/examples/domain-whois-name-servers/) |
| `domain.whois.domain_status` | The status codes in the domain's WHOIS record, mostly EPP codes, in lower case without spaces, such as `clienttransferprohibited`, `clientdeleteprohibited`, `clientupdateprohibited`, `clientrenewprohibited`, `clienthold` or `ok`. | [Example](/reference/discovery/domain-search/examples/domain-whois-domain-status/) |
| `domain.whois_normalized.registrant.organization` | The registrant's organization from WHOIS in normalized form: lower case with spaces and punctuation removed, so `cloudflare, inc.` becomes `cloudflareinc`. A pattern such as `*cloudflare*` finds it more reliably than an exact value. | [Example](/reference/discovery/domain-search/examples/domain-whois-normalized-registrant-organization/) |
| `domain.whois_normalized.registrant.phone` | The registrant's phone number from WHOIS in normalized form: digits only, with `+`, dots and other separators removed. | [Example](/reference/discovery/domain-search/examples/domain-whois-normalized-registrant-phone/) |
| `domain.whois_normalized.registrant.email` | The registrant's e-mail address as kept in `whois_normalized`; `email_fqdn_apex` and `email_domain_apex` hold its host and registrable domain. | [Example](/reference/discovery/domain-search/examples/domain-whois-normalized-registrant-email/) |
| `domain.whois_normalized.registrant.email_fqdn_apex` | The host part of the normalized registrant e-mail address, everything after the `@`: `mail.example.com` for `user@mail.example.com`. | [Example](/reference/discovery/domain-search/examples/domain-whois-normalized-registrant-email-fqdn-apex/) |
| `domain.whois_normalized.registrant.email_domain_apex` | The registrable domain of the normalized registrant e-mail address: `example.com` for `user@mail.example.com`. | [Example](/reference/discovery/domain-search/examples/domain-whois-normalized-registrant-email-domain-apex/) |
| `domain.whois_registrant_email_historical` | Every registrant e-mail address seen in the domain's WHOIS records over time. | [Example](/reference/discovery/domain-search/examples/domain-whois-registrant-email-historical/) |
| `domain.dns.a.ip_addresses` | The IPv4 addresses in the A record of the registrable domain (`domain.dns`); `dns.a.ip_addresses` holds those of the FQDN itself. | [Example](/reference/discovery/domain-search/examples/domain-dns-a-ip-addresses/) |
| `domain.ip_history` | Every IP address the registrable domain has resolved to over time, so it also finds domains that have since moved. | [Example](/reference/discovery/domain-search/examples/domain-ip-history/) |
| `dns.a.ip_addresses` | The IPv4 addresses in the FQDN's DNS A record. | [Example](/reference/discovery/domain-search/examples/dns-a-ip-addresses/) |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the FQDN's DNS AAAA record. | [Example](/reference/discovery/domain-search/examples/dns-aaaa-ip-addresses/) |
| `dns.ns.name_servers` | The name servers in the FQDN's DNS NS record, as host names. | [Example 1](/reference/discovery/domain-search/examples/dns-ns-name-servers/)<br>[Example 2](/reference/discovery/domain-search/examples/must-and-should-together/)<br>[Example 3](/reference/discovery/domain-search/examples/latest-dns-changes-first/) |
| `dns.mx.mail_servers` | The mail server host names in the FQDN's DNS MX record, such as `aspmx.l.google.com` for Google Workspace. | [Example 1](/reference/discovery/domain-search/examples/dns-mx-mail-servers/)<br>[Example 2](/reference/discovery/domain-search/examples/new-look-alikes-with-mail-servers/) |
| `dns.soa.mnames` | The MNAME of the FQDN's SOA record: the primary name server of the zone. | [Example](/reference/discovery/domain-search/examples/dns-soa-mnames/) |
| `dns.soa.rnames` | The RNAME of the FQDN's SOA record, the zone's responsible mailbox in DNS form: `dns.example.com` stands for the mailbox `dns` at `example.com`. | [Example](/reference/discovery/domain-search/examples/dns-soa-rnames/) |
| `dns.soa.rname_emails` | The RNAME of the FQDN's SOA record written as an e-mail address, such as `user@example.com`. | [Example](/reference/discovery/domain-search/examples/dns-soa-rname-emails/) |
| `dns.txt.values` | The text of the FQDN's DNS TXT records, such as SPF policies and site-verification tokens, stored as quoted text (each value starts with `"`). | [Example](/reference/discovery/domain-search/examples/dns-txt-values/) |
| `dns.cname.values` | The target of the FQDN's DNS CNAME record, stored as a fully qualified name with the final dot, such as `www.example.com.`. | [Example](/reference/discovery/domain-search/examples/dns-cname-values/) |
| `dns.others.type` | The type of a DNS record that has no field of its own (`dns.others`), in upper case; values seen include `DNSKEY`, `DS`, `SPF`, `HINFO`, `RRSIG`, `NSEC3`, `NSEC3PARAM`, `CAA`, `PTR` and `TYPE65`. | [Example](/reference/discovery/domain-search/examples/dns-others-type/) |
| `dns.others.values` | The data of a record in `dns.others`, as text in zone-file notation, such as the flags, protocol, algorithm and key of a `DNSKEY` record. | [Example](/reference/discovery/domain-search/examples/dns-others-values/) |
| `ip_history` | Every IP address the FQDN has resolved to over time, including addresses it no longer uses. | [Example](/reference/discovery/domain-search/examples/ip-history/) |
| `ssl.fqdns` | The host names the FQDN's TLS certificate is valid for, in lower case; wildcard names appear without the leading `*.`. | [Example](/reference/discovery/domain-search/examples/ssl-fqdns/) |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the FQDN's TLS certificate, as 64 lower-case hex characters; a fingerprint identifies one certificate, so it finds every host that serves it. | [Example](/reference/discovery/domain-search/examples/ssl-fingerprint-sha256/) |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the FQDN's TLS certificate, as 40 lower-case hex characters. | [Example](/reference/discovery/domain-search/examples/ssl-fingerprint-sha1/) |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the FQDN's TLS certificate, as 32 lower-case hex characters. | [Example](/reference/discovery/domain-search/examples/ssl-fingerprint-md5/) |
| `ssl.signature.value` | The signature of the FQDN's TLS certificate, Base64-encoded. | [Example](/reference/discovery/domain-search/examples/ssl-signature-value/) |
| `ssl.issuer_dn` | The distinguished name of the certificate issuer as one string, such as `CN=YR2,O=Let's Encrypt,C=US`, compared exactly as the response shows it. | [Example](/reference/discovery/domain-search/examples/ssl-issuer-dn/) |
| `ssl.issuer.common_name` | The common name (CN) in the issuer's name, usually the name of the issuing CA certificate, such as `YR2`, `YR1` or `WE1`. | [Example](/reference/discovery/domain-search/examples/ssl-issuer-common-name/) |
| `ssl.issuer.country` | The country (C) in the issuer's name, as a two-letter code in the case the certificate uses, usually upper case such as `US` or `GB`. | [Example](/reference/discovery/domain-search/examples/ssl-issuer-country/) |
| `ssl.issuer.state` | The state or province (ST) in the issuer's name, as written in the certificate. | [Example](/reference/discovery/domain-search/examples/ssl-issuer-state/) |
| `ssl.issuer.locality` | The locality or city (L) in the issuer's name, as written in the certificate. | [Example](/reference/discovery/domain-search/examples/ssl-issuer-locality/) |
| `ssl.issuer.organization` | The organization (O) in the issuer's name, as written in the certificate, such as `Let's Encrypt`, `Google Trust Services` or `DigiCert Inc`. | [Example 1](/reference/discovery/domain-search/examples/ssl-issuer-organization/)<br>[Example 2](/reference/discovery/domain-search/examples/latest-certificate-changes-first/)<br>[Example 3](/reference/discovery/domain-search/examples/wildcard-certificates-from-lets-encrypt/) |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) in the issuer's name, as written in the certificate. | [Example](/reference/discovery/domain-search/examples/ssl-issuer-organizational-unit/) |
| `ssl.subject_dn` | The distinguished name of the certificate subject as one string; a value that starts with `CN=*.` belongs to a wildcard certificate. | [Example 1](/reference/discovery/domain-search/examples/ssl-subject-dn/)<br>[Example 2](/reference/discovery/domain-search/examples/wildcard-certificates-from-lets-encrypt/) |
| `ssl.subject.common_name` | The common name (CN) in the subject's name, usually the host name the certificate was issued for, such as `example.com`. | [Example](/reference/discovery/domain-search/examples/ssl-subject-common-name/) |
| `ssl.subject.country` | The country (C) in the subject's name, as a two-letter code in the case the certificate uses, such as `DE`. | [Example](/reference/discovery/domain-search/examples/ssl-subject-country/) |
| `ssl.subject.state` | The state or province (ST) in the subject's name, as written in the certificate. | [Example](/reference/discovery/domain-search/examples/ssl-subject-state/) |
| `ssl.subject.locality` | The locality or city (L) in the subject's name, as written in the certificate. | [Example](/reference/discovery/domain-search/examples/ssl-subject-locality/) |
| `ssl.subject.organization` | The organization (O) in the subject's name, as written in the certificate: the company the certificate was issued to, when it names one. | [Example](/reference/discovery/domain-search/examples/ssl-subject-organization/) |
| `ssl.subject.organizational_unit` | The organizational unit (OU) in the subject's name, as written in the certificate. | [Example](/reference/discovery/domain-search/examples/ssl-subject-organizational-unit/) |
| `ssl.extensions.subject_alt_name.dns_names` | The DNS names in the certificate's Subject Alternative Name (SAN) extension, including wildcard names such as `*.example.com`. | [Example](/reference/discovery/domain-search/examples/ssl-extensions-subject-alt-name-dns-names/) |
| `webdata.url` | The URL recorded for Deepinfo's web visit to the FQDN (`webdata` is what Deepinfo saw over HTTP(S)); it takes filters, but search results do not return it. | [Example](/reference/discovery/domain-search/examples/webdata-url/) |
| `webdata.connection_status` | The outcome of Deepinfo's web visit to the FQDN: `success`, `not_resolved`, `timeout`, `thread_timeout`, `reset`, `refused`, `connection_error`, `ssl_error` or `too_many_redirects`. | [Example 1](/reference/discovery/domain-search/examples/webdata-connection-status/)<br>[Example 2](/reference/discovery/domain-search/examples/live-sites-without-hsts/)<br>[Example 3](/reference/discovery/domain-search/examples/missing-clickjacking-protection/) |
| `webdata.html.source_code_hash` | The SHA-256 hash of the HTML source Deepinfo received on its web visit to the FQDN, as 64 lower-case hex characters, so identical pages share the same value. | [Example](/reference/discovery/domain-search/examples/webdata-html-source-code-hash/) |
| `webdata.http.redirection_history.url` | The URL of one step of Deepinfo's web visit; `redirection_history` lists every URL requested, from the first one to the final page. | [Example](/reference/discovery/domain-search/examples/webdata-http-redirection-history-url/) |
| `webdata.http.final_url` | The URL Deepinfo's web visit ended on after all redirects, exactly as recorded, with or without a trailing `/`. | [Example](/reference/discovery/domain-search/examples/webdata-http-final-url/) |
| `webdata.http.final_fqdn` | The host name of the URL Deepinfo's web visit ended on after all redirects; an internationalized name is stored and compared in its readable (Unicode) form, not as punycode. | [Example](/reference/discovery/domain-search/examples/webdata-http-final-fqdn/) |
| `webdata.http.final_domain` | The registrable domain of the host Deepinfo's web visit ended on after all redirects, such as `cloudflare.com`; an internationalized name is stored and compared in its readable (Unicode) form, not as punycode. | [Example](/reference/discovery/domain-search/examples/webdata-http-final-domain/) |
| `webdata.http.headers.others.name` | The name of a response header that has no field of its own (`headers.others`), in lower case with dashes written as underscores: `cf-ray` becomes `cf_ray`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-others-name/) |
| `webdata.http.headers.others.value` | The value of a response header listed in `headers.others`, as text. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-others-value/) |
| `webdata.http.headers.access_control_allow_headers` | The value of the `Access-Control-Allow-Headers` response header on Deepinfo's web visit to the FQDN: the request headers the site accepts in cross-origin (CORS) requests. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-access-control-allow-headers/) |
| `webdata.http.headers.access_control_allow_methods` | The value of the `Access-Control-Allow-Methods` response header on Deepinfo's web visit to the FQDN: the HTTP methods the site allows in cross-origin (CORS) requests, such as `GET, POST, OPTIONS`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-access-control-allow-methods/) |
| `webdata.http.headers.access_control_allow_origin` | The value of the `Access-Control-Allow-Origin` response header on Deepinfo's web visit to the FQDN: the origins allowed to read the response in cross-origin (CORS) requests; `*` means any origin. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-access-control-allow-origin/) |
| `webdata.http.headers.cache_control` | The value of the `Cache-Control` response header on Deepinfo's web visit to the FQDN: the caching rules, such as `no-store` or `max-age=0`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-cache-control/) |
| `webdata.http.headers.clear_site_data` | The value of the `Clear-Site-Data` response header on Deepinfo's web visit to the FQDN: the browser data the site asks to clear, such as `cache`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-clear-site-data/) |
| `webdata.http.headers.content_encoding` | The value of the `Content-Encoding` response header on Deepinfo's web visit to the FQDN: the compression used, such as `gzip`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-content-encoding/) |
| `webdata.http.headers.content_security_policy` | The value of the `Content-Security-Policy` response header on Deepinfo's web visit to the FQDN: the sources the page may load scripts and other content from. | [Example 1](/reference/discovery/domain-search/examples/webdata-http-headers-content-security-policy/)<br>[Example 2](/reference/discovery/domain-search/examples/missing-clickjacking-protection/) |
| `webdata.http.headers.content_type` | The value of the `Content-Type` response header on Deepinfo's web visit to the FQDN: the media type and character set, such as `text/html; charset=UTF-8`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-content-type/) |
| `webdata.http.headers.cross_origin_embedder_policy` | The value of the `Cross-Origin-Embedder-Policy` response header on Deepinfo's web visit to the FQDN, such as `require-corp` or `credentialless`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-cross-origin-embedder-policy/) |
| `webdata.http.headers.cross_origin_opener_policy` | The value of the `Cross-Origin-Opener-Policy` response header on Deepinfo's web visit to the FQDN, such as `same-origin` or `unsafe-none`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-cross-origin-opener-policy/) |
| `webdata.http.headers.cross_origin_resource_policy` | The value of the `Cross-Origin-Resource-Policy` response header on Deepinfo's web visit to the FQDN, such as `same-origin` or `cross-origin`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-cross-origin-resource-policy/) |
| `webdata.http.headers.expect_ct` | The value of the `Expect-CT` response header on Deepinfo's web visit to the FQDN (Certificate Transparency enforcement), such as `max-age=86400, enforce`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-expect-ct/) |
| `webdata.http.headers.feature_policy` | The value of the `Feature-Policy` response header on Deepinfo's web visit to the FQDN: the older form of the policy that limits browser features such as camera or geolocation. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-feature-policy/) |
| `webdata.http.headers.last_modified` | The value of the `Last-Modified` response header on Deepinfo's web visit to the FQDN, stored as the header text (an HTTP date such as `Tue, 20 Jan 2026 04:02:54 GMT`), so it takes text operators, not date ranges. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-last-modified/) |
| `webdata.http.headers.permission_policy` | The value of the `Permission-Policy` response header on Deepinfo's web visit to the FQDN (singular spelling). The standard `Permissions-Policy` header is listed in `webdata.http.headers.others` as `permissions_policy`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-permission-policy/) |
| `webdata.http.headers.referrer_policy` | The value of the `Referrer-Policy` response header on Deepinfo's web visit to the FQDN, such as `strict-origin-when-cross-origin` or `no-referrer`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-referrer-policy/) |
| `webdata.http.headers.server` | The value of the `Server` response header on Deepinfo's web visit to the FQDN: the web server software the site reports, such as `nginx`, `Apache`, `LiteSpeed` or `cloudflare`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-server/) |
| `webdata.http.headers.set_cookie` | The value of the `Set-Cookie` response header on Deepinfo's web visit to the FQDN, as text starting with the cookie name, such as `PHPSESSID=`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-set-cookie/) |
| `webdata.http.headers.strict_transport_security` | The value of the `Strict-Transport-Security` response header on Deepinfo's web visit to the FQDN (HSTS), such as `max-age=31536000; includeSubDomains; preload`. | [Example 1](/reference/discovery/domain-search/examples/webdata-http-headers-strict-transport-security/)<br>[Example 2](/reference/discovery/domain-search/examples/live-sites-without-hsts/) |
| `webdata.http.headers.x_content_type_options` | The value of the `X-Content-Type-Options` response header on Deepinfo's web visit to the FQDN, usually `nosniff`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-x-content-type-options/) |
| `webdata.http.headers.x_download_options` | The value of the `X-Download-Options` response header on Deepinfo's web visit to the FQDN, usually `noopen`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-x-download-options/) |
| `webdata.http.headers.x_frame_options` | The value of the `X-Frame-Options` response header on Deepinfo's web visit to the FQDN: whether other sites may show the page in a frame, such as `SAMEORIGIN` or `DENY`, in the case the site sent. | [Example 1](/reference/discovery/domain-search/examples/webdata-http-headers-x-frame-options/)<br>[Example 2](/reference/discovery/domain-search/examples/missing-clickjacking-protection/) |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The value of the `X-Permitted-Cross-Domain-Policies` response header on Deepinfo's web visit to the FQDN, such as `none`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-x-permitted-cross-domain-policies/) |
| `webdata.http.headers.x_powered_by` | The value of the `X-Powered-By` response header on Deepinfo's web visit to the FQDN: the technology the site reports, such as `PHP/8.2.32`, `ASP.NET` or `Next.js`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-x-powered-by/) |
| `webdata.http.headers.x_xss_protection` | The value of the `X-XSS-Protection` response header on Deepinfo's web visit to the FQDN, such as `1; mode=block` or `0`. | [Example](/reference/discovery/domain-search/examples/webdata-http-headers-x-xss-protection/) |
| `webdata.http.cookies.name` | The name of a cookie the site set on Deepinfo's web visit, such as `PHPSESSID` or `__cf_bm`. | [Example](/reference/discovery/domain-search/examples/webdata-http-cookies-name/) |
| `webdata.http.cookies.value` | The value of a cookie the site set on Deepinfo's web visit, as text. | [Example](/reference/discovery/domain-search/examples/webdata-http-cookies-value/) |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description | Example |
|---|---|---|
| `type` | Whether the record is a registrable domain or a subdomain: `1` = domain (such as `example.com`), `2` = subdomain (such as `www.example.com`). | [Example 1](/reference/discovery/domain-search/examples/type/)<br>[Example 2](/reference/discovery/domain-search/examples/exists-false-domains-without-a-registrar/)<br>[Example 3](/reference/discovery/domain-search/examples/must-not-registrable-domains-outside-com/)<br>[Example 4](/reference/discovery/domain-search/examples/sort-by-name/)<br>[Example 5](/reference/discovery/domain-search/examples/sort-by-extension/)<br>[Example 6](/reference/discovery/domain-search/examples/newest-registrations-first/)<br>[Example 7](/reference/discovery/domain-search/examples/latest-whois-changes-first/)<br>[Example 8](/reference/discovery/domain-search/examples/second-page-of-results/)<br>[Example 9](/reference/discovery/domain-search/examples/larger-pages/)<br>[Example 10](/reference/discovery/domain-search/examples/last-reachable-page/) |
| `subdomain.length` | The number of characters in the subdomain part (0 to 255), counted in its ASCII (punycode) form without the dots between labels: `6` for `api.dev.example.com`. | [Example](/reference/discovery/domain-search/examples/subdomain-length/) |
| `subdomain_level_count` | The number of labels in front of the registrable domain: `0` for the domain itself, `1` for `www.example.com`, `2` for `a.b.example.com`. | [Example](/reference/discovery/domain-search/examples/subdomain-level-count/) |
| `domain.name.length` | The number of characters in the domain name without its extension, counted in its ASCII (punycode) form (0 to 63). | [Example 1](/reference/discovery/domain-search/examples/domain-name-length/)<br>[Example 2](/reference/discovery/domain-search/examples/range-name-length-between-3-and-4/) |
| `domain.name.keyword_count` | The number of words detected in the domain name (the length of `domain.name.keywords`). | [Example](/reference/discovery/domain-search/examples/domain-name-keyword-count/) |
| `domain.extension_type` | The kind of extension: `1` = generic (gTLD, such as `.com`), `2` = country code (ccTLD, such as `.de` or `.co.uk`). | [Example](/reference/discovery/domain-search/examples/domain-extension-type/) |
| `domain.whois.create_date` | The date the registrable domain was created (registered), from its WHOIS record (UTC, ISO 8601). | [Example 1](/reference/discovery/domain-search/examples/domain-whois-create-date/)<br>[Example 2](/reference/discovery/domain-search/examples/all-three-new-shops-without-whois-privacy/)<br>[Example 3](/reference/discovery/domain-search/examples/newest-registrations-first/)<br>[Example 4](/reference/discovery/domain-search/examples/new-look-alikes-with-mail-servers/) |
| `domain.whois.update_date` | The last-updated date that the domain's WHOIS record itself reports (UTC, ISO 8601); `domain.whois_last_change_date` is when Deepinfo saw the record change. | [Example](/reference/discovery/domain-search/examples/domain-whois-update-date/) |
| `domain.whois.expiry_date` | The date the domain's registration expires, from its WHOIS record (UTC, ISO 8601). | [Example 1](/reference/discovery/domain-search/examples/domain-whois-expiry-date/)<br>[Example 2](/reference/discovery/domain-search/examples/soonest-to-expire-first/)<br>[Example 3](/reference/discovery/domain-search/examples/expiring-soon-with-whois-privacy/) |
| `domain.whois_create_date_historical` | Every creation date seen in the domain's WHOIS records over time (UTC, ISO 8601), so a domain that was registered again still matches on its earlier dates. | [Example](/reference/discovery/domain-search/examples/domain-whois-create-date-historical/) |
| `domain.whois_last_change_date` | The last time Deepinfo saw the domain's WHOIS record change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/domain-whois-last-change-date/) |
| `domain.dns.a.update_date` | The update date Deepinfo recorded for the registrable domain's A records (UTC, ISO 8601); it is set even when the domain has no A record. | [Example](/reference/discovery/domain-search/examples/domain-dns-a-update-date/) |
| `domain.dns_update_date` | A DNS update date of the registrable domain (UTC, ISO 8601) that takes date filters; search results do not return this field. | [Example](/reference/discovery/domain-search/examples/domain-dns-update-date/) |
| `domain.dns_last_change_date` | The last time Deepinfo saw the DNS records of the registrable domain change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/domain-dns-last-change-date/) |
| `domain.ssl.validity.start_date` | The date the registrable domain's TLS certificate became valid, its not-before date (UTC, ISO 8601). `ssl.validity.start_date` holds the same for the FQDN's own certificate. | [Example](/reference/discovery/domain-search/examples/domain-ssl-validity-start-date/) |
| `domain.ssl.validity.end_date` | The date the registrable domain's TLS certificate expires, its not-after date (UTC, ISO 8601). `ssl.validity.end_date` holds the same for the FQDN's own certificate. | [Example](/reference/discovery/domain-search/examples/domain-ssl-validity-end-date/) |
| `domain.ssl_last_change_date` | The last time Deepinfo saw the registrable domain's TLS certificate change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/domain-ssl-last-change-date/) |
| `dns.a.update_date` | The update date Deepinfo recorded for the FQDN's A records (UTC, ISO 8601); it is set even when the FQDN has no A record. | [Example](/reference/discovery/domain-search/examples/dns-a-update-date/) |
| `dns.aaaa.update_date` | The update date Deepinfo recorded for the FQDN's AAAA records (UTC, ISO 8601); it is set even when the FQDN has no AAAA record. | [Example](/reference/discovery/domain-search/examples/dns-aaaa-update-date/) |
| `dns.ns.update_date` | The update date Deepinfo recorded for the FQDN's NS records (UTC, ISO 8601); it is set even when the FQDN has no NS record. | [Example](/reference/discovery/domain-search/examples/dns-ns-update-date/) |
| `dns.mx.update_date` | The update date Deepinfo recorded for the FQDN's MX records (UTC, ISO 8601); it is set even when the FQDN has no MX record. | [Example](/reference/discovery/domain-search/examples/dns-mx-update-date/) |
| `dns.soa.update_date` | The update date Deepinfo recorded for the FQDN's SOA records (UTC, ISO 8601); it is set even when the FQDN has no SOA record. | [Example](/reference/discovery/domain-search/examples/dns-soa-update-date/) |
| `dns.txt.update_date` | The update date Deepinfo recorded for the FQDN's TXT records (UTC, ISO 8601); it is set even when the FQDN has no TXT record. | [Example](/reference/discovery/domain-search/examples/dns-txt-update-date/) |
| `dns.cname.update_date` | The update date Deepinfo recorded for the FQDN's CNAME records (UTC, ISO 8601); it is set even when the FQDN has no CNAME record. | [Example](/reference/discovery/domain-search/examples/dns-cname-update-date/) |
| `dns.others.update_date` | The update date Deepinfo recorded for a record in `dns.others` (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/dns-others-update-date/) |
| `dns_update_date` | A DNS update date of the FQDN (UTC, ISO 8601) that takes date filters; search results do not return this field. | [Example](/reference/discovery/domain-search/examples/dns-update-date/) |
| `dns_last_change_date` | The last time Deepinfo saw the DNS records of the FQDN change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/dns-last-change-date/) |
| `ssl.validity.start_date` | The date the FQDN's TLS certificate became valid, its not-before date (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/ssl-validity-start-date/) |
| `ssl.validity.end_date` | The date the FQDN's TLS certificate expires, its not-after date (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/ssl-validity-end-date/) |
| `ssl.validity.length` | The validity period of the FQDN's TLS certificate in seconds, from start date to end date: 7,776,000 seconds are 90 days. | [Example](/reference/discovery/domain-search/examples/ssl-validity-length/) |
| `ssl_last_change_date` | The last time Deepinfo saw the FQDN's TLS certificate change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/ssl-last-change-date/) |
| `webdata.http.status_code_first` | The HTTP status code of the first response on Deepinfo's web visit to the FQDN, such as `200`, or `301` for a permanent redirect. | [Example 1](/reference/discovery/domain-search/examples/webdata-http-status-code-first/)<br>[Example 2](/reference/discovery/domain-search/examples/redirects-away-to-another-site/) |
| `webdata.http.status_code_last` | The HTTP status code of the final response on Deepinfo's web visit, after all redirects, such as `200`, `403` or `404`. | [Example](/reference/discovery/domain-search/examples/webdata-http-status-code-last/) |
| `webdata.http.redirection_history.status_code` | The HTTP status code returned at one step of Deepinfo's web visit, such as `301` or `302` for a redirect and `200` for the final page. | [Example](/reference/discovery/domain-search/examples/webdata-http-redirection-history-status-code/) |

Operators: `eq`, `in`, `exists`

| Field | Description | Example |
|---|---|---|
| `is_idn` | `true` when the FQDN is an internationalized domain name (IDN) with non-ASCII characters; `punycode` then holds its ASCII form and `unicode` the readable one. | [Example 1](/reference/discovery/domain-search/examples/is-idn/)<br>[Example 2](/reference/discovery/domain-search/examples/confusable-idn-domains/) |
| `subdomain.is_idn` | `true` when the subdomain part contains non-ASCII (internationalized) characters. | [Example](/reference/discovery/domain-search/examples/subdomain-is-idn/) |
| `subdomain.contains_letter` | `true` when the subdomain part contains at least one letter, checked on its readable (Unicode) form. | [Example](/reference/discovery/domain-search/examples/subdomain-contains-letter/) |
| `subdomain.contains_number` | `true` when the subdomain part contains at least one digit, checked on its readable (Unicode) form, so the digits of an `xn--` punycode form do not count. | [Example](/reference/discovery/domain-search/examples/subdomain-contains-number/) |
| `subdomain.contains_hyphen` | `true` when the subdomain part contains at least one hyphen, checked on its readable (Unicode) form, so the `xn--` prefix of an IDN does not count. | [Example](/reference/discovery/domain-search/examples/subdomain-contains-hyphen/) |
| `name.contains_confusable` | `true` when the FQDN's name (without its extension) contains confusable characters: letters that look like others, such as Cyrillic `а` and Latin `a`, a common trick in look-alike domains. | [Example 1](/reference/discovery/domain-search/examples/name-contains-confusable/)<br>[Example 2](/reference/discovery/domain-search/examples/confusable-idn-domains/) |
| `domain.is_idn` | `true` when the registrable domain contains non-ASCII (internationalized) characters. | [Example](/reference/discovery/domain-search/examples/domain-is-idn/) |
| `domain.name.contains_letter` | `true` when the domain name (without its extension) contains at least one letter, checked on its readable (Unicode) form. | [Example](/reference/discovery/domain-search/examples/domain-name-contains-letter/) |
| `domain.name.contains_number` | `true` when the domain name (without its extension) contains at least one digit, checked on its readable (Unicode) form, so the digits of an `xn--` punycode form do not count. | [Example](/reference/discovery/domain-search/examples/domain-name-contains-number/) |
| `domain.name.contains_hyphen` | `true` when the domain name (without its extension) contains at least one hyphen, checked on its readable (Unicode) form, so the `xn--` prefix of an IDN does not count. | [Example](/reference/discovery/domain-search/examples/domain-name-contains-hyphen/) |
| `domain.extension.is_idn` | `true` when the extension contains non-ASCII (internationalized) characters, such as `.рф` (`xn--p1ai`). | [Example](/reference/discovery/domain-search/examples/domain-extension-is-idn/) |
| `domain.whois_privacy_enabled` | `true` when the domain's WHOIS record hides the registrant's details, through a privacy service or redaction, `false` when it does not. | [Example 1](/reference/discovery/domain-search/examples/domain-whois-privacy-enabled/)<br>[Example 2](/reference/discovery/domain-search/examples/all-three-new-shops-without-whois-privacy/)<br>[Example 3](/reference/discovery/domain-search/examples/expiring-soon-with-whois-privacy/) |
| `ssl.signature.is_self_signed` | `true` when the FQDN's TLS certificate is self-signed, signed with its own key instead of by a certificate authority. | [Example 1](/reference/discovery/domain-search/examples/ssl-signature-is-self-signed/)<br>[Example 2](/reference/discovery/domain-search/examples/self-signed-or-invalid-certificates/) |
| `ssl.signature.is_valid` | `true` when the signature of the FQDN's TLS certificate validates, `false` when it does not. | [Example 1](/reference/discovery/domain-search/examples/ssl-signature-is-valid/)<br>[Example 2](/reference/discovery/domain-search/examples/self-signed-or-invalid-certificates/) |
| `webdata.http.external_redirection` | `true` when Deepinfo's web visit was redirected to a different registrable domain, `false` when it ended on the FQDN's own domain, for example on its `www.` host. | [Example 1](/reference/discovery/domain-search/examples/webdata-http-external-redirection/)<br>[Example 2](/reference/discovery/domain-search/examples/redirects-away-to-another-site/) |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description | Example |
|---|---|---|
| `subdomain` | The subdomain part of the FQDN, everything in front of the registrable domain (`mail` in `mail.example.com`), compared in its ASCII (punycode) form. It is `null` for a registrable domain. | [Example](/reference/discovery/domain-search/examples/subdomain/) |
| `domain.name` | The name of the registrable domain without its extension, compared in its ASCII (punycode) form: `example` in `example.com`, and the same when the extension has two parts, such as `co.uk`. | [Example 1](/reference/discovery/domain-search/examples/domain-name/)<br>[Example 2](/reference/discovery/domain-search/examples/wildcard-names-containing-a-word/)<br>[Example 3](/reference/discovery/domain-search/examples/fuzzy-names-close-to-a-brand/)<br>[Example 4](/reference/discovery/domain-search/examples/endswith-names-ending-in-a-word/)<br>[Example 5](/reference/discovery/domain-search/examples/in-one-of-several-extensions/)<br>[Example 6](/reference/discovery/domain-search/examples/contains-any-phishing-style-keywords/)<br>[Example 7](/reference/discovery/domain-search/examples/contains-all-every-keyword-present/)<br>[Example 8](/reference/discovery/domain-search/examples/look-alikes-excluding-the-real-domain/)<br>[Example 9](/reference/discovery/domain-search/examples/must-not-registrable-domains-outside-com/)<br>[Example 10](/reference/discovery/domain-search/examples/sort-by-extension/)<br>[Example 11](/reference/discovery/domain-search/examples/sort-by-two-fields/)<br>[Example 12](/reference/discovery/domain-search/examples/new-look-alikes-with-mail-servers/) |

Operators: `eq`, `in`, `startswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description | Example |
|---|---|---|
| `name.latinized` | Latin look-alike forms of the FQDN's name (the FQDN without its extension) when it has non-Latin or accented letters: each character becomes the Latin letter it resembles (Cyrillic `р` becomes `p`), so `istanbul` also finds names written with `İ`. | [Example](/reference/discovery/domain-search/examples/name-latinized/) |

### Sortable Fields

Example: a worked example that sorts by the field, with the request and the response it returns.

| Field | Description | Example |
|---|---|---|
| `punycode` | The FQDN in its ASCII (punycode) form, such as `www.example.com`; sorting on it lists results alphabetically. Filters use the same value under the name `fqdn`. | [Example](/reference/discovery/domain-search/examples/sort-by-name/) |
| `domain.extension.punycode` | The extension of the registrable domain in its ASCII (punycode) form, such as `com` or `co.uk`; sorting on it lists results by extension. | [Example 1](/reference/discovery/domain-search/examples/sort-by-extension/)<br>[Example 2](/reference/discovery/domain-search/examples/sort-by-two-fields/) |
| `domain.whois.create_date` | The date the registrable domain was created (registered), from its WHOIS record (UTC, ISO 8601). | [Example 1](/reference/discovery/domain-search/examples/newest-registrations-first/)<br>[Example 2](/reference/discovery/domain-search/examples/sort-by-two-fields/) |
| `domain.whois.expiry_date` | The date the domain's registration expires, from its WHOIS record (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/soonest-to-expire-first/) |
| `domain.whois.update_date` | The last-updated date that the domain's WHOIS record itself reports (UTC, ISO 8601); `domain.whois_last_change_date` is when Deepinfo saw the record change. | [Example](/reference/discovery/domain-search/examples/most-recently-updated-whois-first/) |
| `domain.whois_last_change_date` | The last time Deepinfo saw the domain's WHOIS record change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/latest-whois-changes-first/) |
| `dns_last_change_date` | The last time Deepinfo saw the DNS records of the FQDN change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/latest-dns-changes-first/) |
| `ssl_last_change_date` | The last time Deepinfo saw the FQDN's TLS certificate change (UTC, ISO 8601). | [Example](/reference/discovery/domain-search/examples/latest-certificate-changes-first/) |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].punycode` | string |
| `results[].unicode` | string |
| `results[].is_idn` | boolean |
| `results[].subdomain` | null |
| `results[].subdomain_last` | null |
| `results[].subdomain_root` | null |
| `results[].name` | object |
| `results[].name.punycode` | string |
| `results[].name.unicode` | string |
| `results[].name.is_idn` | boolean |
| `results[].name.contains_letter` | boolean |
| `results[].name.contains_number` | boolean |
| `results[].name.contains_hyphen` | boolean |
| `results[].name.length` | number |
| `results[].name.lang` | string |
| `results[].name.keywords` | array<string> |
| `results[].name.keyword_count` | number |
| `results[].name.latinized` | array |
| `results[].name.contains_confusable` | boolean |
| `results[].domain` | object |
| `results[].domain.punycode` | string |
| `results[].domain.unicode` | string |
| `results[].domain.is_idn` | boolean |
| `results[].domain.name` | object |
| `results[].domain.name.punycode` | string |
| `results[].domain.name.unicode` | string |
| `results[].domain.name.is_idn` | boolean |
| `results[].domain.name.contains_letter` | boolean |
| `results[].domain.name.contains_number` | boolean |
| `results[].domain.name.contains_hyphen` | boolean |
| `results[].domain.name.length` | number |
| `results[].domain.name.lang` | string |
| `results[].domain.name.keywords` | array<string> |
| `results[].domain.name.keyword_count` | number |
| `results[].domain.extension` | object |
| `results[].domain.extension.punycode` | string |
| `results[].domain.extension.unicode` | string |
| `results[].domain.extension.is_idn` | boolean |
| `results[].domain.extension_root` | object |
| `results[].domain.extension_root.punycode` | string |
| `results[].domain.extension_root.unicode` | string |
| `results[].domain.extension_root.is_idn` | boolean |
| `results[].domain.extension_sub` | null |
| `results[].domain.extension_type` | number |
| `results[].domain.reserved` | null |
| `results[].domain.premium` | null |
| `results[].domain.registered` | boolean |
| `results[].domain.whois` | object |
| `results[].domain.whois.create_date` | string \| null |
| `results[].domain.whois.update_date` | string |
| `results[].domain.whois.expiry_date` | string \| null |
| `results[].domain.whois.registrar` | string \| null |
| `results[].domain.whois.registrant` | object |
| `results[].domain.whois.registrant.name` | null |
| `results[].domain.whois.registrant.organization` | null |
| `results[].domain.whois.registrant.street` | null |
| `results[].domain.whois.registrant.city` | null |
| `results[].domain.whois.registrant.state` | null |
| `results[].domain.whois.registrant.postal_code` | null |
| `results[].domain.whois.registrant.country` | null |
| `results[].domain.whois.registrant.phone` | null |
| `results[].domain.whois.registrant.email` | null |
| `results[].domain.whois.name_servers` | array<string> |
| `results[].domain.whois.domain_status` | array<string> |
| `results[].domain.whois.whois_server` | string \| null |
| `results[].domain.whois.check_date` | string |
| `results[].domain.whois_normalized` | object |
| `results[].domain.whois_normalized.registrant` | null |
| `results[].domain.whois_last_check_date` | string |
| `results[].domain.whois_create_date_historical` | array<string> |
| `results[].domain.whois_last_change_date` | string \| null |
| `results[].domain.whois_registrant_email_historical` | array<string> |
| `results[].domain.whois_privacy_enabled` | null |
| `results[].domain.dns` | object |
| `results[].domain.dns.a` | object |
| `results[].domain.dns.a.update_date` | string |
| `results[].domain.dns.a.ip_addresses` | array<string> |
| `results[].domain.dns_last_change_date` | string |
| `results[].domain.ip_history` | array<string> |
| `results[].domain.ssl` | object |
| `results[].domain.ssl.validity` | object |
| `results[].domain.ssl.validity.start_date` | string |
| `results[].domain.ssl.validity.end_date` | string |
| `results[].domain.ssl.serial_number` | string |
| `results[].domain.ssl.check_date` | string |
| `results[].domain.ssl_last_change_date` | string |
| `results[].type` | number |
| `results[].subdomain_level_count` | number |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.update_date` | string |
| `results[].dns.a.ip_addresses` | array<string> |
| `results[].dns.aaaa` | object |
| `results[].dns.aaaa.update_date` | string |
| `results[].dns.aaaa.ip_addresses` | array |
| `results[].dns.ns` | object |
| `results[].dns.ns.update_date` | string |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.update_date` | string |
| `results[].dns.mx.mail_servers` | array<string> |
| `results[].dns.soa` | object |
| `results[].dns.soa.update_date` | string |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.txt` | object |
| `results[].dns.txt.update_date` | string |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.cname` | object |
| `results[].dns.cname.update_date` | string |
| `results[].dns.cname.values` | array |
| `results[].dns.others` | array |
| `results[].dns_last_change_date` | string |
| `results[].ip_history` | array<string> |
| `results[].ssl` | object |
| `results[].ssl.tags` | array<string> |
| `results[].ssl.fqdns` | array<string> |
| `results[].ssl.version` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | null |
| `results[].ssl.issuer.locality` | null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<string> |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.check_date` | string |
| `results[].ssl_last_change_date` | string |
| `results[].webdata` | object |
| `results[].webdata.connection_status` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.http` | object |
| `results[].webdata.http.status_code_first` | number |
| `results[].webdata.http.status_code_last` | number |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.external_redirection` | null |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.cache_control` | null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_encoding` | string \| null |
| `results[].webdata.http.headers.content_security_policy` | null |
| `results[].webdata.http.headers.content_type` | string \| null |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.last_modified` | string \| null |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.referrer_policy` | null |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | string \| null |
| `results[].webdata.http.headers.strict_transport_security` | null |
| `results[].webdata.http.headers.x_content_type_options` | null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | null |
| `results[].webdata.http.headers.x_xss_protection` | null |
| `results[].webdata.http.cookies` | array<object> |
| `results[].webdata.http.cookies[].name` | string |
| `results[].webdata.http.cookies[].value` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/domain-search.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/domain-search/examples/


---

# Domain Detail

URL: https://docs.deepinfo.com/reference/discovery/domain-detail/

GET /discovery/domain-detail: Returns everything Deepinfo has on one domain: WHOIS, DNS, SSL, web data and more.

`GET https://api.deepinfo.com/v1/discovery/domain-detail`

Returns everything Deepinfo has on one domain: WHOIS, DNS, SSL, web data and more.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required |  | `deepinfo.com` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `punycode` | string |  |
| `unicode` | string |  |
| `is_idn` | boolean |  |
| `subdomain` | object |  |
| `subdomain_last` | object |  |
| `subdomain_root` | object |  |
| `name` | object |  |
| `domain` | object |  |
| `type` | integer |  |
| `subdomain_level_count` | integer |  |
| `dns` | object |  |
| `dns_last_change_date` | string | date-time |
| `ip_history` | array of string |  |
| `ssl` | object |  |
| `ssl_last_change_date` | string | date-time |
| `webdata` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `punycode` | string |
| `unicode` | string |
| `is_idn` | boolean |
| `subdomain` | null |
| `subdomain_last` | null |
| `subdomain_root` | null |
| `name` | object |
| `name.punycode` | string |
| `name.unicode` | string |
| `name.is_idn` | boolean |
| `name.contains_letter` | boolean |
| `name.contains_number` | boolean |
| `name.contains_hyphen` | boolean |
| `name.length` | number |
| `name.lang` | string |
| `name.keywords` | array<string> |
| `name.keyword_count` | number |
| `name.latinized` | array |
| `name.contains_confusable` | boolean |
| `domain` | object |
| `domain.punycode` | string |
| `domain.unicode` | string |
| `domain.is_idn` | boolean |
| `domain.name` | object |
| `domain.name.punycode` | string |
| `domain.name.unicode` | string |
| `domain.name.is_idn` | boolean |
| `domain.name.contains_letter` | boolean |
| `domain.name.contains_number` | boolean |
| `domain.name.contains_hyphen` | boolean |
| `domain.name.length` | number |
| `domain.name.lang` | string |
| `domain.name.keywords` | array<string> |
| `domain.name.keyword_count` | number |
| `domain.extension` | object |
| `domain.extension.punycode` | string |
| `domain.extension.unicode` | string |
| `domain.extension.is_idn` | boolean |
| `domain.extension_root` | object |
| `domain.extension_root.punycode` | string |
| `domain.extension_root.unicode` | string |
| `domain.extension_root.is_idn` | boolean |
| `domain.extension_sub` | null |
| `domain.extension_type` | number |
| `domain.reserved` | null |
| `domain.premium` | null |
| `domain.registered` | boolean |
| `domain.whois` | object |
| `domain.whois.create_date` | string |
| `domain.whois.update_date` | string |
| `domain.whois.expiry_date` | string |
| `domain.whois.registrar` | string |
| `domain.whois.registrant` | object |
| `domain.whois.registrant.name` | string |
| `domain.whois.registrant.organization` | string |
| `domain.whois.registrant.street` | string |
| `domain.whois.registrant.city` | string |
| `domain.whois.registrant.state` | string |
| `domain.whois.registrant.postal_code` | string |
| `domain.whois.registrant.country` | string |
| `domain.whois.registrant.phone` | string |
| `domain.whois.registrant.email` | string |
| `domain.whois.name_servers` | array<string> |
| `domain.whois.domain_status` | array<string> |
| `domain.whois.whois_server` | string |
| `domain.whois.check_date` | string |
| `domain.whois_normalized` | object |
| `domain.whois_normalized.registrant` | object |
| `domain.whois_normalized.registrant.organization` | string |
| `domain.whois_normalized.registrant.phone` | string |
| `domain.whois_normalized.registrant.email` | null |
| `domain.whois_normalized.registrant.email_fqdn_apex` | null |
| `domain.whois_normalized.registrant.email_domain_apex` | null |
| `domain.whois_last_check_date` | string |
| `domain.whois_create_date_historical` | array<string> |
| `domain.whois_last_change_date` | string |
| `domain.whois_registrant_email_historical` | array<string> |
| `domain.whois_privacy_enabled` | boolean |
| `domain.dns` | object |
| `domain.dns.a` | object |
| `domain.dns.a.update_date` | string |
| `domain.dns.a.ip_addresses` | array<string> |
| `domain.dns_last_change_date` | string |
| `domain.ip_history` | array<string> |
| `domain.ssl` | object |
| `domain.ssl.validity` | object |
| `domain.ssl.validity.start_date` | string |
| `domain.ssl.validity.end_date` | string |
| `domain.ssl.serial_number` | string |
| `domain.ssl.check_date` | string |
| `domain.ssl_last_change_date` | string |
| `type` | number |
| `subdomain_level_count` | number |
| `dns` | object |
| `dns.a` | object |
| `dns.a.update_date` | string |
| `dns.a.ip_addresses` | array<string> |
| `dns.aaaa` | object |
| `dns.aaaa.update_date` | string |
| `dns.aaaa.ip_addresses` | array<string> |
| `dns.ns` | object |
| `dns.ns.update_date` | string |
| `dns.ns.name_servers` | array<string> |
| `dns.mx` | object |
| `dns.mx.update_date` | string |
| `dns.mx.mail_servers` | array<string> |
| `dns.soa` | object |
| `dns.soa.update_date` | string |
| `dns.soa.mnames` | array<string> |
| `dns.soa.rnames` | array<string> |
| `dns.soa.rname_emails` | array<string> |
| `dns.txt` | object |
| `dns.txt.update_date` | string |
| `dns.txt.values` | array<string> |
| `dns.cname` | object |
| `dns.cname.update_date` | string |
| `dns.cname.values` | array |
| `dns.others` | array<object> |
| `dns.others[].update_date` | string |
| `dns.others[].values` | array |
| `dns.others[].type` | string |
| `dns_last_change_date` | string |
| `ip_history` | array<string> |
| `ssl` | object |
| `ssl.tags` | array<string> |
| `ssl.fqdns` | array<string> |
| `ssl.version` | number |
| `ssl.serial_number` | string |
| `ssl.fingerprint` | object |
| `ssl.fingerprint.sha256` | string |
| `ssl.fingerprint.sha1` | string |
| `ssl.fingerprint.md5` | string |
| `ssl.validity` | object |
| `ssl.validity.start_date` | string |
| `ssl.validity.end_date` | string |
| `ssl.validity.length` | number |
| `ssl.signature` | object |
| `ssl.signature.is_self_signed` | boolean |
| `ssl.signature.is_valid` | boolean |
| `ssl.signature.value` | string |
| `ssl.signature.algorithm` | object |
| `ssl.signature.algorithm.oid` | string |
| `ssl.signature.algorithm.name` | string |
| `ssl.issuer_dn` | string |
| `ssl.issuer` | object |
| `ssl.issuer.common_name` | string |
| `ssl.issuer.country` | string |
| `ssl.issuer.state` | null |
| `ssl.issuer.locality` | null |
| `ssl.issuer.organization` | string |
| `ssl.issuer.organizational_unit` | null |
| `ssl.subject_dn` | string |
| `ssl.subject` | object |
| `ssl.subject.common_name` | string |
| `ssl.subject.country` | null |
| `ssl.subject.state` | null |
| `ssl.subject.locality` | null |
| `ssl.subject.organization` | null |
| `ssl.subject.organizational_unit` | null |
| `ssl.extensions` | object |
| `ssl.extensions.authority_key_id` | string |
| `ssl.extensions.basic_constraints` | object |
| `ssl.extensions.basic_constraints.is_ca` | boolean |
| `ssl.extensions.certificate_policies` | array<string> |
| `ssl.extensions.extended_key_usage` | object |
| `ssl.extensions.extended_key_usage.client_auth` | null |
| `ssl.extensions.extended_key_usage.server_auth` | boolean |
| `ssl.extensions.key_usage` | object |
| `ssl.extensions.key_usage.digital_signature` | boolean |
| `ssl.extensions.key_usage.content_commitment` | boolean |
| `ssl.extensions.key_usage.key_agreement` | boolean |
| `ssl.extensions.key_usage.data_encipherment` | boolean |
| `ssl.extensions.key_usage.key_encipherment` | boolean |
| `ssl.extensions.key_usage.key_cert_sign` | boolean |
| `ssl.extensions.key_usage.crl_sign` | boolean |
| `ssl.extensions.signed_certificate_timestamps` | array<string> |
| `ssl.extensions.subject_alt_name` | object |
| `ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `ssl.extensions.subject_key_id` | string |
| `ssl.check_date` | string |
| `ssl_last_change_date` | string |
| `webdata` | object |
| `webdata.connection_status` | string |
| `webdata.html` | object |
| `webdata.html.source_code_hash` | string |
| `webdata.http` | object |
| `webdata.http.status_code_first` | number |
| `webdata.http.status_code_last` | number |
| `webdata.http.redirection_history` | array<object> |
| `webdata.http.redirection_history[].url` | string |
| `webdata.http.redirection_history[].status_code` | number |
| `webdata.http.external_redirection` | boolean |
| `webdata.http.final_url` | string |
| `webdata.http.final_fqdn` | string |
| `webdata.http.final_domain` | string |
| `webdata.http.headers` | object |
| `webdata.http.headers.others` | array<object> |
| `webdata.http.headers.others[].name` | string |
| `webdata.http.headers.others[].value` | string |
| `webdata.http.headers.access_control_allow_headers` | null |
| `webdata.http.headers.access_control_allow_methods` | null |
| `webdata.http.headers.access_control_allow_origin` | string |
| `webdata.http.headers.cache_control` | string |
| `webdata.http.headers.clear_site_data` | null |
| `webdata.http.headers.content_encoding` | string |
| `webdata.http.headers.content_security_policy` | string |
| `webdata.http.headers.content_type` | string |
| `webdata.http.headers.cross_origin_embedder_policy` | null |
| `webdata.http.headers.cross_origin_opener_policy` | null |
| `webdata.http.headers.cross_origin_resource_policy` | null |
| `webdata.http.headers.expect_ct` | null |
| `webdata.http.headers.feature_policy` | null |
| `webdata.http.headers.last_modified` | null |
| `webdata.http.headers.permission_policy` | null |
| `webdata.http.headers.referrer_policy` | string |
| `webdata.http.headers.server` | string |
| `webdata.http.headers.set_cookie` | null |
| `webdata.http.headers.strict_transport_security` | string |
| `webdata.http.headers.x_content_type_options` | string |
| `webdata.http.headers.x_download_options` | null |
| `webdata.http.headers.x_frame_options` | string |
| `webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `webdata.http.headers.x_powered_by` | null |
| `webdata.http.headers.x_xss_protection` | null |
| `webdata.http.cookies` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/domain-detail.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/domain-detail/examples/


---

# All TLDs

URL: https://docs.deepinfo.com/reference/discovery/all-tlds/

GET /discovery/all-tlds: Finds the same name registered under other TLDs (e.g. deepinfo.net, deepinfo.io).

`GET https://api.deepinfo.com/v1/discovery/all-tlds`

Finds the same name registered under other TLDs (e.g. `deepinfo.net`, `deepinfo.io`).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required |  | `deepinfo.com` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `include_subdomains` | Optional | Default `false`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].punycode` | string |
| `results[].unicode` | string |
| `results[].is_idn` | boolean |
| `results[].subdomain` | null |
| `results[].subdomain_last` | null |
| `results[].subdomain_root` | null |
| `results[].name` | object |
| `results[].name.punycode` | string |
| `results[].name.unicode` | string |
| `results[].name.is_idn` | boolean |
| `results[].name.contains_letter` | boolean |
| `results[].name.contains_number` | boolean |
| `results[].name.contains_hyphen` | boolean |
| `results[].name.length` | number |
| `results[].name.lang` | string |
| `results[].name.keywords` | array<string> |
| `results[].name.keyword_count` | number |
| `results[].name.latinized` | array |
| `results[].name.contains_confusable` | boolean |
| `results[].domain` | object |
| `results[].domain.punycode` | string |
| `results[].domain.unicode` | string |
| `results[].domain.is_idn` | boolean |
| `results[].domain.name` | object |
| `results[].domain.name.punycode` | string |
| `results[].domain.name.unicode` | string |
| `results[].domain.name.is_idn` | boolean |
| `results[].domain.name.contains_letter` | boolean |
| `results[].domain.name.contains_number` | boolean |
| `results[].domain.name.contains_hyphen` | boolean |
| `results[].domain.name.length` | number |
| `results[].domain.name.lang` | string |
| `results[].domain.name.keywords` | array<string> |
| `results[].domain.name.keyword_count` | number |
| `results[].domain.extension` | object |
| `results[].domain.extension.punycode` | string |
| `results[].domain.extension.unicode` | string |
| `results[].domain.extension.is_idn` | boolean |
| `results[].domain.extension_root` | object |
| `results[].domain.extension_root.punycode` | string |
| `results[].domain.extension_root.unicode` | string |
| `results[].domain.extension_root.is_idn` | boolean |
| `results[].domain.extension_sub` | null |
| `results[].domain.extension_type` | number |
| `results[].domain.reserved` | null |
| `results[].domain.premium` | null |
| `results[].domain.registered` | boolean |
| `results[].domain.whois` | object |
| `results[].domain.whois.create_date` | string |
| `results[].domain.whois.update_date` | string |
| `results[].domain.whois.expiry_date` | string |
| `results[].domain.whois.registrar` | string |
| `results[].domain.whois.registrant` | object |
| `results[].domain.whois.registrant.name` | null |
| `results[].domain.whois.registrant.organization` | null |
| `results[].domain.whois.registrant.street` | null |
| `results[].domain.whois.registrant.city` | null |
| `results[].domain.whois.registrant.state` | null |
| `results[].domain.whois.registrant.postal_code` | null |
| `results[].domain.whois.registrant.country` | null |
| `results[].domain.whois.registrant.phone` | null |
| `results[].domain.whois.registrant.email` | null |
| `results[].domain.whois.name_servers` | array<string> |
| `results[].domain.whois.domain_status` | array<string> |
| `results[].domain.whois.whois_server` | null |
| `results[].domain.whois.check_date` | string |
| `results[].domain.whois_normalized` | object |
| `results[].domain.whois_normalized.registrant` | null |
| `results[].domain.whois_last_check_date` | string |
| `results[].domain.whois_create_date_historical` | array<string> |
| `results[].domain.whois_last_change_date` | string |
| `results[].domain.whois_registrant_email_historical` | array |
| `results[].domain.whois_privacy_enabled` | null |
| `results[].domain.dns` | object |
| `results[].domain.dns.a` | object |
| `results[].domain.dns.a.update_date` | string |
| `results[].domain.dns.a.ip_addresses` | array<string> |
| `results[].domain.dns_last_change_date` | string |
| `results[].domain.ip_history` | array<string> |
| `results[].domain.ssl` | object \| null |
| `results[].domain.ssl.validity` | object |
| `results[].domain.ssl.validity.start_date` | string |
| `results[].domain.ssl.validity.end_date` | string |
| `results[].domain.ssl.serial_number` | string |
| `results[].domain.ssl.check_date` | string |
| `results[].domain.ssl_last_change_date` | string \| null |
| `results[].type` | number |
| `results[].subdomain_level_count` | number |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.update_date` | string |
| `results[].dns.a.ip_addresses` | array<string> |
| `results[].dns.aaaa` | object |
| `results[].dns.aaaa.update_date` | string |
| `results[].dns.aaaa.ip_addresses` | array |
| `results[].dns.ns` | object |
| `results[].dns.ns.update_date` | string |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.update_date` | string |
| `results[].dns.mx.mail_servers` | array |
| `results[].dns.soa` | object |
| `results[].dns.soa.update_date` | string |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.txt` | object |
| `results[].dns.txt.update_date` | string |
| `results[].dns.txt.values` | array |
| `results[].dns.cname` | object |
| `results[].dns.cname.update_date` | string |
| `results[].dns.cname.values` | array |
| `results[].dns.others` | array |
| `results[].dns_last_change_date` | string |
| `results[].ip_history` | array<string> |
| `results[].ssl` | object \| null |
| `results[].ssl.tags` | array<string> |
| `results[].ssl.fqdns` | array<string> |
| `results[].ssl.version` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | null |
| `results[].ssl.issuer.locality` | null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<string> |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.check_date` | string |
| `results[].ssl_last_change_date` | string \| null |
| `results[].webdata` | object |
| `results[].webdata.connection_status` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.http` | object |
| `results[].webdata.http.status_code_first` | number |
| `results[].webdata.http.status_code_last` | number |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.external_redirection` | boolean \| null |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | string \| null |
| `results[].webdata.http.headers.cache_control` | string \| null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_encoding` | string \| null |
| `results[].webdata.http.headers.content_security_policy` | null |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.last_modified` | string \| null |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.referrer_policy` | null |
| `results[].webdata.http.headers.server` | string \| null |
| `results[].webdata.http.headers.set_cookie` | null |
| `results[].webdata.http.headers.strict_transport_security` | string \| null |
| `results[].webdata.http.headers.x_content_type_options` | null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | null |
| `results[].webdata.http.headers.x_xss_protection` | null |
| `results[].webdata.http.cookies` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/all-tlds.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/all-tlds/examples/


---

# Associated Domain Finder

URL: https://docs.deepinfo.com/reference/discovery/associated-domain-finder/

Finds domains associated with a domain: same registrant email, organization or phone, same name servers, IP, mail servers or SSL organization.

`GET https://api.deepinfo.com/v1/discovery/associated-domain-finder`

Finds domains associated with a domain: same registrant email, organization or phone, same name servers, IP, mail servers or SSL organization. Choose the `association` type(s); `strict` requires every association to match.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required |  | `deepinfo.com` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `association` | Optional |  |  |
| `strict` | Optional | Default `false`. |  |
| `include_subdomains` | Optional | Default `false`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `domain` | string |  |
| `requested_association_parameters` | array of string |  |
| `applied_association_parameters` | array of string |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array |
| `domain` | string |
| `requested_association_parameters` | array<string> |
| `applied_association_parameters` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/associated-domain-finder.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/associated-domain-finder/examples/


---

# Reverse IP

URL: https://docs.deepinfo.com/reference/discovery/reverse-ip/

GET /discovery/reverse-ip: Finds domains that resolve to ip, or to its network when mask is 8, 16 or 24.

`GET https://api.deepinfo.com/v1/discovery/reverse-ip`

Finds domains that resolve to `ip`, or to its network when `mask` is 8, 16 or 24.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `ip` | Required |  | `104.26.10.21` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `mask` | Optional | One of: `8`, `16`, `24`, `32`. |  |
| `include_subdomains` | Optional | Default `false`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].punycode` | string |
| `results[].unicode` | string |
| `results[].is_idn` | boolean |
| `results[].subdomain` | null |
| `results[].subdomain_last` | null |
| `results[].subdomain_root` | null |
| `results[].name` | object |
| `results[].name.punycode` | string |
| `results[].name.unicode` | string |
| `results[].name.is_idn` | boolean |
| `results[].name.contains_letter` | boolean |
| `results[].name.contains_number` | boolean |
| `results[].name.contains_hyphen` | boolean |
| `results[].name.length` | number |
| `results[].name.lang` | string |
| `results[].name.keywords` | array<string> |
| `results[].name.keyword_count` | number |
| `results[].name.latinized` | array |
| `results[].name.contains_confusable` | boolean |
| `results[].domain` | object |
| `results[].domain.punycode` | string |
| `results[].domain.unicode` | string |
| `results[].domain.is_idn` | boolean |
| `results[].domain.name` | object |
| `results[].domain.name.punycode` | string |
| `results[].domain.name.unicode` | string |
| `results[].domain.name.is_idn` | boolean |
| `results[].domain.name.contains_letter` | boolean |
| `results[].domain.name.contains_number` | boolean |
| `results[].domain.name.contains_hyphen` | boolean |
| `results[].domain.name.length` | number |
| `results[].domain.name.lang` | string |
| `results[].domain.name.keywords` | array<string> |
| `results[].domain.name.keyword_count` | number |
| `results[].domain.extension` | object |
| `results[].domain.extension.punycode` | string |
| `results[].domain.extension.unicode` | string |
| `results[].domain.extension.is_idn` | boolean |
| `results[].domain.extension_root` | object |
| `results[].domain.extension_root.punycode` | string |
| `results[].domain.extension_root.unicode` | string |
| `results[].domain.extension_root.is_idn` | boolean |
| `results[].domain.extension_sub` | null |
| `results[].domain.extension_type` | number |
| `results[].domain.reserved` | null |
| `results[].domain.premium` | null |
| `results[].domain.registered` | boolean |
| `results[].domain.whois` | object |
| `results[].domain.whois.create_date` | string |
| `results[].domain.whois.update_date` | string |
| `results[].domain.whois.expiry_date` | string \| null |
| `results[].domain.whois.registrar` | string \| null |
| `results[].domain.whois.registrant` | object |
| `results[].domain.whois.registrant.name` | null |
| `results[].domain.whois.registrant.organization` | null |
| `results[].domain.whois.registrant.street` | null |
| `results[].domain.whois.registrant.city` | null |
| `results[].domain.whois.registrant.state` | null |
| `results[].domain.whois.registrant.postal_code` | null |
| `results[].domain.whois.registrant.country` | null |
| `results[].domain.whois.registrant.phone` | null |
| `results[].domain.whois.registrant.email` | null |
| `results[].domain.whois.name_servers` | array<string> |
| `results[].domain.whois.domain_status` | array<string> |
| `results[].domain.whois.whois_server` | string \| null |
| `results[].domain.whois.check_date` | string |
| `results[].domain.whois_normalized` | object |
| `results[].domain.whois_normalized.registrant` | null |
| `results[].domain.whois_last_check_date` | string |
| `results[].domain.whois_create_date_historical` | array<string> |
| `results[].domain.whois_last_change_date` | string |
| `results[].domain.whois_registrant_email_historical` | array<string> |
| `results[].domain.whois_privacy_enabled` | null |
| `results[].domain.dns` | object |
| `results[].domain.dns.a` | object |
| `results[].domain.dns.a.update_date` | string |
| `results[].domain.dns.a.ip_addresses` | array<string> |
| `results[].domain.dns_last_change_date` | string |
| `results[].domain.ip_history` | array<string> |
| `results[].domain.ssl` | object |
| `results[].domain.ssl.validity` | object |
| `results[].domain.ssl.validity.start_date` | string |
| `results[].domain.ssl.validity.end_date` | string |
| `results[].domain.ssl.serial_number` | string |
| `results[].domain.ssl.check_date` | string |
| `results[].domain.ssl_last_change_date` | string |
| `results[].type` | number |
| `results[].subdomain_level_count` | number |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.update_date` | string |
| `results[].dns.a.ip_addresses` | array<string> |
| `results[].dns.aaaa` | object |
| `results[].dns.aaaa.update_date` | string |
| `results[].dns.aaaa.ip_addresses` | array<string> |
| `results[].dns.ns` | object |
| `results[].dns.ns.update_date` | string |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.update_date` | string |
| `results[].dns.mx.mail_servers` | array<string> |
| `results[].dns.soa` | object |
| `results[].dns.soa.update_date` | string |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.txt` | object |
| `results[].dns.txt.update_date` | string |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.cname` | object |
| `results[].dns.cname.update_date` | string |
| `results[].dns.cname.values` | array |
| `results[].dns.others` | array |
| `results[].dns_last_change_date` | string |
| `results[].ip_history` | array<string> |
| `results[].ssl` | object |
| `results[].ssl.tags` | array<string> |
| `results[].ssl.fqdns` | array<string> |
| `results[].ssl.version` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | null |
| `results[].ssl.issuer.locality` | null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<string> |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.check_date` | string |
| `results[].ssl_last_change_date` | string |
| `results[].webdata` | object |
| `results[].webdata.connection_status` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.http` | object |
| `results[].webdata.http.status_code_first` | number |
| `results[].webdata.http.status_code_last` | number |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.external_redirection` | boolean |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.cache_control` | string \| null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_encoding` | string |
| `results[].webdata.http.headers.content_security_policy` | null |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.last_modified` | string \| null |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.referrer_policy` | string \| null |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | null |
| `results[].webdata.http.headers.strict_transport_security` | string \| null |
| `results[].webdata.http.headers.x_content_type_options` | string \| null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | string |
| `results[].webdata.http.headers.x_xss_protection` | string \| null |
| `results[].webdata.http.cookies` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/reverse-ip.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/reverse-ip/examples/


---

# Reverse MX

URL: https://docs.deepinfo.com/reference/discovery/reverse-mx/

GET /discovery/reverse-mx: Finds domains that use the mail server mx.

`GET https://api.deepinfo.com/v1/discovery/reverse-mx`

Finds domains that use the mail server `mx`.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `mx` | Required |  | `aspmx.l.google.com` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `apex` | Optional | Default `false`. |  |
| `include_subdomains` | Optional | Default `false`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].punycode` | string |
| `results[].unicode` | string |
| `results[].is_idn` | boolean |
| `results[].subdomain` | null |
| `results[].subdomain_last` | null |
| `results[].subdomain_root` | null |
| `results[].name` | object |
| `results[].name.punycode` | string |
| `results[].name.unicode` | string |
| `results[].name.is_idn` | boolean |
| `results[].name.contains_letter` | boolean |
| `results[].name.contains_number` | boolean |
| `results[].name.contains_hyphen` | boolean |
| `results[].name.length` | number |
| `results[].name.lang` | string |
| `results[].name.keywords` | array<string> |
| `results[].name.keyword_count` | number |
| `results[].name.latinized` | array |
| `results[].name.contains_confusable` | boolean |
| `results[].domain` | object |
| `results[].domain.punycode` | string |
| `results[].domain.unicode` | string |
| `results[].domain.is_idn` | boolean |
| `results[].domain.name` | object |
| `results[].domain.name.punycode` | string |
| `results[].domain.name.unicode` | string |
| `results[].domain.name.is_idn` | boolean |
| `results[].domain.name.contains_letter` | boolean |
| `results[].domain.name.contains_number` | boolean |
| `results[].domain.name.contains_hyphen` | boolean |
| `results[].domain.name.length` | number |
| `results[].domain.name.lang` | string |
| `results[].domain.name.keywords` | array<string> |
| `results[].domain.name.keyword_count` | number |
| `results[].domain.extension` | object |
| `results[].domain.extension.punycode` | string |
| `results[].domain.extension.unicode` | string |
| `results[].domain.extension.is_idn` | boolean |
| `results[].domain.extension_root` | object |
| `results[].domain.extension_root.punycode` | string |
| `results[].domain.extension_root.unicode` | string |
| `results[].domain.extension_root.is_idn` | boolean |
| `results[].domain.extension_sub` | null |
| `results[].domain.extension_type` | number |
| `results[].domain.reserved` | null |
| `results[].domain.premium` | null |
| `results[].domain.registered` | boolean |
| `results[].domain.whois` | object |
| `results[].domain.whois.create_date` | string |
| `results[].domain.whois.update_date` | string |
| `results[].domain.whois.expiry_date` | string |
| `results[].domain.whois.registrar` | string |
| `results[].domain.whois.registrant` | object |
| `results[].domain.whois.registrant.name` | null |
| `results[].domain.whois.registrant.organization` | null |
| `results[].domain.whois.registrant.street` | null |
| `results[].domain.whois.registrant.city` | null |
| `results[].domain.whois.registrant.state` | null |
| `results[].domain.whois.registrant.postal_code` | null |
| `results[].domain.whois.registrant.country` | null |
| `results[].domain.whois.registrant.phone` | null |
| `results[].domain.whois.registrant.email` | null |
| `results[].domain.whois.name_servers` | array<string> |
| `results[].domain.whois.domain_status` | array<string> |
| `results[].domain.whois.whois_server` | string |
| `results[].domain.whois.check_date` | string |
| `results[].domain.whois_normalized` | object |
| `results[].domain.whois_normalized.registrant` | null |
| `results[].domain.whois_last_check_date` | string |
| `results[].domain.whois_create_date_historical` | array<string> |
| `results[].domain.whois_last_change_date` | string |
| `results[].domain.whois_registrant_email_historical` | array<string> |
| `results[].domain.whois_privacy_enabled` | null |
| `results[].domain.dns` | object |
| `results[].domain.dns.a` | object |
| `results[].domain.dns.a.update_date` | string |
| `results[].domain.dns.a.ip_addresses` | array<string> |
| `results[].domain.dns_last_change_date` | string |
| `results[].domain.ip_history` | array<string> |
| `results[].domain.ssl` | object |
| `results[].domain.ssl.validity` | object |
| `results[].domain.ssl.validity.start_date` | string |
| `results[].domain.ssl.validity.end_date` | string |
| `results[].domain.ssl.serial_number` | string |
| `results[].domain.ssl.check_date` | string |
| `results[].domain.ssl_last_change_date` | string |
| `results[].type` | number |
| `results[].subdomain_level_count` | number |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.update_date` | string |
| `results[].dns.a.ip_addresses` | array<string> |
| `results[].dns.aaaa` | object |
| `results[].dns.aaaa.update_date` | string |
| `results[].dns.aaaa.ip_addresses` | array |
| `results[].dns.ns` | object |
| `results[].dns.ns.update_date` | string |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.update_date` | string |
| `results[].dns.mx.mail_servers` | array<string> |
| `results[].dns.soa` | object |
| `results[].dns.soa.update_date` | string |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.txt` | object |
| `results[].dns.txt.update_date` | string |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.cname` | object |
| `results[].dns.cname.update_date` | string |
| `results[].dns.cname.values` | array |
| `results[].dns.others` | array |
| `results[].dns_last_change_date` | string |
| `results[].ip_history` | array<string> |
| `results[].ssl` | object |
| `results[].ssl.tags` | array<string> |
| `results[].ssl.fqdns` | array<string> |
| `results[].ssl.version` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | string \| null |
| `results[].ssl.issuer.locality` | string \| null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | string \| null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | boolean \| null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<string> |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.check_date` | string |
| `results[].ssl_last_change_date` | string |
| `results[].webdata` | object |
| `results[].webdata.connection_status` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.http` | object |
| `results[].webdata.http.status_code_first` | number |
| `results[].webdata.http.status_code_last` | number |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.external_redirection` | boolean |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.cache_control` | string \| null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_encoding` | string \| null |
| `results[].webdata.http.headers.content_security_policy` | string \| null |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.last_modified` | null |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.referrer_policy` | null |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | string \| null |
| `results[].webdata.http.headers.strict_transport_security` | string |
| `results[].webdata.http.headers.x_content_type_options` | string \| null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | string \| null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | null |
| `results[].webdata.http.headers.x_xss_protection` | null |
| `results[].webdata.http.cookies` | array<object> |
| `results[].webdata.http.cookies[].name` | string |
| `results[].webdata.http.cookies[].value` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/reverse-mx.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/reverse-mx/examples/


---

# Reverse NS

URL: https://docs.deepinfo.com/reference/discovery/reverse-ns/

GET /discovery/reverse-ns: Finds domains that use the name server ns.

`GET https://api.deepinfo.com/v1/discovery/reverse-ns`

Finds domains that use the name server `ns`.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `ns` | Required |  | `may.ns.cloudflare.com` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `apex` | Optional | Default `false`. |  |
| `include_subdomains` | Optional | Default `false`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].punycode` | string |
| `results[].unicode` | string |
| `results[].is_idn` | boolean |
| `results[].subdomain` | null |
| `results[].subdomain_last` | null |
| `results[].subdomain_root` | null |
| `results[].name` | object |
| `results[].name.punycode` | string |
| `results[].name.unicode` | string |
| `results[].name.is_idn` | boolean |
| `results[].name.contains_letter` | boolean |
| `results[].name.contains_number` | boolean |
| `results[].name.contains_hyphen` | boolean |
| `results[].name.length` | number |
| `results[].name.lang` | string |
| `results[].name.keywords` | array<string> |
| `results[].name.keyword_count` | number |
| `results[].name.latinized` | array |
| `results[].name.contains_confusable` | boolean |
| `results[].domain` | object |
| `results[].domain.punycode` | string |
| `results[].domain.unicode` | string |
| `results[].domain.is_idn` | boolean |
| `results[].domain.name` | object |
| `results[].domain.name.punycode` | string |
| `results[].domain.name.unicode` | string |
| `results[].domain.name.is_idn` | boolean |
| `results[].domain.name.contains_letter` | boolean |
| `results[].domain.name.contains_number` | boolean |
| `results[].domain.name.contains_hyphen` | boolean |
| `results[].domain.name.length` | number |
| `results[].domain.name.lang` | string |
| `results[].domain.name.keywords` | array<string> |
| `results[].domain.name.keyword_count` | number |
| `results[].domain.extension` | object |
| `results[].domain.extension.punycode` | string |
| `results[].domain.extension.unicode` | string |
| `results[].domain.extension.is_idn` | boolean |
| `results[].domain.extension_root` | object |
| `results[].domain.extension_root.punycode` | string |
| `results[].domain.extension_root.unicode` | string |
| `results[].domain.extension_root.is_idn` | boolean |
| `results[].domain.extension_sub` | object \| null |
| `results[].domain.extension_sub.punycode` | string |
| `results[].domain.extension_sub.unicode` | string |
| `results[].domain.extension_sub.is_idn` | boolean |
| `results[].domain.extension_type` | number |
| `results[].domain.reserved` | null |
| `results[].domain.premium` | null |
| `results[].domain.registered` | boolean \| null |
| `results[].domain.whois` | object \| null |
| `results[].domain.whois.create_date` | string |
| `results[].domain.whois.update_date` | string |
| `results[].domain.whois.expiry_date` | string |
| `results[].domain.whois.registrar` | string |
| `results[].domain.whois.registrant` | object |
| `results[].domain.whois.registrant.name` | string |
| `results[].domain.whois.registrant.organization` | string |
| `results[].domain.whois.registrant.street` | string |
| `results[].domain.whois.registrant.city` | string |
| `results[].domain.whois.registrant.state` | string |
| `results[].domain.whois.registrant.postal_code` | string |
| `results[].domain.whois.registrant.country` | string |
| `results[].domain.whois.registrant.phone` | string |
| `results[].domain.whois.registrant.email` | string |
| `results[].domain.whois.name_servers` | array<string> |
| `results[].domain.whois.domain_status` | array<string> |
| `results[].domain.whois.whois_server` | string |
| `results[].domain.whois.check_date` | string |
| `results[].domain.whois_normalized` | object \| null |
| `results[].domain.whois_normalized.registrant` | object |
| `results[].domain.whois_normalized.registrant.organization` | string |
| `results[].domain.whois_normalized.registrant.phone` | string |
| `results[].domain.whois_normalized.registrant.email` | string |
| `results[].domain.whois_normalized.registrant.email_fqdn_apex` | string |
| `results[].domain.whois_normalized.registrant.email_domain_apex` | string |
| `results[].domain.whois_last_check_date` | string \| null |
| `results[].domain.whois_create_date_historical` | array<string> |
| `results[].domain.whois_last_change_date` | string \| null |
| `results[].domain.whois_registrant_email_historical` | array<string> |
| `results[].domain.whois_privacy_enabled` | boolean \| null |
| `results[].domain.dns` | object |
| `results[].domain.dns.a` | object |
| `results[].domain.dns.a.update_date` | string |
| `results[].domain.dns.a.ip_addresses` | array<string> |
| `results[].domain.dns_last_change_date` | string |
| `results[].domain.ip_history` | array<string> |
| `results[].domain.ssl` | object \| null |
| `results[].domain.ssl.validity` | object |
| `results[].domain.ssl.validity.start_date` | string |
| `results[].domain.ssl.validity.end_date` | string |
| `results[].domain.ssl.serial_number` | string |
| `results[].domain.ssl.check_date` | string |
| `results[].domain.ssl_last_change_date` | string |
| `results[].type` | number |
| `results[].subdomain_level_count` | number |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.update_date` | string |
| `results[].dns.a.ip_addresses` | array<string> |
| `results[].dns.aaaa` | object |
| `results[].dns.aaaa.update_date` | string |
| `results[].dns.aaaa.ip_addresses` | array<string> |
| `results[].dns.ns` | object |
| `results[].dns.ns.update_date` | string |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.update_date` | string |
| `results[].dns.mx.mail_servers` | array<string> |
| `results[].dns.soa` | object |
| `results[].dns.soa.update_date` | string |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.txt` | object |
| `results[].dns.txt.update_date` | string |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.cname` | object |
| `results[].dns.cname.update_date` | string |
| `results[].dns.cname.values` | array |
| `results[].dns.others` | array |
| `results[].dns_last_change_date` | string |
| `results[].ip_history` | array<string> |
| `results[].ssl` | object \| null |
| `results[].ssl.tags` | array<string> |
| `results[].ssl.fqdns` | array<string> |
| `results[].ssl.version` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | null |
| `results[].ssl.issuer.locality` | null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<string> |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.check_date` | string |
| `results[].ssl_last_change_date` | string |
| `results[].webdata` | object |
| `results[].webdata.connection_status` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.http` | object |
| `results[].webdata.http.status_code_first` | number |
| `results[].webdata.http.status_code_last` | number |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.external_redirection` | boolean |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.cache_control` | null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_encoding` | string |
| `results[].webdata.http.headers.content_security_policy` | null |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.last_modified` | null |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.referrer_policy` | null |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | null |
| `results[].webdata.http.headers.strict_transport_security` | null |
| `results[].webdata.http.headers.x_content_type_options` | null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | string \| null |
| `results[].webdata.http.headers.x_xss_protection` | null |
| `results[].webdata.http.cookies` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/reverse-ns.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/reverse-ns/examples/


---

# Reverse WHOIS Email

URL: https://docs.deepinfo.com/reference/discovery/reverse-whois-email/

GET /discovery/reverse-email: Finds domains whose WHOIS registrant email is email. apex=true matches the whole email domain.

`GET https://api.deepinfo.com/v1/discovery/reverse-email`

Finds domains whose WHOIS registrant email is `email`. `apex=true` matches the whole email domain.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `email` | Required |  | `user@cloudflare.com` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `apex` | Optional | Default `false`. |  |
| `include_subdomains` | Optional | Default `false`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].punycode` | string |
| `results[].unicode` | string |
| `results[].is_idn` | boolean |
| `results[].subdomain` | null |
| `results[].subdomain_last` | null |
| `results[].subdomain_root` | null |
| `results[].name` | object |
| `results[].name.punycode` | string |
| `results[].name.unicode` | string |
| `results[].name.is_idn` | boolean |
| `results[].name.contains_letter` | boolean |
| `results[].name.contains_number` | boolean |
| `results[].name.contains_hyphen` | boolean |
| `results[].name.length` | number |
| `results[].name.lang` | string |
| `results[].name.keywords` | array<string> |
| `results[].name.keyword_count` | number |
| `results[].name.latinized` | array |
| `results[].name.contains_confusable` | boolean |
| `results[].domain` | object |
| `results[].domain.punycode` | string |
| `results[].domain.unicode` | string |
| `results[].domain.is_idn` | boolean |
| `results[].domain.name` | object |
| `results[].domain.name.punycode` | string |
| `results[].domain.name.unicode` | string |
| `results[].domain.name.is_idn` | boolean |
| `results[].domain.name.contains_letter` | boolean |
| `results[].domain.name.contains_number` | boolean |
| `results[].domain.name.contains_hyphen` | boolean |
| `results[].domain.name.length` | number |
| `results[].domain.name.lang` | string |
| `results[].domain.name.keywords` | array<string> |
| `results[].domain.name.keyword_count` | number |
| `results[].domain.extension` | object |
| `results[].domain.extension.punycode` | string |
| `results[].domain.extension.unicode` | string |
| `results[].domain.extension.is_idn` | boolean |
| `results[].domain.extension_root` | object |
| `results[].domain.extension_root.punycode` | string |
| `results[].domain.extension_root.unicode` | string |
| `results[].domain.extension_root.is_idn` | boolean |
| `results[].domain.extension_sub` | object |
| `results[].domain.extension_sub.punycode` | string |
| `results[].domain.extension_sub.unicode` | string |
| `results[].domain.extension_sub.is_idn` | boolean |
| `results[].domain.extension_type` | number |
| `results[].domain.reserved` | null |
| `results[].domain.premium` | null |
| `results[].domain.registered` | boolean |
| `results[].domain.whois` | object |
| `results[].domain.whois.create_date` | string \| null |
| `results[].domain.whois.update_date` | string |
| `results[].domain.whois.expiry_date` | string \| null |
| `results[].domain.whois.registrar` | string |
| `results[].domain.whois.registrant` | object |
| `results[].domain.whois.registrant.name` | string |
| `results[].domain.whois.registrant.organization` | string |
| `results[].domain.whois.registrant.street` | string |
| `results[].domain.whois.registrant.city` | string \| null |
| `results[].domain.whois.registrant.state` | null |
| `results[].domain.whois.registrant.postal_code` | string |
| `results[].domain.whois.registrant.country` | string |
| `results[].domain.whois.registrant.phone` | string |
| `results[].domain.whois.registrant.email` | string |
| `results[].domain.whois.name_servers` | array<string> |
| `results[].domain.whois.domain_status` | array<string> |
| `results[].domain.whois.whois_server` | null |
| `results[].domain.whois.check_date` | string |
| `results[].domain.whois_normalized` | object |
| `results[].domain.whois_normalized.registrant` | object |
| `results[].domain.whois_normalized.registrant.organization` | string |
| `results[].domain.whois_normalized.registrant.phone` | string |
| `results[].domain.whois_normalized.registrant.email` | string |
| `results[].domain.whois_normalized.registrant.email_fqdn_apex` | string |
| `results[].domain.whois_normalized.registrant.email_domain_apex` | string |
| `results[].domain.whois_last_check_date` | string |
| `results[].domain.whois_create_date_historical` | array<string> |
| `results[].domain.whois_last_change_date` | string \| null |
| `results[].domain.whois_registrant_email_historical` | array<string> |
| `results[].domain.whois_privacy_enabled` | boolean |
| `results[].domain.dns` | object |
| `results[].domain.dns.a` | object |
| `results[].domain.dns.a.update_date` | string |
| `results[].domain.dns.a.ip_addresses` | array<string> |
| `results[].domain.dns_last_change_date` | string |
| `results[].domain.ip_history` | array<string> |
| `results[].domain.ssl` | object |
| `results[].domain.ssl.validity` | object |
| `results[].domain.ssl.validity.start_date` | string |
| `results[].domain.ssl.validity.end_date` | string |
| `results[].domain.ssl.serial_number` | string |
| `results[].domain.ssl.check_date` | string |
| `results[].domain.ssl_last_change_date` | string |
| `results[].type` | number |
| `results[].subdomain_level_count` | number |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.update_date` | string |
| `results[].dns.a.ip_addresses` | array<string> |
| `results[].dns.aaaa` | object |
| `results[].dns.aaaa.update_date` | string |
| `results[].dns.aaaa.ip_addresses` | array<string> |
| `results[].dns.ns` | object |
| `results[].dns.ns.update_date` | string |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.update_date` | string |
| `results[].dns.mx.mail_servers` | array |
| `results[].dns.soa` | object |
| `results[].dns.soa.update_date` | string |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.txt` | object |
| `results[].dns.txt.update_date` | string |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.cname` | object |
| `results[].dns.cname.update_date` | string |
| `results[].dns.cname.values` | array |
| `results[].dns.others` | array |
| `results[].dns_last_change_date` | string |
| `results[].ip_history` | array<string> |
| `results[].ssl` | object |
| `results[].ssl.tags` | array<string> |
| `results[].ssl.fqdns` | array<string> |
| `results[].ssl.version` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | null |
| `results[].ssl.issuer.locality` | null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<string> |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.check_date` | string |
| `results[].ssl_last_change_date` | string |
| `results[].webdata` | object |
| `results[].webdata.connection_status` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.http` | object |
| `results[].webdata.http.status_code_first` | number |
| `results[].webdata.http.status_code_last` | number |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.external_redirection` | boolean |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.cache_control` | string |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_encoding` | string |
| `results[].webdata.http.headers.content_security_policy` | string |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | string |
| `results[].webdata.http.headers.cross_origin_resource_policy` | string |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.last_modified` | null |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.referrer_policy` | string |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | string |
| `results[].webdata.http.headers.strict_transport_security` | string |
| `results[].webdata.http.headers.x_content_type_options` | string |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | string |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | null |
| `results[].webdata.http.headers.x_xss_protection` | string |
| `results[].webdata.http.cookies` | array<object> |
| `results[].webdata.http.cookies[].name` | string |
| `results[].webdata.http.cookies[].value` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/reverse-whois-email.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/reverse-whois-email/examples/


---

# Same-Time Registered Domain Finder

URL: https://docs.deepinfo.com/reference/discovery/same-time-registered-domain-finder/

GET /discovery/sametime-domain-finder: Finds domains registered by the same registrant within interval minutes (1–60, default 5) of the given domain.

`GET https://api.deepinfo.com/v1/discovery/sametime-domain-finder`

Finds domains registered by the same registrant within `interval` minutes (1–60, default 5) of the given domain.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required |  | `deepinfo.com` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `interval` | Optional | Min `1`, max `60`. Default `5`. | `5` |
| `include_subdomains` | Optional | Default `false`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].punycode` | string |
| `results[].unicode` | string |
| `results[].is_idn` | boolean |
| `results[].subdomain` | null |
| `results[].subdomain_last` | null |
| `results[].subdomain_root` | null |
| `results[].name` | object |
| `results[].name.punycode` | string |
| `results[].name.unicode` | string |
| `results[].name.is_idn` | boolean |
| `results[].name.contains_letter` | boolean |
| `results[].name.contains_number` | boolean |
| `results[].name.contains_hyphen` | boolean |
| `results[].name.length` | number |
| `results[].name.lang` | string |
| `results[].name.keywords` | array<string> |
| `results[].name.keyword_count` | number |
| `results[].name.latinized` | array |
| `results[].name.contains_confusable` | boolean |
| `results[].domain` | object |
| `results[].domain.punycode` | string |
| `results[].domain.unicode` | string |
| `results[].domain.is_idn` | boolean |
| `results[].domain.name` | object |
| `results[].domain.name.punycode` | string |
| `results[].domain.name.unicode` | string |
| `results[].domain.name.is_idn` | boolean |
| `results[].domain.name.contains_letter` | boolean |
| `results[].domain.name.contains_number` | boolean |
| `results[].domain.name.contains_hyphen` | boolean |
| `results[].domain.name.length` | number |
| `results[].domain.name.lang` | string |
| `results[].domain.name.keywords` | array<string> |
| `results[].domain.name.keyword_count` | number |
| `results[].domain.extension` | object |
| `results[].domain.extension.punycode` | string |
| `results[].domain.extension.unicode` | string |
| `results[].domain.extension.is_idn` | boolean |
| `results[].domain.extension_root` | object |
| `results[].domain.extension_root.punycode` | string |
| `results[].domain.extension_root.unicode` | string |
| `results[].domain.extension_root.is_idn` | boolean |
| `results[].domain.extension_sub` | null |
| `results[].domain.extension_type` | number |
| `results[].domain.reserved` | null |
| `results[].domain.premium` | null |
| `results[].domain.registered` | boolean |
| `results[].domain.whois` | object |
| `results[].domain.whois.create_date` | string |
| `results[].domain.whois.update_date` | string |
| `results[].domain.whois.expiry_date` | string |
| `results[].domain.whois.registrar` | string |
| `results[].domain.whois.registrant` | object |
| `results[].domain.whois.registrant.name` | string |
| `results[].domain.whois.registrant.organization` | string \| null |
| `results[].domain.whois.registrant.street` | string |
| `results[].domain.whois.registrant.city` | string |
| `results[].domain.whois.registrant.state` | string |
| `results[].domain.whois.registrant.postal_code` | string |
| `results[].domain.whois.registrant.country` | string |
| `results[].domain.whois.registrant.phone` | string |
| `results[].domain.whois.registrant.email` | string |
| `results[].domain.whois.name_servers` | array<string> |
| `results[].domain.whois.domain_status` | array<string> |
| `results[].domain.whois.whois_server` | string |
| `results[].domain.whois.check_date` | string |
| `results[].domain.whois_normalized` | object |
| `results[].domain.whois_normalized.registrant` | object |
| `results[].domain.whois_normalized.registrant.organization` | string \| null |
| `results[].domain.whois_normalized.registrant.phone` | string |
| `results[].domain.whois_normalized.registrant.email` | string |
| `results[].domain.whois_normalized.registrant.email_fqdn_apex` | string |
| `results[].domain.whois_normalized.registrant.email_domain_apex` | string |
| `results[].domain.whois_last_check_date` | string |
| `results[].domain.whois_create_date_historical` | array<string> |
| `results[].domain.whois_last_change_date` | string |
| `results[].domain.whois_registrant_email_historical` | array<string> |
| `results[].domain.whois_privacy_enabled` | boolean |
| `results[].domain.dns` | object |
| `results[].domain.dns.a` | object |
| `results[].domain.dns.a.update_date` | string |
| `results[].domain.dns.a.ip_addresses` | array<string> |
| `results[].domain.dns_last_change_date` | string \| null |
| `results[].domain.ip_history` | array<string> |
| `results[].domain.ssl` | object |
| `results[].domain.ssl.validity` | object |
| `results[].domain.ssl.validity.start_date` | string |
| `results[].domain.ssl.validity.end_date` | string |
| `results[].domain.ssl.serial_number` | string |
| `results[].domain.ssl.check_date` | string |
| `results[].domain.ssl_last_change_date` | string \| null |
| `results[].type` | number |
| `results[].subdomain_level_count` | number |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.update_date` | string |
| `results[].dns.a.ip_addresses` | array<string> |
| `results[].dns.aaaa` | object |
| `results[].dns.aaaa.update_date` | string |
| `results[].dns.aaaa.ip_addresses` | array |
| `results[].dns.ns` | object |
| `results[].dns.ns.update_date` | string |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.update_date` | string |
| `results[].dns.mx.mail_servers` | array<string> |
| `results[].dns.soa` | object |
| `results[].dns.soa.update_date` | string |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.txt` | object |
| `results[].dns.txt.update_date` | string |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.cname` | object |
| `results[].dns.cname.update_date` | string |
| `results[].dns.cname.values` | array |
| `results[].dns.others` | array |
| `results[].dns_last_change_date` | string \| null |
| `results[].ip_history` | array<string> |
| `results[].ssl` | object |
| `results[].ssl.tags` | array<string> |
| `results[].ssl.fqdns` | array<string> |
| `results[].ssl.version` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | string \| null |
| `results[].ssl.issuer.locality` | string \| null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | string \| null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | boolean \| null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<string> |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.check_date` | string |
| `results[].ssl_last_change_date` | string \| null |
| `results[].webdata` | object |
| `results[].webdata.connection_status` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.http` | object |
| `results[].webdata.http.status_code_first` | number |
| `results[].webdata.http.status_code_last` | number |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.external_redirection` | boolean \| null |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.cache_control` | null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_encoding` | string \| null |
| `results[].webdata.http.headers.content_security_policy` | null |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.last_modified` | string |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.referrer_policy` | null |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | null |
| `results[].webdata.http.headers.strict_transport_security` | null |
| `results[].webdata.http.headers.x_content_type_options` | null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | null |
| `results[].webdata.http.headers.x_xss_protection` | null |
| `results[].webdata.http.cookies` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/same-time-registered-domain-finder.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/same-time-registered-domain-finder/examples/


---

# Subdomain Finder

URL: https://docs.deepinfo.com/reference/discovery/subdomain-finder/

GET /discovery/subdomain-finder: Finds all known subdomains of a domain.

`GET https://api.deepinfo.com/v1/discovery/subdomain-finder`

Finds all known subdomains of a domain.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain` | Required |  | `deepinfo.com` |
| `export` | Optional | Default `false`. | `true` |
| `export_format` | Optional | One of: `json`, `csv`. | `csv` |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. | `basic` |
| `ordering` | Optional |  |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `100` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].punycode` | string |  |
| `results[].unicode` | string |  |
| `results[].is_idn` | boolean |  |
| `results[].subdomain` | object |  |
| `results[].subdomain_last` | object |  |
| `results[].subdomain_root` | object |  |
| `results[].name` | object |  |
| `results[].domain` | object |  |
| `results[].type` | integer |  |
| `results[].subdomain_level_count` | integer |  |
| `results[].dns` | object |  |
| `results[].dns_last_change_date` | string | date-time |
| `results[].ip_history` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].webdata` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Examples

Request and response examples: https://docs.deepinfo.com/reference/discovery/subdomain-finder.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/discovery/subdomain-finder/examples/


---

# Darkweb

URL: https://docs.deepinfo.com/reference/darkweb/

Search dark web sources (forums, markets, paste sites, chats, leaks). Results are paged 25 per page, up to page 250.

Search dark web sources (forums, markets, paste sites, chats, leaks). Results are paged **25 per page**, up to page **250**.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Search](/reference/darkweb/search/) | `/discovery/darkweb-search` |


---

# Search

URL: https://docs.deepinfo.com/reference/darkweb/search/

POST /discovery/darkweb-search: Searches dark web content by free text, by indicators and by sources. At least one of them is required.

`POST https://api.deepinfo.com/v1/discovery/darkweb-search`

Searches dark web content by free `text`, by indicators and by sources. At least one of them is required.

Indicators:

- `email`
- `email_apex`
- `ip_address`
- `crypto_address`
- `ccn`
- `cve`
- `ssn`
- `website_mention`
- `data_leak`

Sources:

- `source_type`
- `source_group`
- `source_domain`

Narrow the results with:

- `language`
- `crawl_date`
- `post_date`
- `hackishness` (0–1)

Sort with `sorting`.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page` | Optional | Min `1`, max `250`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required |
|---|---|---|
| `text` | string | Optional |
| `include_similar` | boolean | Optional |
| `language` | array | Optional |
| `source_domain` | array | Optional |
| `crawl_date` | object | Optional |
| `post_date` | object | Optional |
| `hackishness` | object | Optional |
| `contains` | array | Optional |
| `include_text_content` | boolean | Optional |
| `ccn` | array | Optional |
| `cve` | array | Optional |
| `website_mention` | array | Optional |
| `ssn` | array | Optional |
| `email` | array | Optional |
| `email_apex` | array | Optional |
| `ip_address` | array | Optional |
| `site_id` | string | Optional |
| `crypto_address` | array | Optional |
| `data_leak` | array | Optional |
| `source_type` | array | Optional |
| `source_group` | array | Optional |
| `source_discord_channel` | array | Optional |
| `source_telegram_channel` | array | Optional |
| `sorting` | object | Optional |

```json
{}
```

## Response Fields

| Field | Type |
|---|---|
| `page` | integer |
| `page_size` | integer |
| `result_count` | integer |
| `results` | array of object |
| `results[].id` | string |
| `results[].ref` | string |
| `results[].body` | string |
| `results[].hackishness` | number |
| `results[].title` | string |
| `results[].uri` | string |
| `results[].url` | string |
| `results[].location` | string |
| `results[].crawl_date` | string |
| `results[].file_size` | integer |
| `results[].network` | string |
| `results[].languages` | array of string |
| `results[].domain` | string |
| `results[].site_id` | string |
| `results[].snippet` | string |
| `results[].emails` | array of string |
| `results[].ssns` | array of string |
| `results[].ccns` | array of string |
| `results[].cves` | array of string |
| `results[].websites` | array of string |
| `results[].ips` | array of string |
| `results[].cryptos` | array of string |
| `results[].headers` | array of string |
| `results[].groups` | array of string |
| `results[].paste` | object |
| `results[].market` | object |
| `results[].leak` | object |
| `results[].chat` | object |
| `results[].irc` | object |
| `results[].forum` | object |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/darkweb/search.md


---

# Vulnerability

URL: https://docs.deepinfo.com/reference/vulnerability/

Deepinfo's vulnerability (CVE) database: search, CVE details, EPSS history and global statistics.

Deepinfo's vulnerability (CVE) database: search, CVE details, EPSS history and global statistics.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Search](/reference/vulnerability/search/) | `/discovery/vulnerability-search` |
| GET | [Detail](/reference/vulnerability/detail/) | `/discovery/vulnerability-detail` |
| GET | [EPSS History](/reference/vulnerability/epss-history/) | `/explore/vulnerability-insight/epss-history/{cve}` |
| GET | [Finder](/reference/vulnerability/finder/) | `/discovery/vulnerability-finder` |
| GET | [Latest Added](/reference/vulnerability/latest-added/) | `/explore/vulnerability-insight/latest-added-vulnerabilities-list` |
| GET | [CISA KEV Stats](/reference/vulnerability/cisa-kev-stats/) | `/explore/vulnerability-insight/cisa-kev-stats` |
| GET | [CVE Stats](/reference/vulnerability/cve-stats/) | `/explore/vulnerability-insight/cve-stats` |
| GET | [CVSS Score Stats](/reference/vulnerability/cvss-score-stats/) | `/explore/vulnerability-insight/vulnerability-stats-by-cvss-scores` |
| GET | [CWE Timeline](/reference/vulnerability/cwe-timeline/) | `/explore/vulnerability-insight/cwe-timeline` |
| GET | [Severity by Year Stats](/reference/vulnerability/severity-by-year-stats/) | `/explore/vulnerability-insight/vulnerability-severity-stats-by-year` |


---

# Search

URL: https://docs.deepinfo.com/reference/vulnerability/search/

POST /discovery/vulnerability-search: Searches Deepinfo's CVE database with filters.

`POST https://api.deepinfo.com/v1/discovery/vulnerability-search`

Searches Deepinfo's CVE database with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `export` | Optional | Default `false`. |  |
| `export_format` | Optional | One of: `json`, `csv`. |  |
| `export_scope` | Optional | One of: `basic`, `default`, `extended`. |  |
| `page` | Optional | Min `1`, max `400`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400). Example: a worked example that filters by the field, with the request and the response it returns.

Operators: `eq`, `startswith`, `wildcard`, `exists`

| Field | Description | Example |
|---|---|---|
| `source_identifier` | The CVE's assigner, shown as Assigner in the platform: the organization that submitted the CVE record, identified by an email address or a UUID. | [Example](/reference/vulnerability/search/examples/source-identifier/) |
| `status` | Analysis status of the CVE record. Values seen: `Received`, `Awaiting Analysis`, `Undergoing Analysis`, `Analyzed`, `Modified`, `Deferred`, `Rejected`. | [Example 1](/reference/vulnerability/search/examples/status/)<br>[Example 2](/reference/vulnerability/search/examples/sort-last-modified/) |
| `descriptions.lang` | Language of one of the CVE's descriptions, as a two-letter code (`en` and `es` seen). | [Example](/reference/vulnerability/search/examples/descriptions-lang/) |
| `references.url` | URL of one of the CVE's references, such as a vendor advisory, a patch or an exploit. | [Example](/reference/vulnerability/search/examples/references-url/) |
| `references.source` | Who added the reference to the CVE record, identified by an email address or a UUID. | [Example](/reference/vulnerability/search/examples/references-source/) |
| `metrics.cvss_metric_v2.source` | Who provided a CVSS 2.0 assessment of the CVE, identified by an email address or a UUID. A CVE can carry one CVSS 2.0 assessment per source. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-source/) |
| `metrics.cvss_metric_v2.type` | Role of a CVSS 2.0 assessment of the CVE. Values: `Primary`, `Secondary`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-type/) |
| `metrics.cvss_metric_v2.cvss_data.version` | CVSS version of the assessment; always `2.0` here. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-version/) |
| `metrics.cvss_metric_v2.cvss_data.vector_string` | The full CVSS 2.0 vector of the assessment, for example `AV:N/AC:L/Au:N/C:C/I:C/A:C`; it encodes the individual metrics of the assessment. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-vector-string/) |
| `metrics.cvss_metric_v2.cvss_data.access_vector` | CVSS 2.0 Access Vector (AV): how an attacker reaches the vulnerable system. Values: `NETWORK`, `ADJACENT_NETWORK`, `LOCAL`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-access-vector/) |
| `metrics.cvss_metric_v2.cvss_data.access_complexity` | CVSS 2.0 Access Complexity (AC): how difficult the attack is once the attacker has access to the target. Values: `HIGH`, `MEDIUM`, `LOW`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-access-complexity/) |
| `metrics.cvss_metric_v2.cvss_data.authentication` | CVSS 2.0 Authentication (Au): how many times an attacker must authenticate to exploit the vulnerability. Values: `MULTIPLE`, `SINGLE`, `NONE`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-authentication/) |
| `metrics.cvss_metric_v2.cvss_data.confidentiality_impact` | CVSS 2.0 Confidentiality Impact (C): how much a successful attack affects the confidentiality of data. Values: `NONE`, `PARTIAL`, `COMPLETE`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-confidentiality-impact/) |
| `metrics.cvss_metric_v2.cvss_data.integrity_impact` | CVSS 2.0 Integrity Impact (I): how much a successful attack affects the integrity of data. Values: `NONE`, `PARTIAL`, `COMPLETE`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-integrity-impact/) |
| `metrics.cvss_metric_v2.cvss_data.availability_impact` | CVSS 2.0 Availability Impact (A): how much a successful attack affects the availability of the affected system. Values: `NONE`, `PARTIAL`, `COMPLETE`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-availability-impact/) |
| `metrics.cvss_metric_v2.cvss_data.exploitability` | CVSS 2.0 Exploitability (E), a temporal metric: how mature the exploit code or technique is. Values: `UNPROVEN`, `PROOF_OF_CONCEPT`, `FUNCTIONAL`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.remediation_level` | CVSS 2.0 Remediation Level (RL), a temporal metric: what kind of fix is available. Values: `OFFICIAL_FIX`, `TEMPORARY_FIX`, `WORKAROUND`, `UNAVAILABLE`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.report_confidence` | CVSS 2.0 Report Confidence (RC), a temporal metric: how far the existence of the vulnerability is confirmed. Values: `UNCONFIRMED`, `UNCORROBORATED`, `CONFIRMED`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.collateral_damage_potential` | CVSS 2.0 Collateral Damage Potential (CDP), an environmental metric: the potential for loss of life, physical assets or revenue. Values: `NONE`, `LOW`, `LOW_MEDIUM`, `MEDIUM_HIGH`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.target_distribution` | CVSS 2.0 Target Distribution (TD), an environmental metric: the share of systems in an environment that are vulnerable. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.confidentiality_requirement` | CVSS 2.0 Confidentiality Requirement (CR), an environmental metric: how important confidentiality of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.integrity_requirement` | CVSS 2.0 Integrity Requirement (IR), an environmental metric: how important integrity of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.availability_requirement` | CVSS 2.0 Availability Requirement (AR), an environmental metric: how important availability of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.base_severity` | Severity band of the CVSS 2.0 base score. Values: `LOW`, `MEDIUM`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-base-severity/) |
| `metrics.cvss_metric_v30.source` | Who provided a CVSS 3.0 assessment of the CVE, identified by an email address or a UUID. A CVE can carry one CVSS 3.0 assessment per source. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-source/) |
| `metrics.cvss_metric_v30.type` | Role of a CVSS 3.0 assessment of the CVE. Values: `Primary`, `Secondary`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-type/) |
| `metrics.cvss_metric_v30.cvss_data.version` | CVSS version of the assessment; always `3.0` here. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-version/) |
| `metrics.cvss_metric_v30.cvss_data.vector_string` | The full CVSS 3.0 vector of the assessment, for example `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`; it encodes the individual metrics of the assessment. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-vector-string/) |
| `metrics.cvss_metric_v30.cvss_data.attack_vector` | CVSS 3.0 Attack Vector (AV): how an attacker reaches the vulnerable component. Values: `NETWORK`, `ADJACENT_NETWORK`, `LOCAL`, `PHYSICAL`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-attack-vector/) |
| `metrics.cvss_metric_v30.cvss_data.attack_complexity` | CVSS 3.0 Attack Complexity (AC): how difficult the attack is to carry out. Values: `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-attack-complexity/) |
| `metrics.cvss_metric_v30.cvss_data.privileges_required` | CVSS 3.0 Privileges Required (PR): the level of privileges an attacker needs before the attack. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-privileges-required/) |
| `metrics.cvss_metric_v30.cvss_data.user_interaction` | CVSS 3.0 User Interaction (UI): whether a user other than the attacker must take part in the attack. Values: `NONE`, `REQUIRED`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-user-interaction/) |
| `metrics.cvss_metric_v30.cvss_data.scope` | CVSS 3.0 Scope (S): whether a successful attack can affect components beyond the vulnerable one. Values: `UNCHANGED`, `CHANGED`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-scope/) |
| `metrics.cvss_metric_v30.cvss_data.confidentiality_impact` | CVSS 3.0 Confidentiality Impact (C): how much a successful attack affects the confidentiality of data. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-confidentiality-impact/) |
| `metrics.cvss_metric_v30.cvss_data.integrity_impact` | CVSS 3.0 Integrity Impact (I): how much a successful attack affects the integrity of data. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-integrity-impact/) |
| `metrics.cvss_metric_v30.cvss_data.availability_impact` | CVSS 3.0 Availability Impact (A): how much a successful attack affects the availability of the affected system. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-availability-impact/) |
| `metrics.cvss_metric_v30.cvss_data.base_severity` | Severity band of the CVSS 3.0 base score. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-base-severity/) |
| `metrics.cvss_metric_v30.cvss_data.exploit_code_maturity` | CVSS 3.0 Exploit Code Maturity (E), a temporal metric: how mature the exploit code or technique is. Values: `UNPROVEN`, `PROOF_OF_CONCEPT`, `FUNCTIONAL`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.remediation_level` | CVSS 3.0 Remediation Level (RL), a temporal metric: what kind of fix is available. Values: `OFFICIAL_FIX`, `TEMPORARY_FIX`, `WORKAROUND`, `UNAVAILABLE`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.report_confidence` | CVSS 3.0 Report Confidence (RC), a temporal metric: how far the existence of the vulnerability is confirmed. Values: `UNKNOWN`, `REASONABLE`, `CONFIRMED`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.temporal_severity` | Severity band of the CVSS 3.0 temporal score. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.confidentiality_requirement` | CVSS 3.0 Confidentiality Requirement (CR), an environmental metric: how important confidentiality of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.integrity_requirement` | CVSS 3.0 Integrity Requirement (IR), an environmental metric: how important integrity of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.availability_requirement` | CVSS 3.0 Availability Requirement (AR), an environmental metric: how important availability of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_attack_vector` | CVSS 3.0 Modified Attack Vector (MAV), an environmental metric that overrides Attack Vector for a specific environment. Values: `NETWORK`, `ADJACENT_NETWORK`, `LOCAL`, `PHYSICAL`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_attack_complexity` | CVSS 3.0 Modified Attack Complexity (MAC), an environmental metric that overrides Attack Complexity for a specific environment. Values: `HIGH`, `LOW`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_privileges_required` | CVSS 3.0 Modified Privileges Required (MPR), an environmental metric that overrides Privileges Required for a specific environment. Values: `HIGH`, `LOW`, `NONE`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_user_interaction` | CVSS 3.0 Modified User Interaction (MUI), an environmental metric that overrides User Interaction for a specific environment. Values: `NONE`, `REQUIRED`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_scope` | CVSS 3.0 Modified Scope (MS), an environmental metric that overrides Scope for a specific environment. Values: `UNCHANGED`, `CHANGED`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_confidentiality_impact` | CVSS 3.0 Modified Confidentiality Impact (MC), an environmental metric that overrides Confidentiality Impact for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_integrity_impact` | CVSS 3.0 Modified Integrity Impact (MI), an environmental metric that overrides Integrity Impact for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.modified_availability_impact` | CVSS 3.0 Modified Availability Impact (MA), an environmental metric that overrides Availability Impact for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.environmental_severity` | Severity band of the CVSS 3.0 environmental score. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.source` | Who provided a CVSS 3.1 assessment of the CVE, identified by an email address or a UUID. A CVE can carry one CVSS 3.1 assessment per source. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-source/) |
| `metrics.cvss_metric_v31.type` | Role of a CVSS 3.1 assessment of the CVE. Values: `Primary`, `Secondary`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-type/) |
| `metrics.cvss_metric_v31.cvss_data.version` | CVSS version of the assessment; always `3.1` here. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-version/) |
| `metrics.cvss_metric_v31.cvss_data.vector_string` | The full CVSS 3.1 vector of the assessment, for example `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`; it encodes the individual metrics of the assessment. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-vector-string/) |
| `metrics.cvss_metric_v31.cvss_data.attack_vector` | CVSS 3.1 Attack Vector (AV): how an attacker reaches the vulnerable component. Values: `NETWORK`, `ADJACENT_NETWORK`, `LOCAL`, `PHYSICAL`. | [Example 1](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-attack-vector/)<br>[Example 2](/reference/vulnerability/search/examples/remote-unauthenticated-no-interaction/) |
| `metrics.cvss_metric_v31.cvss_data.attack_complexity` | CVSS 3.1 Attack Complexity (AC): how difficult the attack is to carry out. Values: `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-attack-complexity/) |
| `metrics.cvss_metric_v31.cvss_data.privileges_required` | CVSS 3.1 Privileges Required (PR): the level of privileges an attacker needs before the attack. Values: `NONE`, `LOW`, `HIGH`. | [Example 1](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-privileges-required/)<br>[Example 2](/reference/vulnerability/search/examples/remote-unauthenticated-no-interaction/) |
| `metrics.cvss_metric_v31.cvss_data.user_interaction` | CVSS 3.1 User Interaction (UI): whether a user other than the attacker must take part in the attack. Values: `NONE`, `REQUIRED`. | [Example 1](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-user-interaction/)<br>[Example 2](/reference/vulnerability/search/examples/remote-unauthenticated-no-interaction/) |
| `metrics.cvss_metric_v31.cvss_data.scope` | CVSS 3.1 Scope (S): whether a successful attack can affect components beyond the vulnerable one. Values: `UNCHANGED`, `CHANGED`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-scope/) |
| `metrics.cvss_metric_v31.cvss_data.confidentiality_impact` | CVSS 3.1 Confidentiality Impact (C): how much a successful attack affects the confidentiality of data. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-confidentiality-impact/) |
| `metrics.cvss_metric_v31.cvss_data.integrity_impact` | CVSS 3.1 Integrity Impact (I): how much a successful attack affects the integrity of data. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-integrity-impact/) |
| `metrics.cvss_metric_v31.cvss_data.availability_impact` | CVSS 3.1 Availability Impact (A): how much a successful attack affects the availability of the affected system. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-availability-impact/) |
| `metrics.cvss_metric_v31.cvss_data.base_severity` | Severity band of the CVSS 3.1 base score. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-base-severity/) |
| `metrics.cvss_metric_v31.cvss_data.exploit_code_maturity` | CVSS 3.1 Exploit Code Maturity (E), a temporal metric: how mature the exploit code or technique is. Values: `UNPROVEN`, `PROOF_OF_CONCEPT`, `FUNCTIONAL`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.remediation_level` | CVSS 3.1 Remediation Level (RL), a temporal metric: what kind of fix is available. Values: `OFFICIAL_FIX`, `TEMPORARY_FIX`, `WORKAROUND`, `UNAVAILABLE`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.report_confidence` | CVSS 3.1 Report Confidence (RC), a temporal metric: how far the existence of the vulnerability is confirmed. Values: `UNKNOWN`, `REASONABLE`, `CONFIRMED`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.temporal_severity` | Severity band of the CVSS 3.1 temporal score. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.confidentiality_requirement` | CVSS 3.1 Confidentiality Requirement (CR), an environmental metric: how important confidentiality of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.integrity_requirement` | CVSS 3.1 Integrity Requirement (IR), an environmental metric: how important integrity of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.availability_requirement` | CVSS 3.1 Availability Requirement (AR), an environmental metric: how important availability of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_attack_vector` | CVSS 3.1 Modified Attack Vector (MAV), an environmental metric that overrides Attack Vector for a specific environment. Values: `NETWORK`, `ADJACENT_NETWORK`, `LOCAL`, `PHYSICAL`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_attack_complexity` | CVSS 3.1 Modified Attack Complexity (MAC), an environmental metric that overrides Attack Complexity for a specific environment. Values: `HIGH`, `LOW`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_privileges_required` | CVSS 3.1 Modified Privileges Required (MPR), an environmental metric that overrides Privileges Required for a specific environment. Values: `HIGH`, `LOW`, `NONE`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_user_interaction` | CVSS 3.1 Modified User Interaction (MUI), an environmental metric that overrides User Interaction for a specific environment. Values: `NONE`, `REQUIRED`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_scope` | CVSS 3.1 Modified Scope (MS), an environmental metric that overrides Scope for a specific environment. Values: `UNCHANGED`, `CHANGED`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_confidentiality_impact` | CVSS 3.1 Modified Confidentiality Impact (MC), an environmental metric that overrides Confidentiality Impact for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_integrity_impact` | CVSS 3.1 Modified Integrity Impact (MI), an environmental metric that overrides Integrity Impact for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.modified_availability_impact` | CVSS 3.1 Modified Availability Impact (MA), an environmental metric that overrides Availability Impact for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.environmental_severity` | Severity band of the CVSS 3.1 environmental score. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`; not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v40.source` | Who provided a CVSS 4.0 assessment of the CVE, identified by an email address or a UUID. A CVE can carry one CVSS 4.0 assessment per source. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-source/) |
| `metrics.cvss_metric_v40.type` | Role of a CVSS 4.0 assessment of the CVE. Values: `Primary`, `Secondary`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-type/) |
| `metrics.cvss_metric_v40.cvss_data.version` | CVSS version of the assessment; always `4.0` here. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-version/) |
| `metrics.cvss_metric_v40.cvss_data.vector_string` | The full CVSS 4.0 vector of the assessment, for example `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` followed by the threat, environmental and supplemental metrics (`X` when not defined). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-vector-string/) |
| `metrics.cvss_metric_v40.cvss_data.base_severity` | Severity band of the CVSS 4.0 base score. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-base-severity/) |
| `metrics.cvss_metric_v40.cvss_data.attack_vector` | CVSS 4.0 Attack Vector (AV): how an attacker reaches the vulnerable system. Values: `NETWORK`, `ADJACENT`, `LOCAL`, `PHYSICAL`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-attack-vector/) |
| `metrics.cvss_metric_v40.cvss_data.attack_complexity` | CVSS 4.0 Attack Complexity (AC): how difficult the attack is to carry out. Values: `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-attack-complexity/) |
| `metrics.cvss_metric_v40.cvss_data.attack_requirements` | CVSS 4.0 Attack Requirements (AT): whether the attack depends on conditions of the vulnerable system that the attacker does not control. Values: `NONE`, `PRESENT`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-attack-requirements/) |
| `metrics.cvss_metric_v40.cvss_data.privileges_required` | CVSS 4.0 Privileges Required (PR): the level of privileges an attacker needs before the attack. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-privileges-required/) |
| `metrics.cvss_metric_v40.cvss_data.user_interaction` | CVSS 4.0 User Interaction (UI): whether and how a user other than the attacker must take part in the attack. Values: `NONE`, `PASSIVE`, `ACTIVE`. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-user-interaction/) |
| `metrics.cvss_metric_v40.cvss_data.vulnerable_system_confidentiality` | CVSS 4.0 Vulnerable System Confidentiality (VC): impact of a successful attack on the confidentiality of the vulnerable system. Values: `NONE`, `LOW`, `HIGH`; rarely filled, and for most CVSS 4.0 assessments the value appears only in `vector_string` (as `VC`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) |
| `metrics.cvss_metric_v40.cvss_data.vulnerable_system_integrity` | CVSS 4.0 Vulnerable System Integrity (VI): impact of a successful attack on the integrity of the vulnerable system. Values: `NONE`, `LOW`, `HIGH`; rarely filled, and for most CVSS 4.0 assessments the value appears only in `vector_string` (as `VI`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) |
| `metrics.cvss_metric_v40.cvss_data.vulnerable_system_availability` | CVSS 4.0 Vulnerable System Availability (VA): impact of a successful attack on the availability of the vulnerable system. Values: `NONE`, `LOW`, `HIGH`; rarely filled, and for most CVSS 4.0 assessments the value appears only in `vector_string` (as `VA`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) |
| `metrics.cvss_metric_v40.cvss_data.subsequent_system_confidentiality` | CVSS 4.0 Subsequent System Confidentiality (SC): impact of a successful attack on the confidentiality of other systems beyond the vulnerable one. Values: `NONE`, `LOW`, `HIGH`; rarely filled, and for most CVSS 4.0 assessments the value appears only in `vector_string` (as `SC`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) |
| `metrics.cvss_metric_v40.cvss_data.subsequent_system_integrity` | CVSS 4.0 Subsequent System Integrity (SI): impact of a successful attack on the integrity of other systems beyond the vulnerable one. Values: `NONE`, `LOW`, `HIGH`; rarely filled, and for most CVSS 4.0 assessments the value appears only in `vector_string` (as `SI`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) |
| `metrics.cvss_metric_v40.cvss_data.subsequent_system_availability` | CVSS 4.0 Subsequent System Availability (SA): impact of a successful attack on the availability of other systems beyond the vulnerable one. Values: `NONE`, `LOW`, `HIGH`; rarely filled, and for most CVSS 4.0 assessments the value appears only in `vector_string` (as `SA`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-impact/) |
| `metrics.cvss_metric_v40.cvss_data.exploit_maturity` | CVSS 4.0 Exploit Maturity (E), a threat metric: how likely the vulnerability is to be attacked, based on known exploits and attacks. Values: `UNREPORTED`, `PROOF_OF_CONCEPT`, `ATTACKED`, `NOT_DEFINED` (stored when the vector has `E:X`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-exploit-maturity/) |
| `metrics.cvss_metric_v40.cvss_data.confidentiality_requirements` | CVSS 4.0 Confidentiality Requirement (CR), an environmental metric: how important confidentiality of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.integrity_requirements` | CVSS 4.0 Integrity Requirement (IR), an environmental metric: how important integrity of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.availability_requirements` | CVSS 4.0 Availability Requirement (AR), an environmental metric: how important availability of the affected asset is to the organization. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.modified_attack_vector` | CVSS 4.0 Modified Attack Vector (MAV), an environmental metric that overrides Attack Vector for a specific environment. Values: `NETWORK`, `ADJACENT`, `LOCAL`, `PHYSICAL`, `NOT_DEFINED`; usually `NOT_DEFINED` (`MAV:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-modified/) |
| `metrics.cvss_metric_v40.cvss_data.modified_attack_complexity` | CVSS 4.0 Modified Attack Complexity (MAC), an environmental metric that overrides Attack Complexity for a specific environment. Values: `HIGH`, `LOW`, `NOT_DEFINED`; usually `NOT_DEFINED` (`MAC:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-modified/) |
| `metrics.cvss_metric_v40.cvss_data.modified_attack_requirements` | CVSS 4.0 Modified Attack Requirements (MAT), an environmental metric that overrides Attack Requirements for a specific environment. Values: `NONE`, `PRESENT`, `NOT_DEFINED`; usually `NOT_DEFINED` (`MAT:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-modified/) |
| `metrics.cvss_metric_v40.cvss_data.modified_privileges_required` | CVSS 4.0 Modified Privileges Required (MPR), an environmental metric that overrides Privileges Required for a specific environment. Values: `HIGH`, `LOW`, `NONE`, `NOT_DEFINED`; usually `NOT_DEFINED` (`MPR:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-modified/) |
| `metrics.cvss_metric_v40.cvss_data.modified_user_interaction` | CVSS 4.0 Modified User Interaction (MUI), an environmental metric that overrides User Interaction for a specific environment. Values: `NONE`, `PASSIVE`, `ACTIVE`, `NOT_DEFINED`; usually `NOT_DEFINED` (`MUI:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-modified/) |
| `metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_confidentiality` | CVSS 4.0 Modified Vulnerable System Confidentiality (MVC), an environmental metric that overrides Vulnerable System Confidentiality for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_integrity` | CVSS 4.0 Modified Vulnerable System Integrity (MVI), an environmental metric that overrides Vulnerable System Integrity for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.modified_vulnerable_system_availability` | CVSS 4.0 Modified Vulnerable System Availability (MVA), an environmental metric that overrides Vulnerable System Availability for a specific environment. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_confidentiality` | CVSS 4.0 Modified Subsequent System Confidentiality (MSC), an environmental metric that overrides Subsequent System Confidentiality for a specific environment. Values: `NEGLIGIBLE`, `LOW`, `HIGH`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_integrity` | CVSS 4.0 Modified Subsequent System Integrity (MSI), an environmental metric that overrides Subsequent System Integrity for a specific environment. Values: `NEGLIGIBLE`, `LOW`, `HIGH`, `SAFETY`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.modified_subsequent_system_availability` | CVSS 4.0 Modified Subsequent System Availability (MSA), an environmental metric that overrides Subsequent System Availability for a specific environment. Values: `NEGLIGIBLE`, `LOW`, `HIGH`, `SAFETY`, `NOT_DEFINED`; rarely filled. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.safety` | CVSS 4.0 Safety (S), a supplemental metric: whether exploitation can affect human safety. Values: `NEGLIGIBLE`, `PRESENT`, `NOT_DEFINED`; rarely filled, and `vector_string` usually has `S:X` (not defined). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.automatable` | CVSS 4.0 Automatable (AU), a supplemental metric: whether an attacker can automate exploitation across many targets. Values: `NO`, `YES`, `NOT_DEFINED`; rarely filled, and `vector_string` usually has `AU:X` (not defined). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.recovery` | CVSS 4.0 Recovery (R), a supplemental metric: how the system recovers after an attack. Values: `AUTOMATIC`, `USER`, `IRRECOVERABLE`, `NOT_DEFINED`; rarely filled, and `vector_string` usually has `R:X` (not defined). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-supplemental/) |
| `metrics.cvss_metric_v40.cvss_data.value_density` | CVSS 4.0 Value Density (V), a supplemental metric: whether the resources an attacker gains control of are diffuse or concentrated. Values: `DIFFUSE`, `CONCENTRATED`, `NOT_DEFINED`; usually `NOT_DEFINED` (`V:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-value-density/) |
| `metrics.cvss_metric_v40.cvss_data.vulnerability_response_effort` | CVSS 4.0 Vulnerability Response Effort (RE), a supplemental metric: how much effort it takes to respond to the vulnerability. Values: `LOW`, `MODERATE`, `HIGH`, `NOT_DEFINED`; usually `NOT_DEFINED` (`RE:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-vulnerability-response-effort/) |
| `metrics.cvss_metric_v40.cvss_data.provider_urgency` | CVSS 4.0 Provider Urgency (U), a supplemental metric: the urgency the provider assigns to the vulnerability. Values: `CLEAR`, `GREEN`, `AMBER`, `RED`, `NOT_DEFINED`; usually `NOT_DEFINED` (`U:X` in the vector). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-provider-urgency/) |
| `weaknesses.source` | Who assigned a weakness (CWE) to the CVE, identified by an email address or a UUID. | [Example](/reference/vulnerability/search/examples/weaknesses-source/) |
| `weaknesses.type` | Role of a weakness entry of the CVE. Values: `Primary`, `Secondary`. | [Example](/reference/vulnerability/search/examples/weaknesses-type/) |
| `weaknesses.description.lang` | Language code of a weakness entry; `en` in all data seen. | [Example](/reference/vulnerability/search/examples/weaknesses-description-lang/) |
| `weaknesses.description.value` | The weakness itself: a CWE ID such as `CWE-94`, or `NVD-CWE-noinfo` (not enough information) or `NVD-CWE-Other` (no specific CWE fits). | [Example](/reference/vulnerability/search/examples/weaknesses-description-value/) |
| `configurations.operator` | Operator that joins the nodes of one applicability configuration (a product combination the CVE applies to): `AND` or `OR`. Set only when the configuration has more than one node; `AND` in all data seen. | [Example](/reference/vulnerability/search/examples/configurations-operator/) |
| `configurations.nodes.operator` | Operator that joins the CPE matches inside a configuration node: `AND` or `OR`; `OR` in all data seen. | [Example](/reference/vulnerability/search/examples/configurations-nodes-operator/) |
| `configurations.nodes.cpe_match.criteria` | CPE 2.3 match string of a product in the configuration, for example `cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*`. | [Example](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-criteria/) |
| `configurations.nodes.cpe_match.match_criteria_id` | Unique identifier (UUID) of the CPE match criterion. | [Example](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-match-criteria-id/) |
| `configurations.nodes.cpe_match.version_start_including` | Start of the affected version range of the CPE match, inclusive: this version and later ones are affected. | [Example](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-start-including/) |
| `configurations.nodes.cpe_match.version_start_excluding` | Start of the affected version range of the CPE match, exclusive: versions after this one are affected. | [Example](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-start-excluding/) |
| `configurations.nodes.cpe_match.version_end_including` | End of the affected version range of the CPE match, inclusive: this version and earlier ones are affected. | [Example](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-end-including/) |
| `configurations.nodes.cpe_match.version_end_excluding` | End of the affected version range of the CPE match, exclusive: versions before this one are affected. | [Example](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-version-end-excluding/) |
| `enrichment.cpe.criteria` | CPE 2.3 match string of a product the CVE applies to, in Deepinfo's product list for the CVE (built from the CPE matches in `configurations`). | [Example](/reference/vulnerability/search/examples/enrichment-cpe-criteria/) |
| `enrichment.cpe.vendor` | Vendor of a product the CVE applies to, as written in its CPE (lower case, for example `adobe` or `cisco`). | [Example 1](/reference/vulnerability/search/examples/enrichment-cpe-vendor/)<br>[Example 2](/reference/vulnerability/search/examples/moveit-except-cve-2023-34362/)<br>[Example 3](/reference/vulnerability/search/examples/microsoft-2024-high-epss/)<br>[Example 4](/reference/vulnerability/search/examples/sort-base-score/)<br>[Example 5](/reference/vulnerability/search/examples/sort-base-severity/) |
| `enrichment.cpe.product` | Product the CVE applies to, as written in its CPE (lower case with underscores, for example `linux_kernel`). | [Example 1](/reference/vulnerability/search/examples/enrichment-cpe-product/)<br>[Example 2](/reference/vulnerability/search/examples/moveit-except-cve-2023-34362/)<br>[Example 3](/reference/vulnerability/search/examples/sort-id/)<br>[Example 4](/reference/vulnerability/search/examples/sort-base-score/)<br>[Example 5](/reference/vulnerability/search/examples/sort-base-severity/) |
| `enrichment.cpe.product_type` | Kind of product, from the CPE part. Values: `a` (application), `h` (hardware), `o` (operating system). | [Example](/reference/vulnerability/search/examples/enrichment-cpe-product-type/) |
| `enrichment.cpe.version_start_including` | Start of the product's affected version range, inclusive: this version and later ones are affected. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-version-start-including/) |
| `enrichment.cpe.version_start_excluding` | Start of the product's affected version range, exclusive: versions after this one are affected. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-version-start-excluding/) |
| `enrichment.cpe.version_end_including` | End of the product's affected version range, inclusive: this version and earlier ones are affected. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-version-end-including/) |
| `enrichment.cpe.version_end_excluding` | End of the product's affected version range, exclusive: versions before this one are affected. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-version-end-excluding/) |
| `enrichment.cpe.affected_versions_first` | First affected version of the product; together with `affected_versions_last` it gives the version range the platform shows (for example v1.5.0 - v1.7.0). | [Example](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-first/) |
| `enrichment.cpe.affected_versions_last` | Last affected version of the product; together with `affected_versions_first` it gives the version range the platform shows (for example v1.5.0 - v1.7.0). | [Example](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-last/) |
| `enrichment.cpe.cpe_names.cpe_name` | A concrete CPE 2.3 name covered by the product's match string. You can filter on it, but only GET /discovery/vulnerability-detail returns it; search results leave it out. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-cpe-names-cpe-name/) |
| `enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of the weakness. Values: `A01 Broken Access Control`, `A02 Cryptographic Failures`, `A03 Injection`, `A04 Insecure Design`, `A05 Security Misconfiguration`, `A06 Vulnerable and Outdated Components`, `A07 Identification and Authentication Failures`, `A08 Software and Data Integrity Failures`, `A09 Security Logging and Monitoring Failures`, `A10 Server-Side Request Forgery (SSRF)`. | [Example](/reference/vulnerability/search/examples/enrichment-cwe-owasptop10-2021/) |
| `enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Microsoft`. | [Example 1](/reference/vulnerability/search/examples/enrichment-cisa-kev-vendor-project/)<br>[Example 2](/reference/vulnerability/search/examples/sort-enrichment-cpe-product/) |
| `enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Kernel` or `Multiple Products`. | [Example](/reference/vulnerability/search/examples/enrichment-cisa-kev-product/) |
| `enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE is known to be used in ransomware campaigns, according to CISA KEV. Values: `Known`, `Unknown`. | [Example 1](/reference/vulnerability/search/examples/enrichment-cisa-kev-known-ransomware-campaign-use/)<br>[Example 2](/reference/vulnerability/search/examples/ransomware-kev-2026/) |
| `enrichment.vdeep_metric.source` | Source of the CVE's main CVSS assessment (copied from the highest CVSS version available), as an email address or a UUID; the platform shows it as CVE ORIGIN. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-source/) |
| `enrichment.vdeep_metric.type` | Role of the CVE's main CVSS assessment: `Primary` or `Secondary`. When the highest CVSS version has both, the Primary one is used. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-type/) |
| `enrichment.vdeep_metric.cvss_data.version` | CVSS version of the CVE's main CVSS assessment, the highest version available. Values: `2.0`, `3.0`, `3.1`, `4.0`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-version/) |
| `enrichment.vdeep_metric.cvss_data.vector_string` | CVSS vector of the CVE's main CVSS assessment, in the format of its version (for example `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`). | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vector-string/) |
| `enrichment.vdeep_metric.cvss_data.attack_vector` | Attack vector of the CVE's main CVSS assessment (Access Vector for CVSS 2.0). Values: `NETWORK`, `ADJACENT_NETWORK`, `ADJACENT`, `LOCAL`, `PHYSICAL`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-vector/) |
| `enrichment.vdeep_metric.cvss_data.attack_complexity` | Attack complexity of the CVE's main CVSS assessment (Access Complexity for CVSS 2.0). Values: `LOW`, `MEDIUM`, `HIGH`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-complexity/) |
| `enrichment.vdeep_metric.cvss_data.attack_requirements` | Attack Requirements (AT) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0. Values: `NONE`, `PRESENT`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-requirements/) |
| `enrichment.vdeep_metric.cvss_data.privileges_required` | Privileges required by the CVE's main CVSS assessment; empty when it is CVSS 2.0. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-privileges-required/) |
| `enrichment.vdeep_metric.cvss_data.user_interaction` | User interaction of the CVE's main CVSS assessment; empty when it is CVSS 2.0. Values: `NONE`, `REQUIRED` (CVSS 3.x) or `NONE`, `PASSIVE`, `ACTIVE` (CVSS 4.0). | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-user-interaction/) |
| `enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: the Confidentiality Impact of a CVSS 2.0 or 3.x assessment (`NONE`, `PARTIAL`, `COMPLETE` or `NONE`, `LOW`, `HIGH`), or VC of a CVSS 4.0 one, which is rarely filled. The platform shows it in the C/I/A classification. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-confidentiality/) |
| `enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: the Integrity Impact of a CVSS 2.0 or 3.x assessment (`NONE`, `PARTIAL`, `COMPLETE` or `NONE`, `LOW`, `HIGH`), or VI of a CVSS 4.0 one, which is rarely filled. The platform shows it in the C/I/A classification. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-integrity/) |
| `enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: the Availability Impact of a CVSS 2.0 or 3.x assessment (`NONE`, `PARTIAL`, `COMPLETE` or `NONE`, `LOW`, `HIGH`), or VA of a CVSS 4.0 one, which is rarely filled. The platform shows it in the C/I/A classification. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerable-system-availability/) |
| `enrichment.vdeep_metric.cvss_data.subsequent_system_confidentiality` | Subsequent System Confidentiality (SC) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-subsequent-system/) |
| `enrichment.vdeep_metric.cvss_data.subsequent_system_integrity` | Subsequent System Integrity (SI) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-subsequent-system/) |
| `enrichment.vdeep_metric.cvss_data.subsequent_system_availability` | Subsequent System Availability (SA) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NONE`, `LOW`, `HIGH`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-subsequent-system/) |
| `enrichment.vdeep_metric.cvss_data.exploit_maturity` | Exploit Maturity (E) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0. Values: `UNREPORTED`, `PROOF_OF_CONCEPT`, `ATTACKED`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-exploit-maturity/) |
| `enrichment.vdeep_metric.cvss_data.confidentiality_requirements` | Confidentiality Requirement (CR) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.integrity_requirements` | Integrity Requirement (IR) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.availability_requirements` | Availability Requirement (AR) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `LOW`, `MEDIUM`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.modified_attack_vector` | Modified Attack Vector (MAV) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `NETWORK`, `ADJACENT`, `LOCAL`, `PHYSICAL`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-modified/) |
| `enrichment.vdeep_metric.cvss_data.modified_attack_complexity` | Modified Attack Complexity (MAC) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `HIGH`, `LOW`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-modified/) |
| `enrichment.vdeep_metric.cvss_data.modified_attack_requirements` | Modified Attack Requirements (MAT) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `NONE`, `PRESENT`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-modified/) |
| `enrichment.vdeep_metric.cvss_data.modified_privileges_required` | Modified Privileges Required (MPR) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `HIGH`, `LOW`, `NONE`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-modified/) |
| `enrichment.vdeep_metric.cvss_data.modified_user_interaction` | Modified User Interaction (MUI) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `NONE`, `PASSIVE`, `ACTIVE`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-modified/) |
| `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_confidentiality` | Modified Vulnerable System Confidentiality (MVC) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_integrity` | Modified Vulnerable System Integrity (MVI) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_availability` | Modified Vulnerable System Availability (MVA) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NONE`, `LOW`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_confidentiality` | Modified Subsequent System Confidentiality (MSC) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NEGLIGIBLE`, `LOW`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_integrity` | Modified Subsequent System Integrity (MSI) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NEGLIGIBLE`, `LOW`, `HIGH`, `SAFETY`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_availability` | Modified Subsequent System Availability (MSA) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NEGLIGIBLE`, `LOW`, `HIGH`, `SAFETY`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.safety` | Safety (S) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NEGLIGIBLE`, `PRESENT`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.automatable` | Automatable (AU) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `NO`, `YES`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.recovery` | Recovery (R) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, and rarely even then. Values: `AUTOMATIC`, `USER`, `IRRECOVERABLE`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-supplemental/) |
| `enrichment.vdeep_metric.cvss_data.value_density` | Value Density (V) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `DIFFUSE`, `CONCENTRATED`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-value-density/) |
| `enrichment.vdeep_metric.cvss_data.vulnerability_response_effort` | Vulnerability Response Effort (RE) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `LOW`, `MODERATE`, `HIGH`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vulnerability-response-effort/) |
| `enrichment.vdeep_metric.cvss_data.provider_urgency` | Provider Urgency (U) of the CVE's main CVSS assessment; filled only when it is CVSS 4.0, usually `NOT_DEFINED`. Values: `CLEAR`, `GREEN`, `AMBER`, `RED`, `NOT_DEFINED`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-provider-urgency/) |
| `enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` (`LOW`, `MEDIUM`, `HIGH` for CVSS 2.0); the platform shows it as the CVE's severity. | [Example 1](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-base-severity/)<br>[Example 2](/reference/vulnerability/search/examples/kev-critical-high-epss/) |

Operators: `eq`, `gt`, `gte`, `lt`, `lte`, `exists`

| Field | Description | Example |
|---|---|---|
| `published` | Date and time the CVE was first published, in ISO 8601 UTC (for example `2026-06-30T16:16:54Z`). | [Example 1](/reference/vulnerability/search/examples/published/)<br>[Example 2](/reference/vulnerability/search/examples/operator-lt/)<br>[Example 3](/reference/vulnerability/search/examples/microsoft-2024-high-epss/)<br>[Example 4](/reference/vulnerability/search/examples/sqli-or-command-injection-recent/)<br>[Example 5](/reference/vulnerability/search/examples/sort-enrichment-cpe-vendor/)<br>[Example 6](/reference/vulnerability/search/examples/sort-epss/)<br>[Example 7](/reference/vulnerability/search/examples/page-400/) |
| `last_modified` | Date and time the CVE record was last changed, in ISO 8601 UTC (for example `2026-08-26T16:35:20Z`). | [Example](/reference/vulnerability/search/examples/last-modified/) |
| `cisa_exploit_add` | Date the CVE was added to the CISA Known Exploited Vulnerabilities (KEV) catalog (YYYY-MM-DD), as given in the CVE record. `enrichment.cisa_kev.date_added` holds the same date and is filled for a few more CVEs. | [Example](/reference/vulnerability/search/examples/cisa-exploit-add/) |
| `cisa_action_due` | Remediation due date from the CISA KEV catalog (YYYY-MM-DD), as given in the CVE record. `enrichment.cisa_kev.due_date` holds the same date and is filled for a few more CVEs. | [Example](/reference/vulnerability/search/examples/cisa-action-due/) |
| `metrics.cvss_metric_v2.cvss_data.base_score` | CVSS 2.0 base score of the assessment, from 0 to 10. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-base-score/) |
| `metrics.cvss_metric_v2.cvss_data.temporal_score` | CVSS 2.0 temporal score, from 0 to 10: the base score adjusted by the temporal metrics. Not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.cvss_data.environmental_score` | CVSS 2.0 environmental score, from 0 to 10: the score adjusted for a specific environment. Not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v2.exploitability_score` | CVSS 2.0 exploitability subscore, from 0 to 10: the part of the base score that comes from access vector, access complexity and authentication. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-exploitability-score/) |
| `metrics.cvss_metric_v2.impact_score` | CVSS 2.0 impact subscore, from 0 to 10: the part of the base score that comes from the confidentiality, integrity and availability impacts. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-impact-score/) |
| `metrics.cvss_metric_v30.cvss_data.base_score` | CVSS 3.0 base score of the assessment, from 0 to 10. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-cvss-data-base-score/) |
| `metrics.cvss_metric_v30.cvss_data.temporal_score` | CVSS 3.0 temporal score, from 0 to 10: the base score adjusted by the temporal metrics. Not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.cvss_data.environmental_score` | CVSS 3.0 environmental score, from 0 to 10: the score adjusted for a specific environment. Not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v30.exploitability_score` | CVSS 3.0 exploitability subscore: the part of the base score that comes from attack vector, attack complexity, privileges required and user interaction (for example `3.9`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-exploitability-score/) |
| `metrics.cvss_metric_v30.impact_score` | CVSS 3.0 impact subscore: the part of the base score that comes from the confidentiality, integrity and availability impacts (for example `5.9`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-impact-score/) |
| `metrics.cvss_metric_v31.cvss_data.base_score` | CVSS 3.1 base score of the assessment, from 0 to 10. | [Example 1](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-base-score/)<br>[Example 2](/reference/vulnerability/search/examples/remote-unauthenticated-no-interaction/) |
| `metrics.cvss_metric_v31.cvss_data.temporal_score` | CVSS 3.1 temporal score, from 0 to 10: the base score adjusted by the temporal metrics. Not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.cvss_data.environmental_score` | CVSS 3.1 environmental score, from 0 to 10: the score adjusted for a specific environment. Not filled for any CVE in the current data. |  |
| `metrics.cvss_metric_v31.exploitability_score` | CVSS 3.1 exploitability subscore: the part of the base score that comes from attack vector, attack complexity, privileges required and user interaction (for example `3.9`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-exploitability-score/) |
| `metrics.cvss_metric_v31.impact_score` | CVSS 3.1 impact subscore: the part of the base score that comes from the confidentiality, integrity and availability impacts (for example `5.9`). | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-impact-score/) |
| `metrics.cvss_metric_v40.cvss_data.base_score` | CVSS 4.0 base score of the assessment, from 0 to 10. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-base-score/) |
| `vendor_comments.last_modified` | Date and time the vendor comment was last changed, in ISO 8601 UTC. | [Example](/reference/vulnerability/search/examples/vendor-comments-last-modified/) |
| `enrichment.cwe.id` | Number of a CWE weakness linked to the CVE (for example `94` for CWE-94). `enrichment.cwe` adds CWE catalog details for each CWE listed in `weaknesses`. | [Example 1](/reference/vulnerability/search/examples/enrichment-cwe-id/)<br>[Example 2](/reference/vulnerability/search/examples/sqli-or-command-injection-recent/)<br>[Example 3](/reference/vulnerability/search/examples/sort-enrichment-cpe-vendor/) |
| `enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. | [Example 1](/reference/vulnerability/search/examples/enrichment-epss-score-epss/)<br>[Example 2](/reference/vulnerability/search/examples/kev-critical-high-epss/)<br>[Example 3](/reference/vulnerability/search/examples/microsoft-2024-high-epss/) |
| `enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). | [Example](/reference/vulnerability/search/examples/enrichment-epss-score-percentile/) |
| `enrichment.epss_score.date` | Date of the EPSS score (YYYY-MM-DD); the platform shows it as ANALYSIS DATE. | [Example](/reference/vulnerability/search/examples/enrichment-epss-score-date/) |
| `enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog (YYYY-MM-DD); empty for CVEs not in the catalog. The platform shows CISA KEV: YES when it is set. | [Example 1](/reference/vulnerability/search/examples/enrichment-cisa-kev-date-added/)<br>[Example 2](/reference/vulnerability/search/examples/operator-exists/)<br>[Example 3](/reference/vulnerability/search/examples/kev-critical-high-epss/)<br>[Example 4](/reference/vulnerability/search/examples/ransomware-kev-2026/)<br>[Example 5](/reference/vulnerability/search/examples/sort-published/)<br>[Example 6](/reference/vulnerability/search/examples/sort-cisa-kev-date-added/)<br>[Example 7](/reference/vulnerability/search/examples/page-2/)<br>[Example 8](/reference/vulnerability/search/examples/page-size-100/) |
| `enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry (YYYY-MM-DD), shown as REMEDIATION DUE; the results table marks CVEs that have it as EXPLOITABLE. | [Example](/reference/vulnerability/search/examples/enrichment-cisa-kev-due-date/) |
| `enrichment.vdeep_metric.cvss_data.base_score` | Base score, from 0 to 10, of the CVE's main CVSS assessment: the assessment of the highest CVSS version the CVE has. The platform shows it as the CVE's score. | [Example 1](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-base-score/)<br>[Example 2](/reference/vulnerability/search/examples/operator-gt/) |

Operators: `eq`, `startswith`, `wildcard`, `contains_any`, `contains_all`, `exists`

| Field | Description | Example |
|---|---|---|
| `evaluator_comment` | Free-text comment from the CVE's evaluator, such as a link to the matching CWE entry or a note on how the score applies to particular platforms or versions. Filled for few CVEs. | [Example](/reference/vulnerability/search/examples/evaluator-comment/) |
| `evaluator_solution` | Free-text note from the CVE's evaluator about the fix, often a link or a quote from an advisory. Filled for few CVEs. | [Example](/reference/vulnerability/search/examples/evaluator-solution/) |
| `evaluator_impact` | Free-text note from the CVE's evaluator about the impact or the affected products, often quoting an advisory. Filled for few CVEs. | [Example](/reference/vulnerability/search/examples/evaluator-impact/) |
| `cisa_required_action` | Action CISA requires for the CVE in the KEV catalog, as given in the CVE record, for example to apply updates per vendor instructions. Same text as `enrichment.cisa_kev.required_action`. | [Example](/reference/vulnerability/search/examples/cisa-required-action/) |
| `cisa_vulnerability_name` | Name of the vulnerability in the CISA KEV catalog, as given in the CVE record. Same text as `enrichment.cisa_kev.vulnerability_name`. | [Example](/reference/vulnerability/search/examples/cisa-vulnerability-name/) |
| `vendor_comments.organization` | Name of a vendor that commented on the CVE, for example `Red Hat` or `Oracle`. | [Example](/reference/vulnerability/search/examples/vendor-comments-organization/) |
| `vendor_comments.comment` | Text of the vendor's statement about the CVE. | [Example](/reference/vulnerability/search/examples/vendor-comments-comment/) |
| `enrichment.cwe.name` | Name of the CWE weakness, for example `Improper Access Control`. | [Example](/reference/vulnerability/search/examples/enrichment-cwe-name/) |
| `enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry. | [Example](/reference/vulnerability/search/examples/enrichment-cisa-kev-vulnerability-name/) |
| `enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the KEV entry. | [Example](/reference/vulnerability/search/examples/enrichment-cisa-kev-short-description/) |
| `enrichment.cisa_kev.required_action` | Action CISA requires in the KEV entry, for example to apply updates per vendor instructions. | [Example](/reference/vulnerability/search/examples/enrichment-cisa-kev-required-action/) |
| `enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, usually reference URLs separated by `;`. | [Example](/reference/vulnerability/search/examples/enrichment-cisa-kev-notes/) |

Operators: `eq`, `exists`

| Field | Description | Example |
|---|---|---|
| `metrics.cvss_metric_v2.ac_insuf_info` | Flag on a CVSS 2.0 assessment: `true` when there was not enough information to rate Access Complexity. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-ac-insuf-info/) |
| `metrics.cvss_metric_v2.obtain_all_privilege` | Flag on a CVSS 2.0 assessment: `true` when a successful attack gives the attacker all privileges on the affected system. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-obtain-all-privilege/) |
| `metrics.cvss_metric_v2.obtain_user_privilege` | Flag on a CVSS 2.0 assessment: `true` when a successful attack gives the attacker user-level privileges on the affected system. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-obtain-user-privilege/) |
| `metrics.cvss_metric_v2.obtain_other_privilege` | Flag on a CVSS 2.0 assessment: `true` when a successful attack gives the attacker other privileges on the affected system. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-obtain-other-privilege/) |
| `metrics.cvss_metric_v2.user_interaction_required` | Flag on a CVSS 2.0 assessment: `true` when exploitation needs a user to take some action. | [Example](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-user-interaction-required/) |
| `configurations.negate` | When `true`, the configuration's condition is negated. Not filled for any CVE in the current data. |  |
| `configurations.nodes.negate` | When `true`, the node matches products that do not meet its CPE matches; `false` in all data seen. | [Example](/reference/vulnerability/search/examples/configurations-nodes-negate/) |
| `configurations.nodes.cpe_match.vulnerable` | `true` when the product in this CPE match is vulnerable; `false` when it is only part of the configuration, such as the hardware a vulnerable firmware runs on. | [Example](/reference/vulnerability/search/examples/configurations-nodes-cpe-match-vulnerable/) |
| `enrichment.cpe.vulnerable` | `true` when the product is vulnerable; `false` when it is only part of an affected configuration, such as the hardware a vulnerable firmware runs on. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-vulnerable/) |
| `enrichment.cpe.cpe_names.deprecated` | `true` when that CPE name is deprecated in the CPE dictionary. You can filter on it, but only GET /discovery/vulnerability-detail returns it; search results leave it out. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-cpe-names-deprecated/) |

Operators: `eq`, `in`, `startswith`, `wildcard`, `exists`

| Field | Description | Example |
|---|---|---|
| `references.tags` | Tags that classify a reference. Values: `Vendor Advisory`, `Third Party Advisory`, `Patch`, `Exploit`, `VDB Entry`, `Mailing List`, `US Government Resource`, `Issue Tracking`, `Release Notes`, `Broken Link`, `Permissions Required`, `Product`, `Mitigation`, `Technical Description`, `Not Applicable`, `Press/Media Coverage`, `Tool Signature`, `URL Repurposed`. | [Example 1](/reference/vulnerability/search/examples/references-tags/)<br>[Example 2](/reference/vulnerability/search/examples/operator-in/) |
| `enrichment.cpe.affected_versions` | All affected versions of the product. You can filter on it, but only GET /discovery/vulnerability-detail returns it; search results leave it out. | [Example](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions/) |
| `enrichment.cwe.scope` | Security areas the weakness can affect, from the CWE entry. Values: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Accountability`, `Authentication`, `Authorization`, `Non-Repudiation`, `Other`. | [Example](/reference/vulnerability/search/examples/enrichment-cwe-scope/) |
| `enrichment.cwe.impact` | Technical impacts the weakness can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Application Data` or `DoS: Crash, Exit, or Restart`. | [Example](/reference/vulnerability/search/examples/enrichment-cwe-impact/) |
| `enrichment.cwe.detection_method` | Methods that can detect the weakness, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`. | [Example](/reference/vulnerability/search/examples/enrichment-cwe-detection-method/) |
| `enrichment.vdeep_metric.available_versions` | CVSS versions the CVE has assessments for, highest first. Values: `2.0`, `3.0`, `3.1`, `4.0`. | [Example](/reference/vulnerability/search/examples/enrichment-vdeep-metric-available-versions/) |

Operators: `wildcard`, `contains_any`, `contains_all`, `exists`

| Field | Description | Example |
|---|---|---|
| `descriptions.value` | Text of one of the CVE's descriptions, in the language given by `descriptions.lang`. For a rejected CVE it holds the rejection reason. | [Example 1](/reference/vulnerability/search/examples/descriptions-value/)<br>[Example 2](/reference/vulnerability/search/examples/operator-contains-any/)<br>[Example 3](/reference/vulnerability/search/examples/operator-contains-all/) |
| `enrichment.cwe.description` | The CWE catalog's description of the weakness. | [Example](/reference/vulnerability/search/examples/enrichment-cwe-description/) |

Operators: `eq`, `in`, `gt`, `gte`, `lt`, `lte`, `exists`

| Field | Description | Example |
|---|---|---|
| `enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to the weakness, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. | [Example](/reference/vulnerability/search/examples/enrichment-cwe-capec-id/) |

Operators: `eq`, `startswith`, `wildcard`, `gt`, `lt`, `exists`

| Field | Description | Example |
|---|---|---|
| `id` | The CVE identifier, in the form CVE-YYYY-NNNN with four to seven digits after the year (for example `CVE-2021-44228`). | [Example 1](/reference/vulnerability/search/examples/id/)<br>[Example 2](/reference/vulnerability/search/examples/operator-wildcard/)<br>[Example 3](/reference/vulnerability/search/examples/operator-startswith/)<br>[Example 4](/reference/vulnerability/search/examples/moveit-except-cve-2023-34362/) |

### Sortable Fields

Example: a worked example that sorts by the field, with the request and the response it returns.

| Field | Description | Example |
|---|---|---|
| `id` | The CVE identifier, in the form CVE-YYYY-NNNN with four to seven digits after the year (for example `CVE-2021-44228`). | [Example](/reference/vulnerability/search/examples/sort-id/) |
| `enrichment.cpe.vendor` | Vendor of a product the CVE applies to, as written in its CPE (lower case, for example `adobe` or `cisco`). | [Example](/reference/vulnerability/search/examples/sort-enrichment-cpe-vendor/) |
| `enrichment.cpe.product` | Product the CVE applies to, as written in its CPE (lower case with underscores, for example `linux_kernel`). | [Example](/reference/vulnerability/search/examples/sort-enrichment-cpe-product/) |
| `published` | Date and time the CVE was first published, in ISO 8601 UTC (for example `2026-06-30T16:16:54Z`). | [Example 1](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-obtain-other-privilege/)<br>[Example 2](/reference/vulnerability/search/examples/sort-published/) |
| `last_modified` | Date and time the CVE record was last changed, in ISO 8601 UTC (for example `2026-08-26T16:35:20Z`). | [Example](/reference/vulnerability/search/examples/sort-last-modified/) |
| `enrichment.vdeep_metric.cvss_data.base_score` | Base score, from 0 to 10, of the CVE's main CVSS assessment: the assessment of the highest CVSS version the CVE has. The platform shows it as the CVE's score. | [Example](/reference/vulnerability/search/examples/sort-base-score/) |
| `enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment. Values: `NONE`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` (`LOW`, `MEDIUM`, `HIGH` for CVSS 2.0); the platform shows it as the CVE's severity. | [Example](/reference/vulnerability/search/examples/sort-base-severity/) |
| `enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. | [Example](/reference/vulnerability/search/examples/sort-epss/) |
| `enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog (YYYY-MM-DD); empty for CVEs not in the catalog. The platform shows CISA KEV: YES when it is set. | [Example](/reference/vulnerability/search/examples/sort-cisa-kev-date-added/) |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].source_identifier` | string |  |
| `results[].published` | string | date-time |
| `results[].last_modified` | string | date-time |
| `results[].status` | string |  |
| `results[].evaluator_comment` | string |  |
| `results[].evaluator_solution` | string |  |
| `results[].evaluator_impact` | string |  |
| `results[].cisa_exploit_add` | string | date |
| `results[].cisa_action_due` | string | date |
| `results[].cisa_required_action` | string |  |
| `results[].cisa_vulnerability_name` | string |  |
| `results[].descriptions` | array of object |  |
| `results[].references` | array of object |  |
| `results[].metrics` | object |  |
| `results[].weaknesses` | array of object |  |
| `results[].configurations` | array of object |  |
| `results[].vendor_comments` | array of object |  |
| `results[].enrichment` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].source_identifier` | string |
| `results[].published` | string |
| `results[].last_modified` | string |
| `results[].status` | string |
| `results[].evaluator_comment` | null |
| `results[].evaluator_solution` | null |
| `results[].evaluator_impact` | null |
| `results[].cisa_exploit_add` | null |
| `results[].cisa_action_due` | null |
| `results[].cisa_required_action` | null |
| `results[].cisa_vulnerability_name` | null |
| `results[].descriptions` | array<object> |
| `results[].descriptions[].lang` | string |
| `results[].descriptions[].value` | string |
| `results[].references` | array<object> |
| `results[].references[].url` | string |
| `results[].references[].source` | string |
| `results[].references[].tags` | null |
| `results[].metrics` | object |
| `results[].metrics.cvss_metric_v40` | array<object> |
| `results[].metrics.cvss_metric_v40[].source` | string |
| `results[].metrics.cvss_metric_v40[].type` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data` | object |
| `results[].metrics.cvss_metric_v40[].cvss_data.version` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.vector_string` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.attack_vector` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.attack_complexity` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.attack_requirements` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.privileges_required` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.user_interaction` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.vulnerable_system_confidentiality` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.vulnerable_system_integrity` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.vulnerable_system_availability` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.subsequent_system_confidentiality` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.subsequent_system_integrity` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.subsequent_system_availability` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.exploit_maturity` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.confidentiality_requirements` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.integrity_requirements` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.availability_requirements` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_attack_vector` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_attack_complexity` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_attack_requirements` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_privileges_required` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_user_interaction` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_vulnerable_system_confidentiality` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_vulnerable_system_integrity` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_vulnerable_system_availability` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_subsequent_system_confidentiality` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_subsequent_system_integrity` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.modified_subsequent_system_availability` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.safety` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.automatable` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.recovery` | null |
| `results[].metrics.cvss_metric_v40[].cvss_data.value_density` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.vulnerability_response_effort` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.provider_urgency` | string |
| `results[].metrics.cvss_metric_v40[].cvss_data.base_score` | number |
| `results[].metrics.cvss_metric_v40[].cvss_data.base_severity` | string |
| `results[].metrics.cvss_metric_v31` | array<object> \| null |
| `results[].metrics.cvss_metric_v31[].source` | string |
| `results[].metrics.cvss_metric_v31[].type` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data` | object |
| `results[].metrics.cvss_metric_v31[].cvss_data.version` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.vector_string` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.attack_vector` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.attack_complexity` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.privileges_required` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.user_interaction` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.scope` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.confidentiality_impact` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.integrity_impact` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.availability_impact` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.base_score` | number |
| `results[].metrics.cvss_metric_v31[].cvss_data.base_severity` | string |
| `results[].metrics.cvss_metric_v31[].cvss_data.exploit_code_maturity` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.remediation_level` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.report_confidence` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.temporal_score` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.temporal_severity` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.confidentiality_requirement` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.integrity_requirement` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.availability_requirement` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_attack_vector` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_attack_complexity` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_privileges_required` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_user_interaction` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_scope` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_confidentiality_impact` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_integrity_impact` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.modified_availability_impact` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.environmental_score` | null |
| `results[].metrics.cvss_metric_v31[].cvss_data.environmental_severity` | null |
| `results[].metrics.cvss_metric_v31[].exploitability_score` | number |
| `results[].metrics.cvss_metric_v31[].impact_score` | number |
| `results[].metrics.cvss_metric_v30` | null |
| `results[].metrics.cvss_metric_v2` | null |
| `results[].weaknesses` | array<object> |
| `results[].weaknesses[].source` | string |
| `results[].weaknesses[].type` | string |
| `results[].weaknesses[].description` | array<object> |
| `results[].weaknesses[].description[].lang` | string |
| `results[].weaknesses[].description[].value` | string |
| `results[].configurations` | null |
| `results[].vendor_comments` | null |
| `results[].enrichment` | object |
| `results[].enrichment.cpe` | null |
| `results[].enrichment.cwe` | array<object> |
| `results[].enrichment.cwe[].id` | number |
| `results[].enrichment.cwe[].owasptop10_2021` | null |
| `results[].enrichment.cwe[].name` | string |
| `results[].enrichment.cwe[].description` | string |
| `results[].enrichment.cwe[].capec_id` | array<number> |
| `results[].enrichment.cwe[].scope` | array<string> |
| `results[].enrichment.cwe[].impact` | array<string> |
| `results[].enrichment.cwe[].detection_method` | array<string> \| null |
| `results[].enrichment.epss_score` | object |
| `results[].enrichment.epss_score.epss` | number |
| `results[].enrichment.epss_score.percentile` | number |
| `results[].enrichment.epss_score.date` | string |
| `results[].enrichment.cisa_kev` | null |
| `results[].enrichment.vdeep_metric` | object |
| `results[].enrichment.vdeep_metric.available_versions` | array<string> |
| `results[].enrichment.vdeep_metric.source` | string |
| `results[].enrichment.vdeep_metric.type` | string |
| `results[].enrichment.vdeep_metric.cvss_data` | object |
| `results[].enrichment.vdeep_metric.cvss_data.version` | string |
| `results[].enrichment.vdeep_metric.cvss_data.vector_string` | string |
| `results[].enrichment.vdeep_metric.cvss_data.attack_vector` | string |
| `results[].enrichment.vdeep_metric.cvss_data.attack_complexity` | string |
| `results[].enrichment.vdeep_metric.cvss_data.attack_requirements` | string |
| `results[].enrichment.vdeep_metric.cvss_data.privileges_required` | string |
| `results[].enrichment.vdeep_metric.cvss_data.user_interaction` | string |
| `results[].enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | null |
| `results[].enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | null |
| `results[].enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | null |
| `results[].enrichment.vdeep_metric.cvss_data.subsequent_system_confidentiality` | null |
| `results[].enrichment.vdeep_metric.cvss_data.subsequent_system_integrity` | null |
| `results[].enrichment.vdeep_metric.cvss_data.subsequent_system_availability` | null |
| `results[].enrichment.vdeep_metric.cvss_data.exploit_maturity` | string |
| `results[].enrichment.vdeep_metric.cvss_data.confidentiality_requirements` | null |
| `results[].enrichment.vdeep_metric.cvss_data.integrity_requirements` | null |
| `results[].enrichment.vdeep_metric.cvss_data.availability_requirements` | null |
| `results[].enrichment.vdeep_metric.cvss_data.modified_attack_vector` | string |
| `results[].enrichment.vdeep_metric.cvss_data.modified_attack_complexity` | string |
| `results[].enrichment.vdeep_metric.cvss_data.modified_attack_requirements` | string |
| `results[].enrichment.vdeep_metric.cvss_data.modified_privileges_required` | string |
| `results[].enrichment.vdeep_metric.cvss_data.modified_user_interaction` | string |
| `results[].enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_confidentiality` | null |
| `results[].enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_integrity` | null |
| `results[].enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_availability` | null |
| `results[].enrichment.vdeep_metric.cvss_data.modified_subsequent_system_confidentiality` | null |
| `results[].enrichment.vdeep_metric.cvss_data.modified_subsequent_system_integrity` | null |
| `results[].enrichment.vdeep_metric.cvss_data.modified_subsequent_system_availability` | null |
| `results[].enrichment.vdeep_metric.cvss_data.safety` | null |
| `results[].enrichment.vdeep_metric.cvss_data.automatable` | null |
| `results[].enrichment.vdeep_metric.cvss_data.recovery` | null |
| `results[].enrichment.vdeep_metric.cvss_data.value_density` | string |
| `results[].enrichment.vdeep_metric.cvss_data.vulnerability_response_effort` | string |
| `results[].enrichment.vdeep_metric.cvss_data.provider_urgency` | string |
| `results[].enrichment.vdeep_metric.cvss_data.base_score` | number |
| `results[].enrichment.vdeep_metric.cvss_data.base_severity` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/search.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/search/examples/


---

# Detail

URL: https://docs.deepinfo.com/reference/vulnerability/detail/

GET /discovery/vulnerability-detail: Returns full details of a CVE: description, CVSS, CWE, EPSS, KEV status, affected products (CPE) and references.

`GET https://api.deepinfo.com/v1/discovery/vulnerability-detail`

Returns full details of a CVE: description, CVSS, CWE, EPSS, KEV status, affected products (CPE) and references.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `cve` | Required |  | `CVE-2021-44228` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `source_identifier` | string |  |
| `published` | string | date-time |
| `last_modified` | string | date-time |
| `status` | string |  |
| `evaluator_comment` | string |  |
| `evaluator_solution` | string |  |
| `evaluator_impact` | string |  |
| `cisa_exploit_add` | string | date |
| `cisa_action_due` | string | date |
| `cisa_required_action` | string |  |
| `cisa_vulnerability_name` | string |  |
| `descriptions` | array of object |  |
| `references` | array of object |  |
| `metrics` | object |  |
| `weaknesses` | array of object |  |
| `configurations` | array of object |  |
| `vendor_comments` | array of object |  |
| `enrichment` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `source_identifier` | string |
| `published` | string |
| `last_modified` | string |
| `status` | string |
| `evaluator_comment` | null |
| `evaluator_solution` | null |
| `evaluator_impact` | null |
| `cisa_exploit_add` | string |
| `cisa_action_due` | string |
| `cisa_required_action` | string |
| `cisa_vulnerability_name` | string |
| `descriptions` | array<object> |
| `descriptions[].lang` | string |
| `descriptions[].value` | string |
| `references` | array<object> |
| `references[].url` | string |
| `references[].source` | string |
| `references[].tags` | array<string> |
| `metrics` | object |
| `metrics.cvss_metric_v40` | null |
| `metrics.cvss_metric_v31` | array<object> |
| `metrics.cvss_metric_v31[].source` | string |
| `metrics.cvss_metric_v31[].type` | string |
| `metrics.cvss_metric_v31[].cvss_data` | object |
| `metrics.cvss_metric_v31[].cvss_data.version` | string |
| `metrics.cvss_metric_v31[].cvss_data.vector_string` | string |
| `metrics.cvss_metric_v31[].cvss_data.attack_vector` | string |
| `metrics.cvss_metric_v31[].cvss_data.attack_complexity` | string |
| `metrics.cvss_metric_v31[].cvss_data.privileges_required` | string |
| `metrics.cvss_metric_v31[].cvss_data.user_interaction` | string |
| `metrics.cvss_metric_v31[].cvss_data.scope` | string |
| `metrics.cvss_metric_v31[].cvss_data.confidentiality_impact` | string |
| `metrics.cvss_metric_v31[].cvss_data.integrity_impact` | string |
| `metrics.cvss_metric_v31[].cvss_data.availability_impact` | string |
| `metrics.cvss_metric_v31[].cvss_data.base_score` | number |
| `metrics.cvss_metric_v31[].cvss_data.base_severity` | string |
| `metrics.cvss_metric_v31[].cvss_data.exploit_code_maturity` | null |
| `metrics.cvss_metric_v31[].cvss_data.remediation_level` | null |
| `metrics.cvss_metric_v31[].cvss_data.report_confidence` | null |
| `metrics.cvss_metric_v31[].cvss_data.temporal_score` | null |
| `metrics.cvss_metric_v31[].cvss_data.temporal_severity` | null |
| `metrics.cvss_metric_v31[].cvss_data.confidentiality_requirement` | null |
| `metrics.cvss_metric_v31[].cvss_data.integrity_requirement` | null |
| `metrics.cvss_metric_v31[].cvss_data.availability_requirement` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_attack_vector` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_attack_complexity` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_privileges_required` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_user_interaction` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_scope` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_confidentiality_impact` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_integrity_impact` | null |
| `metrics.cvss_metric_v31[].cvss_data.modified_availability_impact` | null |
| `metrics.cvss_metric_v31[].cvss_data.environmental_score` | null |
| `metrics.cvss_metric_v31[].cvss_data.environmental_severity` | null |
| `metrics.cvss_metric_v31[].exploitability_score` | number |
| `metrics.cvss_metric_v31[].impact_score` | number |
| `metrics.cvss_metric_v30` | null |
| `metrics.cvss_metric_v2` | array<object> |
| `metrics.cvss_metric_v2[].source` | string |
| `metrics.cvss_metric_v2[].type` | string |
| `metrics.cvss_metric_v2[].cvss_data` | object |
| `metrics.cvss_metric_v2[].cvss_data.version` | string |
| `metrics.cvss_metric_v2[].cvss_data.vector_string` | string |
| `metrics.cvss_metric_v2[].cvss_data.access_vector` | string |
| `metrics.cvss_metric_v2[].cvss_data.access_complexity` | string |
| `metrics.cvss_metric_v2[].cvss_data.authentication` | string |
| `metrics.cvss_metric_v2[].cvss_data.confidentiality_impact` | string |
| `metrics.cvss_metric_v2[].cvss_data.integrity_impact` | string |
| `metrics.cvss_metric_v2[].cvss_data.availability_impact` | string |
| `metrics.cvss_metric_v2[].cvss_data.base_score` | number |
| `metrics.cvss_metric_v2[].cvss_data.exploitability` | null |
| `metrics.cvss_metric_v2[].cvss_data.remediation_level` | null |
| `metrics.cvss_metric_v2[].cvss_data.report_confidence` | null |
| `metrics.cvss_metric_v2[].cvss_data.temporal_score` | null |
| `metrics.cvss_metric_v2[].cvss_data.collateral_damage_potential` | null |
| `metrics.cvss_metric_v2[].cvss_data.target_distribution` | null |
| `metrics.cvss_metric_v2[].cvss_data.confidentiality_requirement` | null |
| `metrics.cvss_metric_v2[].cvss_data.integrity_requirement` | null |
| `metrics.cvss_metric_v2[].cvss_data.availability_requirement` | null |
| `metrics.cvss_metric_v2[].cvss_data.environmental_score` | null |
| `metrics.cvss_metric_v2[].base_severity` | string |
| `metrics.cvss_metric_v2[].exploitability_score` | number |
| `metrics.cvss_metric_v2[].impact_score` | number |
| `metrics.cvss_metric_v2[].ac_insuf_info` | boolean |
| `metrics.cvss_metric_v2[].obtain_all_privilege` | boolean |
| `metrics.cvss_metric_v2[].obtain_user_privilege` | boolean |
| `metrics.cvss_metric_v2[].obtain_other_privilege` | boolean |
| `metrics.cvss_metric_v2[].user_interaction_required` | boolean |
| `weaknesses` | array<object> |
| `weaknesses[].source` | string |
| `weaknesses[].type` | string |
| `weaknesses[].description` | array<object> |
| `weaknesses[].description[].lang` | string |
| `weaknesses[].description[].value` | string |
| `configurations` | array<object> |
| `configurations[].operator` | string |
| `configurations[].negate` | null |
| `configurations[].nodes` | array<object> |
| `configurations[].nodes[].operator` | string |
| `configurations[].nodes[].negate` | boolean |
| `configurations[].nodes[].cpe_match` | array<object> |
| `configurations[].nodes[].cpe_match[].vulnerable` | boolean |
| `configurations[].nodes[].cpe_match[].criteria` | string |
| `configurations[].nodes[].cpe_match[].match_criteria_id` | string |
| `configurations[].nodes[].cpe_match[].version_start_including` | null |
| `configurations[].nodes[].cpe_match[].version_start_excluding` | null |
| `configurations[].nodes[].cpe_match[].version_end_including` | null |
| `configurations[].nodes[].cpe_match[].version_end_excluding` | string \| null |
| `vendor_comments` | null |
| `enrichment` | object |
| `enrichment.cpe` | array<object> |
| `enrichment.cpe[].criteria` | string |
| `enrichment.cpe[].vendor` | string |
| `enrichment.cpe[].product` | string |
| `enrichment.cpe[].product_type` | string |
| `enrichment.cpe[].vulnerable` | boolean |
| `enrichment.cpe[].version_start_including` | null |
| `enrichment.cpe[].version_start_excluding` | null |
| `enrichment.cpe[].version_end_including` | null |
| `enrichment.cpe[].version_end_excluding` | string \| null |
| `enrichment.cpe[].affected_versions_first` | null |
| `enrichment.cpe[].affected_versions_last` | null |
| `enrichment.cpe[].affected_versions` | array<string> |
| `enrichment.cpe[].cpe_names` | array<object> |
| `enrichment.cpe[].cpe_names[].cpe_name` | string |
| `enrichment.cpe[].cpe_names[].deprecated` | boolean |
| `enrichment.cwe` | array<object> |
| `enrichment.cwe[].id` | number |
| `enrichment.cwe[].owasptop10_2021` | string \| null |
| `enrichment.cwe[].name` | string |
| `enrichment.cwe[].description` | string |
| `enrichment.cwe[].capec_id` | array<number> |
| `enrichment.cwe[].scope` | array<string> |
| `enrichment.cwe[].impact` | array<string> |
| `enrichment.cwe[].detection_method` | array<string> |
| `enrichment.epss_score` | object |
| `enrichment.epss_score.epss` | number |
| `enrichment.epss_score.percentile` | number |
| `enrichment.epss_score.date` | string |
| `enrichment.cisa_kev` | object |
| `enrichment.cisa_kev.vendor_project` | string |
| `enrichment.cisa_kev.product` | string |
| `enrichment.cisa_kev.vulnerability_name` | string |
| `enrichment.cisa_kev.date_added` | string |
| `enrichment.cisa_kev.short_description` | string |
| `enrichment.cisa_kev.required_action` | string |
| `enrichment.cisa_kev.due_date` | string |
| `enrichment.cisa_kev.known_ransomware_campaign_use` | string |
| `enrichment.cisa_kev.notes` | string |
| `enrichment.vdeep_metric` | object |
| `enrichment.vdeep_metric.available_versions` | array<string> |
| `enrichment.vdeep_metric.source` | string |
| `enrichment.vdeep_metric.type` | string |
| `enrichment.vdeep_metric.cvss_data` | object |
| `enrichment.vdeep_metric.cvss_data.version` | string |
| `enrichment.vdeep_metric.cvss_data.vector_string` | string |
| `enrichment.vdeep_metric.cvss_data.attack_vector` | string |
| `enrichment.vdeep_metric.cvss_data.attack_complexity` | string |
| `enrichment.vdeep_metric.cvss_data.attack_requirements` | null |
| `enrichment.vdeep_metric.cvss_data.privileges_required` | string |
| `enrichment.vdeep_metric.cvss_data.user_interaction` | string |
| `enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | string |
| `enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | string |
| `enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | string |
| `enrichment.vdeep_metric.cvss_data.subsequent_system_confidentiality` | null |
| `enrichment.vdeep_metric.cvss_data.subsequent_system_integrity` | null |
| `enrichment.vdeep_metric.cvss_data.subsequent_system_availability` | null |
| `enrichment.vdeep_metric.cvss_data.exploit_maturity` | null |
| `enrichment.vdeep_metric.cvss_data.confidentiality_requirements` | null |
| `enrichment.vdeep_metric.cvss_data.integrity_requirements` | null |
| `enrichment.vdeep_metric.cvss_data.availability_requirements` | null |
| `enrichment.vdeep_metric.cvss_data.modified_attack_vector` | null |
| `enrichment.vdeep_metric.cvss_data.modified_attack_complexity` | null |
| `enrichment.vdeep_metric.cvss_data.modified_attack_requirements` | null |
| `enrichment.vdeep_metric.cvss_data.modified_privileges_required` | null |
| `enrichment.vdeep_metric.cvss_data.modified_user_interaction` | null |
| `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_confidentiality` | null |
| `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_integrity` | null |
| `enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_availability` | null |
| `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_confidentiality` | null |
| `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_integrity` | null |
| `enrichment.vdeep_metric.cvss_data.modified_subsequent_system_availability` | null |
| `enrichment.vdeep_metric.cvss_data.safety` | null |
| `enrichment.vdeep_metric.cvss_data.automatable` | null |
| `enrichment.vdeep_metric.cvss_data.recovery` | null |
| `enrichment.vdeep_metric.cvss_data.value_density` | null |
| `enrichment.vdeep_metric.cvss_data.vulnerability_response_effort` | null |
| `enrichment.vdeep_metric.cvss_data.provider_urgency` | null |
| `enrichment.vdeep_metric.cvss_data.base_score` | number |
| `enrichment.vdeep_metric.cvss_data.base_severity` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/detail.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/detail/examples/


---

# EPSS History

URL: https://docs.deepinfo.com/reference/vulnerability/epss-history/

GET /explore/vulnerability-insight/epss-history/{cve}: Returns the EPSS (exploit prediction) score history of a CVE.

`GET https://api.deepinfo.com/v1/explore/vulnerability-insight/epss-history/{cve}`

Returns the EPSS (exploit prediction) score history of a CVE.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `cve` | Required |  | `CVE-2021-44228` |

## Response Fields

| Field | Type |
|---|---|
| `cve` | string |
| `records` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `cve` | string |
| `records` | array<object> |
| `records[].epss` | number |
| `records[].percentile` | number |
| `records[].date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/epss-history.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/epss-history/examples/


---

# Finder

URL: https://docs.deepinfo.com/reference/vulnerability/finder/

GET /discovery/vulnerability-finder: Finds vulnerabilities that affect the technologies detected on a url.

`GET https://api.deepinfo.com/v1/discovery/vulnerability-finder`

Finds vulnerabilities that affect the technologies detected on a `url`.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `url` | Required | FQDN, IP or URL. |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `check_date` | string | date-time |
| `connection_status` | string |  |
| `url` | string |  |
| `redirection_history` | array of object |  |
| `technologies` | array of object |  |
| `vulnerability_stats` | object |  |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/finder.md


---

# Latest Added

URL: https://docs.deepinfo.com/reference/vulnerability/latest-added/

GET /explore/vulnerability-insight/latest-added-vulnerabilities-list: Lists the latest added CVEs.

`GET https://api.deepinfo.com/v1/explore/vulnerability-insight/latest-added-vulnerabilities-list`

Lists the latest added CVEs.

Optional filters:

- `vendor`
- `product`
- `version`
- `severity`

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `size` | Optional | Min `1`, max `100`. Default `10`. | `5` |
| `vendor` | Optional |  |  |
| `product` | Optional |  |  |
| `version` | Optional |  |  |
| `version__startswith` | Optional |  |  |
| `severity` | Optional |  |  |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `source_identifier` | string |  |
| `published` | string | date-time |
| `last_modified` | string | date-time |
| `status` | string |  |
| `evaluator_comment` | string |  |
| `evaluator_solution` | string |  |
| `evaluator_impact` | string |  |
| `cisa_exploit_add` | string | date |
| `cisa_action_due` | string | date |
| `cisa_required_action` | string |  |
| `cisa_vulnerability_name` | string |  |
| `descriptions` | array of object |  |
| `references` | array of object |  |
| `metrics` | object |  |
| `weaknesses` | array of object |  |
| `configurations` | array of object |  |
| `vendor_comments` | array of object |  |
| `enrichment` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].source_identifier` | string |
| `[].published` | string |
| `[].last_modified` | string |
| `[].status` | string |
| `[].evaluator_comment` | null |
| `[].evaluator_solution` | null |
| `[].evaluator_impact` | null |
| `[].cisa_exploit_add` | null |
| `[].cisa_action_due` | null |
| `[].cisa_required_action` | null |
| `[].cisa_vulnerability_name` | null |
| `[].descriptions` | array<object> |
| `[].descriptions[].lang` | string |
| `[].descriptions[].value` | string |
| `[].references` | array<object> |
| `[].references[].url` | string |
| `[].references[].source` | string |
| `[].references[].tags` | null |
| `[].metrics` | object |
| `[].metrics.cvss_metric_v40` | array<object> |
| `[].metrics.cvss_metric_v40[].source` | string |
| `[].metrics.cvss_metric_v40[].type` | string |
| `[].metrics.cvss_metric_v40[].cvss_data` | object |
| `[].metrics.cvss_metric_v40[].cvss_data.version` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.vector_string` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.attack_vector` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.attack_complexity` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.attack_requirements` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.privileges_required` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.user_interaction` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.vulnerable_system_confidentiality` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.vulnerable_system_integrity` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.vulnerable_system_availability` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.subsequent_system_confidentiality` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.subsequent_system_integrity` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.subsequent_system_availability` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.exploit_maturity` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.confidentiality_requirements` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.integrity_requirements` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.availability_requirements` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_attack_vector` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_attack_complexity` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_attack_requirements` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_privileges_required` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_user_interaction` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_vulnerable_system_confidentiality` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_vulnerable_system_integrity` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_vulnerable_system_availability` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_subsequent_system_confidentiality` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_subsequent_system_integrity` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.modified_subsequent_system_availability` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.safety` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.automatable` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.recovery` | null |
| `[].metrics.cvss_metric_v40[].cvss_data.value_density` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.vulnerability_response_effort` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.provider_urgency` | string |
| `[].metrics.cvss_metric_v40[].cvss_data.base_score` | number |
| `[].metrics.cvss_metric_v40[].cvss_data.base_severity` | string |
| `[].metrics.cvss_metric_v31` | null |
| `[].metrics.cvss_metric_v30` | null |
| `[].metrics.cvss_metric_v2` | null |
| `[].weaknesses` | array<object> |
| `[].weaknesses[].source` | string |
| `[].weaknesses[].type` | string |
| `[].weaknesses[].description` | array<object> |
| `[].weaknesses[].description[].lang` | string |
| `[].weaknesses[].description[].value` | string |
| `[].configurations` | null |
| `[].vendor_comments` | null |
| `[].enrichment` | object |
| `[].enrichment.cpe` | null |
| `[].enrichment.cwe` | array<object> |
| `[].enrichment.cwe[].id` | number |
| `[].enrichment.cwe[].owasptop10_2021` | string |
| `[].enrichment.cwe[].name` | string |
| `[].enrichment.cwe[].description` | string |
| `[].enrichment.cwe[].capec_id` | array<number> |
| `[].enrichment.cwe[].scope` | array<string> |
| `[].enrichment.cwe[].impact` | array<string> |
| `[].enrichment.cwe[].detection_method` | array<string> |
| `[].enrichment.epss_score` | null |
| `[].enrichment.cisa_kev` | null |
| `[].enrichment.vdeep_metric` | object |
| `[].enrichment.vdeep_metric.available_versions` | array<string> |
| `[].enrichment.vdeep_metric.source` | string |
| `[].enrichment.vdeep_metric.type` | string |
| `[].enrichment.vdeep_metric.cvss_data` | object |
| `[].enrichment.vdeep_metric.cvss_data.version` | string |
| `[].enrichment.vdeep_metric.cvss_data.vector_string` | string |
| `[].enrichment.vdeep_metric.cvss_data.attack_vector` | string |
| `[].enrichment.vdeep_metric.cvss_data.attack_complexity` | string |
| `[].enrichment.vdeep_metric.cvss_data.attack_requirements` | string |
| `[].enrichment.vdeep_metric.cvss_data.privileges_required` | string |
| `[].enrichment.vdeep_metric.cvss_data.user_interaction` | string |
| `[].enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | null |
| `[].enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | null |
| `[].enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | null |
| `[].enrichment.vdeep_metric.cvss_data.subsequent_system_confidentiality` | null |
| `[].enrichment.vdeep_metric.cvss_data.subsequent_system_integrity` | null |
| `[].enrichment.vdeep_metric.cvss_data.subsequent_system_availability` | null |
| `[].enrichment.vdeep_metric.cvss_data.exploit_maturity` | string |
| `[].enrichment.vdeep_metric.cvss_data.confidentiality_requirements` | null |
| `[].enrichment.vdeep_metric.cvss_data.integrity_requirements` | null |
| `[].enrichment.vdeep_metric.cvss_data.availability_requirements` | null |
| `[].enrichment.vdeep_metric.cvss_data.modified_attack_vector` | string |
| `[].enrichment.vdeep_metric.cvss_data.modified_attack_complexity` | string |
| `[].enrichment.vdeep_metric.cvss_data.modified_attack_requirements` | string |
| `[].enrichment.vdeep_metric.cvss_data.modified_privileges_required` | string |
| `[].enrichment.vdeep_metric.cvss_data.modified_user_interaction` | string |
| `[].enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_confidentiality` | null |
| `[].enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_integrity` | null |
| `[].enrichment.vdeep_metric.cvss_data.modified_vulnerable_system_availability` | null |
| `[].enrichment.vdeep_metric.cvss_data.modified_subsequent_system_confidentiality` | null |
| `[].enrichment.vdeep_metric.cvss_data.modified_subsequent_system_integrity` | null |
| `[].enrichment.vdeep_metric.cvss_data.modified_subsequent_system_availability` | null |
| `[].enrichment.vdeep_metric.cvss_data.safety` | null |
| `[].enrichment.vdeep_metric.cvss_data.automatable` | null |
| `[].enrichment.vdeep_metric.cvss_data.recovery` | null |
| `[].enrichment.vdeep_metric.cvss_data.value_density` | string |
| `[].enrichment.vdeep_metric.cvss_data.vulnerability_response_effort` | string |
| `[].enrichment.vdeep_metric.cvss_data.provider_urgency` | string |
| `[].enrichment.vdeep_metric.cvss_data.base_score` | number |
| `[].enrichment.vdeep_metric.cvss_data.base_severity` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/latest-added.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/latest-added/examples/


---

# CISA KEV Stats

URL: https://docs.deepinfo.com/reference/vulnerability/cisa-kev-stats/

GET /explore/vulnerability-insight/cisa-kev-stats: Statistics on the CISA Known Exploited Vulnerabilities catalog.

`GET https://api.deepinfo.com/v1/explore/vulnerability-insight/cisa-kev-stats`

Statistics on the CISA Known Exploited Vulnerabilities catalog.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `added_in_last_1_day` | integer |
| `added_in_last_7_days` | integer |
| `added_in_last_30_days` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `added_in_last_1_day` | number |
| `added_in_last_7_days` | number |
| `added_in_last_30_days` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/cisa-kev-stats.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/cisa-kev-stats/examples/


---

# CVE Stats

URL: https://docs.deepinfo.com/reference/vulnerability/cve-stats/

GET /explore/vulnerability-insight/cve-stats: Number of CVEs published in the last 1, 7, 30 and 365 days.

`GET https://api.deepinfo.com/v1/explore/vulnerability-insight/cve-stats`

Number of CVEs published in the last 1, 7, 30 and 365 days.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `published_in_last_1_day` | integer |
| `published_in_last_7_days` | integer |
| `published_in_last_30_days` | integer |
| `modified_in_last_1_day` | integer |
| `modified_in_last_7_days` | integer |
| `modified_in_last_30_days` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `published_in_last_1_day` | number |
| `published_in_last_7_days` | number |
| `published_in_last_30_days` | number |
| `modified_in_last_1_day` | number |
| `modified_in_last_7_days` | number |
| `modified_in_last_30_days` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/cve-stats.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/cve-stats/examples/


---

# CVSS Score Stats

URL: https://docs.deepinfo.com/reference/vulnerability/cvss-score-stats/

GET /explore/vulnerability-insight/vulnerability-stats-by-cvss-scores: Distribution of CVEs by CVSS score.

`GET https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-stats-by-cvss-scores`

Distribution of CVEs by CVSS score.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `vendor` | Optional |  |  |
| `product` | Optional |  |  |
| `version` | Optional |  |  |
| `version__startswith` | Optional |  |  |

## Response Fields

| Field | Type |
|---|---|
| `vendor` | string |
| `product` | string |
| `version` | string |
| `cve_count` | integer |
| `cve_count_by_score` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `vendor` | string |
| `product` | string |
| `version` | string |
| `cve_count` | number |
| `cve_count_by_score` | array<object> |
| `cve_count_by_score[].score` | number |
| `cve_count_by_score[].cve_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/cvss-score-stats.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/cvss-score-stats/examples/


---

# CWE Timeline

URL: https://docs.deepinfo.com/reference/vulnerability/cwe-timeline/

GET /explore/vulnerability-insight/cwe-timeline: Time series of CVEs per CWE (weakness type).

`GET https://api.deepinfo.com/v1/explore/vulnerability-insight/cwe-timeline`

Time series of CVEs per CWE (weakness type).

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `year` | integer |
| `cwe_stats` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].year` | number |
| `[].cwe_stats` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/cwe-timeline.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/cwe-timeline/examples/


---

# Severity by Year Stats

URL: https://docs.deepinfo.com/reference/vulnerability/severity-by-year-stats/

GET /explore/vulnerability-insight/vulnerability-severity-stats-by-year: CVE counts per severity and year.

`GET https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year`

CVE counts per severity and year.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `vendor` | Optional |  |  |
| `product` | Optional |  |  |
| `version` | Optional |  |  |
| `version__startswith` | Optional |  |  |

## Response Fields

| Field | Type |
|---|---|
| `vendor` | string |
| `product` | string |
| `version` | string |
| `cve_count` | integer |
| `cve_count_by_year` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `vendor` | string |
| `product` | string |
| `version` | string |
| `cve_count` | number |
| `cve_count_by_year` | array<object> |
| `cve_count_by_year[].year` | number |
| `cve_count_by_year[].cve_count` | number |
| `cve_count_by_year[].cve_count_by_severity` | object |
| `cve_count_by_year[].cve_count_by_severity.critical` | number |
| `cve_count_by_year[].cve_count_by_severity.high` | number |
| `cve_count_by_year[].cve_count_by_severity.medium` | number |
| `cve_count_by_year[].cve_count_by_severity.low` | number |
| `cve_count_by_year[].cve_count_by_severity.other` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/vulnerability/severity-by-year-stats.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/vulnerability/severity-by-year-stats/examples/


---

# Domain Intelligence

URL: https://docs.deepinfo.com/reference/domain-intelligence/

Global domain registration statistics.

Global domain registration statistics.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Keyword Stats](/reference/domain-intelligence/keyword-stats/) | `/explorer/domain-intelligence/keyword-stats` |
| GET | [Registration Stats](/reference/domain-intelligence/registration-stats/) | `/explorer/domain-intelligence/registration-stats` |
| GET | [Registration Timeline](/reference/domain-intelligence/registration-timeline/) | `/explorer/domain-intelligence/registration-timeline` |
| GET | [TLD Stats](/reference/domain-intelligence/tld-stats/) | `/explorer/domain-intelligence/tld-stats` |


---

# Keyword Stats

URL: https://docs.deepinfo.com/reference/domain-intelligence/keyword-stats/

GET /explorer/domain-intelligence/keyword-stats: Top keywords in newly registered domain names. Same parameters as TLD Stats. Can take several seconds.

`GET https://api.deepinfo.com/v1/explorer/domain-intelligence/keyword-stats`

Top keywords in newly registered domain names. Same parameters as TLD Stats. Can take several seconds.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `1`, `7`, `30`, `365`. |  |
| `size` | Optional | One of: `10`, `100`, `1000`, `10000`. Default `10`. | `10` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `keyword` | string |
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].keyword` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/domain-intelligence/keyword-stats.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/domain-intelligence/keyword-stats/examples/


---

# Registration Stats

URL: https://docs.deepinfo.com/reference/domain-intelligence/registration-stats/

GET /explorer/domain-intelligence/registration-stats: Number of domains registered in the last 1, 7, 30 and 365 days.

`GET https://api.deepinfo.com/v1/explorer/domain-intelligence/registration-stats`

Number of domains registered in the last 1, 7, 30 and 365 days.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `created_in_last_1_day` | integer |
| `created_in_last_7_days` | integer |
| `created_in_last_30_days` | integer |
| `created_in_last_365_days` | integer |
| `created_all_time` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `created_in_last_1_day` | number |
| `created_in_last_7_days` | number |
| `created_in_last_30_days` | number |
| `created_in_last_365_days` | number |
| `created_all_time` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/domain-intelligence/registration-stats.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/domain-intelligence/registration-stats/examples/


---

# Registration Timeline

URL: https://docs.deepinfo.com/reference/domain-intelligence/registration-timeline/

GET /explorer/domain-intelligence/registration-timeline: Daily registration counts for the last interval days (1–30).

`GET https://api.deepinfo.com/v1/explorer/domain-intelligence/registration-timeline`

Daily registration counts for the last `interval` days (1–30).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | Min `1`, max `30`. Default `7`. | `7` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/domain-intelligence/registration-timeline.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/domain-intelligence/registration-timeline/examples/


---

# TLD Stats

URL: https://docs.deepinfo.com/reference/domain-intelligence/tld-stats/

GET /explorer/domain-intelligence/tld-stats: Top TLDs by registrations. interval (days: 1, 7, 30, 365), size (10–10000).

`GET https://api.deepinfo.com/v1/explorer/domain-intelligence/tld-stats`

Top TLDs by registrations. `interval` (days: 1, 7, 30, 365), `size` (10–10000).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `1`, `7`, `30`, `365`. |  |
| `size` | Optional | One of: `10`, `100`, `1000`, `10000`. Default `10`. | `10` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `tld` | string |
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].tld` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/domain-intelligence/tld-stats.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/domain-intelligence/tld-stats/examples/


---

# Feeds

URL: https://docs.deepinfo.com/reference/feeds/

Download Deepinfo data feeds (all domains/subdomains, daily registered/updated/deleted domains, daily discovered subdomains).

Download Deepinfo data feeds (all domains/subdomains, daily registered/updated/deleted domains, daily discovered subdomains).

Each endpoint returns file metadata and a **pre-signed `download_url`**, valid for 1 hour. `file_format`: `json` (default) or `csv`.

| Method | Endpoint | Path |
|---|---|---|
| GET | [List](/reference/feeds/list/) | `/feeds/latest` |
| GET | [All Domains](/reference/feeds/all-domains/) | `/feeds/all-domains` |
| GET | [All Subdomains](/reference/feeds/all-subdomains/) | `/feeds/all-subdomains` |
| GET | [Daily Deleted Domains](/reference/feeds/daily-deleted-domains/) | `/feeds/daily-deleted-domains` |
| GET | [Daily Discovered Subdomains](/reference/feeds/daily-discovered-subdomains/) | `/feeds/daily-discovered-subdomains` |
| GET | [Daily Registered Domains](/reference/feeds/daily-registered-domains/) | `/feeds/daily-registered-domains` |
| GET | [Daily Updated Domains](/reference/feeds/daily-updated-domains/) | `/feeds/daily-updated-domains` |


---

# List

URL: https://docs.deepinfo.com/reference/feeds/list/

GET /feeds/latest: Lists every feed with its files (format, size, line count, update time) and the API URL to get each.

`GET https://api.deepinfo.com/v1/feeds/latest`

Lists every feed with its files (format, size, line count, update time) and the API URL to get each.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `type` | string |
| `files` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].type` | string |
| `[].files` | array<object> |
| `[].files[].file_format` | string |
| `[].files[].file_size` | number |
| `[].files[].file_update_time` | string |
| `[].files[].line_count` | number |
| `[].files[].api_url` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/feeds/list.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/feeds/list/examples/


---

# All Domains

URL: https://docs.deepinfo.com/reference/feeds/all-domains/

GET /feeds/all-domains: All registered domains Deepinfo knows about.

`GET https://api.deepinfo.com/v1/feeds/all-domains`

All registered domains Deepinfo knows about.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `file_format` | Optional | One of: `csv`, `json`. | `json` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `download_url` | string | uri |
| `file_format` | string | One of `csv`, `json` |
| `file_size` | integer |  |
| `file_update_time` | string | date-time |
| `line_count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `download_url` | string |
| `file_format` | string |
| `file_size` | number |
| `file_update_time` | string |
| `line_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/feeds/all-domains.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/feeds/all-domains/examples/


---

# All Subdomains

URL: https://docs.deepinfo.com/reference/feeds/all-subdomains/

GET /feeds/all-subdomains: All subdomains Deepinfo knows about.

`GET https://api.deepinfo.com/v1/feeds/all-subdomains`

All subdomains Deepinfo knows about.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `file_format` | Optional | One of: `csv`, `json`. | `json` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `download_url` | string | uri |
| `file_format` | string | One of `csv`, `json` |
| `file_size` | integer |  |
| `file_update_time` | string | date-time |
| `line_count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `download_url` | string |
| `file_format` | string |
| `file_size` | number |
| `file_update_time` | string |
| `line_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/feeds/all-subdomains.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/feeds/all-subdomains/examples/


---

# Daily Deleted Domains

URL: https://docs.deepinfo.com/reference/feeds/daily-deleted-domains/

GET /feeds/daily-deleted-domains: Domains deleted in the last day.

`GET https://api.deepinfo.com/v1/feeds/daily-deleted-domains`

Domains deleted in the last day.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `file_format` | Optional | One of: `csv`, `json`. | `json` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `download_url` | string | uri |
| `file_format` | string | One of `csv`, `json` |
| `file_size` | integer |  |
| `file_update_time` | string | date-time |
| `line_count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `download_url` | string |
| `file_format` | string |
| `file_size` | number |
| `file_update_time` | string |
| `line_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/feeds/daily-deleted-domains.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/feeds/daily-deleted-domains/examples/


---

# Daily Discovered Subdomains

URL: https://docs.deepinfo.com/reference/feeds/daily-discovered-subdomains/

GET /feeds/daily-discovered-subdomains: Subdomains discovered in the last day.

`GET https://api.deepinfo.com/v1/feeds/daily-discovered-subdomains`

Subdomains discovered in the last day.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `file_format` | Optional | One of: `csv`, `json`. | `json` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `download_url` | string | uri |
| `file_format` | string | One of `csv`, `json` |
| `file_size` | integer |  |
| `file_update_time` | string | date-time |
| `line_count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `download_url` | string |
| `file_format` | string |
| `file_size` | number |
| `file_update_time` | string |
| `line_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/feeds/daily-discovered-subdomains.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/feeds/daily-discovered-subdomains/examples/


---

# Daily Registered Domains

URL: https://docs.deepinfo.com/reference/feeds/daily-registered-domains/

GET /feeds/daily-registered-domains: Domains registered in the last day.

`GET https://api.deepinfo.com/v1/feeds/daily-registered-domains`

Domains registered in the last day.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `file_format` | Optional | One of: `csv`, `json`. | `csv` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `download_url` | string | uri |
| `file_format` | string | One of `csv`, `json` |
| `file_size` | integer |  |
| `file_update_time` | string | date-time |
| `line_count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `download_url` | string |
| `file_format` | string |
| `file_size` | number |
| `file_update_time` | string |
| `line_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/feeds/daily-registered-domains.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/feeds/daily-registered-domains/examples/


---

# Daily Updated Domains

URL: https://docs.deepinfo.com/reference/feeds/daily-updated-domains/

GET /feeds/daily-updated-domains: Domains whose registration was updated in the last day.

`GET https://api.deepinfo.com/v1/feeds/daily-updated-domains`

Domains whose registration was updated in the last day.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `file_format` | Optional | One of: `csv`, `json`. | `json` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `download_url` | string | uri |
| `file_format` | string | One of `csv`, `json` |
| `file_size` | integer |  |
| `file_update_time` | string | date-time |
| `line_count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `download_url` | string |
| `file_format` | string |
| `file_size` | number |
| `file_update_time` | string |
| `line_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/feeds/daily-updated-domains.md

## Worked Examples

Worked examples of this endpoint, each on its own page: https://docs.deepinfo.com/reference/feeds/daily-updated-domains/examples/


---

# External Attack Surface Management (EASM)

URL: https://docs.deepinfo.com/reference/easm/

External Attack Surface Management: your monitored assets (domains, subdomains, IPs, websites), what Deepinfo discovers around them, and the issues…

Your monitored **assets** (domains, subdomains, IPs, websites), what Deepinfo **discovers** around them, and the **issues**, **vulnerabilities** and **technologies** found on them.

## Assets

Add, search, update, tag and delete the assets you monitor, and trigger an on-demand scan.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Asset Search](/reference/easm/asset-search/) | `/easm/assets/search` |
| POST | [Asset Export](/reference/easm/asset-export/) | `/easm/assets/search:export` |
| GET | [Asset Detail](/reference/easm/asset-detail/) | `/easm/assets/{asset_id}` |
| POST | [Asset Create](/reference/easm/asset-create/) | `/easm/assets` |
| POST | [Asset Delete](/reference/easm/asset-delete/) | `/easm/assets/search:delete` |
| POST | [Asset Enable Discovery](/reference/easm/asset-enable-discovery/) | `/easm/assets/search:enable-discovery` |
| POST | [Asset Instant Scan](/reference/easm/asset-instant-scan/) | `/easm/assets/{asset_id}/instant-scan` |
| POST | [Asset Set Tag](/reference/easm/asset-set-tag/) | `/easm/assets/search:set-tag` |
| POST | [Asset Set Weight](/reference/easm/asset-set-weight/) | `/easm/assets/search:set-weight` |
| GET | [Asset Instant Scan Status](/reference/easm/asset-instant-scan-status/) | `/easm/assets/{asset_id}/instant-scan-status` |
| PUT | [Asset Update](/reference/easm/asset-update/) | `/easm/assets/{asset_id}` |
| DELETE | [Asset Remove Tag](/reference/easm/asset-remove-tag/) | `/easm/assets/{asset_id}/tags/{tag_id}` |

## Asset Tags

Tags you have put on assets. A tag is identified by its **name** (`{tag_id}` is the tag text).

| Method | Endpoint | Path |
|---|---|---|
| GET | [Asset Tag List](/reference/easm/asset-tag-list/) | `/easm/asset-tags` |
| PUT | [Asset Tag Update](/reference/easm/asset-tag-update/) | `/easm/asset-tags/{tag_id}` |
| DELETE | [Asset Tag Delete](/reference/easm/asset-tag-delete/) | `/easm/asset-tags/{tag_id}` |

## Deleted Assets

Assets that were removed from monitoring.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Deleted Asset Search](/reference/easm/deleted-asset-search/) | `/easm/deleted-assets/search` |
| POST | [Deleted Asset Export](/reference/easm/deleted-asset-export/) | `/easm/deleted-assets/search:export` |

## Asset History

Every change Deepinfo recorded for an asset, per data type (WHOIS, DNS, SSL, port scan, HTTP, web data, IP DNS, IP WHOIS). List endpoints return snapshot ids with their `check_date`; detail endpoints return the full snapshot.

| History | Available for asset types |
|---|---|
| WHOIS, DNS, SSL, port scan | domain, subdomain |
| HTTP, web data | website |
| IP DNS, IP WHOIS | ip |

Requesting a history type the asset does not have returns **404** `30003` (e.g. *"domain asset type does not include ipdns scope."*).

| Method | Endpoint | Path |
|---|---|---|
| GET | [Asset DNS History List](/reference/easm/asset-dns-history-list/) | `/easm/assets/{asset_id}/dns-history` |
| GET | [Asset HTTP History List](/reference/easm/asset-http-history-list/) | `/easm/assets/{asset_id}/http-history` |
| GET | [Asset IP DNS PTR History List](/reference/easm/asset-ip-dns-ptr-history-list/) | `/easm/assets/{asset_id}/ipdns-history` |
| GET | [Asset IP Whois History List](/reference/easm/asset-ip-whois-history-list/) | `/easm/assets/{asset_id}/ipwhois-history` |
| GET | [Asset Port Scan History List](/reference/easm/asset-port-scan-history-list/) | `/easm/assets/{asset_id}/port-scan-history` |
| GET | [Asset SSL History List](/reference/easm/asset-ssl-history-list/) | `/easm/assets/{asset_id}/ssl-history` |
| GET | [Asset Webdata History List](/reference/easm/asset-webdata-history-list/) | `/easm/assets/{asset_id}/webdata-history` |
| GET | [Asset Whois History List](/reference/easm/asset-whois-history-list/) | `/easm/assets/{asset_id}/whois-history` |
| GET | [Asset DNS History Detail](/reference/easm/asset-dns-history-detail/) | `/easm/assets/{asset_id}/dns-history/{history_id}` |
| GET | [Asset HTTP History Detail](/reference/easm/asset-http-history-detail/) | `/easm/assets/{asset_id}/http-history/{history_id}` |
| GET | [Asset IP DNS PTR History Detail](/reference/easm/asset-ip-dns-ptr-history-detail/) | `/easm/assets/{asset_id}/ipdns-history/{history_id}` |
| GET | [Asset IP Whois History Detail](/reference/easm/asset-ip-whois-history-detail/) | `/easm/assets/{asset_id}/ipwhois-history/{history_id}` |
| GET | [Asset Port Scan History Detail](/reference/easm/asset-port-scan-history-detail/) | `/easm/assets/{asset_id}/port-scan-history/{history_id}` |
| GET | [Asset SSL History Detail](/reference/easm/asset-ssl-history-detail/) | `/easm/assets/{asset_id}/ssl-history/{history_id}` |
| GET | [Asset Webdata History Detail](/reference/easm/asset-webdata-history-detail/) | `/easm/assets/{asset_id}/webdata-history/{history_id}` |
| GET | [Asset Whois History Detail](/reference/easm/asset-whois-history-detail/) | `/easm/assets/{asset_id}/whois-history/{history_id}` |

## Open Ports

Ports and services found on an asset, their history, and on-demand port scans.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Asset Open Port History List](/reference/easm/asset-open-port-history-list/) | `/easm/assets/{asset_id}/open-ports/history` |
| GET | [Asset Open Port List](/reference/easm/asset-open-port-list/) | `/easm/assets/{asset_id}/open-ports` |
| GET | [Asset Open Port History Detail](/reference/easm/asset-open-port-history-detail/) | `/easm/assets/{asset_id}/open-ports/history/{history_id}` |
| POST | [Asset Instant Open Port Scan](/reference/easm/asset-instant-open-port-scan/) | `/easm/assets/{asset_id}/open-ports/instant-scan` |
| GET | [Asset Open Port Count Timeline](/reference/easm/asset-open-port-count-timeline/) | `/easm/assets/{asset_id}/open-ports/count-timeline` |
| GET | [Asset Open Port State Stats](/reference/easm/asset-open-port-state-stats/) | `/easm/assets/{asset_id}/stats/open-port-state` |

## Asset Timelines

Time series for a single asset. `interval`: `daily`, `weekly` or `monthly`.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Asset Issue Severity Stats Timeline](/reference/easm/asset-issue-severity-stats-timeline/) | `/easm/assets/{asset_id}/stats/issue-severity-timeline` |
| GET | [Asset Security Score Timeline](/reference/easm/asset-security-score-timeline/) | `/easm/assets/{asset_id}/stats/security-score-timeline` |
| GET | [Asset Technology Count Timeline](/reference/easm/asset-technology-count-timeline/) | `/easm/assets/{asset_id}/stats/technology-count-timeline` |
| GET | [Asset Vulnerability Severity Stats Timeline](/reference/easm/asset-vulnerability-severity-stats-timeline/) | `/easm/assets/{asset_id}/stats/vulnerability-severity-timeline` |
| GET | [Asset Website Count Timeline](/reference/easm/asset-website-count-timeline/) | `/easm/assets/{asset_id}/stats/website-count-timeline` |
| GET | [Domain Security Score Timeline](/reference/easm/domain-security-score-timeline/) | `/easm/assets/{asset_id}/stats/domain-security-score-timeline` |
| GET | [Domain Subdomain Count Timeline](/reference/easm/domain-subdomain-count-timeline/) | `/easm/assets/{asset_id}/stats/subdomain-count-timeline` |

## Snapshots

Pre-computed summaries (security score and statistics) of an asset, a domain or your whole attack surface. `instant-snapshot` recalculates one on demand; the result is available shortly after via `latest-snapshot`.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Asset Instant Snapshot](/reference/easm/asset-instant-snapshot/) | `/easm/assets/{asset_id}/instant-snapshot` |
| GET | [Asset Latest Snapshot](/reference/easm/asset-latest-snapshot/) | `/easm/assets/{asset_id}/latest-snapshot` |
| POST | [Domain Instant Snapshot](/reference/easm/domain-instant-snapshot/) | `/easm/assets/{domain_id}/domain-instant-snapshot` |
| GET | [Domain Latest Snapshot](/reference/easm/domain-latest-snapshot/) | `/easm/assets/{domain_id}/domain-latest-snapshot` |
| POST | [Instant Snapshot](/reference/easm/instant-snapshot/) | `/easm/instant-snapshot` |
| GET | [Latest Snapshot](/reference/easm/latest-snapshot/) | `/easm/latest-snapshot` |

## Dashboard

Aggregated statistics across all your assets.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Assets With Most Issues](/reference/easm/assets-with-most-issues/) | `/easm/assets/stats/most-issues` |
| GET | [Assets With Most Websites](/reference/easm/assets-with-most-websites/) | `/easm/assets/stats/most-websites` |
| GET | [Domains With Most Subdomains](/reference/easm/domains-with-most-subdomains/) | `/easm/assets/stats/most-subdomains` |
| GET | [Latest Added Assets](/reference/easm/latest-added-assets/) | `/easm/assets/stats/latest` |
| GET | [Asset Type Stats](/reference/easm/asset-type-stats/) | `/easm/assets/stats/type` |
| GET | [Asset Type Stats Timeline](/reference/easm/asset-type-stats-timeline/) | `/easm/assets/stats/type-timeline` |
| GET | [Insight Stats](/reference/easm/insight-stats/) | `/easm/assets/stats/insights` |
| GET | [Open Port Count Timeline](/reference/easm/open-port-count-timeline/) | `/easm/stats/open-port-count-timeline` |
| GET | [Security Score Timeline](/reference/easm/security-score-timeline/) | `/easm/stats/security-score-timeline` |

## Discovery

Assets Deepinfo discovers around your attack surface, the rules that discover them, and discovery settings.

### Discovered Assets

Candidates found by discovery rules. Each is `in_review`, `approved` (added to your assets) or `ignored`.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Discovered Asset Search](/reference/easm/discovered-asset-search/) | `/easm/discovery/assets/search` |
| POST | [Discovered Asset Export](/reference/easm/discovered-asset-export/) | `/easm/discovery/assets/search:export` |
| GET | [Discovered Asset Detail](/reference/easm/discovered-asset-detail/) | `/easm/discovery/assets/{asset_id}` |
| POST | [Discovered Asset Approve](/reference/easm/discovered-asset-approve/) | `/easm/discovery/assets/search:approve` |
| POST | [Discovered Asset Ignore](/reference/easm/discovered-asset-ignore/) | `/easm/discovery/assets/search:ignore` |
| POST | [Discovered Asset Revert](/reference/easm/discovered-asset-revert/) | `/easm/discovery/assets/search:revert` |
| GET | [Discovered Asset State Stats](/reference/easm/discovered-asset-state-stats/) | `/easm/discovery/stats/asset-state` |

### Discovery Rules

**Smart discovery** and **smart monitoring** rules are managed by Deepinfo (you can tune them); **custom rules** are your own.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Asset Discovery Custom Discovery Rule Search](/reference/easm/asset-discovery-custom-discovery-rule-search/) | `/easm/discovery/custom-rules/search` |
| GET | [Asset Discovery Rule List](/reference/easm/asset-discovery-rule-list/) | `/easm/discovery/rules` |
| GET | [Asset Discovery Smart Discovery Rule List](/reference/easm/asset-discovery-smart-discovery-rule-list/) | `/easm/discovery/smart-discovery-rules` |
| GET | [Asset Discovery Smart Monitoring Rule List](/reference/easm/asset-discovery-smart-monitoring-rule-list/) | `/easm/discovery/smart-monitoring-rules` |
| GET | [Asset Discovery Custom Discovery Rule Detail](/reference/easm/asset-discovery-custom-discovery-rule-detail/) | `/easm/discovery/custom-rules/{rule_id}` |
| GET | [Asset Discovery Smart Discovery Rule Detail](/reference/easm/asset-discovery-smart-discovery-rule-detail/) | `/easm/discovery/smart-discovery-rules/{rule_id}` |
| GET | [Asset Discovery Smart Monitoring Rule Detail](/reference/easm/asset-discovery-smart-monitoring-rule-detail/) | `/easm/discovery/smart-monitoring-rules/{rule_id}` |
| POST | [Asset Discovery Custom Discovery Rule Create](/reference/easm/asset-discovery-custom-discovery-rule-create/) | `/easm/discovery/custom-rules` |
| PUT | [Asset Discovery Custom Discovery Rule Update](/reference/easm/asset-discovery-custom-discovery-rule-update/) | `/easm/discovery/custom-rules/{rule_id}` |
| PUT | [Asset Discovery Smart Discovery Rule Update](/reference/easm/asset-discovery-smart-discovery-rule-update/) | `/easm/discovery/smart-discovery-rules/{rule_id}` |
| PUT | [Asset Discovery Smart Monitoring Rule Update](/reference/easm/asset-discovery-smart-monitoring-rule-update/) | `/easm/discovery/smart-monitoring-rules/{rule_id}` |
| DELETE | [Asset Discovery Custom Discovery Rule Delete](/reference/easm/asset-discovery-custom-discovery-rule-delete/) | `/easm/discovery/custom-rules/{rule_id}` |

### Settings

Discovery-wide settings.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Asset Discovery Settings Detail](/reference/easm/asset-discovery-settings-detail/) | `/easm/discovery/settings` |
| PUT | [Asset Discovery Settings Update](/reference/easm/asset-discovery-settings-update/) | `/easm/discovery/settings` |

## Issues

Security issues detected on your assets, grouped by issue **type** and **category**.

### Issues

Search issues and change their state.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Issue Search](/reference/easm/issue-search/) | `/easm/issues/search` |
| POST | [Issue Export](/reference/easm/issue-export/) | `/easm/issues/search:export` |
| GET | [Issue Detail](/reference/easm/issue-detail/) | `/easm/issues/{issue_id}` |
| POST | [Issue Accept Risk](/reference/easm/issue-accept-risk/) | `/easm/issues/search:accept-risk` |
| POST | [Issue Ignore](/reference/easm/issue-ignore/) | `/easm/issues/search:ignore` |
| POST | [Issue Mark False Positive](/reference/easm/issue-mark-false-positive/) | `/easm/issues/search:mark-false-positive` |
| POST | [Issue Mark Resolved](/reference/easm/issue-mark-resolved/) | `/easm/issues/search:mark-resolved` |
| POST | [Issue Revert](/reference/easm/issue-revert/) | `/easm/issues/search:revert` |

### Issue Stats

Issue statistics across your assets.

Most of them accept these filters:

- `asset`
- `type_id`
- `type_category_id`

| Method | Endpoint | Path |
|---|---|---|
| GET | [Issue Asset Type Stats](/reference/easm/issue-asset-type-stats/) | `/easm/issues/stats/asset-type` |
| GET | [Issue Category Stats](/reference/easm/issue-category-stats/) | `/easm/issues/stats/category-type` |
| GET | [Issue Duration Stats](/reference/easm/issue-duration-stats/) | `/easm/issues/stats/duration` |
| GET | [Issue Severity Stats](/reference/easm/issue-severity-stats/) | `/easm/issues/stats/severity` |
| GET | [Issue Severity Stats Timeline](/reference/easm/issue-severity-stats-timeline/) | `/easm/issues/stats/severity-timeline` |
| GET | [Issue State Stats](/reference/easm/issue-state-stats/) | `/easm/issues/stats/state` |
| GET | [Issue Type Stats](/reference/easm/issue-type-stats/) | `/easm/issues/stats/type` |

### Issue Types

Details, score timeline and snapshot of one issue type.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Issue Type Detail](/reference/easm/issue-type-detail/) | `/easm/issues/types/{issue_type_id}` |
| POST | [Issue Type Instant Snapshot](/reference/easm/issue-type-instant-snapshot/) | `/easm/issues/types/{issue_type_id}/instant-snapshot` |
| GET | [Issue Type Latest Snapshot](/reference/easm/issue-type-latest-snapshot/) | `/easm/issues/types/{issue_type_id}/latest-snapshot` |
| GET | [Issue Type Security Score Timeline](/reference/easm/issue-type-security-score-timeline/) | `/easm/issues/types/{issue_type_id}/security-score-timeline` |

### Issue Categories

Issue categories, with score timeline and snapshot per category.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Issue Categories](/reference/easm/issue-categories/) | `/easm/issues/categories/list` |
| POST | [Issue Categories Instant Snapshot](/reference/easm/issue-categories-instant-snapshot/) | `/easm/issues/categories/{issue_type_category_id}/instant-snapshot` |
| GET | [Issue Categories Latest Snapshot](/reference/easm/issue-categories-latest-snapshot/) | `/easm/issues/categories/{issue_type_category_id}/latest-snapshot` |
| GET | [Issue Categories Security Score Timeline](/reference/easm/issue-categories-security-score-timeline/) | `/easm/issues/categories/{issue_type_category_id}/security-score-timeline` |

## Vulnerabilities

Vulnerabilities (CVEs) that affect technologies found on your assets.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Vulnerability Asset Search](/reference/easm/vulnerability-asset-search/) | `/easm/vulnerabilities/asset-search` |
| POST | [Vulnerability Search](/reference/easm/vulnerability-search/) | `/easm/vulnerabilities/search` |
| POST | [Vulnerability Asset Export](/reference/easm/vulnerability-asset-export/) | `/easm/vulnerabilities/asset-search:export` |
| POST | [Vulnerability Export](/reference/easm/vulnerability-export/) | `/easm/vulnerabilities/search:export` |
| GET | [Vulnerability Detail](/reference/easm/vulnerability-detail/) | `/easm/vulnerabilities/{vulnerability_id}` |
| POST | [Vulnerability Accept Risk](/reference/easm/vulnerability-accept-risk/) | `/easm/vulnerabilities/search:accept-risk` |
| POST | [Vulnerability Ignore](/reference/easm/vulnerability-ignore/) | `/easm/vulnerabilities/search:ignore` |
| POST | [Vulnerability Mark False Positive](/reference/easm/vulnerability-mark-false-positive/) | `/easm/vulnerabilities/search:mark-false-positive` |
| POST | [Vulnerability Mark Resolved](/reference/easm/vulnerability-mark-resolved/) | `/easm/vulnerabilities/search:mark-resolved` |
| POST | [Vulnerability Revert](/reference/easm/vulnerability-revert/) | `/easm/vulnerabilities/search:revert` |
| GET | [Vulnerability Exploitability Score Stats](/reference/easm/vulnerability-exploitability-score-stats/) | `/easm/vulnerabilities/stats/exploitability-score` |
| GET | [Vulnerability Known Exploitable Stats](/reference/easm/vulnerability-known-exploitable-stats/) | `/easm/vulnerabilities/stats/known-exploitable` |
| GET | [Vulnerability Severity Stats](/reference/easm/vulnerability-severity-stats/) | `/easm/vulnerabilities/stats/severity` |
| GET | [Vulnerability Severity Stats Timeline](/reference/easm/vulnerability-severity-stats-timeline/) | `/easm/vulnerabilities/stats/severity-timeline` |

## Technologies

Technologies (software, frameworks, services) detected on your assets.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Technology Asset Search](/reference/easm/technology-asset-search/) | `/easm/technologies/asset-search` |
| POST | [Technology Search](/reference/easm/technology-search/) | `/easm/technologies/search` |
| POST | [Technology Asset Export](/reference/easm/technology-asset-export/) | `/easm/technologies/asset-search:export` |
| POST | [Technology Export](/reference/easm/technology-export/) | `/easm/technologies/search:export` |
| GET | [Technology Detail](/reference/easm/technology-detail/) | `/easm/technologies/{tech_id}` |
| GET | [Most Vulnerable Technologies](/reference/easm/most-vulnerable-technologies/) | `/easm/technologies/stats/most-vulnerable` |
| GET | [Technology End of Life Status](/reference/easm/technology-end-of-life-status/) | `/easm/technologies/eol/{product}` |
| GET | [Technology Vulnerabilities](/reference/easm/technology-vulnerabilities/) | `/easm/technologies/vulnerabilities` |
| GET | [Technology Asset Stats](/reference/easm/technology-asset-stats/) | `/easm/technologies/stats/assets` |
| GET | [Technology Category Stats](/reference/easm/technology-category-stats/) | `/easm/technologies/stats/category` |
| GET | [Technology Count Timeline](/reference/easm/technology-count-timeline/) | `/easm/technologies/stats/count-timeline` |
| GET | [Technology Vulnerability Stats](/reference/easm/technology-vulnerability-stats/) | `/easm/technologies/stats/vulnerability` |


---

# Asset Search

URL: https://docs.deepinfo.com/reference/easm/asset-search/

POST /easm/assets/search: Searches your monitored assets with filters and sorting. An empty body {} returns all assets.

`POST https://api.deepinfo.com/v1/easm/assets/search`

Searches your monitored assets with filters and sorting. An empty body `{}` returns all assets. See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the filter syntax; `name` accepts every searchable asset field (see [Filtering](#ref-filtering)).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the asset, such as a business unit or an environment; each tag is 3 to 100 characters long. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.name.unicode` | The host name without its extension, in Unicode: `acme` for `acme.example`, `www.acme` for `www.acme.example`. |
| `fqdn.name.latinized` | Latin-letter spellings of a name that has non-Latin or accented letters, so a search for `istanbul` also finds names written with `İ`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_sub.unicode` | The second-level part of a two-part extension, such as `co` in `co.uk`; empty for single-part extensions. |
| `website.path` | The URL path of a website asset, such as `/`. |
| `website.scheme` | The URL scheme of a website asset, such as `http`. |
| `website.parent_asset.id` | The ID of the domain or subdomain asset that a website asset belongs to. |
| `website.parent_asset.name` | The name of the domain or subdomain asset that a website asset belongs to. |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.name` | The registrant's name in WHOIS; often a privacy placeholder such as `redacted for privacy`. |
| `whois.registrant.country` | The registrant's country in WHOIS, as a two-letter code in lower case such as `us`. |
| `whois.registrant.state` | The registrant's state or province in WHOIS. |
| `whois.registrant.city` | The registrant's city in WHOIS. |
| `whois.registrant.street` | The registrant's street address in WHOIS. |
| `whois.registrant.postal_code` | The registrant's postal code in WHOIS. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `whois_registrant_email_historical` | Every registrant e-mail address seen for the domain over time, the current one included. |
| `whois_normalized.registrar` | The registrar reduced to a short normalized name, such as `godaddy` or `gandi`, so the same registrar matches across spellings. |
| `whois_normalized.registrant.email` | The registrant e-mail address after WHOIS normalization. |
| `whois_normalized.registrant.email_real` | Another normalized registrant e-mail field, set on fewer domains than `whois_normalized.registrant.email`; in the samples it is set only where `whois_privacy_enabled` is false, with the same address. |
| `whois_normalized.registrant.email_domain_apex` | The registrable domain of the registrant e-mail address: `acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.email_fqdn_apex` | The full host name after the `@` of the registrant e-mail address: `mail.acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.organization` | The registrant organization cleaned up across registrars: lower case, with spaces and punctuation removed, such as `domainsbyproxyllc`. |
| `whois_normalized.registrant.phone` | The registrant phone number reduced to its digits, such as `14805551234`. |
| `whois_last_change_data` | The WHOIS fields that changed in the last change seen, as field paths such as `whois.update_date` or `whois.domain_status`. |
| `dns.a.value` | The asset's current A records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.a.value_previous` | The asset's A records as they were before the last change, in the same text form as `dns.a.value`. |
| `dns.a.rcode` | The DNS response code returned for the asset's A lookup, such as `NOERROR`. |
| `dns.a.rcode_previous` | The DNS response code of the A lookup before it last changed. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.entities` | The handles of the registry contacts and organizations linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, when it is kept. |
| `dns.a.ip_addresses.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the A-record address. |
| `dns.a.ip_addresses.raw` | The raw IP WHOIS response for the A-record address, when it is kept; empty on every sampled asset. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.a.ip_addresses.network.start_address` | The first address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.end_address` | The last address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.handle` | The registry handle of the network that contains the A-record address, such as `NET-192-0-2-0-1`. |
| `dns.a.ip_addresses.network.ip_version` | The IP version of the network that contains the A-record address: `v4` or `v6`. |
| `dns.a.ip_addresses.network.links` | Links to the registry record of the network that contains the A-record address, such as its RDAP and WHOIS URLs. |
| `dns.a.ip_addresses.network.parent_handle` | The handle of the larger network block from which the network of the A-record address was allocated. |
| `dns.a.ip_addresses.network.raw` | The raw RDAP network object for the A-record address, when it is kept. |
| `dns.a.ip_addresses.network.status` | The registry status of the network that contains the A-record address, such as `active`. |
| `dns.a.ip_addresses.network.type` | The registry's allocation type for the network that contains the A-record address, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `dns.a.ip_addresses.network.notices.title` | The title of a notice the registry attached to the network record of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.network.notices.description` | The text of a notice the registry attached to the network record of the A-record address. |
| `dns.a.ip_addresses.network.notices.links` | Links given in a notice on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.title` | The title of a remark on the network record of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.network.remarks.description` | The text of a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.links` | Links given in a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.events.action` | An event in the history of the network record of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.network.events.actor` | Who performed an event on the network record of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the A-record address, such as `abuse`. |
| `dns.a.ip_addresses.objects.contact.email.value` | An e-mail address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.value` | A postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the A-record address, such as `voice` or `work`. |
| `dns.a.ip_addresses.objects.contact.phone.value` | A phone number of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.kind` | What kind of contact is linked to the network of the A-record address: `org`, `group` or `individual`. |
| `dns.a.ip_addresses.objects.contact.name` | The name of a contact or organization linked to the network of the A-record address, such as `Abuse` or a company name. |
| `dns.a.ip_addresses.objects.contact.role` | The role given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.title` | The title given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.entities` | Handles of further entities listed under a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.events.action` | An event in the history of a contact record linked to the network of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.objects.events.actor` | Who performed an event on a contact record linked to the network of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.events_actor` | Events in which a contact linked to the network of the A-record address is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `dns.a.ip_addresses.objects.handle` | The registry handle of a contact or organization linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.links` | Links to the registry record of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.title` | The title of a notice on a contact record linked to the network of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.objects.notices.description` | The text of a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.links` | Links given in a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.raw` | The raw RDAP object of a contact linked to the network of the A-record address, when it is kept. |
| `dns.a.ip_addresses.objects.remarks.title` | The title of a remark on a contact record linked to the network of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.objects.remarks.description` | The text of a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.roles` | The roles of a contact for the network of the A-record address, such as `registrant`, `abuse` or `technical`. |
| `dns.a.ip_addresses.objects.status` | The registry status of a contact linked to the network of the A-record address, such as `validated`. |
| `dns.a.ip_history` | Every IPv4 address seen in the asset's A records over time, the current ones included. |
| `dns.aaaa.value` | The asset's current AAAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.aaaa.value_previous` | The asset's AAAA records as they were before the last change, in the same text form as `dns.aaaa.value`. |
| `dns.aaaa.rcode` | The DNS response code returned for the asset's AAAA lookup, such as `NOERROR`. |
| `dns.aaaa.rcode_previous` | The DNS response code of the AAAA lookup before it last changed. |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the asset's AAAA records. |
| `dns.caa.value` | The asset's current CAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.caa.value_previous` | The asset's CAA records as they were before the last change, in the same text form as `dns.caa.value`. |
| `dns.caa.rcode` | The DNS response code returned for the asset's CAA lookup, such as `NOERROR`. |
| `dns.caa.rcode_previous` | The DNS response code of the CAA lookup before it last changed. |
| `dns.caa.issue_fqdns` | The certificate authorities allowed to issue certificates for the name, from the CAA `issue` tags, such as `fernhill.example` or `kestrel.example`. |
| `dns.caa.issuewild_fqdns` | The certificate authorities allowed to issue wildcard certificates for the name, from the CAA `issuewild` tags. |
| `dns.caa.iodef_emails` | The e-mail addresses from the CAA `iodef` tags, where certificate authorities report requests that break the CAA policy. |
| `dns.cname.value` | The asset's current CNAME records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.cname.value_previous` | The asset's CNAME records as they were before the last change, in the same text form as `dns.cname.value`. |
| `dns.cname.rcode` | The DNS response code returned for the asset's CNAME lookup, such as `NOERROR`. |
| `dns.cname.rcode_previous` | The DNS response code of the CNAME lookup before it last changed. |
| `dns.cname.canonical_fqdns` | The host names the asset's CNAME records point to (the alias targets). |
| `dns.dnskey.value` | The asset's current DNSKEY records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.dnskey.value_previous` | The asset's DNSKEY records as they were before the last change, in the same text form as `dns.dnskey.value`. |
| `dns.dnskey.rcode` | The DNS response code returned for the asset's DNSKEY lookup, such as `NOERROR`. |
| `dns.dnskey.rcode_previous` | The DNS response code of the DNSKEY lookup before it last changed. |
| `dns.dnskey.records.public_key` | The public key of a DNSKEY record, Base64-encoded and split into space-separated groups as in the zone-file text. |
| `dns.ds.value` | The asset's current DS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ds.value_previous` | The asset's DS records as they were before the last change, in the same text form as `dns.ds.value`. |
| `dns.ds.rcode` | The DNS response code returned for the asset's DS lookup, such as `NOERROR`. |
| `dns.ds.rcode_previous` | The DNS response code of the DS lookup before it last changed. |
| `dns.ds.records.digest` | The digest of a DS record, the hash of the DNSKEY it refers to. |
| `dns.mx.value` | The asset's current MX records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.mx.value_previous` | The asset's MX records as they were before the last change, in the same text form as `dns.mx.value`. |
| `dns.mx.rcode` | The DNS response code returned for the asset's MX lookup, such as `NOERROR`. |
| `dns.mx.rcode_previous` | The DNS response code of the MX lookup before it last changed. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns.mx.domains` | The registrable domains of the asset's mail servers, such as `acme.example`. |
| `dns.ns.value` | The asset's current NS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ns.value_previous` | The asset's NS records as they were before the last change, in the same text form as `dns.ns.value`. |
| `dns.ns.rcode` | The DNS response code returned for the asset's NS lookup, such as `NOERROR`. |
| `dns.ns.rcode_previous` | The DNS response code of the NS lookup before it last changed. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.ns.domains` | The registrable domains of the asset's name servers, such as `acme.example`. |
| `dns.nsec.value` | The asset's current NSEC records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec.value_previous` | The asset's NSEC records as they were before the last change, in the same text form as `dns.nsec.value`. |
| `dns.nsec.rcode` | The DNS response code returned for the asset's NSEC lookup, such as `NOERROR`. |
| `dns.nsec.rcode_previous` | The DNS response code of the NSEC lookup before it last changed. |
| `dns.nsec.records.next_domain` | The next name in the zone, from an NSEC record. |
| `dns.nsec.records.record_types` | The record types that exist at the name, from an NSEC record's type list, such as `A`, `NS` or `SOA`. |
| `dns.nsec3.value` | The asset's current NSEC3 records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec3.value_previous` | The asset's NSEC3 records as they were before the last change, in the same text form as `dns.nsec3.value`. |
| `dns.nsec3.rcode` | The DNS response code returned for the asset's NSEC3 lookup, such as `NOERROR`. |
| `dns.nsec3.rcode_previous` | The DNS response code of the NSEC3 lookup before it last changed. |
| `dns.nsec3.records.next_domain_hashed` | The hashed next name in the zone, from an NSEC3 record. |
| `dns.nsec3.records.record_types` | The record types that exist at the name, from an NSEC3 record's type list, such as `A` or `MX`. |
| `dns.rrsig.value` | The asset's current RRSIG records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.rrsig.value_previous` | The asset's RRSIG records as they were before the last change, in the same text form as `dns.rrsig.value`. |
| `dns.rrsig.rcode` | The DNS response code returned for the asset's RRSIG lookup, such as `NOERROR`. |
| `dns.rrsig.rcode_previous` | The DNS response code of the RRSIG lookup before it last changed. |
| `dns.rrsig.type_covered` | The record type that an RRSIG signature covers, such as `A` or `SOA`. |
| `dns.rrsig.signature` | The signature data of an RRSIG record, Base64-encoded. |
| `dns.soa.value` | The asset's current SOA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.soa.value_previous` | The asset's SOA records as they were before the last change, in the same text form as `dns.soa.value`. |
| `dns.soa.rcode` | The DNS response code returned for the asset's SOA lookup, such as `NOERROR`. |
| `dns.soa.rcode_previous` | The DNS response code of the SOA lookup before it last changed. |
| `dns.soa.mnames` | The MNAME of the SOA record: the primary name server of the zone, such as `ns1.acme.example`. |
| `dns.soa.rnames` | The RNAME of the SOA record, the zone administrator's mailbox in DNS form: `hostmaster.acme.example` stands for the mailbox `hostmaster` at `acme.example`. |
| `dns.soa.rname_emails` | The RNAME of the SOA record written as an e-mail address, such as `user@acme.example`. |
| `dns.srv.value` | The asset's current SRV records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.srv.value_previous` | The asset's SRV records as they were before the last change, in the same text form as `dns.srv.value`. |
| `dns.srv.rcode` | The DNS response code returned for the asset's SRV lookup, such as `NOERROR`. |
| `dns.srv.rcode_previous` | The DNS response code of the SRV lookup before it last changed. |
| `dns.srv.records.service` | The service named in an SRV record (the `_service` part of its name). |
| `dns.srv.records.protocol` | The protocol named in an SRV record (the `_proto` part of its name, such as TCP or UDP). |
| `dns.srv.records.target` | The host name an SRV record points to. |
| `dns.txt.value` | The asset's current TXT records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.txt.value_previous` | The asset's TXT records as they were before the last change, in the same text form as `dns.txt.value`. |
| `dns.txt.rcode` | The DNS response code returned for the asset's TXT lookup, such as `NOERROR`. |
| `dns.txt.rcode_previous` | The DNS response code of the TXT lookup before it last changed. |
| `dns.txt.values` | Each TXT record of the asset as its quoted text, such as `"v=spf1 include:_spf.acme.example ~all"`; the quotes are part of the value. |
| `dns.txt.spf_list.value` | The text of an SPF record (a TXT record that starts with `v=spf1`), quoted as in `dns.txt.values`. |
| `dns.txt.spf_list.allowed_domains` | The registrable domains that an SPF record refers to, such as `acme.example` for `include:_spf.acme.example`. |
| `dns.txt.spf_list.allowed_ips` | The IP addresses and ranges that an SPF record authorizes to send mail (its `ip4:` and `ip6:` entries). |
| `dns.txt.verifications.value` | The text of a site-verification TXT record, quoted as in `dns.txt.values`. |
| `dns.txt.verifications.domain` | The domain of the service a verification record is for, such as `acme.example`, `fernhill.example` or `kestrel.example`. |
| `dns.txt.verifications.name` | The name of a verification record, such as `site-verification` or `domain-verification`. |
| `dns_last_change_data` | The DNS fields that changed in the last change seen, as field paths such as `dns.soa.mnames`. |
| `ssl.target` | The host name that the asset's TLS certificate was collected from, normally the asset itself. |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the asset's TLS certificate, as lower-case hex; one fingerprint identifies one certificate. |
| `ssl.issuer.common_name` | The common name (CN) of the certificate authority that issued the asset's TLS certificate, such as `WE1` or `YE2`. |
| `ssl.issuer.country` | The country (C) of the certificate authority that issued the asset's TLS certificate, as a two-letter code such as `US`. |
| `ssl.issuer.state` | The state or province (ST) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.locality` | The locality or city (L) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.organization` | The organization (O) of the certificate authority that issued the asset's TLS certificate, such as `Let's Encrypt` or `Google Trust Services`. |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer_dn` | The full distinguished name of the issuer of the asset's TLS certificate, as one string such as `CN=WE1,O=Google Trust Services,C=US`. |
| `ssl.subject.common_name` | The common name (CN) of the subject (holder) of the asset's TLS certificate, usually a host name such as `acme.example`. |
| `ssl.subject.country` | The country (C) of the subject (holder) of the asset's TLS certificate, as a two-letter code. |
| `ssl.subject.state` | The state or province (ST) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.locality` | The locality or city (L) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organizational_unit` | The organizational unit (OU) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject_dn` | The full distinguished name of the subject of the asset's TLS certificate, such as `CN=acme.example`; one that starts with `CN=*.` belongs to a wildcard certificate. |
| `ssl.signature.value` | The signature of the asset's TLS certificate, Base64-encoded. |
| `ssl.signature.invalid_reason` | Why certificate validation failed, such as a host name mismatch or `unable to get issuer certificate`. |
| `ssl.signature.algorithm.name` | The hash algorithm of the signature on the asset's TLS certificate, such as `sha256` or `sha384`. |
| `ssl.signature.algorithm.oid` | The object identifier (OID) of the signature algorithm, such as `1.2.840.113549.1.1.11` (SHA-256 with RSA) or `1.2.840.10045.4.3.2` (ECDSA with SHA-256). |
| `ssl.extensions.authority_key_id` | The Authority Key Identifier extension, which identifies the issuer's key, Base64-encoded. |
| `ssl.extensions.certificate_policies` | The policy OIDs in the Certificate Policies extension, such as `2.23.140.1.2.1` (domain validated). |
| `ssl.extensions.signed_certificate_timestamps.log_id` | The ID of the Certificate Transparency log that issued a signed certificate timestamp (SCT) for the certificate, Base64-encoded. |
| `ssl.extensions.signed_certificate_timestamps.signature` | The log's signature on a signed certificate timestamp, Base64-encoded. |
| `ssl.extensions.subject_alt_name.dns_names` | The host names in the certificate's Subject Alternative Name extension, including wildcard names such as `*.acme.example`. |
| `ssl.extensions.subject_key_id` | The Subject Key Identifier extension, which identifies the certificate's own key, Base64-encoded. |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | The hash algorithm used for `ssl.subject_key_info.fingerprint.value`, such as `sha256` or `sha384`. |
| `ssl.subject_key_info.fingerprint.value` | A hex fingerprint recorded under the certificate's subject key information, made with the hash in `hash_algorithm`. In the samples it equals `ssl.fingerprint.sha256` when that hash is SHA-256. |
| `ssl.subject_key_info.key_algorithm.name` | The algorithm of the certificate's public key, such as `RSA` or `ECDSA`. |
| `ssl.version.name` | The X.509 version of the certificate, such as `v3`. |
| `ssl.version.value` | The X.509 version as encoded in the certificate, counted from zero: `2` means `v3`. |
| `ssl.tbs_fingerprint` | A SHA-256 fingerprint (hex) of the certificate's to-be-signed part, the certificate content without its signature. |
| `ssl.certificate` | The whole certificate, Base64-encoded (a PEM body without the header and footer lines). |
| `ssl.fqdn_list` | The host names the certificate covers, with the `*.` of wildcard names removed and duplicates merged, so `*.acme.example` and `acme.example` both give `acme.example`. |
| `ssl_last_change_data` | The certificate fields that changed in the last change seen, as field paths such as `ssl.validity.end_date`. |
| `http.requested_url` | The URL the HTTP check started from, such as `http://acme.example`. |
| `http.requested_domain` | The registrable domain of the URL the HTTP check started from. |
| `http.requested_fqdn` | The host name of the URL the HTTP check started from. |
| `http.final_url` | The URL the HTTP check ended on after following all redirects. |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.redirection_history.url` | A URL in the redirect chain of the HTTP check, listed in the order visited. |
| `http.headers.accept` | The `Accept` header, when it was returned in the HTTP check. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the HTTP check. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `http.headers.accept_language` | The `Accept-Language` header, when it was returned in the HTTP check. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the HTTP check; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the HTTP check; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the HTTP check; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the HTTP check; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the HTTP check; it lists the response headers that scripts from other origins may read (CORS). |
| `http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the HTTP check; it says how many seconds browsers may cache a CORS preflight result. |
| `http.headers.alt_svc` | The `Alt-Svc` header returned in the HTTP check; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `http.headers.authorization` | The `Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `http.headers.cache_control` | The `Cache-Control` header returned in the HTTP check; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the HTTP check; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `http.headers.content_disposition` | The `Content-Disposition` header returned in the HTTP check; it says whether the content is shown in the browser or downloaded as a file. |
| `http.headers.content_encoding` | The `Content-Encoding` header returned in the HTTP check; it names the compression applied to the response body, for example `gzip` or `br`. |
| `http.headers.content_language` | The `Content-Language` header returned in the HTTP check; it gives the language of the content, for example `en` or `tr`. |
| `http.headers.content_length` | The `Content-Length` header returned in the HTTP check; it gives the size of the response body in bytes. |
| `http.headers.content_range` | The `Content-Range` header returned in the HTTP check; it says which part of the full body a partial response holds. |
| `http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the HTTP check; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `http.headers.content_type` | The `Content-Type` header returned in the HTTP check; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `http.headers.cookie` | The `Cookie` header, when it was returned in the HTTP check. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the HTTP check; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the HTTP check; it controls whether the page shares its browsing context with cross-origin windows. |
| `http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the HTTP check; it controls which sites may load the resource. |
| `http.headers.date` | The `Date` header returned in the HTTP check; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `http.headers.early_data` | The `Early-Data` header, when it was returned in the HTTP check. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `http.headers.expect_ct` | The `Expect-CT` header returned in the HTTP check; it is a deprecated header about Certificate Transparency enforcement. |
| `http.headers.expires` | The `Expires` header returned in the HTTP check; it gives the date after which the response counts as stale, in HTTP date format. |
| `http.headers.feature_policy` | The `Feature-Policy` header returned in the HTTP check; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `http.headers.host` | The `Host` header, when it was returned in the HTTP check. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the HTTP check. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the HTTP check. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `http.headers.last_modified` | The `Last-Modified` header returned in the HTTP check; it gives the time the server says the resource last changed, in HTTP date format. |
| `http.headers.origin_isolation` | The `Origin-Isolation` header returned in the HTTP check; it is an experimental header that asks browsers to isolate the site's origin. |
| `http.headers.others.name` | The name of a header returned in the HTTP check that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `http.headers.others.value` | The value of a header listed in `headers.others` for the HTTP check. |
| `http.headers.permission_policy` | The `Permission-Policy` header returned in the HTTP check; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `http.headers.permissions_policy` | The `Permissions-Policy` header returned in the HTTP check; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `http.headers.pragma` | The `Pragma` header returned in the HTTP check; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the HTTP check; it tells a client how to authenticate to a proxy. |
| `http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the HTTP check; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `http.headers.range` | The `Range` header, when it was returned in the HTTP check. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `http.headers.referer` | The `Referer` header, when it was returned in the HTTP check. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `http.headers.referrer_policy` | The `Referrer-Policy` header returned in the HTTP check; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the HTTP check. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `http.headers.server` | The `Server` header returned in the HTTP check; it names the server software the site reports, for example `nginx` or `Apache`. |
| `http.headers.set_cookie` | The `Set-Cookie` header returned in the HTTP check; it sets cookies, with their attributes. |
| `http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the HTTP check; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `http.headers.te` | The `TE` header, when it was returned in the HTTP check. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the HTTP check; it says how the body is transferred, for example `chunked`. |
| `http.headers.upgrade` | The `Upgrade` header returned in the HTTP check; it offers or asks for a switch to another protocol. |
| `http.headers.user_agent` | The `User-Agent` header, when it was returned in the HTTP check. It is normally a request header (the client software), so it is rarely set. |
| `http.headers.vary` | The `Vary` header returned in the HTTP check; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the HTTP check; it tells a client how to authenticate, usually with a `401` response. |
| `http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the HTTP check; it stops browsers from guessing the content type when set to `nosniff`. |
| `http.headers.x_download_options` | The `X-Download-Options` header returned in the HTTP check; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `http.headers.x_frame_options` | The `X-Frame-Options` header returned in the HTTP check; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the HTTP check; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `http.headers.x_powered_by` | The `X-Powered-By` header returned in the HTTP check; it names the technology the server reports running on, for example `Express`. |
| `http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the HTTP check; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `http.cookies.name` | The name of a cookie set in the HTTP check. |
| `http.cookies.value` | The value of a cookie set in the HTTP check. |
| `http.html.source_code_hash` | A SHA-256 hash of the page source returned in the HTTP check; the same hash means the same source. |
| `http_last_change_data` | The HTTP check fields that changed in the last change seen, as field paths such as `http.html.source_code_hash`. |
| `webdata.requested_url` | The URL the web data scan started from, such as `http://acme.example`. |
| `webdata.requested_domain` | The registrable domain of the URL the web data scan started from. |
| `webdata.requested_fqdn` | The host name of the URL the web data scan started from. |
| `webdata.html.internal_links_fqdns` | The host names of links on the scanned page that stay within the site's own domain, such as other subdomains. |
| `webdata.html.external_links_domains` | The registrable domains of links on the scanned page that point to other domains, such as `kestrel.example`. |
| `webdata.html.external_links_fqdns` | The host names of links on the scanned page that point to other domains, such as `www.kestrel.example`. |
| `webdata.html.external_links` | The full URLs of links on the scanned page that point to other domains. |
| `webdata.html.script_links` | The URLs of the scripts the scanned page loads. |
| `webdata.html.iframe_links` | The URLs of the frames (iframes) embedded in the scanned page. |
| `webdata.html.trackers.name` | The name of an analytics or advertising tracker found on the scanned page, such as `google_adsense` or `google_tag_manager`. |
| `webdata.html.trackers.values` | The IDs found for a tracker, such as a Google Analytics ID that starts with `G-` or `UA-`. |
| `webdata.html.emails` | The e-mail addresses found on the scanned page. |
| `webdata.html.emails_internal` | The e-mail addresses found on the scanned page that belong to the site's own domain. |
| `webdata.html.source_code_hash` | A SHA-256 hash of the page source in the web data scan; the same hash means the same source. |
| `webdata.html.content_hash` | A SHA-256 hash of the page content in the web data scan, kept apart from `source_code_hash`, the hash of the raw source. |
| `webdata.html.content_top_keywords` | The most frequent words in the text of the scanned page. |
| `webdata.html.favicon_links` | The URLs of the icons the scanned page declares, such as its favicon and touch icons. |
| `webdata.html.html_meta.name` | The site or application name declared in the scanned page's metadata. |
| `webdata.html.html_meta.description` | The meta description of the scanned page. |
| `webdata.html.html_meta.language` | The language the scanned page declares, such as `en`, `tr` or `en-US`. |
| `webdata.html.html_meta.language_alternatives` | The languages of the alternative versions the scanned page links to, such as `en` or `ar`. |
| `webdata.html.html_meta.keywords` | The keywords listed in the keywords meta tag of the scanned page. |
| `webdata.html.html_meta.encoding` | The character encoding the scanned page declares, such as `utf-8`. |
| `webdata.html.html_meta.canonical_url` | The canonical URL the scanned page declares. |
| `webdata.html.html_meta.title` | The title of the scanned page. |
| `webdata.favicon.url` | The URL of a site icon (favicon) recorded by the web data scan. |
| `webdata.favicon.hash` | A SHA-256 hash of a site icon; the same hash means the same icon. |
| `webdata.http.final_url` | The URL the web data scan ended on after following all redirects. |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.redirection_history.url` | A URL in the redirect chain of the web data scan, listed in the order visited. |
| `webdata.http.redirection_history.method` | How a step of the web data scan's redirect chain was made; `http-header` (a redirect sent in the HTTP response) is the value in the samples. |
| `webdata.http.headers.accept` | The `Accept` header, when it was returned in the web data scan. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the web data scan. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_language` | The `Accept-Language` header, when it was returned in the web data scan. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `webdata.http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the web data scan; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `webdata.http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the web data scan; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `webdata.http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the web data scan; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `webdata.http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the web data scan; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `webdata.http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the web data scan; it lists the response headers that scripts from other origins may read (CORS). |
| `webdata.http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the web data scan; it says how many seconds browsers may cache a CORS preflight result. |
| `webdata.http.headers.alt_svc` | The `Alt-Svc` header returned in the web data scan; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `webdata.http.headers.authorization` | The `Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `webdata.http.headers.cache_control` | The `Cache-Control` header returned in the web data scan; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `webdata.http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the web data scan; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `webdata.http.headers.content_disposition` | The `Content-Disposition` header returned in the web data scan; it says whether the content is shown in the browser or downloaded as a file. |
| `webdata.http.headers.content_encoding` | The `Content-Encoding` header returned in the web data scan; it names the compression applied to the response body, for example `gzip` or `br`. |
| `webdata.http.headers.content_language` | The `Content-Language` header returned in the web data scan; it gives the language of the content, for example `en` or `tr`. |
| `webdata.http.headers.content_length` | The `Content-Length` header returned in the web data scan; it gives the size of the response body in bytes. |
| `webdata.http.headers.content_range` | The `Content-Range` header returned in the web data scan; it says which part of the full body a partial response holds. |
| `webdata.http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the web data scan; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `webdata.http.headers.content_type` | The `Content-Type` header returned in the web data scan; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `webdata.http.headers.cookie` | The `Cookie` header, when it was returned in the web data scan. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `webdata.http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the web data scan; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `webdata.http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the web data scan; it controls whether the page shares its browsing context with cross-origin windows. |
| `webdata.http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the web data scan; it controls which sites may load the resource. |
| `webdata.http.headers.date` | The `Date` header returned in the web data scan; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `webdata.http.headers.early_data` | The `Early-Data` header, when it was returned in the web data scan. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `webdata.http.headers.expect_ct` | The `Expect-CT` header returned in the web data scan; it is a deprecated header about Certificate Transparency enforcement. |
| `webdata.http.headers.expires` | The `Expires` header returned in the web data scan; it gives the date after which the response counts as stale, in HTTP date format. |
| `webdata.http.headers.feature_policy` | The `Feature-Policy` header returned in the web data scan; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `webdata.http.headers.host` | The `Host` header, when it was returned in the web data scan. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `webdata.http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the web data scan. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `webdata.http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the web data scan. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `webdata.http.headers.last_modified` | The `Last-Modified` header returned in the web data scan; it gives the time the server says the resource last changed, in HTTP date format. |
| `webdata.http.headers.origin_isolation` | The `Origin-Isolation` header returned in the web data scan; it is an experimental header that asks browsers to isolate the site's origin. |
| `webdata.http.headers.others.name` | The name of a header returned in the web data scan that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `webdata.http.headers.others.value` | The value of a header listed in `headers.others` for the web data scan. |
| `webdata.http.headers.permission_policy` | The `Permission-Policy` header returned in the web data scan; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `webdata.http.headers.permissions_policy` | The `Permissions-Policy` header returned in the web data scan; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `webdata.http.headers.pragma` | The `Pragma` header returned in the web data scan; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `webdata.http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the web data scan; it tells a client how to authenticate to a proxy. |
| `webdata.http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `webdata.http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the web data scan; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `webdata.http.headers.range` | The `Range` header, when it was returned in the web data scan. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `webdata.http.headers.referer` | The `Referer` header, when it was returned in the web data scan. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `webdata.http.headers.referrer_policy` | The `Referrer-Policy` header returned in the web data scan; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `webdata.http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `webdata.http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the web data scan. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `webdata.http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `webdata.http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the web data scan. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `webdata.http.headers.server` | The `Server` header returned in the web data scan; it names the server software the site reports, for example `nginx` or `Apache`. |
| `webdata.http.headers.set_cookie` | The `Set-Cookie` header returned in the web data scan; it sets cookies, with their attributes. |
| `webdata.http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the web data scan; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `webdata.http.headers.te` | The `TE` header, when it was returned in the web data scan. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `webdata.http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the web data scan; it says how the body is transferred, for example `chunked`. |
| `webdata.http.headers.upgrade` | The `Upgrade` header returned in the web data scan; it offers or asks for a switch to another protocol. |
| `webdata.http.headers.user_agent` | The `User-Agent` header, when it was returned in the web data scan. It is normally a request header (the client software), so it is rarely set. |
| `webdata.http.headers.vary` | The `Vary` header returned in the web data scan; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `webdata.http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the web data scan; it tells a client how to authenticate, usually with a `401` response. |
| `webdata.http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the web data scan; it stops browsers from guessing the content type when set to `nosniff`. |
| `webdata.http.headers.x_download_options` | The `X-Download-Options` header returned in the web data scan; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `webdata.http.headers.x_frame_options` | The `X-Frame-Options` header returned in the web data scan; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the web data scan; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `webdata.http.headers.x_powered_by` | The `X-Powered-By` header returned in the web data scan; it names the technology the server reports running on, for example `Express`. |
| `webdata.http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the web data scan; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `webdata.http.cookies.name` | The name of a cookie set in the web data scan. |
| `webdata.http.cookies.value` | The value of a cookie set in the web data scan. |
| `webdata.http.cookies.domain` | The domain a cookie set in the web data scan applies to, such as `.acme.example`. |
| `webdata.http.cookies.path` | The path a cookie set in the web data scan applies to, such as `/`. |
| `webdata.http.cookies.same_party` | The SameParty attribute of a cookie set in the web data scan; in the samples it always holds the same value as `same_site`, such as `Lax` or `None`. |
| `webdata.http.cookies.priority` | The Priority attribute of a cookie set in the web data scan (`Low`, `Medium` or `High` in Chromium-based browsers). |
| `webdata.http.cookies.same_site` | The SameSite attribute of a cookie set in the web data scan, such as `Lax`, `Strict` or `None`. |
| `webdata.technology.stacks.slug` | A short identifier of a technology detected on the site, such as `iis` or `windows-server`. |
| `webdata.technology.stacks.name` | The name of a technology detected on the site, such as `IIS` or `Microsoft ASP.NET`. |
| `webdata.technology.stacks.icon` | The file name of a detected technology's icon, such as `acme.png`. |
| `webdata.technology.stacks.website` | The website of a detected technology's vendor or project. |
| `webdata.technology.stacks.cpe` | The CPE identifier of a detected technology, such as `cpe:/a:acme:acme-portal`, used to match it to known vulnerabilities. |
| `webdata.technology.stacks.version` | The detected version of a technology, such as `1.0`. |
| `webdata.technology.stacks.categories` | The categories of a detected technology, such as `Web servers` or `Operating systems`. |
| `webdata.technology.stacks.description` | A short description of a detected technology. |
| `webdata_last_change_data` | The web data fields that changed in the last change seen, as field paths under `webdata`. |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.entities` | The handles of the registry contacts and organizations linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, when it is kept. |
| `ipwhois.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the IP address asset. |
| `ipwhois.raw` | The raw IP WHOIS response for the IP address asset, when it is kept; empty on every sampled asset. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `ipwhois.network.start_address` | The first address of the registered network block that contains the IP address asset. |
| `ipwhois.network.end_address` | The last address of the registered network block that contains the IP address asset. |
| `ipwhois.network.handle` | The registry handle of the network that contains the IP address asset, such as `NET-192-0-2-0-1`. |
| `ipwhois.network.ip_version` | The IP version of the network that contains the IP address asset: `v4` or `v6`. |
| `ipwhois.network.links` | Links to the registry record of the network that contains the IP address asset, such as its RDAP and WHOIS URLs. |
| `ipwhois.network.parent_handle` | The handle of the larger network block from which the network of the IP address asset was allocated. |
| `ipwhois.network.raw` | The raw RDAP network object for the IP address asset, when it is kept. |
| `ipwhois.network.status` | The registry status of the network that contains the IP address asset, such as `active`. |
| `ipwhois.network.type` | The registry's allocation type for the network that contains the IP address asset, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `ipwhois.network.notices.title` | The title of a notice the registry attached to the network record of the IP address asset, such as `Terms of Service`. |
| `ipwhois.network.notices.description` | The text of a notice the registry attached to the network record of the IP address asset. |
| `ipwhois.network.notices.links` | Links given in a notice on the network record of the IP address asset. |
| `ipwhois.network.remarks.title` | The title of a remark on the network record of the IP address asset, such as `Registration Comments`. |
| `ipwhois.network.remarks.description` | The text of a remark on the network record of the IP address asset. |
| `ipwhois.network.remarks.links` | Links given in a remark on the network record of the IP address asset. |
| `ipwhois.network.events.action` | An event in the history of the network record of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.network.events.actor` | Who performed an event on the network record of the IP address asset, when the registry names one. |
| `ipwhois.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the IP address asset, such as `abuse`. |
| `ipwhois.objects.contact.email.value` | An e-mail address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.value` | A postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the IP address asset, such as `voice` or `work`. |
| `ipwhois.objects.contact.phone.value` | A phone number of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.kind` | What kind of contact is linked to the network of the IP address asset: `org`, `group` or `individual`. |
| `ipwhois.objects.contact.name` | The name of a contact or organization linked to the network of the IP address asset, such as `Abuse` or a company name. |
| `ipwhois.objects.contact.role` | The role given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.contact.title` | The title given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.entities` | Handles of further entities listed under a contact linked to the network of the IP address asset. |
| `ipwhois.objects.events.action` | An event in the history of a contact record linked to the network of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.objects.events.actor` | Who performed an event on a contact record linked to the network of the IP address asset, when the registry names one. |
| `ipwhois.objects.events_actor` | Events in which a contact linked to the network of the IP address asset is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `ipwhois.objects.handle` | The registry handle of a contact or organization linked to the network of the IP address asset. |
| `ipwhois.objects.links` | Links to the registry record of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.notices.title` | The title of a notice on a contact record linked to the network of the IP address asset, such as `Terms of Service`. |
| `ipwhois.objects.notices.description` | The text of a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.notices.links` | Links given in a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.raw` | The raw RDAP object of a contact linked to the network of the IP address asset, when it is kept. |
| `ipwhois.objects.remarks.title` | The title of a remark on a contact record linked to the network of the IP address asset, such as `Registration Comments`. |
| `ipwhois.objects.remarks.description` | The text of a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.roles` | The roles of a contact for the network of the IP address asset, such as `registrant`, `abuse` or `technical`. |
| `ipwhois.objects.status` | The registry status of a contact linked to the network of the IP address asset, such as `validated`. |
| `ipwhois_last_change_data` | The IP WHOIS fields that changed in the last change seen, as field paths under `ipwhois`. |
| `ipdns.ptr_records` | The PTR (reverse DNS) host names of an IP address asset. |
| `ipdns_last_change_data` | The reverse DNS fields that changed in the last change seen, as field paths under `ipdns`. |
| `issue_category_stats.name` | The name of an issue category in the per-category issue counts of the asset, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. |
| `technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the asset, such as `Web servers` or `Analytics`. |
| `domain_snapshot.issue_category_stats.name` | The name of an issue category in the per-category issue counts of the domain and its subdomains together, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the domain and its subdomains together, such as `Web servers` or `Analytics`. Set on domain assets. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.name.length` | The number of characters in the name without the extension: `4` for `acme.example`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois_create_date_historical` | Every creation date seen for the domain over time, so a domain that was deleted and registered again keeps its earlier dates too (UTC date-times). |
| `whois_check_date` | When the WHOIS record of the asset was last checked (UTC date-time). |
| `whois_last_change_date` | When a change in the WHOIS record of the asset was last seen (UTC date-time). |
| `dns.a.value_last_change_date` | When the A record text (`dns.a.value`) last changed (UTC date-time). |
| `dns.a.rcode_last_change_date` | When the response code of the A lookup (`dns.a.rcode`) last changed (UTC date-time). |
| `dns.a.last_change_date` | When the asset's A records last changed, in their text or their response code (UTC date-time). |
| `dns.a.ip_addresses.asn_date` | The registry allocation date that the ASN lookup reports for the A-record address, as a date at midnight UTC. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was created (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was last updated (UTC date-time). |
| `dns.a.ip_addresses.network.events.timestamp` | When an event on the network record of the A-record address happened (UTC date-time). |
| `dns.a.ip_addresses.objects.events.timestamp` | When an event on a contact record linked to the network of the A-record address happened (UTC date-time). |
| `dns.aaaa.value_last_change_date` | When the AAAA record text (`dns.aaaa.value`) last changed (UTC date-time). |
| `dns.aaaa.rcode_last_change_date` | When the response code of the AAAA lookup (`dns.aaaa.rcode`) last changed (UTC date-time). |
| `dns.aaaa.last_change_date` | When the asset's AAAA records last changed, in their text or their response code (UTC date-time). |
| `dns.caa.value_last_change_date` | When the CAA record text (`dns.caa.value`) last changed (UTC date-time). |
| `dns.caa.rcode_last_change_date` | When the response code of the CAA lookup (`dns.caa.rcode`) last changed (UTC date-time). |
| `dns.caa.last_change_date` | When the asset's CAA records last changed, in their text or their response code (UTC date-time). |
| `dns.cname.value_last_change_date` | When the CNAME record text (`dns.cname.value`) last changed (UTC date-time). |
| `dns.cname.rcode_last_change_date` | When the response code of the CNAME lookup (`dns.cname.rcode`) last changed (UTC date-time). |
| `dns.cname.last_change_date` | When the asset's CNAME records last changed, in their text or their response code (UTC date-time). |
| `dns.dnskey.value_last_change_date` | When the DNSKEY record text (`dns.dnskey.value`) last changed (UTC date-time). |
| `dns.dnskey.rcode_last_change_date` | When the response code of the DNSKEY lookup (`dns.dnskey.rcode`) last changed (UTC date-time). |
| `dns.dnskey.last_change_date` | When the asset's DNSKEY records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.value_last_change_date` | When the DS record text (`dns.ds.value`) last changed (UTC date-time). |
| `dns.ds.rcode_last_change_date` | When the response code of the DS lookup (`dns.ds.rcode`) last changed (UTC date-time). |
| `dns.ds.last_change_date` | When the asset's DS records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.records.key_tag` | The key tag (a number) of the DNSKEY that a DS record refers to. |
| `dns.mx.value_last_change_date` | When the MX record text (`dns.mx.value`) last changed (UTC date-time). |
| `dns.mx.rcode_last_change_date` | When the response code of the MX lookup (`dns.mx.rcode`) last changed (UTC date-time). |
| `dns.mx.last_change_date` | When the asset's MX records last changed, in their text or their response code (UTC date-time). |
| `dns.ns.value_last_change_date` | When the NS record text (`dns.ns.value`) last changed (UTC date-time). |
| `dns.ns.rcode_last_change_date` | When the response code of the NS lookup (`dns.ns.rcode`) last changed (UTC date-time). |
| `dns.ns.last_change_date` | When the asset's NS records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec.value_last_change_date` | When the NSEC record text (`dns.nsec.value`) last changed (UTC date-time). |
| `dns.nsec.rcode_last_change_date` | When the response code of the NSEC lookup (`dns.nsec.rcode`) last changed (UTC date-time). |
| `dns.nsec.last_change_date` | When the asset's NSEC records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec3.value_last_change_date` | When the NSEC3 record text (`dns.nsec3.value`) last changed (UTC date-time). |
| `dns.nsec3.rcode_last_change_date` | When the response code of the NSEC3 lookup (`dns.nsec3.rcode`) last changed (UTC date-time). |
| `dns.nsec3.last_change_date` | When the asset's NSEC3 records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.value_last_change_date` | When the RRSIG record text (`dns.rrsig.value`) last changed (UTC date-time). |
| `dns.rrsig.rcode_last_change_date` | When the response code of the RRSIG lookup (`dns.rrsig.rcode`) last changed (UTC date-time). |
| `dns.rrsig.last_change_date` | When the asset's RRSIG records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.signature_inception` | When an RRSIG signature becomes valid (UTC date-time). |
| `dns.rrsig.signature_expiration` | When an RRSIG signature expires (UTC date-time). |
| `dns.soa.value_last_change_date` | When the SOA record text (`dns.soa.value`) last changed (UTC date-time). |
| `dns.soa.rcode_last_change_date` | When the response code of the SOA lookup (`dns.soa.rcode`) last changed (UTC date-time). |
| `dns.soa.last_change_date` | When the asset's SOA records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.value_last_change_date` | When the SRV record text (`dns.srv.value`) last changed (UTC date-time). |
| `dns.srv.rcode_last_change_date` | When the response code of the SRV lookup (`dns.srv.rcode`) last changed (UTC date-time). |
| `dns.srv.last_change_date` | When the asset's SRV records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.records.port` | The port an SRV record points to. |
| `dns.txt.value_last_change_date` | When the TXT record text (`dns.txt.value`) last changed (UTC date-time). |
| `dns.txt.rcode_last_change_date` | When the response code of the TXT lookup (`dns.txt.rcode`) last changed (UTC date-time). |
| `dns.txt.last_change_date` | When the asset's TXT records last changed, in their text or their response code (UTC date-time). |
| `dns_check_date` | When the DNS records of the asset were last checked (UTC date-time). |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.port` | The port that the asset's TLS certificate was collected on, such as `443`. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl.validity.length` | The validity period of the certificate in seconds: 7,776,000 seconds are 90 days. |
| `ssl.extensions.signed_certificate_timestamps.timestamp` | When a Certificate Transparency log recorded the certificate, from a signed certificate timestamp (UTC date-time). |
| `ssl.extensions.signed_certificate_timestamps.version` | The version of a signed certificate timestamp; `0` stands for version 1. |
| `ssl_check_date` | When the TLS certificate of the asset was last checked (UTC date-time). |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the HTTP check, such as `301` or `200`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_check_date` | When the HTTP check of the asset last ran (UTC date-time). |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the web data scan, such as `301` or `200`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata.http.cookies.size` | The size of a cookie set in the web data scan, in bytes (name plus value). |
| `webdata.http.cookies.expires` | When a cookie set in the web data scan expires (UTC date-time); session cookies show `1969-12-31T23:59:59Z`. |
| `webdata.technology.stacks.confidence` | How certain the detection of a technology is, from 0 to 100; every sampled detection has `100`. |
| `webdata.technology.stacks.clean_version` | The major version of a detected technology as a whole number, such as `1` for version `1.0`. |
| `webdata_check_date` | When the web data scan of the asset, which collects the page content, headers and technologies, last ran (UTC date-time). |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn_date` | The registry allocation date that the ASN lookup reports for the IP address asset, as a date at midnight UTC. |
| `ipwhois.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was created (UTC date-time). |
| `ipwhois.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was last updated (UTC date-time). |
| `ipwhois.network.events.timestamp` | When an event on the network record of the IP address asset happened (UTC date-time). |
| `ipwhois.objects.events.timestamp` | When an event on a contact record linked to the network of the IP address asset happened (UTC date-time). |
| `ipwhois_check_date` | When the IP WHOIS record of an IP address asset was last checked (UTC date-time). |
| `ipwhois_last_change_date` | When a change in the IP WHOIS record of an IP address asset was last seen (UTC date-time). |
| `ipdns_check_date` | When the reverse DNS (PTR) records of an IP address asset were last checked (UTC date-time). |
| `ipdns_last_change_date` | When a change in the reverse DNS (PTR) records of an IP address asset was last seen (UTC date-time). |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `open_port_count` | The number of open ports found on the asset. |
| `open_ports` | The open port numbers found on the asset, such as `80`, `443` or `8080`. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_category_stats.count` | The number of active issues in that category on the asset. |
| `issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the asset. |
| `issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the asset. |
| `issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the asset. |
| `issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the asset. |
| `issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the asset. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `issue_count.active_by_severity.low` | The number of active issues of low severity on the asset. |
| `issue_count.active_by_severity.information` | The number of active issues of information severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `technology_count.by_category.count` | The number of technologies in that category on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity on the asset. |
| `vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity on the asset. |
| `vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity on the asset. |
| `vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) on the asset whose severity is `none`. |
| `vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) on the asset whose severity is `unknown`. |
| `security_score` | The asset's External Attack Surface Management (EASM) security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.count` | The number of active issues in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.count` | The number of distinct technologies in that category across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `fqdn.is_idn` | True when the host name is an internationalized domain name (IDN) with non-ASCII characters. |
| `fqdn.name.contains_confusable` | True when the name contains confusable characters that look like other letters, such as Cyrillic `а` for Latin `a`, a common trick in look-alike domains. |
| `fqdn.name.contains_hyphen` | True when the name (without the extension) contains a hyphen. |
| `fqdn.name.contains_letter` | True when the name (without the extension) contains a letter. |
| `fqdn.name.contains_number` | True when the name (without the extension) contains a digit. |
| `fqdn.domain.is_idn` | True when the registrable domain is an internationalized domain name (IDN) with non-ASCII characters. |
| `whois_privacy_enabled` | True when the platform flagged WHOIS privacy protection on the domain's registrant details; set on domain assets. |
| `ssl.signature.is_valid` | True when the asset's TLS certificate passed validation for the host; when false, `ssl.signature.invalid_reason` says why. |
| `ssl.signature.is_valid_chain` | A flag for whether the certificate chain of the asset's TLS certificate is valid. It was true on every sampled certificate, even one whose validation failed with `unable to get issuer certificate`. |
| `ssl.signature.is_self_signed` | True when the asset's TLS certificate is self-signed, that is signed by its own key rather than by a certificate authority. |
| `ssl.extensions.basic_constraints.is_ca` | True when the certificate is a certificate authority (CA) certificate, from its Basic Constraints extension. |
| `ssl.extensions.extended_key_usage.client_auth` | True when the Extended Key Usage extension allows TLS client authentication. |
| `ssl.extensions.extended_key_usage.server_auth` | True when the Extended Key Usage extension allows TLS server authentication, as website certificates need. |
| `ssl.extensions.key_usage.content_commitment` | True when the Key Usage extension allows the certificate's key to be used for content commitment (non-repudiation). |
| `ssl.extensions.key_usage.crl_sign` | True when the Key Usage extension allows the certificate's key to be used for signing certificate revocation lists (CRL sign). |
| `ssl.extensions.key_usage.data_encipherment` | True when the Key Usage extension allows the certificate's key to be used for data encipherment. |
| `ssl.extensions.key_usage.digital_signature` | True when the Key Usage extension allows the certificate's key to be used for digital signatures. |
| `ssl.extensions.key_usage.key_agreement` | True when the Key Usage extension allows the certificate's key to be used for key agreement. |
| `ssl.extensions.key_usage.key_cert_sign` | True when the Key Usage extension allows the certificate's key to be used for signing other certificates (certificate sign). |
| `ssl.extensions.key_usage.key_encipherment` | True when the Key Usage extension allows the certificate's key to be used for key encipherment. |
| `ssl.has_expired` | True when the asset's TLS certificate is past its end date. |
| `http.external_domain_redirection` | True when the HTTP check ended on a different registrable domain than it started on. |
| `http.external_fqdn_redirection` | True when the HTTP check ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.html.inspect_disabled` | A flag of the web data scan that marks pages whose inspection was disabled; it was `false` on every sampled asset. |
| `webdata.html.html_meta.no_index_status` | True when the scanned page asks search engines not to index it (a `noindex` robots directive). |
| `webdata.http.external_domain_redirection` | True when the web data scan ended on a different registrable domain than it started on. |
| `webdata.http.external_fqdn_redirection` | True when the web data scan ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.http.cookies.secure` | True when a cookie set in the web data scan is sent over HTTPS only (Secure attribute). |
| `webdata.http.cookies.http_only` | True when scripts on the page cannot read a cookie set in the web data scan (HttpOnly attribute). |
| `webdata.http.cookies.session` | True when a cookie set in the web data scan is a session cookie, deleted when the browser closes. |
| `is_parked` | True when the asset is parked; Inventory marks it with a P badge whose tooltip shows where it redirects. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `dns.dnskey.records.key_type` | The role of a DNSKEY: `ZSK` (zone-signing key), `KSK` (key-signing key) or `KSK_REVOKED` (revoked key-signing key). |
| `dns.dnskey.records.algorithm` | The DNSSEC algorithm of a DNSKEY, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.algorithm` | The DNSSEC algorithm of the key that a DS record refers to, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.digest_type` | The hash used for a DS record's digest: `SHA1`, `SHA256`, `SHA384`, `GOST` or `NULL`. |
| `dns.rrsig.algorithm` | The DNSSEC algorithm of an RRSIG signature, such as `ECDSAP256SHA256` or `RSASHA256`. |

Operators: not measured

| Field | Description |
|---|---|
| `website.parent_asset.type` | The asset type of the website's parent asset, such as `subdomain`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `website_count` | The number of website assets (`host:port`) in your inventory that belong to this asset. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `open_port_count` | The number of open ports found on the asset. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `security_score` | The asset's EASM security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].asset` | string |  |
| `results[].asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `results[].added_date` | string | date-time |
| `results[].tags` | array of string |  |
| `results[].creation_method` | string | One of `manually_added`, `manually_approved`, `auto_approved` |
| `results[].favicon` | string |  |
| `results[].screenshot` | string |  |
| `results[].thumbnail` | string |  |
| `results[].latest_scan_date` | string | date-time |
| `results[].is_main_asset` | boolean |  |
| `results[].seems_inactive` | boolean |  |
| `results[].seems_inactive_first_seen` | string | date-time |
| `results[].seems_inactive_last_seen` | string | date-time |
| `results[].discovery_enabled` | boolean |  |
| `results[].dns_wildcard_active` | boolean |  |
| `results[].is_login_page` | boolean |  |
| `results[].login_page_probability` | number |  |
| `results[].fqdn` | object |  |
| `results[].website` | object |  |
| `results[].whois` | object |  |
| `results[].whois_privacy_enabled` | boolean |  |
| `results[].whois_registrant_email_historical` | array of string |  |
| `results[].whois_create_date_historical` | array of string |  |
| `results[].whois_normalized` | object |  |
| `results[].whois_check_date` | string | date-time |
| `results[].whois_last_change_date` | string | date-time |
| `results[].whois_last_change_data` | array of string |  |
| `results[].dns` | object |  |
| `results[].dns_check_date` | string | date-time |
| `results[].dns_last_change_date` | string | date-time |
| `results[].dns_last_change_data` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_check_date` | string | date-time |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].ssl_last_change_data` | array of string |  |
| `results[].http` | object |  |
| `results[].http_check_date` | string | date-time |
| `results[].http_last_change_date` | string | date-time |
| `results[].http_last_change_data` | array of string |  |
| `results[].webdata` | object |  |
| `results[].webdata_check_date` | string | date-time |
| `results[].webdata_last_change_date` | string | date-time |
| `results[].webdata_last_change_data` | array of string |  |
| `results[].ipwhois` | object |  |
| `results[].ipwhois_check_date` | string | date-time |
| `results[].ipwhois_last_change_date` | string | date-time |
| `results[].ipwhois_last_change_data` | array of string |  |
| `results[].ipdns` | object |  |
| `results[].ipdns_check_date` | string | date-time |
| `results[].ipdns_last_change_date` | string | date-time |
| `results[].ipdns_last_change_data` | array of string |  |
| `results[].subdomain_count` | integer |  |
| `results[].website_count` | integer |  |
| `results[].pointed_fqdn_count` | integer |  |
| `results[].redirected_domain_count` | integer |  |
| `results[].redirected_asset_count` | integer |  |
| `results[].average_issue_duration` | integer |  |
| `results[].average_fix_duration` | integer |  |
| `results[].is_parked` | boolean |  |
| `results[].open_port_count` | integer |  |
| `results[].open_ports` | array of integer |  |
| `results[].issue_state_stats` | object |  |
| `results[].issue_category_stats` | array of object |  |
| `results[].issue_count` | object |  |
| `results[].technology_count` | object |  |
| `results[].vulnerability_count` | object |  |
| `results[].security_score` | number |  |
| `results[].weight` | integer |  |
| `results[].user_weight` | integer |  |
| `results[].system_weight` | integer |  |
| `results[].domain_snapshot` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].asset` | string |
| `results[].asset_type` | string |
| `results[].added_date` | string |
| `results[].tags` | array |
| `results[].creation_method` | string |
| `results[].favicon` | null |
| `results[].screenshot` | string \| null |
| `results[].thumbnail` | string \| null |
| `results[].latest_scan_date` | string |
| `results[].is_main_asset` | boolean |
| `results[].seems_inactive` | boolean |
| `results[].seems_inactive_first_seen` | null |
| `results[].seems_inactive_last_seen` | null |
| `results[].discovery_enabled` | boolean |
| `results[].dns_wildcard_active` | boolean \| null |
| `results[].is_login_page` | boolean |
| `results[].login_page_probability` | null |
| `results[].fqdn` | object |
| `results[].fqdn.unicode` | string |
| `results[].fqdn.punycode` | string |
| `results[].fqdn.is_idn` | boolean |
| `results[].fqdn.name` | object |
| `results[].fqdn.name.unicode` | string |
| `results[].fqdn.name.contains_confusable` | boolean |
| `results[].fqdn.name.latinized` | array |
| `results[].fqdn.name.contains_hyphen` | boolean |
| `results[].fqdn.name.contains_letter` | boolean |
| `results[].fqdn.name.contains_number` | boolean |
| `results[].fqdn.name.length` | number |
| `results[].fqdn.domain` | object |
| `results[].fqdn.domain.unicode` | string |
| `results[].fqdn.domain.punycode` | string |
| `results[].fqdn.domain.is_idn` | boolean |
| `results[].fqdn.domain.extension` | object |
| `results[].fqdn.domain.extension.unicode` | string |
| `results[].fqdn.domain.extension_root` | object |
| `results[].fqdn.domain.extension_root.unicode` | string |
| `results[].fqdn.domain.extension_sub` | null |
| `results[].fqdn.domain.extension_type` | string |
| `results[].website` | null |
| `results[].whois` | object |
| `results[].whois.create_date` | string |
| `results[].whois.update_date` | string |
| `results[].whois.expiry_date` | string |
| `results[].whois.domain_status` | array<string> |
| `results[].whois.name_servers` | array<string> |
| `results[].whois.registrar` | string |
| `results[].whois.registrant` | object |
| `results[].whois.registrant.organization` | string |
| `results[].whois.registrant.name` | string |
| `results[].whois.registrant.country` | string |
| `results[].whois.registrant.state` | string \| null |
| `results[].whois.registrant.city` | string |
| `results[].whois.registrant.street` | string |
| `results[].whois.registrant.postal_code` | string |
| `results[].whois.registrant.email` | string |
| `results[].whois.registrant.phone` | string |
| `results[].whois_privacy_enabled` | boolean |
| `results[].whois_registrant_email_historical` | array<string> |
| `results[].whois_create_date_historical` | array<string> |
| `results[].whois_normalized` | object |
| `results[].whois_normalized.registrar` | string |
| `results[].whois_normalized.registrant` | object |
| `results[].whois_normalized.registrant.email` | string \| null |
| `results[].whois_normalized.registrant.email_real` | null |
| `results[].whois_normalized.registrant.email_domain_apex` | string \| null |
| `results[].whois_normalized.registrant.email_fqdn_apex` | string \| null |
| `results[].whois_normalized.registrant.organization` | string |
| `results[].whois_normalized.registrant.phone` | string \| null |
| `results[].whois_check_date` | string |
| `results[].whois_last_change_date` | string |
| `results[].whois_last_change_data` | array<string> |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.value` | string |
| `results[].dns.a.value_previous` | null |
| `results[].dns.a.value_last_change_date` | null |
| `results[].dns.a.rcode` | string |
| `results[].dns.a.rcode_previous` | null |
| `results[].dns.a.rcode_last_change_date` | null |
| `results[].dns.a.last_change_date` | null |
| `results[].dns.a.ip_addresses` | array<object> |
| `results[].dns.a.ip_addresses[].asn` | string |
| `results[].dns.a.ip_addresses[].asn_cidr` | string |
| `results[].dns.a.ip_addresses[].asn_description` | string |
| `results[].dns.a.ip_addresses[].asn_country_code` | string |
| `results[].dns.a.ip_addresses[].asn_registry` | string |
| `results[].dns.a.ip_addresses[].entities` | array<string> |
| `results[].dns.a.ip_addresses[].asn_date` | string |
| `results[].dns.a.ip_addresses[].nir` | null |
| `results[].dns.a.ip_addresses[].query` | string |
| `results[].dns.a.ip_addresses[].raw` | null |
| `results[].dns.a.ip_addresses[].network` | object |
| `results[].dns.a.ip_addresses[].network.cidr` | string |
| `results[].dns.a.ip_addresses[].network.name` | string |
| `results[].dns.a.ip_addresses[].network.country` | null |
| `results[].dns.a.ip_addresses[].network.start_address` | string |
| `results[].dns.a.ip_addresses[].network.end_address` | string |
| `results[].dns.a.ip_addresses[].network.handle` | string |
| `results[].dns.a.ip_addresses[].network.ip_version` | string |
| `results[].dns.a.ip_addresses[].network.links` | array<string> |
| `results[].dns.a.ip_addresses[].network.parent_handle` | string |
| `results[].dns.a.ip_addresses[].network.raw` | null |
| `results[].dns.a.ip_addresses[].network.status` | array<string> |
| `results[].dns.a.ip_addresses[].network.type` | string |
| `results[].dns.a.ip_addresses[].network.notices` | array<object> |
| `results[].dns.a.ip_addresses[].network.notices[].title` | string |
| `results[].dns.a.ip_addresses[].network.notices[].description` | string |
| `results[].dns.a.ip_addresses[].network.notices[].links` | array<string> |
| `results[].dns.a.ip_addresses[].network.remarks` | array<object> |
| `results[].dns.a.ip_addresses[].network.remarks[].title` | string |
| `results[].dns.a.ip_addresses[].network.remarks[].description` | string |
| `results[].dns.a.ip_addresses[].network.remarks[].links` | array |
| `results[].dns.a.ip_addresses[].network.events` | array<object> |
| `results[].dns.a.ip_addresses[].network.events[].action` | string |
| `results[].dns.a.ip_addresses[].network.events[].actor` | null |
| `results[].dns.a.ip_addresses[].network.events[].timestamp` | string |
| `results[].dns.a.ip_addresses[].objects` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].uid` | string |
| `results[].dns.a.ip_addresses[].objects[].contact` | object |
| `results[].dns.a.ip_addresses[].objects[].contact.email` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].contact.email[].type` | array |
| `results[].dns.a.ip_addresses[].objects[].contact.email[].value` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.address` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].contact.address[].type` | array |
| `results[].dns.a.ip_addresses[].objects[].contact.address[].value` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.phone` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].contact.phone[].type` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].contact.phone[].value` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.kind` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.name` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.role` | null |
| `results[].dns.a.ip_addresses[].objects[].contact.title` | null |
| `results[].dns.a.ip_addresses[].objects[].entities` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].events` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].events[].action` | string |
| `results[].dns.a.ip_addresses[].objects[].events[].actor` | null |
| `results[].dns.a.ip_addresses[].objects[].events[].timestamp` | string |
| `results[].dns.a.ip_addresses[].objects[].events_actor` | array |
| `results[].dns.a.ip_addresses[].objects[].handle` | string |
| `results[].dns.a.ip_addresses[].objects[].links` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].notices` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].notices[].title` | string |
| `results[].dns.a.ip_addresses[].objects[].notices[].description` | string |
| `results[].dns.a.ip_addresses[].objects[].notices[].links` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].raw` | null |
| `results[].dns.a.ip_addresses[].objects[].remarks` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].remarks[].title` | string |
| `results[].dns.a.ip_addresses[].objects[].remarks[].description` | string |
| `results[].dns.a.ip_addresses[].objects[].remarks[].links` | array |
| `results[].dns.a.ip_addresses[].objects[].roles` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].status` | array<string> |
| `results[].dns.a.ip_addresses[].ip` | string |
| `results[].dns.a.ip_history` | array<string> |
| `results[].dns.aaaa` | object \| null |
| `results[].dns.aaaa.value` | string |
| `results[].dns.aaaa.value_previous` | null |
| `results[].dns.aaaa.value_last_change_date` | null |
| `results[].dns.aaaa.rcode` | string |
| `results[].dns.aaaa.rcode_previous` | null |
| `results[].dns.aaaa.rcode_last_change_date` | null |
| `results[].dns.aaaa.last_change_date` | null |
| `results[].dns.aaaa.ip_addresses` | array<string> |
| `results[].dns.caa` | null |
| `results[].dns.cname` | null |
| `results[].dns.dnskey` | null |
| `results[].dns.ds` | null |
| `results[].dns.ns` | object |
| `results[].dns.ns.value` | string |
| `results[].dns.ns.value_previous` | string \| null |
| `results[].dns.ns.value_last_change_date` | string \| null |
| `results[].dns.ns.rcode` | string |
| `results[].dns.ns.rcode_previous` | null |
| `results[].dns.ns.rcode_last_change_date` | null |
| `results[].dns.ns.last_change_date` | string \| null |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.ns.domains` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.value` | string |
| `results[].dns.mx.value_previous` | null |
| `results[].dns.mx.value_last_change_date` | null |
| `results[].dns.mx.rcode` | string |
| `results[].dns.mx.rcode_previous` | null |
| `results[].dns.mx.rcode_last_change_date` | null |
| `results[].dns.mx.last_change_date` | null |
| `results[].dns.mx.mail_servers` | array<string> |
| `results[].dns.mx.domains` | array<string> |
| `results[].dns.nsec` | null |
| `results[].dns.nsec3` | null |
| `results[].dns.rrsig` | null |
| `results[].dns.soa` | object |
| `results[].dns.soa.value` | string |
| `results[].dns.soa.value_previous` | string \| null |
| `results[].dns.soa.value_last_change_date` | string \| null |
| `results[].dns.soa.rcode` | string |
| `results[].dns.soa.rcode_previous` | null |
| `results[].dns.soa.rcode_last_change_date` | null |
| `results[].dns.soa.last_change_date` | string \| null |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.srv` | null |
| `results[].dns.txt` | object |
| `results[].dns.txt.value` | string |
| `results[].dns.txt.value_previous` | null |
| `results[].dns.txt.value_last_change_date` | null |
| `results[].dns.txt.rcode` | string |
| `results[].dns.txt.rcode_previous` | null |
| `results[].dns.txt.rcode_last_change_date` | null |
| `results[].dns.txt.last_change_date` | null |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.txt.spf_list` | array<object> |
| `results[].dns.txt.spf_list[].value` | string |
| `results[].dns.txt.spf_list[].allowed_domains` | array<string> |
| `results[].dns.txt.spf_list[].allowed_ips` | array |
| `results[].dns.txt.verifications` | array<object> |
| `results[].dns.txt.verifications[].value` | string |
| `results[].dns.txt.verifications[].domain` | string |
| `results[].dns.txt.verifications[].name` | string |
| `results[].dns_check_date` | string |
| `results[].dns_last_change_date` | string \| null |
| `results[].dns_last_change_data` | array<string> |
| `results[].ssl` | object \| null |
| `results[].ssl.target` | string |
| `results[].ssl.port` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | null |
| `results[].ssl.issuer.locality` | null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | null |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.invalid_reason` | null |
| `results[].ssl.signature.is_valid_chain` | boolean |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<object> |
| `results[].ssl.extensions.signed_certificate_timestamps[].log_id` | string |
| `results[].ssl.extensions.signed_certificate_timestamps[].timestamp` | string |
| `results[].ssl.extensions.signed_certificate_timestamps[].version` | number |
| `results[].ssl.extensions.signed_certificate_timestamps[].signature` | string |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.subject_key_info` | object |
| `results[].ssl.subject_key_info.fingerprint` | object |
| `results[].ssl.subject_key_info.fingerprint.hash_algorithm` | string |
| `results[].ssl.subject_key_info.fingerprint.value` | string |
| `results[].ssl.subject_key_info.key_algorithm` | object |
| `results[].ssl.subject_key_info.key_algorithm.name` | string |
| `results[].ssl.version` | object |
| `results[].ssl.version.name` | string |
| `results[].ssl.version.value` | string |
| `results[].ssl.tbs_fingerprint` | string |
| `results[].ssl.certificate` | string |
| `results[].ssl.has_expired` | boolean |
| `results[].ssl.fqdn_list` | array<string> |
| `results[].ssl_check_date` | string |
| `results[].ssl_last_change_date` | string \| null |
| `results[].ssl_last_change_data` | array<string> |
| `results[].http` | object |
| `results[].http.requested_url` | string |
| `results[].http.requested_domain` | string |
| `results[].http.requested_fqdn` | string |
| `results[].http.final_url` | string |
| `results[].http.final_domain` | string |
| `results[].http.final_fqdn` | string |
| `results[].http.redirection_history` | array<object> |
| `results[].http.redirection_history[].url` | string |
| `results[].http.redirection_history[].status_code` | number |
| `results[].http.external_domain_redirection` | boolean |
| `results[].http.external_fqdn_redirection` | boolean |
| `results[].http.first_status_code` | number |
| `results[].http.final_status_code` | number |
| `results[].http.headers` | object |
| `results[].http.headers.accept` | null |
| `results[].http.headers.accept_encoding` | null |
| `results[].http.headers.accept_language` | null |
| `results[].http.headers.access_control_allow_credentials` | null |
| `results[].http.headers.access_control_allow_headers` | null |
| `results[].http.headers.access_control_allow_methods` | null |
| `results[].http.headers.access_control_allow_origin` | string \| null |
| `results[].http.headers.access_control_expose_headers` | null |
| `results[].http.headers.access_control_max_age` | null |
| `results[].http.headers.alt_svc` | null |
| `results[].http.headers.authorization` | null |
| `results[].http.headers.cache_control` | string \| null |
| `results[].http.headers.clear_site_data` | null |
| `results[].http.headers.content_disposition` | null |
| `results[].http.headers.content_encoding` | string |
| `results[].http.headers.content_language` | null |
| `results[].http.headers.content_length` | string \| null |
| `results[].http.headers.content_range` | null |
| `results[].http.headers.content_security_policy` | string \| null |
| `results[].http.headers.content_type` | string |
| `results[].http.headers.cookie` | null |
| `results[].http.headers.cross_origin_embedder_policy` | null |
| `results[].http.headers.cross_origin_opener_policy` | null |
| `results[].http.headers.cross_origin_resource_policy` | null |
| `results[].http.headers.date` | string |
| `results[].http.headers.early_data` | null |
| `results[].http.headers.expect_ct` | null |
| `results[].http.headers.expires` | null |
| `results[].http.headers.feature_policy` | null |
| `results[].http.headers.host` | null |
| `results[].http.headers.if_modified_since` | null |
| `results[].http.headers.if_none_match` | null |
| `results[].http.headers.last_modified` | string \| null |
| `results[].http.headers.origin_isolation` | null |
| `results[].http.headers.others` | array<object> |
| `results[].http.headers.others[].name` | string |
| `results[].http.headers.others[].value` | string |
| `results[].http.headers.permission_policy` | null |
| `results[].http.headers.permissions_policy` | string \| null |
| `results[].http.headers.pragma` | null |
| `results[].http.headers.proxy_authenticate` | null |
| `results[].http.headers.proxy_authorization` | null |
| `results[].http.headers.public_key_pins` | null |
| `results[].http.headers.range` | null |
| `results[].http.headers.referer` | null |
| `results[].http.headers.referrer_policy` | string \| null |
| `results[].http.headers.sec_fetch_dest` | null |
| `results[].http.headers.sec_fetch_mode` | null |
| `results[].http.headers.sec_fetch_site` | null |
| `results[].http.headers.sec_fetch_user` | null |
| `results[].http.headers.server` | string |
| `results[].http.headers.set_cookie` | null |
| `results[].http.headers.strict_transport_security` | string \| null |
| `results[].http.headers.te` | null |
| `results[].http.headers.transfer_encoding` | string \| null |
| `results[].http.headers.upgrade` | null |
| `results[].http.headers.user_agent` | null |
| `results[].http.headers.vary` | string |
| `results[].http.headers.www_authenticate` | null |
| `results[].http.headers.x_content_type_options` | string \| null |
| `results[].http.headers.x_download_options` | null |
| `results[].http.headers.x_frame_options` | string \| null |
| `results[].http.headers.x_permitted_cross_domain_policies` | null |
| `results[].http.headers.x_powered_by` | string \| null |
| `results[].http.headers.x_xss_protection` | null |
| `results[].http.cookies` | array |
| `results[].http.html` | object |
| `results[].http.html.source_code_hash` | string |
| `results[].http_check_date` | string |
| `results[].http_last_change_date` | string |
| `results[].http_last_change_data` | array<string> |
| `results[].webdata` | object \| null |
| `results[].webdata.requested_url` | string |
| `results[].webdata.requested_domain` | string |
| `results[].webdata.requested_fqdn` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.internal_links_fqdns` | array<string> |
| `results[].webdata.html.external_links_domains` | array |
| `results[].webdata.html.external_links_fqdns` | array |
| `results[].webdata.html.external_links` | array |
| `results[].webdata.html.script_links` | array |
| `results[].webdata.html.iframe_links` | array |
| `results[].webdata.html.trackers` | array |
| `results[].webdata.html.emails` | array |
| `results[].webdata.html.emails_internal` | array |
| `results[].webdata.html.inspect_disabled` | boolean |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.html.content_hash` | string |
| `results[].webdata.html.content_top_keywords` | array<string> |
| `results[].webdata.html.favicon_links` | array |
| `results[].webdata.html.html_meta` | object |
| `results[].webdata.html.html_meta.name` | null |
| `results[].webdata.html.html_meta.description` | null |
| `results[].webdata.html.html_meta.language` | string |
| `results[].webdata.html.html_meta.language_alternatives` | array |
| `results[].webdata.html.html_meta.keywords` | array |
| `results[].webdata.html.html_meta.no_index_status` | boolean |
| `results[].webdata.html.html_meta.encoding` | null |
| `results[].webdata.html.html_meta.canonical_url` | null |
| `results[].webdata.html.html_meta.title` | string |
| `results[].webdata.favicon` | array |
| `results[].webdata.http` | object |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.redirection_history[].method` | null |
| `results[].webdata.http.external_domain_redirection` | boolean |
| `results[].webdata.http.external_fqdn_redirection` | boolean |
| `results[].webdata.http.first_status_code` | number |
| `results[].webdata.http.final_status_code` | number |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.accept` | null |
| `results[].webdata.http.headers.accept_encoding` | null |
| `results[].webdata.http.headers.accept_language` | null |
| `results[].webdata.http.headers.access_control_allow_credentials` | null |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.access_control_expose_headers` | null |
| `results[].webdata.http.headers.access_control_max_age` | null |
| `results[].webdata.http.headers.alt_svc` | null |
| `results[].webdata.http.headers.authorization` | null |
| `results[].webdata.http.headers.cache_control` | null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_disposition` | null |
| `results[].webdata.http.headers.content_encoding` | string |
| `results[].webdata.http.headers.content_language` | null |
| `results[].webdata.http.headers.content_length` | string |
| `results[].webdata.http.headers.content_range` | null |
| `results[].webdata.http.headers.content_security_policy` | null |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cookie` | null |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.date` | string |
| `results[].webdata.http.headers.early_data` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.expires` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.host` | null |
| `results[].webdata.http.headers.if_modified_since` | null |
| `results[].webdata.http.headers.if_none_match` | null |
| `results[].webdata.http.headers.last_modified` | string |
| `results[].webdata.http.headers.origin_isolation` | null |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.permissions_policy` | null |
| `results[].webdata.http.headers.pragma` | null |
| `results[].webdata.http.headers.proxy_authenticate` | null |
| `results[].webdata.http.headers.proxy_authorization` | null |
| `results[].webdata.http.headers.public_key_pins` | null |
| `results[].webdata.http.headers.range` | null |
| `results[].webdata.http.headers.referer` | null |
| `results[].webdata.http.headers.referrer_policy` | null |
| `results[].webdata.http.headers.sec_fetch_dest` | null |
| `results[].webdata.http.headers.sec_fetch_mode` | null |
| `results[].webdata.http.headers.sec_fetch_site` | null |
| `results[].webdata.http.headers.sec_fetch_user` | null |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | null |
| `results[].webdata.http.headers.strict_transport_security` | null |
| `results[].webdata.http.headers.te` | null |
| `results[].webdata.http.headers.transfer_encoding` | null |
| `results[].webdata.http.headers.upgrade` | null |
| `results[].webdata.http.headers.user_agent` | null |
| `results[].webdata.http.headers.vary` | string |
| `results[].webdata.http.headers.www_authenticate` | null |
| `results[].webdata.http.headers.x_content_type_options` | null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | string |
| `results[].webdata.http.headers.x_xss_protection` | null |
| `results[].webdata.http.cookies` | array |
| `results[].webdata.technology` | object |
| `results[].webdata.technology.stacks` | array<object> |
| `results[].webdata.technology.stacks[].slug` | string |
| `results[].webdata.technology.stacks[].name` | string |
| `results[].webdata.technology.stacks[].confidence` | number |
| `results[].webdata.technology.stacks[].icon` | string |
| `results[].webdata.technology.stacks[].website` | string |
| `results[].webdata.technology.stacks[].cpe` | string |
| `results[].webdata.technology.stacks[].version` | string |
| `results[].webdata.technology.stacks[].categories` | array<string> |
| `results[].webdata.technology.stacks[].description` | string |
| `results[].webdata.technology.stacks[].clean_version` | null |
| `results[].webdata_check_date` | string \| null |
| `results[].webdata_last_change_date` | string \| null |
| `results[].webdata_last_change_data` | array<string> |
| `results[].ipwhois` | null |
| `results[].ipwhois_check_date` | null |
| `results[].ipwhois_last_change_date` | null |
| `results[].ipwhois_last_change_data` | array |
| `results[].ipdns` | null |
| `results[].ipdns_check_date` | null |
| `results[].ipdns_last_change_date` | null |
| `results[].ipdns_last_change_data` | array |
| `results[].subdomain_count` | number |
| `results[].website_count` | number |
| `results[].pointed_fqdn_count` | null |
| `results[].redirected_domain_count` | number |
| `results[].redirected_asset_count` | number |
| `results[].average_issue_duration` | number |
| `results[].average_fix_duration` | number |
| `results[].is_parked` | boolean |
| `results[].open_port_count` | number |
| `results[].open_ports` | array<number> |
| `results[].issue_state_stats` | object |
| `results[].issue_state_stats.newly_detected` | number |
| `results[].issue_state_stats.reappeared` | number |
| `results[].issue_state_stats.unresolved` | number |
| `results[].issue_state_stats.marked_as_resolved` | number |
| `results[].issue_state_stats.risk_accepted` | number |
| `results[].issue_state_stats.ignored` | number |
| `results[].issue_state_stats.marked_as_false_positive` | number |
| `results[].issue_state_stats.not_applicable` | number |
| `results[].issue_state_stats.verified_resolved` | number |
| `results[].issue_category_stats` | array<object> |
| `results[].issue_category_stats[].name` | string |
| `results[].issue_category_stats[].count` | number |
| `results[].issue_category_stats[].severity_stats` | object |
| `results[].issue_category_stats[].severity_stats.critical` | number |
| `results[].issue_category_stats[].severity_stats.high` | number |
| `results[].issue_category_stats[].severity_stats.medium` | number |
| `results[].issue_category_stats[].severity_stats.low` | number |
| `results[].issue_category_stats[].severity_stats.information` | number |
| `results[].issue_count` | object |
| `results[].issue_count.total` | number |
| `results[].issue_count.active` | number |
| `results[].issue_count.active_by_severity` | object |
| `results[].issue_count.active_by_severity.critical` | number |
| `results[].issue_count.active_by_severity.high` | number |
| `results[].issue_count.active_by_severity.medium` | number |
| `results[].issue_count.active_by_severity.low` | number |
| `results[].issue_count.active_by_severity.information` | number |
| `results[].technology_count` | object |
| `results[].technology_count.total` | number |
| `results[].technology_count.by_category` | array<object> |
| `results[].technology_count.by_category[].name` | string |
| `results[].technology_count.by_category[].count` | number |
| `results[].vulnerability_count` | object |
| `results[].vulnerability_count.total` | number |
| `results[].vulnerability_count.by_severity` | object |
| `results[].vulnerability_count.by_severity.critical` | number |
| `results[].vulnerability_count.by_severity.high` | number |
| `results[].vulnerability_count.by_severity.medium` | number |
| `results[].vulnerability_count.by_severity.low` | number |
| `results[].vulnerability_count.by_severity.none` | number |
| `results[].vulnerability_count.by_severity.unknown` | number |
| `results[].security_score` | number |
| `results[].weight` | number |
| `results[].user_weight` | null |
| `results[].system_weight` | number |
| `results[].domain_snapshot` | object |
| `results[].domain_snapshot.issue_count` | object |
| `results[].domain_snapshot.issue_count.total` | number |
| `results[].domain_snapshot.issue_count.active` | number |
| `results[].domain_snapshot.issue_count.active_by_severity` | object |
| `results[].domain_snapshot.issue_count.active_by_severity.critical` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.high` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.medium` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.low` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.information` | number |
| `results[].domain_snapshot.issue_category_stats` | array<object> |
| `results[].domain_snapshot.issue_category_stats[].name` | string |
| `results[].domain_snapshot.issue_category_stats[].count` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats` | object |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.critical` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.high` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.medium` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.low` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.information` | number |
| `results[].domain_snapshot.issue_state_stats` | object |
| `results[].domain_snapshot.issue_state_stats.newly_detected` | number |
| `results[].domain_snapshot.issue_state_stats.reappeared` | number |
| `results[].domain_snapshot.issue_state_stats.unresolved` | number |
| `results[].domain_snapshot.issue_state_stats.marked_as_resolved` | number |
| `results[].domain_snapshot.issue_state_stats.risk_accepted` | number |
| `results[].domain_snapshot.issue_state_stats.ignored` | number |
| `results[].domain_snapshot.issue_state_stats.marked_as_false_positive` | number |
| `results[].domain_snapshot.issue_state_stats.not_applicable` | number |
| `results[].domain_snapshot.issue_state_stats.verified_resolved` | number |
| `results[].domain_snapshot.average_issue_duration` | number |
| `results[].domain_snapshot.average_fix_duration` | number |
| `results[].domain_snapshot.technology_count` | object |
| `results[].domain_snapshot.technology_count.total` | number |
| `results[].domain_snapshot.technology_count.by_category` | array<object> |
| `results[].domain_snapshot.technology_count.by_category[].name` | string |
| `results[].domain_snapshot.technology_count.by_category[].count` | number |
| `results[].domain_snapshot.open_port_count` | number |
| `results[].domain_snapshot.vulnerability_count` | object |
| `results[].domain_snapshot.vulnerability_count.total` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity` | object |
| `results[].domain_snapshot.vulnerability_count.by_severity.critical` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.high` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.medium` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.low` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.none` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.unknown` | number |
| `results[].domain_snapshot.security_score` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-search.md


---

# Asset Export

URL: https://docs.deepinfo.com/reference/easm/asset-export/

POST /easm/assets/search:export: Exports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array.

`POST https://api.deepinfo.com/v1/easm/assets/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |
| `scope` | Optional | One of: `basic`, `default`, `extended`. |  |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset_type",
        "type": "eq",
        "value": "domain"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the asset, such as a business unit or an environment; each tag is 3 to 100 characters long. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.name.unicode` | The host name without its extension, in Unicode: `acme` for `acme.example`, `www.acme` for `www.acme.example`. |
| `fqdn.name.latinized` | Latin-letter spellings of a name that has non-Latin or accented letters, so a search for `istanbul` also finds names written with `İ`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_sub.unicode` | The second-level part of a two-part extension, such as `co` in `co.uk`; empty for single-part extensions. |
| `website.path` | The URL path of a website asset, such as `/`. |
| `website.scheme` | The URL scheme of a website asset, such as `http`. |
| `website.parent_asset.id` | The ID of the domain or subdomain asset that a website asset belongs to. |
| `website.parent_asset.name` | The name of the domain or subdomain asset that a website asset belongs to. |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.name` | The registrant's name in WHOIS; often a privacy placeholder such as `redacted for privacy`. |
| `whois.registrant.country` | The registrant's country in WHOIS, as a two-letter code in lower case such as `us`. |
| `whois.registrant.state` | The registrant's state or province in WHOIS. |
| `whois.registrant.city` | The registrant's city in WHOIS. |
| `whois.registrant.street` | The registrant's street address in WHOIS. |
| `whois.registrant.postal_code` | The registrant's postal code in WHOIS. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `whois_registrant_email_historical` | Every registrant e-mail address seen for the domain over time, the current one included. |
| `whois_normalized.registrar` | The registrar reduced to a short normalized name, such as `godaddy` or `gandi`, so the same registrar matches across spellings. |
| `whois_normalized.registrant.email` | The registrant e-mail address after WHOIS normalization. |
| `whois_normalized.registrant.email_real` | Another normalized registrant e-mail field, set on fewer domains than `whois_normalized.registrant.email`; in the samples it is set only where `whois_privacy_enabled` is false, with the same address. |
| `whois_normalized.registrant.email_domain_apex` | The registrable domain of the registrant e-mail address: `acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.email_fqdn_apex` | The full host name after the `@` of the registrant e-mail address: `mail.acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.organization` | The registrant organization cleaned up across registrars: lower case, with spaces and punctuation removed, such as `domainsbyproxyllc`. |
| `whois_normalized.registrant.phone` | The registrant phone number reduced to its digits, such as `14805551234`. |
| `whois_last_change_data` | The WHOIS fields that changed in the last change seen, as field paths such as `whois.update_date` or `whois.domain_status`. |
| `dns.a.value` | The asset's current A records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.a.value_previous` | The asset's A records as they were before the last change, in the same text form as `dns.a.value`. |
| `dns.a.rcode` | The DNS response code returned for the asset's A lookup, such as `NOERROR`. |
| `dns.a.rcode_previous` | The DNS response code of the A lookup before it last changed. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.entities` | The handles of the registry contacts and organizations linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, when it is kept. |
| `dns.a.ip_addresses.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the A-record address. |
| `dns.a.ip_addresses.raw` | The raw IP WHOIS response for the A-record address, when it is kept; empty on every sampled asset. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.a.ip_addresses.network.start_address` | The first address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.end_address` | The last address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.handle` | The registry handle of the network that contains the A-record address, such as `NET-192-0-2-0-1`. |
| `dns.a.ip_addresses.network.ip_version` | The IP version of the network that contains the A-record address: `v4` or `v6`. |
| `dns.a.ip_addresses.network.links` | Links to the registry record of the network that contains the A-record address, such as its RDAP and WHOIS URLs. |
| `dns.a.ip_addresses.network.parent_handle` | The handle of the larger network block from which the network of the A-record address was allocated. |
| `dns.a.ip_addresses.network.raw` | The raw RDAP network object for the A-record address, when it is kept. |
| `dns.a.ip_addresses.network.status` | The registry status of the network that contains the A-record address, such as `active`. |
| `dns.a.ip_addresses.network.type` | The registry's allocation type for the network that contains the A-record address, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `dns.a.ip_addresses.network.notices.title` | The title of a notice the registry attached to the network record of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.network.notices.description` | The text of a notice the registry attached to the network record of the A-record address. |
| `dns.a.ip_addresses.network.notices.links` | Links given in a notice on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.title` | The title of a remark on the network record of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.network.remarks.description` | The text of a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.links` | Links given in a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.events.action` | An event in the history of the network record of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.network.events.actor` | Who performed an event on the network record of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the A-record address, such as `abuse`. |
| `dns.a.ip_addresses.objects.contact.email.value` | An e-mail address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.value` | A postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the A-record address, such as `voice` or `work`. |
| `dns.a.ip_addresses.objects.contact.phone.value` | A phone number of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.kind` | What kind of contact is linked to the network of the A-record address: `org`, `group` or `individual`. |
| `dns.a.ip_addresses.objects.contact.name` | The name of a contact or organization linked to the network of the A-record address, such as `Abuse` or a company name. |
| `dns.a.ip_addresses.objects.contact.role` | The role given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.title` | The title given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.entities` | Handles of further entities listed under a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.events.action` | An event in the history of a contact record linked to the network of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.objects.events.actor` | Who performed an event on a contact record linked to the network of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.events_actor` | Events in which a contact linked to the network of the A-record address is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `dns.a.ip_addresses.objects.handle` | The registry handle of a contact or organization linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.links` | Links to the registry record of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.title` | The title of a notice on a contact record linked to the network of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.objects.notices.description` | The text of a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.links` | Links given in a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.raw` | The raw RDAP object of a contact linked to the network of the A-record address, when it is kept. |
| `dns.a.ip_addresses.objects.remarks.title` | The title of a remark on a contact record linked to the network of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.objects.remarks.description` | The text of a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.roles` | The roles of a contact for the network of the A-record address, such as `registrant`, `abuse` or `technical`. |
| `dns.a.ip_addresses.objects.status` | The registry status of a contact linked to the network of the A-record address, such as `validated`. |
| `dns.a.ip_history` | Every IPv4 address seen in the asset's A records over time, the current ones included. |
| `dns.aaaa.value` | The asset's current AAAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.aaaa.value_previous` | The asset's AAAA records as they were before the last change, in the same text form as `dns.aaaa.value`. |
| `dns.aaaa.rcode` | The DNS response code returned for the asset's AAAA lookup, such as `NOERROR`. |
| `dns.aaaa.rcode_previous` | The DNS response code of the AAAA lookup before it last changed. |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the asset's AAAA records. |
| `dns.caa.value` | The asset's current CAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.caa.value_previous` | The asset's CAA records as they were before the last change, in the same text form as `dns.caa.value`. |
| `dns.caa.rcode` | The DNS response code returned for the asset's CAA lookup, such as `NOERROR`. |
| `dns.caa.rcode_previous` | The DNS response code of the CAA lookup before it last changed. |
| `dns.caa.issue_fqdns` | The certificate authorities allowed to issue certificates for the name, from the CAA `issue` tags, such as `fernhill.example` or `kestrel.example`. |
| `dns.caa.issuewild_fqdns` | The certificate authorities allowed to issue wildcard certificates for the name, from the CAA `issuewild` tags. |
| `dns.caa.iodef_emails` | The e-mail addresses from the CAA `iodef` tags, where certificate authorities report requests that break the CAA policy. |
| `dns.cname.value` | The asset's current CNAME records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.cname.value_previous` | The asset's CNAME records as they were before the last change, in the same text form as `dns.cname.value`. |
| `dns.cname.rcode` | The DNS response code returned for the asset's CNAME lookup, such as `NOERROR`. |
| `dns.cname.rcode_previous` | The DNS response code of the CNAME lookup before it last changed. |
| `dns.cname.canonical_fqdns` | The host names the asset's CNAME records point to (the alias targets). |
| `dns.dnskey.value` | The asset's current DNSKEY records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.dnskey.value_previous` | The asset's DNSKEY records as they were before the last change, in the same text form as `dns.dnskey.value`. |
| `dns.dnskey.rcode` | The DNS response code returned for the asset's DNSKEY lookup, such as `NOERROR`. |
| `dns.dnskey.rcode_previous` | The DNS response code of the DNSKEY lookup before it last changed. |
| `dns.dnskey.records.public_key` | The public key of a DNSKEY record, Base64-encoded and split into space-separated groups as in the zone-file text. |
| `dns.ds.value` | The asset's current DS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ds.value_previous` | The asset's DS records as they were before the last change, in the same text form as `dns.ds.value`. |
| `dns.ds.rcode` | The DNS response code returned for the asset's DS lookup, such as `NOERROR`. |
| `dns.ds.rcode_previous` | The DNS response code of the DS lookup before it last changed. |
| `dns.ds.records.digest` | The digest of a DS record, the hash of the DNSKEY it refers to. |
| `dns.mx.value` | The asset's current MX records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.mx.value_previous` | The asset's MX records as they were before the last change, in the same text form as `dns.mx.value`. |
| `dns.mx.rcode` | The DNS response code returned for the asset's MX lookup, such as `NOERROR`. |
| `dns.mx.rcode_previous` | The DNS response code of the MX lookup before it last changed. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns.mx.domains` | The registrable domains of the asset's mail servers, such as `acme.example`. |
| `dns.ns.value` | The asset's current NS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ns.value_previous` | The asset's NS records as they were before the last change, in the same text form as `dns.ns.value`. |
| `dns.ns.rcode` | The DNS response code returned for the asset's NS lookup, such as `NOERROR`. |
| `dns.ns.rcode_previous` | The DNS response code of the NS lookup before it last changed. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.ns.domains` | The registrable domains of the asset's name servers, such as `acme.example`. |
| `dns.nsec.value` | The asset's current NSEC records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec.value_previous` | The asset's NSEC records as they were before the last change, in the same text form as `dns.nsec.value`. |
| `dns.nsec.rcode` | The DNS response code returned for the asset's NSEC lookup, such as `NOERROR`. |
| `dns.nsec.rcode_previous` | The DNS response code of the NSEC lookup before it last changed. |
| `dns.nsec.records.next_domain` | The next name in the zone, from an NSEC record. |
| `dns.nsec.records.record_types` | The record types that exist at the name, from an NSEC record's type list, such as `A`, `NS` or `SOA`. |
| `dns.nsec3.value` | The asset's current NSEC3 records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec3.value_previous` | The asset's NSEC3 records as they were before the last change, in the same text form as `dns.nsec3.value`. |
| `dns.nsec3.rcode` | The DNS response code returned for the asset's NSEC3 lookup, such as `NOERROR`. |
| `dns.nsec3.rcode_previous` | The DNS response code of the NSEC3 lookup before it last changed. |
| `dns.nsec3.records.next_domain_hashed` | The hashed next name in the zone, from an NSEC3 record. |
| `dns.nsec3.records.record_types` | The record types that exist at the name, from an NSEC3 record's type list, such as `A` or `MX`. |
| `dns.rrsig.value` | The asset's current RRSIG records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.rrsig.value_previous` | The asset's RRSIG records as they were before the last change, in the same text form as `dns.rrsig.value`. |
| `dns.rrsig.rcode` | The DNS response code returned for the asset's RRSIG lookup, such as `NOERROR`. |
| `dns.rrsig.rcode_previous` | The DNS response code of the RRSIG lookup before it last changed. |
| `dns.rrsig.type_covered` | The record type that an RRSIG signature covers, such as `A` or `SOA`. |
| `dns.rrsig.signature` | The signature data of an RRSIG record, Base64-encoded. |
| `dns.soa.value` | The asset's current SOA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.soa.value_previous` | The asset's SOA records as they were before the last change, in the same text form as `dns.soa.value`. |
| `dns.soa.rcode` | The DNS response code returned for the asset's SOA lookup, such as `NOERROR`. |
| `dns.soa.rcode_previous` | The DNS response code of the SOA lookup before it last changed. |
| `dns.soa.mnames` | The MNAME of the SOA record: the primary name server of the zone, such as `ns1.acme.example`. |
| `dns.soa.rnames` | The RNAME of the SOA record, the zone administrator's mailbox in DNS form: `hostmaster.acme.example` stands for the mailbox `hostmaster` at `acme.example`. |
| `dns.soa.rname_emails` | The RNAME of the SOA record written as an e-mail address, such as `user@acme.example`. |
| `dns.srv.value` | The asset's current SRV records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.srv.value_previous` | The asset's SRV records as they were before the last change, in the same text form as `dns.srv.value`. |
| `dns.srv.rcode` | The DNS response code returned for the asset's SRV lookup, such as `NOERROR`. |
| `dns.srv.rcode_previous` | The DNS response code of the SRV lookup before it last changed. |
| `dns.srv.records.service` | The service named in an SRV record (the `_service` part of its name). |
| `dns.srv.records.protocol` | The protocol named in an SRV record (the `_proto` part of its name, such as TCP or UDP). |
| `dns.srv.records.target` | The host name an SRV record points to. |
| `dns.txt.value` | The asset's current TXT records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.txt.value_previous` | The asset's TXT records as they were before the last change, in the same text form as `dns.txt.value`. |
| `dns.txt.rcode` | The DNS response code returned for the asset's TXT lookup, such as `NOERROR`. |
| `dns.txt.rcode_previous` | The DNS response code of the TXT lookup before it last changed. |
| `dns.txt.values` | Each TXT record of the asset as its quoted text, such as `"v=spf1 include:_spf.acme.example ~all"`; the quotes are part of the value. |
| `dns.txt.spf_list.value` | The text of an SPF record (a TXT record that starts with `v=spf1`), quoted as in `dns.txt.values`. |
| `dns.txt.spf_list.allowed_domains` | The registrable domains that an SPF record refers to, such as `acme.example` for `include:_spf.acme.example`. |
| `dns.txt.spf_list.allowed_ips` | The IP addresses and ranges that an SPF record authorizes to send mail (its `ip4:` and `ip6:` entries). |
| `dns.txt.verifications.value` | The text of a site-verification TXT record, quoted as in `dns.txt.values`. |
| `dns.txt.verifications.domain` | The domain of the service a verification record is for, such as `acme.example`, `fernhill.example` or `kestrel.example`. |
| `dns.txt.verifications.name` | The name of a verification record, such as `site-verification` or `domain-verification`. |
| `dns_last_change_data` | The DNS fields that changed in the last change seen, as field paths such as `dns.soa.mnames`. |
| `ssl.target` | The host name that the asset's TLS certificate was collected from, normally the asset itself. |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the asset's TLS certificate, as lower-case hex; one fingerprint identifies one certificate. |
| `ssl.issuer.common_name` | The common name (CN) of the certificate authority that issued the asset's TLS certificate, such as `WE1` or `YE2`. |
| `ssl.issuer.country` | The country (C) of the certificate authority that issued the asset's TLS certificate, as a two-letter code such as `US`. |
| `ssl.issuer.state` | The state or province (ST) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.locality` | The locality or city (L) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.organization` | The organization (O) of the certificate authority that issued the asset's TLS certificate, such as `Let's Encrypt` or `Google Trust Services`. |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer_dn` | The full distinguished name of the issuer of the asset's TLS certificate, as one string such as `CN=WE1,O=Google Trust Services,C=US`. |
| `ssl.subject.common_name` | The common name (CN) of the subject (holder) of the asset's TLS certificate, usually a host name such as `acme.example`. |
| `ssl.subject.country` | The country (C) of the subject (holder) of the asset's TLS certificate, as a two-letter code. |
| `ssl.subject.state` | The state or province (ST) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.locality` | The locality or city (L) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organizational_unit` | The organizational unit (OU) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject_dn` | The full distinguished name of the subject of the asset's TLS certificate, such as `CN=acme.example`; one that starts with `CN=*.` belongs to a wildcard certificate. |
| `ssl.signature.value` | The signature of the asset's TLS certificate, Base64-encoded. |
| `ssl.signature.invalid_reason` | Why certificate validation failed, such as a host name mismatch or `unable to get issuer certificate`. |
| `ssl.signature.algorithm.name` | The hash algorithm of the signature on the asset's TLS certificate, such as `sha256` or `sha384`. |
| `ssl.signature.algorithm.oid` | The object identifier (OID) of the signature algorithm, such as `1.2.840.113549.1.1.11` (SHA-256 with RSA) or `1.2.840.10045.4.3.2` (ECDSA with SHA-256). |
| `ssl.extensions.authority_key_id` | The Authority Key Identifier extension, which identifies the issuer's key, Base64-encoded. |
| `ssl.extensions.certificate_policies` | The policy OIDs in the Certificate Policies extension, such as `2.23.140.1.2.1` (domain validated). |
| `ssl.extensions.signed_certificate_timestamps.log_id` | The ID of the Certificate Transparency log that issued a signed certificate timestamp (SCT) for the certificate, Base64-encoded. |
| `ssl.extensions.signed_certificate_timestamps.signature` | The log's signature on a signed certificate timestamp, Base64-encoded. |
| `ssl.extensions.subject_alt_name.dns_names` | The host names in the certificate's Subject Alternative Name extension, including wildcard names such as `*.acme.example`. |
| `ssl.extensions.subject_key_id` | The Subject Key Identifier extension, which identifies the certificate's own key, Base64-encoded. |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | The hash algorithm used for `ssl.subject_key_info.fingerprint.value`, such as `sha256` or `sha384`. |
| `ssl.subject_key_info.fingerprint.value` | A hex fingerprint recorded under the certificate's subject key information, made with the hash in `hash_algorithm`. In the samples it equals `ssl.fingerprint.sha256` when that hash is SHA-256. |
| `ssl.subject_key_info.key_algorithm.name` | The algorithm of the certificate's public key, such as `RSA` or `ECDSA`. |
| `ssl.version.name` | The X.509 version of the certificate, such as `v3`. |
| `ssl.version.value` | The X.509 version as encoded in the certificate, counted from zero: `2` means `v3`. |
| `ssl.tbs_fingerprint` | A SHA-256 fingerprint (hex) of the certificate's to-be-signed part, the certificate content without its signature. |
| `ssl.certificate` | The whole certificate, Base64-encoded (a PEM body without the header and footer lines). |
| `ssl.fqdn_list` | The host names the certificate covers, with the `*.` of wildcard names removed and duplicates merged, so `*.acme.example` and `acme.example` both give `acme.example`. |
| `ssl_last_change_data` | The certificate fields that changed in the last change seen, as field paths such as `ssl.validity.end_date`. |
| `http.requested_url` | The URL the HTTP check started from, such as `http://acme.example`. |
| `http.requested_domain` | The registrable domain of the URL the HTTP check started from. |
| `http.requested_fqdn` | The host name of the URL the HTTP check started from. |
| `http.final_url` | The URL the HTTP check ended on after following all redirects. |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.redirection_history.url` | A URL in the redirect chain of the HTTP check, listed in the order visited. |
| `http.headers.accept` | The `Accept` header, when it was returned in the HTTP check. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the HTTP check. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `http.headers.accept_language` | The `Accept-Language` header, when it was returned in the HTTP check. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the HTTP check; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the HTTP check; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the HTTP check; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the HTTP check; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the HTTP check; it lists the response headers that scripts from other origins may read (CORS). |
| `http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the HTTP check; it says how many seconds browsers may cache a CORS preflight result. |
| `http.headers.alt_svc` | The `Alt-Svc` header returned in the HTTP check; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `http.headers.authorization` | The `Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `http.headers.cache_control` | The `Cache-Control` header returned in the HTTP check; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the HTTP check; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `http.headers.content_disposition` | The `Content-Disposition` header returned in the HTTP check; it says whether the content is shown in the browser or downloaded as a file. |
| `http.headers.content_encoding` | The `Content-Encoding` header returned in the HTTP check; it names the compression applied to the response body, for example `gzip` or `br`. |
| `http.headers.content_language` | The `Content-Language` header returned in the HTTP check; it gives the language of the content, for example `en` or `tr`. |
| `http.headers.content_length` | The `Content-Length` header returned in the HTTP check; it gives the size of the response body in bytes. |
| `http.headers.content_range` | The `Content-Range` header returned in the HTTP check; it says which part of the full body a partial response holds. |
| `http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the HTTP check; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `http.headers.content_type` | The `Content-Type` header returned in the HTTP check; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `http.headers.cookie` | The `Cookie` header, when it was returned in the HTTP check. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the HTTP check; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the HTTP check; it controls whether the page shares its browsing context with cross-origin windows. |
| `http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the HTTP check; it controls which sites may load the resource. |
| `http.headers.date` | The `Date` header returned in the HTTP check; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `http.headers.early_data` | The `Early-Data` header, when it was returned in the HTTP check. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `http.headers.expect_ct` | The `Expect-CT` header returned in the HTTP check; it is a deprecated header about Certificate Transparency enforcement. |
| `http.headers.expires` | The `Expires` header returned in the HTTP check; it gives the date after which the response counts as stale, in HTTP date format. |
| `http.headers.feature_policy` | The `Feature-Policy` header returned in the HTTP check; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `http.headers.host` | The `Host` header, when it was returned in the HTTP check. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the HTTP check. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the HTTP check. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `http.headers.last_modified` | The `Last-Modified` header returned in the HTTP check; it gives the time the server says the resource last changed, in HTTP date format. |
| `http.headers.origin_isolation` | The `Origin-Isolation` header returned in the HTTP check; it is an experimental header that asks browsers to isolate the site's origin. |
| `http.headers.others.name` | The name of a header returned in the HTTP check that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `http.headers.others.value` | The value of a header listed in `headers.others` for the HTTP check. |
| `http.headers.permission_policy` | The `Permission-Policy` header returned in the HTTP check; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `http.headers.permissions_policy` | The `Permissions-Policy` header returned in the HTTP check; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `http.headers.pragma` | The `Pragma` header returned in the HTTP check; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the HTTP check; it tells a client how to authenticate to a proxy. |
| `http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the HTTP check; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `http.headers.range` | The `Range` header, when it was returned in the HTTP check. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `http.headers.referer` | The `Referer` header, when it was returned in the HTTP check. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `http.headers.referrer_policy` | The `Referrer-Policy` header returned in the HTTP check; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the HTTP check. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `http.headers.server` | The `Server` header returned in the HTTP check; it names the server software the site reports, for example `nginx` or `Apache`. |
| `http.headers.set_cookie` | The `Set-Cookie` header returned in the HTTP check; it sets cookies, with their attributes. |
| `http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the HTTP check; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `http.headers.te` | The `TE` header, when it was returned in the HTTP check. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the HTTP check; it says how the body is transferred, for example `chunked`. |
| `http.headers.upgrade` | The `Upgrade` header returned in the HTTP check; it offers or asks for a switch to another protocol. |
| `http.headers.user_agent` | The `User-Agent` header, when it was returned in the HTTP check. It is normally a request header (the client software), so it is rarely set. |
| `http.headers.vary` | The `Vary` header returned in the HTTP check; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the HTTP check; it tells a client how to authenticate, usually with a `401` response. |
| `http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the HTTP check; it stops browsers from guessing the content type when set to `nosniff`. |
| `http.headers.x_download_options` | The `X-Download-Options` header returned in the HTTP check; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `http.headers.x_frame_options` | The `X-Frame-Options` header returned in the HTTP check; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the HTTP check; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `http.headers.x_powered_by` | The `X-Powered-By` header returned in the HTTP check; it names the technology the server reports running on, for example `Express`. |
| `http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the HTTP check; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `http.cookies.name` | The name of a cookie set in the HTTP check. |
| `http.cookies.value` | The value of a cookie set in the HTTP check. |
| `http.html.source_code_hash` | A SHA-256 hash of the page source returned in the HTTP check; the same hash means the same source. |
| `http_last_change_data` | The HTTP check fields that changed in the last change seen, as field paths such as `http.html.source_code_hash`. |
| `webdata.requested_url` | The URL the web data scan started from, such as `http://acme.example`. |
| `webdata.requested_domain` | The registrable domain of the URL the web data scan started from. |
| `webdata.requested_fqdn` | The host name of the URL the web data scan started from. |
| `webdata.html.internal_links_fqdns` | The host names of links on the scanned page that stay within the site's own domain, such as other subdomains. |
| `webdata.html.external_links_domains` | The registrable domains of links on the scanned page that point to other domains, such as `kestrel.example`. |
| `webdata.html.external_links_fqdns` | The host names of links on the scanned page that point to other domains, such as `www.kestrel.example`. |
| `webdata.html.external_links` | The full URLs of links on the scanned page that point to other domains. |
| `webdata.html.script_links` | The URLs of the scripts the scanned page loads. |
| `webdata.html.iframe_links` | The URLs of the frames (iframes) embedded in the scanned page. |
| `webdata.html.trackers.name` | The name of an analytics or advertising tracker found on the scanned page, such as `google_adsense` or `google_tag_manager`. |
| `webdata.html.trackers.values` | The IDs found for a tracker, such as a Google Analytics ID that starts with `G-` or `UA-`. |
| `webdata.html.emails` | The e-mail addresses found on the scanned page. |
| `webdata.html.emails_internal` | The e-mail addresses found on the scanned page that belong to the site's own domain. |
| `webdata.html.source_code_hash` | A SHA-256 hash of the page source in the web data scan; the same hash means the same source. |
| `webdata.html.content_hash` | A SHA-256 hash of the page content in the web data scan, kept apart from `source_code_hash`, the hash of the raw source. |
| `webdata.html.content_top_keywords` | The most frequent words in the text of the scanned page. |
| `webdata.html.favicon_links` | The URLs of the icons the scanned page declares, such as its favicon and touch icons. |
| `webdata.html.html_meta.name` | The site or application name declared in the scanned page's metadata. |
| `webdata.html.html_meta.description` | The meta description of the scanned page. |
| `webdata.html.html_meta.language` | The language the scanned page declares, such as `en`, `tr` or `en-US`. |
| `webdata.html.html_meta.language_alternatives` | The languages of the alternative versions the scanned page links to, such as `en` or `ar`. |
| `webdata.html.html_meta.keywords` | The keywords listed in the keywords meta tag of the scanned page. |
| `webdata.html.html_meta.encoding` | The character encoding the scanned page declares, such as `utf-8`. |
| `webdata.html.html_meta.canonical_url` | The canonical URL the scanned page declares. |
| `webdata.html.html_meta.title` | The title of the scanned page. |
| `webdata.favicon.url` | The URL of a site icon (favicon) recorded by the web data scan. |
| `webdata.favicon.hash` | A SHA-256 hash of a site icon; the same hash means the same icon. |
| `webdata.http.final_url` | The URL the web data scan ended on after following all redirects. |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.redirection_history.url` | A URL in the redirect chain of the web data scan, listed in the order visited. |
| `webdata.http.redirection_history.method` | How a step of the web data scan's redirect chain was made; `http-header` (a redirect sent in the HTTP response) is the value in the samples. |
| `webdata.http.headers.accept` | The `Accept` header, when it was returned in the web data scan. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the web data scan. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_language` | The `Accept-Language` header, when it was returned in the web data scan. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `webdata.http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the web data scan; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `webdata.http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the web data scan; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `webdata.http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the web data scan; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `webdata.http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the web data scan; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `webdata.http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the web data scan; it lists the response headers that scripts from other origins may read (CORS). |
| `webdata.http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the web data scan; it says how many seconds browsers may cache a CORS preflight result. |
| `webdata.http.headers.alt_svc` | The `Alt-Svc` header returned in the web data scan; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `webdata.http.headers.authorization` | The `Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `webdata.http.headers.cache_control` | The `Cache-Control` header returned in the web data scan; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `webdata.http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the web data scan; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `webdata.http.headers.content_disposition` | The `Content-Disposition` header returned in the web data scan; it says whether the content is shown in the browser or downloaded as a file. |
| `webdata.http.headers.content_encoding` | The `Content-Encoding` header returned in the web data scan; it names the compression applied to the response body, for example `gzip` or `br`. |
| `webdata.http.headers.content_language` | The `Content-Language` header returned in the web data scan; it gives the language of the content, for example `en` or `tr`. |
| `webdata.http.headers.content_length` | The `Content-Length` header returned in the web data scan; it gives the size of the response body in bytes. |
| `webdata.http.headers.content_range` | The `Content-Range` header returned in the web data scan; it says which part of the full body a partial response holds. |
| `webdata.http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the web data scan; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `webdata.http.headers.content_type` | The `Content-Type` header returned in the web data scan; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `webdata.http.headers.cookie` | The `Cookie` header, when it was returned in the web data scan. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `webdata.http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the web data scan; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `webdata.http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the web data scan; it controls whether the page shares its browsing context with cross-origin windows. |
| `webdata.http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the web data scan; it controls which sites may load the resource. |
| `webdata.http.headers.date` | The `Date` header returned in the web data scan; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `webdata.http.headers.early_data` | The `Early-Data` header, when it was returned in the web data scan. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `webdata.http.headers.expect_ct` | The `Expect-CT` header returned in the web data scan; it is a deprecated header about Certificate Transparency enforcement. |
| `webdata.http.headers.expires` | The `Expires` header returned in the web data scan; it gives the date after which the response counts as stale, in HTTP date format. |
| `webdata.http.headers.feature_policy` | The `Feature-Policy` header returned in the web data scan; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `webdata.http.headers.host` | The `Host` header, when it was returned in the web data scan. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `webdata.http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the web data scan. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `webdata.http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the web data scan. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `webdata.http.headers.last_modified` | The `Last-Modified` header returned in the web data scan; it gives the time the server says the resource last changed, in HTTP date format. |
| `webdata.http.headers.origin_isolation` | The `Origin-Isolation` header returned in the web data scan; it is an experimental header that asks browsers to isolate the site's origin. |
| `webdata.http.headers.others.name` | The name of a header returned in the web data scan that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `webdata.http.headers.others.value` | The value of a header listed in `headers.others` for the web data scan. |
| `webdata.http.headers.permission_policy` | The `Permission-Policy` header returned in the web data scan; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `webdata.http.headers.permissions_policy` | The `Permissions-Policy` header returned in the web data scan; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `webdata.http.headers.pragma` | The `Pragma` header returned in the web data scan; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `webdata.http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the web data scan; it tells a client how to authenticate to a proxy. |
| `webdata.http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `webdata.http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the web data scan; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `webdata.http.headers.range` | The `Range` header, when it was returned in the web data scan. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `webdata.http.headers.referer` | The `Referer` header, when it was returned in the web data scan. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `webdata.http.headers.referrer_policy` | The `Referrer-Policy` header returned in the web data scan; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `webdata.http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `webdata.http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the web data scan. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `webdata.http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `webdata.http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the web data scan. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `webdata.http.headers.server` | The `Server` header returned in the web data scan; it names the server software the site reports, for example `nginx` or `Apache`. |
| `webdata.http.headers.set_cookie` | The `Set-Cookie` header returned in the web data scan; it sets cookies, with their attributes. |
| `webdata.http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the web data scan; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `webdata.http.headers.te` | The `TE` header, when it was returned in the web data scan. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `webdata.http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the web data scan; it says how the body is transferred, for example `chunked`. |
| `webdata.http.headers.upgrade` | The `Upgrade` header returned in the web data scan; it offers or asks for a switch to another protocol. |
| `webdata.http.headers.user_agent` | The `User-Agent` header, when it was returned in the web data scan. It is normally a request header (the client software), so it is rarely set. |
| `webdata.http.headers.vary` | The `Vary` header returned in the web data scan; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `webdata.http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the web data scan; it tells a client how to authenticate, usually with a `401` response. |
| `webdata.http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the web data scan; it stops browsers from guessing the content type when set to `nosniff`. |
| `webdata.http.headers.x_download_options` | The `X-Download-Options` header returned in the web data scan; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `webdata.http.headers.x_frame_options` | The `X-Frame-Options` header returned in the web data scan; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the web data scan; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `webdata.http.headers.x_powered_by` | The `X-Powered-By` header returned in the web data scan; it names the technology the server reports running on, for example `Express`. |
| `webdata.http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the web data scan; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `webdata.http.cookies.name` | The name of a cookie set in the web data scan. |
| `webdata.http.cookies.value` | The value of a cookie set in the web data scan. |
| `webdata.http.cookies.domain` | The domain a cookie set in the web data scan applies to, such as `.acme.example`. |
| `webdata.http.cookies.path` | The path a cookie set in the web data scan applies to, such as `/`. |
| `webdata.http.cookies.same_party` | The SameParty attribute of a cookie set in the web data scan; in the samples it always holds the same value as `same_site`, such as `Lax` or `None`. |
| `webdata.http.cookies.priority` | The Priority attribute of a cookie set in the web data scan (`Low`, `Medium` or `High` in Chromium-based browsers). |
| `webdata.http.cookies.same_site` | The SameSite attribute of a cookie set in the web data scan, such as `Lax`, `Strict` or `None`. |
| `webdata.technology.stacks.slug` | A short identifier of a technology detected on the site, such as `iis` or `windows-server`. |
| `webdata.technology.stacks.name` | The name of a technology detected on the site, such as `IIS` or `Microsoft ASP.NET`. |
| `webdata.technology.stacks.icon` | The file name of a detected technology's icon, such as `acme.png`. |
| `webdata.technology.stacks.website` | The website of a detected technology's vendor or project. |
| `webdata.technology.stacks.cpe` | The CPE identifier of a detected technology, such as `cpe:/a:acme:acme-portal`, used to match it to known vulnerabilities. |
| `webdata.technology.stacks.version` | The detected version of a technology, such as `1.0`. |
| `webdata.technology.stacks.categories` | The categories of a detected technology, such as `Web servers` or `Operating systems`. |
| `webdata.technology.stacks.description` | A short description of a detected technology. |
| `webdata_last_change_data` | The web data fields that changed in the last change seen, as field paths under `webdata`. |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.entities` | The handles of the registry contacts and organizations linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, when it is kept. |
| `ipwhois.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the IP address asset. |
| `ipwhois.raw` | The raw IP WHOIS response for the IP address asset, when it is kept; empty on every sampled asset. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `ipwhois.network.start_address` | The first address of the registered network block that contains the IP address asset. |
| `ipwhois.network.end_address` | The last address of the registered network block that contains the IP address asset. |
| `ipwhois.network.handle` | The registry handle of the network that contains the IP address asset, such as `NET-192-0-2-0-1`. |
| `ipwhois.network.ip_version` | The IP version of the network that contains the IP address asset: `v4` or `v6`. |
| `ipwhois.network.links` | Links to the registry record of the network that contains the IP address asset, such as its RDAP and WHOIS URLs. |
| `ipwhois.network.parent_handle` | The handle of the larger network block from which the network of the IP address asset was allocated. |
| `ipwhois.network.raw` | The raw RDAP network object for the IP address asset, when it is kept. |
| `ipwhois.network.status` | The registry status of the network that contains the IP address asset, such as `active`. |
| `ipwhois.network.type` | The registry's allocation type for the network that contains the IP address asset, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `ipwhois.network.notices.title` | The title of a notice the registry attached to the network record of the IP address asset, such as `Terms of Service`. |
| `ipwhois.network.notices.description` | The text of a notice the registry attached to the network record of the IP address asset. |
| `ipwhois.network.notices.links` | Links given in a notice on the network record of the IP address asset. |
| `ipwhois.network.remarks.title` | The title of a remark on the network record of the IP address asset, such as `Registration Comments`. |
| `ipwhois.network.remarks.description` | The text of a remark on the network record of the IP address asset. |
| `ipwhois.network.remarks.links` | Links given in a remark on the network record of the IP address asset. |
| `ipwhois.network.events.action` | An event in the history of the network record of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.network.events.actor` | Who performed an event on the network record of the IP address asset, when the registry names one. |
| `ipwhois.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the IP address asset, such as `abuse`. |
| `ipwhois.objects.contact.email.value` | An e-mail address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.value` | A postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the IP address asset, such as `voice` or `work`. |
| `ipwhois.objects.contact.phone.value` | A phone number of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.kind` | What kind of contact is linked to the network of the IP address asset: `org`, `group` or `individual`. |
| `ipwhois.objects.contact.name` | The name of a contact or organization linked to the network of the IP address asset, such as `Abuse` or a company name. |
| `ipwhois.objects.contact.role` | The role given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.contact.title` | The title given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.entities` | Handles of further entities listed under a contact linked to the network of the IP address asset. |
| `ipwhois.objects.events.action` | An event in the history of a contact record linked to the network of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.objects.events.actor` | Who performed an event on a contact record linked to the network of the IP address asset, when the registry names one. |
| `ipwhois.objects.events_actor` | Events in which a contact linked to the network of the IP address asset is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `ipwhois.objects.handle` | The registry handle of a contact or organization linked to the network of the IP address asset. |
| `ipwhois.objects.links` | Links to the registry record of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.notices.title` | The title of a notice on a contact record linked to the network of the IP address asset, such as `Terms of Service`. |
| `ipwhois.objects.notices.description` | The text of a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.notices.links` | Links given in a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.raw` | The raw RDAP object of a contact linked to the network of the IP address asset, when it is kept. |
| `ipwhois.objects.remarks.title` | The title of a remark on a contact record linked to the network of the IP address asset, such as `Registration Comments`. |
| `ipwhois.objects.remarks.description` | The text of a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.roles` | The roles of a contact for the network of the IP address asset, such as `registrant`, `abuse` or `technical`. |
| `ipwhois.objects.status` | The registry status of a contact linked to the network of the IP address asset, such as `validated`. |
| `ipwhois_last_change_data` | The IP WHOIS fields that changed in the last change seen, as field paths under `ipwhois`. |
| `ipdns.ptr_records` | The PTR (reverse DNS) host names of an IP address asset. |
| `ipdns_last_change_data` | The reverse DNS fields that changed in the last change seen, as field paths under `ipdns`. |
| `issue_category_stats.name` | The name of an issue category in the per-category issue counts of the asset, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. |
| `technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the asset, such as `Web servers` or `Analytics`. |
| `domain_snapshot.issue_category_stats.name` | The name of an issue category in the per-category issue counts of the domain and its subdomains together, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the domain and its subdomains together, such as `Web servers` or `Analytics`. Set on domain assets. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.name.length` | The number of characters in the name without the extension: `4` for `acme.example`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois_create_date_historical` | Every creation date seen for the domain over time, so a domain that was deleted and registered again keeps its earlier dates too (UTC date-times). |
| `whois_check_date` | When the WHOIS record of the asset was last checked (UTC date-time). |
| `whois_last_change_date` | When a change in the WHOIS record of the asset was last seen (UTC date-time). |
| `dns.a.value_last_change_date` | When the A record text (`dns.a.value`) last changed (UTC date-time). |
| `dns.a.rcode_last_change_date` | When the response code of the A lookup (`dns.a.rcode`) last changed (UTC date-time). |
| `dns.a.last_change_date` | When the asset's A records last changed, in their text or their response code (UTC date-time). |
| `dns.a.ip_addresses.asn_date` | The registry allocation date that the ASN lookup reports for the A-record address, as a date at midnight UTC. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was created (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was last updated (UTC date-time). |
| `dns.a.ip_addresses.network.events.timestamp` | When an event on the network record of the A-record address happened (UTC date-time). |
| `dns.a.ip_addresses.objects.events.timestamp` | When an event on a contact record linked to the network of the A-record address happened (UTC date-time). |
| `dns.aaaa.value_last_change_date` | When the AAAA record text (`dns.aaaa.value`) last changed (UTC date-time). |
| `dns.aaaa.rcode_last_change_date` | When the response code of the AAAA lookup (`dns.aaaa.rcode`) last changed (UTC date-time). |
| `dns.aaaa.last_change_date` | When the asset's AAAA records last changed, in their text or their response code (UTC date-time). |
| `dns.caa.value_last_change_date` | When the CAA record text (`dns.caa.value`) last changed (UTC date-time). |
| `dns.caa.rcode_last_change_date` | When the response code of the CAA lookup (`dns.caa.rcode`) last changed (UTC date-time). |
| `dns.caa.last_change_date` | When the asset's CAA records last changed, in their text or their response code (UTC date-time). |
| `dns.cname.value_last_change_date` | When the CNAME record text (`dns.cname.value`) last changed (UTC date-time). |
| `dns.cname.rcode_last_change_date` | When the response code of the CNAME lookup (`dns.cname.rcode`) last changed (UTC date-time). |
| `dns.cname.last_change_date` | When the asset's CNAME records last changed, in their text or their response code (UTC date-time). |
| `dns.dnskey.value_last_change_date` | When the DNSKEY record text (`dns.dnskey.value`) last changed (UTC date-time). |
| `dns.dnskey.rcode_last_change_date` | When the response code of the DNSKEY lookup (`dns.dnskey.rcode`) last changed (UTC date-time). |
| `dns.dnskey.last_change_date` | When the asset's DNSKEY records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.value_last_change_date` | When the DS record text (`dns.ds.value`) last changed (UTC date-time). |
| `dns.ds.rcode_last_change_date` | When the response code of the DS lookup (`dns.ds.rcode`) last changed (UTC date-time). |
| `dns.ds.last_change_date` | When the asset's DS records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.records.key_tag` | The key tag (a number) of the DNSKEY that a DS record refers to. |
| `dns.mx.value_last_change_date` | When the MX record text (`dns.mx.value`) last changed (UTC date-time). |
| `dns.mx.rcode_last_change_date` | When the response code of the MX lookup (`dns.mx.rcode`) last changed (UTC date-time). |
| `dns.mx.last_change_date` | When the asset's MX records last changed, in their text or their response code (UTC date-time). |
| `dns.ns.value_last_change_date` | When the NS record text (`dns.ns.value`) last changed (UTC date-time). |
| `dns.ns.rcode_last_change_date` | When the response code of the NS lookup (`dns.ns.rcode`) last changed (UTC date-time). |
| `dns.ns.last_change_date` | When the asset's NS records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec.value_last_change_date` | When the NSEC record text (`dns.nsec.value`) last changed (UTC date-time). |
| `dns.nsec.rcode_last_change_date` | When the response code of the NSEC lookup (`dns.nsec.rcode`) last changed (UTC date-time). |
| `dns.nsec.last_change_date` | When the asset's NSEC records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec3.value_last_change_date` | When the NSEC3 record text (`dns.nsec3.value`) last changed (UTC date-time). |
| `dns.nsec3.rcode_last_change_date` | When the response code of the NSEC3 lookup (`dns.nsec3.rcode`) last changed (UTC date-time). |
| `dns.nsec3.last_change_date` | When the asset's NSEC3 records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.value_last_change_date` | When the RRSIG record text (`dns.rrsig.value`) last changed (UTC date-time). |
| `dns.rrsig.rcode_last_change_date` | When the response code of the RRSIG lookup (`dns.rrsig.rcode`) last changed (UTC date-time). |
| `dns.rrsig.last_change_date` | When the asset's RRSIG records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.signature_inception` | When an RRSIG signature becomes valid (UTC date-time). |
| `dns.rrsig.signature_expiration` | When an RRSIG signature expires (UTC date-time). |
| `dns.soa.value_last_change_date` | When the SOA record text (`dns.soa.value`) last changed (UTC date-time). |
| `dns.soa.rcode_last_change_date` | When the response code of the SOA lookup (`dns.soa.rcode`) last changed (UTC date-time). |
| `dns.soa.last_change_date` | When the asset's SOA records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.value_last_change_date` | When the SRV record text (`dns.srv.value`) last changed (UTC date-time). |
| `dns.srv.rcode_last_change_date` | When the response code of the SRV lookup (`dns.srv.rcode`) last changed (UTC date-time). |
| `dns.srv.last_change_date` | When the asset's SRV records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.records.port` | The port an SRV record points to. |
| `dns.txt.value_last_change_date` | When the TXT record text (`dns.txt.value`) last changed (UTC date-time). |
| `dns.txt.rcode_last_change_date` | When the response code of the TXT lookup (`dns.txt.rcode`) last changed (UTC date-time). |
| `dns.txt.last_change_date` | When the asset's TXT records last changed, in their text or their response code (UTC date-time). |
| `dns_check_date` | When the DNS records of the asset were last checked (UTC date-time). |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.port` | The port that the asset's TLS certificate was collected on, such as `443`. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl.validity.length` | The validity period of the certificate in seconds: 7,776,000 seconds are 90 days. |
| `ssl.extensions.signed_certificate_timestamps.timestamp` | When a Certificate Transparency log recorded the certificate, from a signed certificate timestamp (UTC date-time). |
| `ssl.extensions.signed_certificate_timestamps.version` | The version of a signed certificate timestamp; `0` stands for version 1. |
| `ssl_check_date` | When the TLS certificate of the asset was last checked (UTC date-time). |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the HTTP check, such as `301` or `200`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_check_date` | When the HTTP check of the asset last ran (UTC date-time). |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the web data scan, such as `301` or `200`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata.http.cookies.size` | The size of a cookie set in the web data scan, in bytes (name plus value). |
| `webdata.http.cookies.expires` | When a cookie set in the web data scan expires (UTC date-time); session cookies show `1969-12-31T23:59:59Z`. |
| `webdata.technology.stacks.confidence` | How certain the detection of a technology is, from 0 to 100; every sampled detection has `100`. |
| `webdata.technology.stacks.clean_version` | The major version of a detected technology as a whole number, such as `1` for version `1.0`. |
| `webdata_check_date` | When the web data scan of the asset, which collects the page content, headers and technologies, last ran (UTC date-time). |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn_date` | The registry allocation date that the ASN lookup reports for the IP address asset, as a date at midnight UTC. |
| `ipwhois.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was created (UTC date-time). |
| `ipwhois.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was last updated (UTC date-time). |
| `ipwhois.network.events.timestamp` | When an event on the network record of the IP address asset happened (UTC date-time). |
| `ipwhois.objects.events.timestamp` | When an event on a contact record linked to the network of the IP address asset happened (UTC date-time). |
| `ipwhois_check_date` | When the IP WHOIS record of an IP address asset was last checked (UTC date-time). |
| `ipwhois_last_change_date` | When a change in the IP WHOIS record of an IP address asset was last seen (UTC date-time). |
| `ipdns_check_date` | When the reverse DNS (PTR) records of an IP address asset were last checked (UTC date-time). |
| `ipdns_last_change_date` | When a change in the reverse DNS (PTR) records of an IP address asset was last seen (UTC date-time). |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `open_port_count` | The number of open ports found on the asset. |
| `open_ports` | The open port numbers found on the asset, such as `80`, `443` or `8080`. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_category_stats.count` | The number of active issues in that category on the asset. |
| `issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the asset. |
| `issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the asset. |
| `issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the asset. |
| `issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the asset. |
| `issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the asset. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `issue_count.active_by_severity.low` | The number of active issues of low severity on the asset. |
| `issue_count.active_by_severity.information` | The number of active issues of information severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `technology_count.by_category.count` | The number of technologies in that category on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity on the asset. |
| `vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity on the asset. |
| `vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity on the asset. |
| `vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) on the asset whose severity is `none`. |
| `vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) on the asset whose severity is `unknown`. |
| `security_score` | The asset's External Attack Surface Management (EASM) security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.count` | The number of active issues in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.count` | The number of distinct technologies in that category across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `fqdn.is_idn` | True when the host name is an internationalized domain name (IDN) with non-ASCII characters. |
| `fqdn.name.contains_confusable` | True when the name contains confusable characters that look like other letters, such as Cyrillic `а` for Latin `a`, a common trick in look-alike domains. |
| `fqdn.name.contains_hyphen` | True when the name (without the extension) contains a hyphen. |
| `fqdn.name.contains_letter` | True when the name (without the extension) contains a letter. |
| `fqdn.name.contains_number` | True when the name (without the extension) contains a digit. |
| `fqdn.domain.is_idn` | True when the registrable domain is an internationalized domain name (IDN) with non-ASCII characters. |
| `whois_privacy_enabled` | True when the platform flagged WHOIS privacy protection on the domain's registrant details; set on domain assets. |
| `ssl.signature.is_valid` | True when the asset's TLS certificate passed validation for the host; when false, `ssl.signature.invalid_reason` says why. |
| `ssl.signature.is_valid_chain` | A flag for whether the certificate chain of the asset's TLS certificate is valid. It was true on every sampled certificate, even one whose validation failed with `unable to get issuer certificate`. |
| `ssl.signature.is_self_signed` | True when the asset's TLS certificate is self-signed, that is signed by its own key rather than by a certificate authority. |
| `ssl.extensions.basic_constraints.is_ca` | True when the certificate is a certificate authority (CA) certificate, from its Basic Constraints extension. |
| `ssl.extensions.extended_key_usage.client_auth` | True when the Extended Key Usage extension allows TLS client authentication. |
| `ssl.extensions.extended_key_usage.server_auth` | True when the Extended Key Usage extension allows TLS server authentication, as website certificates need. |
| `ssl.extensions.key_usage.content_commitment` | True when the Key Usage extension allows the certificate's key to be used for content commitment (non-repudiation). |
| `ssl.extensions.key_usage.crl_sign` | True when the Key Usage extension allows the certificate's key to be used for signing certificate revocation lists (CRL sign). |
| `ssl.extensions.key_usage.data_encipherment` | True when the Key Usage extension allows the certificate's key to be used for data encipherment. |
| `ssl.extensions.key_usage.digital_signature` | True when the Key Usage extension allows the certificate's key to be used for digital signatures. |
| `ssl.extensions.key_usage.key_agreement` | True when the Key Usage extension allows the certificate's key to be used for key agreement. |
| `ssl.extensions.key_usage.key_cert_sign` | True when the Key Usage extension allows the certificate's key to be used for signing other certificates (certificate sign). |
| `ssl.extensions.key_usage.key_encipherment` | True when the Key Usage extension allows the certificate's key to be used for key encipherment. |
| `ssl.has_expired` | True when the asset's TLS certificate is past its end date. |
| `http.external_domain_redirection` | True when the HTTP check ended on a different registrable domain than it started on. |
| `http.external_fqdn_redirection` | True when the HTTP check ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.html.inspect_disabled` | A flag of the web data scan that marks pages whose inspection was disabled; it was `false` on every sampled asset. |
| `webdata.html.html_meta.no_index_status` | True when the scanned page asks search engines not to index it (a `noindex` robots directive). |
| `webdata.http.external_domain_redirection` | True when the web data scan ended on a different registrable domain than it started on. |
| `webdata.http.external_fqdn_redirection` | True when the web data scan ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.http.cookies.secure` | True when a cookie set in the web data scan is sent over HTTPS only (Secure attribute). |
| `webdata.http.cookies.http_only` | True when scripts on the page cannot read a cookie set in the web data scan (HttpOnly attribute). |
| `webdata.http.cookies.session` | True when a cookie set in the web data scan is a session cookie, deleted when the browser closes. |
| `is_parked` | True when the asset is parked; Inventory marks it with a P badge whose tooltip shows where it redirects. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `dns.dnskey.records.key_type` | The role of a DNSKEY: `ZSK` (zone-signing key), `KSK` (key-signing key) or `KSK_REVOKED` (revoked key-signing key). |
| `dns.dnskey.records.algorithm` | The DNSSEC algorithm of a DNSKEY, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.algorithm` | The DNSSEC algorithm of the key that a DS record refers to, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.digest_type` | The hash used for a DS record's digest: `SHA1`, `SHA256`, `SHA384`, `GOST` or `NULL`. |
| `dns.rrsig.algorithm` | The DNSSEC algorithm of an RRSIG signature, such as `ECDSAP256SHA256` or `RSASHA256`. |

Operators: not measured

| Field | Description |
|---|---|
| `website.parent_asset.type` | The asset type of the website's parent asset, such as `subdomain`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `website_count` | The number of website assets (`host:port`) in your inventory that belong to this asset. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `open_port_count` | The number of open ports found on the asset. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `security_score` | The asset's EASM security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-export.md


---

# Asset Detail

URL: https://docs.deepinfo.com/reference/easm/asset-detail/

GET /easm/assets/{asset_id}: Returns everything Deepinfo knows about one asset: latest WHOIS, DNS, SSL, HTTP and web data, open ports, technologies, issue and…

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}`

Returns everything Deepinfo knows about one asset: latest WHOIS, DNS, SSL, HTTP and web data, open ports, technologies, issue and vulnerability counts, and security score.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `asset` | string |  |
| `asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `added_date` | string | date-time |
| `tags` | array of string |  |
| `creation_method` | string | One of `manually_added`, `manually_approved`, `auto_approved` |
| `favicon` | string |  |
| `screenshot` | string |  |
| `thumbnail` | string |  |
| `latest_scan_date` | string | date-time |
| `is_main_asset` | boolean |  |
| `seems_inactive` | boolean |  |
| `seems_inactive_first_seen` | string | date-time |
| `seems_inactive_last_seen` | string | date-time |
| `discovery_enabled` | boolean |  |
| `dns_wildcard_active` | boolean |  |
| `is_login_page` | boolean |  |
| `login_page_probability` | number |  |
| `fqdn` | object |  |
| `website` | object |  |
| `whois` | object |  |
| `whois_privacy_enabled` | boolean |  |
| `whois_registrant_email_historical` | array of string |  |
| `whois_create_date_historical` | array of string |  |
| `whois_normalized` | object |  |
| `whois_check_date` | string | date-time |
| `whois_last_change_date` | string | date-time |
| `whois_last_change_data` | array of string |  |
| `dns` | object |  |
| `dns_check_date` | string | date-time |
| `dns_last_change_date` | string | date-time |
| `dns_last_change_data` | array of string |  |
| `ssl` | object |  |
| `ssl_check_date` | string | date-time |
| `ssl_last_change_date` | string | date-time |
| `ssl_last_change_data` | array of string |  |
| `http` | object |  |
| `http_check_date` | string | date-time |
| `http_last_change_date` | string | date-time |
| `http_last_change_data` | array of string |  |
| `webdata` | object |  |
| `webdata_check_date` | string | date-time |
| `webdata_last_change_date` | string | date-time |
| `webdata_last_change_data` | array of string |  |
| `ipwhois` | object |  |
| `ipwhois_check_date` | string | date-time |
| `ipwhois_last_change_date` | string | date-time |
| `ipwhois_last_change_data` | array of string |  |
| `ipdns` | object |  |
| `ipdns_check_date` | string | date-time |
| `ipdns_last_change_date` | string | date-time |
| `ipdns_last_change_data` | array of string |  |
| `subdomain_count` | integer |  |
| `website_count` | integer |  |
| `pointed_fqdn_count` | integer |  |
| `redirected_domain_count` | integer |  |
| `redirected_asset_count` | integer |  |
| `average_issue_duration` | integer |  |
| `average_fix_duration` | integer |  |
| `is_parked` | boolean |  |
| `open_port_count` | integer |  |
| `open_ports` | array of integer |  |
| `issue_state_stats` | object |  |
| `issue_category_stats` | array of object |  |
| `issue_count` | object |  |
| `technology_count` | object |  |
| `vulnerability_count` | object |  |
| `security_score` | number |  |
| `weight` | integer |  |
| `user_weight` | integer |  |
| `system_weight` | integer |  |
| `domain_snapshot` | object |  |
| `domain_asset` | object |  |
| `weight_last_update_date` | string | date-time |
| `user_weight_last_update_date` | string | date-time |
| `system_weight_last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `asset` | string |
| `asset_type` | string |
| `added_date` | string |
| `tags` | array |
| `creation_method` | string |
| `favicon` | null |
| `screenshot` | null |
| `thumbnail` | null |
| `latest_scan_date` | string |
| `is_main_asset` | boolean |
| `seems_inactive` | boolean |
| `seems_inactive_first_seen` | null |
| `seems_inactive_last_seen` | null |
| `discovery_enabled` | boolean |
| `dns_wildcard_active` | null |
| `is_login_page` | boolean |
| `login_page_probability` | null |
| `fqdn` | object |
| `fqdn.unicode` | string |
| `fqdn.punycode` | string |
| `fqdn.is_idn` | boolean |
| `fqdn.name` | object |
| `fqdn.name.unicode` | string |
| `fqdn.name.contains_confusable` | boolean |
| `fqdn.name.latinized` | array |
| `fqdn.name.contains_hyphen` | boolean |
| `fqdn.name.contains_letter` | boolean |
| `fqdn.name.contains_number` | boolean |
| `fqdn.name.length` | number |
| `fqdn.domain` | object |
| `fqdn.domain.unicode` | string |
| `fqdn.domain.punycode` | string |
| `fqdn.domain.is_idn` | boolean |
| `fqdn.domain.extension` | object |
| `fqdn.domain.extension.unicode` | string |
| `fqdn.domain.extension_root` | object |
| `fqdn.domain.extension_root.unicode` | string |
| `fqdn.domain.extension_sub` | null |
| `fqdn.domain.extension_type` | string |
| `website` | null |
| `whois` | object |
| `whois.create_date` | string |
| `whois.update_date` | string |
| `whois.expiry_date` | string |
| `whois.domain_status` | array<string> |
| `whois.name_servers` | array<string> |
| `whois.registrar` | string |
| `whois.registrant` | object |
| `whois.registrant.organization` | string |
| `whois.registrant.name` | string |
| `whois.registrant.country` | string |
| `whois.registrant.state` | string |
| `whois.registrant.city` | string |
| `whois.registrant.street` | string |
| `whois.registrant.postal_code` | string |
| `whois.registrant.email` | string |
| `whois.registrant.phone` | string |
| `whois_privacy_enabled` | boolean |
| `whois_registrant_email_historical` | array<string> |
| `whois_create_date_historical` | array<string> |
| `whois_normalized` | object |
| `whois_normalized.registrar` | string |
| `whois_normalized.registrant` | object |
| `whois_normalized.registrant.email` | null |
| `whois_normalized.registrant.email_real` | null |
| `whois_normalized.registrant.email_domain_apex` | null |
| `whois_normalized.registrant.email_fqdn_apex` | null |
| `whois_normalized.registrant.organization` | string |
| `whois_normalized.registrant.phone` | string |
| `whois_check_date` | string |
| `whois_last_change_date` | string |
| `whois_last_change_data` | array<string> |
| `dns` | object |
| `dns.a` | object |
| `dns.a.value` | string |
| `dns.a.value_previous` | null |
| `dns.a.value_last_change_date` | null |
| `dns.a.rcode` | string |
| `dns.a.rcode_previous` | null |
| `dns.a.rcode_last_change_date` | null |
| `dns.a.last_change_date` | null |
| `dns.a.ip_addresses` | array<object> |
| `dns.a.ip_addresses[].asn` | string |
| `dns.a.ip_addresses[].asn_cidr` | string |
| `dns.a.ip_addresses[].asn_description` | string |
| `dns.a.ip_addresses[].asn_country_code` | string |
| `dns.a.ip_addresses[].asn_registry` | string |
| `dns.a.ip_addresses[].entities` | array<string> |
| `dns.a.ip_addresses[].asn_date` | string |
| `dns.a.ip_addresses[].nir` | null |
| `dns.a.ip_addresses[].query` | string |
| `dns.a.ip_addresses[].raw` | null |
| `dns.a.ip_addresses[].network` | object |
| `dns.a.ip_addresses[].network.cidr` | string |
| `dns.a.ip_addresses[].network.name` | string |
| `dns.a.ip_addresses[].network.country` | null |
| `dns.a.ip_addresses[].network.start_address` | string |
| `dns.a.ip_addresses[].network.end_address` | string |
| `dns.a.ip_addresses[].network.handle` | string |
| `dns.a.ip_addresses[].network.ip_version` | string |
| `dns.a.ip_addresses[].network.links` | array<string> |
| `dns.a.ip_addresses[].network.parent_handle` | string |
| `dns.a.ip_addresses[].network.raw` | null |
| `dns.a.ip_addresses[].network.status` | array<string> |
| `dns.a.ip_addresses[].network.type` | string |
| `dns.a.ip_addresses[].network.notices` | array<object> |
| `dns.a.ip_addresses[].network.notices[].title` | string |
| `dns.a.ip_addresses[].network.notices[].description` | string |
| `dns.a.ip_addresses[].network.notices[].links` | array<string> |
| `dns.a.ip_addresses[].network.remarks` | array<object> |
| `dns.a.ip_addresses[].network.remarks[].title` | string |
| `dns.a.ip_addresses[].network.remarks[].description` | string |
| `dns.a.ip_addresses[].network.remarks[].links` | array |
| `dns.a.ip_addresses[].network.events` | array<object> |
| `dns.a.ip_addresses[].network.events[].action` | string |
| `dns.a.ip_addresses[].network.events[].actor` | null |
| `dns.a.ip_addresses[].network.events[].timestamp` | string |
| `dns.a.ip_addresses[].objects` | array<object> |
| `dns.a.ip_addresses[].objects[].uid` | string |
| `dns.a.ip_addresses[].objects[].contact` | object |
| `dns.a.ip_addresses[].objects[].contact.email` | array<object> |
| `dns.a.ip_addresses[].objects[].contact.email[].type` | array |
| `dns.a.ip_addresses[].objects[].contact.email[].value` | string |
| `dns.a.ip_addresses[].objects[].contact.address` | array<object> |
| `dns.a.ip_addresses[].objects[].contact.address[].type` | array |
| `dns.a.ip_addresses[].objects[].contact.address[].value` | string |
| `dns.a.ip_addresses[].objects[].contact.phone` | array<object> |
| `dns.a.ip_addresses[].objects[].contact.phone[].type` | array<string> |
| `dns.a.ip_addresses[].objects[].contact.phone[].value` | string |
| `dns.a.ip_addresses[].objects[].contact.kind` | string |
| `dns.a.ip_addresses[].objects[].contact.name` | string |
| `dns.a.ip_addresses[].objects[].contact.role` | null |
| `dns.a.ip_addresses[].objects[].contact.title` | null |
| `dns.a.ip_addresses[].objects[].entities` | array<string> |
| `dns.a.ip_addresses[].objects[].events` | array<object> |
| `dns.a.ip_addresses[].objects[].events[].action` | string |
| `dns.a.ip_addresses[].objects[].events[].actor` | null |
| `dns.a.ip_addresses[].objects[].events[].timestamp` | string |
| `dns.a.ip_addresses[].objects[].events_actor` | array |
| `dns.a.ip_addresses[].objects[].handle` | string |
| `dns.a.ip_addresses[].objects[].links` | array<string> |
| `dns.a.ip_addresses[].objects[].notices` | array |
| `dns.a.ip_addresses[].objects[].raw` | null |
| `dns.a.ip_addresses[].objects[].remarks` | array<object> |
| `dns.a.ip_addresses[].objects[].remarks[].title` | string |
| `dns.a.ip_addresses[].objects[].remarks[].description` | string |
| `dns.a.ip_addresses[].objects[].remarks[].links` | array |
| `dns.a.ip_addresses[].objects[].roles` | array<string> |
| `dns.a.ip_addresses[].objects[].status` | array |
| `dns.a.ip_addresses[].ip` | string |
| `dns.a.ip_history` | array<string> |
| `dns.aaaa` | object |
| `dns.aaaa.value` | string |
| `dns.aaaa.value_previous` | null |
| `dns.aaaa.value_last_change_date` | null |
| `dns.aaaa.rcode` | string |
| `dns.aaaa.rcode_previous` | null |
| `dns.aaaa.rcode_last_change_date` | null |
| `dns.aaaa.last_change_date` | null |
| `dns.aaaa.ip_addresses` | array<string> |
| `dns.caa` | null |
| `dns.cname` | null |
| `dns.dnskey` | null |
| `dns.ds` | null |
| `dns.ns` | object |
| `dns.ns.value` | string |
| `dns.ns.value_previous` | null |
| `dns.ns.value_last_change_date` | null |
| `dns.ns.rcode` | string |
| `dns.ns.rcode_previous` | null |
| `dns.ns.rcode_last_change_date` | null |
| `dns.ns.last_change_date` | null |
| `dns.ns.name_servers` | array<string> |
| `dns.ns.domains` | array<string> |
| `dns.mx` | object |
| `dns.mx.value` | string |
| `dns.mx.value_previous` | null |
| `dns.mx.value_last_change_date` | null |
| `dns.mx.rcode` | string |
| `dns.mx.rcode_previous` | null |
| `dns.mx.rcode_last_change_date` | null |
| `dns.mx.last_change_date` | null |
| `dns.mx.mail_servers` | array<string> |
| `dns.mx.domains` | array<string> |
| `dns.nsec` | null |
| `dns.nsec3` | null |
| `dns.rrsig` | null |
| `dns.soa` | object |
| `dns.soa.value` | string |
| `dns.soa.value_previous` | null |
| `dns.soa.value_last_change_date` | null |
| `dns.soa.rcode` | string |
| `dns.soa.rcode_previous` | null |
| `dns.soa.rcode_last_change_date` | null |
| `dns.soa.last_change_date` | null |
| `dns.soa.mnames` | array<string> |
| `dns.soa.rnames` | array<string> |
| `dns.soa.rname_emails` | array<string> |
| `dns.srv` | null |
| `dns.txt` | object |
| `dns.txt.value` | string |
| `dns.txt.value_previous` | null |
| `dns.txt.value_last_change_date` | null |
| `dns.txt.rcode` | string |
| `dns.txt.rcode_previous` | null |
| `dns.txt.rcode_last_change_date` | null |
| `dns.txt.last_change_date` | null |
| `dns.txt.values` | array<string> |
| `dns.txt.spf_list` | array<object> |
| `dns.txt.spf_list[].value` | string |
| `dns.txt.spf_list[].allowed_domains` | array<string> |
| `dns.txt.spf_list[].allowed_ips` | array |
| `dns.txt.verifications` | array<object> |
| `dns.txt.verifications[].value` | string |
| `dns.txt.verifications[].domain` | string |
| `dns.txt.verifications[].name` | string |
| `dns_check_date` | string |
| `dns_last_change_date` | null |
| `dns_last_change_data` | array |
| `ssl` | object |
| `ssl.target` | string |
| `ssl.port` | number |
| `ssl.serial_number` | string |
| `ssl.fingerprint` | object |
| `ssl.fingerprint.md5` | string |
| `ssl.fingerprint.sha1` | string |
| `ssl.fingerprint.sha256` | string |
| `ssl.issuer` | object |
| `ssl.issuer.common_name` | string |
| `ssl.issuer.country` | string |
| `ssl.issuer.state` | null |
| `ssl.issuer.locality` | null |
| `ssl.issuer.organization` | string |
| `ssl.issuer.organizational_unit` | null |
| `ssl.issuer_dn` | string |
| `ssl.subject` | object |
| `ssl.subject.common_name` | string |
| `ssl.subject.country` | null |
| `ssl.subject.state` | null |
| `ssl.subject.locality` | null |
| `ssl.subject.organization` | null |
| `ssl.subject.organizational_unit` | null |
| `ssl.subject_dn` | string |
| `ssl.signature` | object |
| `ssl.signature.value` | string |
| `ssl.signature.is_valid` | boolean |
| `ssl.signature.invalid_reason` | null |
| `ssl.signature.is_valid_chain` | boolean |
| `ssl.signature.is_self_signed` | boolean |
| `ssl.signature.algorithm` | object |
| `ssl.signature.algorithm.name` | string |
| `ssl.signature.algorithm.oid` | string |
| `ssl.validity` | object |
| `ssl.validity.start_date` | string |
| `ssl.validity.end_date` | string |
| `ssl.validity.length` | number |
| `ssl.extensions` | object |
| `ssl.extensions.authority_key_id` | string |
| `ssl.extensions.basic_constraints` | object |
| `ssl.extensions.basic_constraints.is_ca` | boolean |
| `ssl.extensions.certificate_policies` | array<string> |
| `ssl.extensions.extended_key_usage` | object |
| `ssl.extensions.extended_key_usage.client_auth` | null |
| `ssl.extensions.extended_key_usage.server_auth` | boolean |
| `ssl.extensions.key_usage` | object |
| `ssl.extensions.key_usage.content_commitment` | boolean |
| `ssl.extensions.key_usage.crl_sign` | boolean |
| `ssl.extensions.key_usage.data_encipherment` | boolean |
| `ssl.extensions.key_usage.digital_signature` | boolean |
| `ssl.extensions.key_usage.key_agreement` | boolean |
| `ssl.extensions.key_usage.key_cert_sign` | boolean |
| `ssl.extensions.key_usage.key_encipherment` | boolean |
| `ssl.extensions.signed_certificate_timestamps` | array<object> |
| `ssl.extensions.signed_certificate_timestamps[].log_id` | string |
| `ssl.extensions.signed_certificate_timestamps[].timestamp` | string |
| `ssl.extensions.signed_certificate_timestamps[].version` | number |
| `ssl.extensions.signed_certificate_timestamps[].signature` | string |
| `ssl.extensions.subject_alt_name` | object |
| `ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `ssl.extensions.subject_key_id` | string |
| `ssl.subject_key_info` | object |
| `ssl.subject_key_info.fingerprint` | object |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | string |
| `ssl.subject_key_info.fingerprint.value` | string |
| `ssl.subject_key_info.key_algorithm` | object |
| `ssl.subject_key_info.key_algorithm.name` | string |
| `ssl.version` | object |
| `ssl.version.name` | string |
| `ssl.version.value` | string |
| `ssl.tbs_fingerprint` | string |
| `ssl.certificate` | string |
| `ssl.has_expired` | boolean |
| `ssl.fqdn_list` | array<string> |
| `ssl_check_date` | string |
| `ssl_last_change_date` | string |
| `ssl_last_change_data` | array<string> |
| `http` | object |
| `http.requested_url` | string |
| `http.requested_domain` | string |
| `http.requested_fqdn` | string |
| `http.final_url` | string |
| `http.final_domain` | string |
| `http.final_fqdn` | string |
| `http.redirection_history` | array<object> |
| `http.redirection_history[].url` | string |
| `http.redirection_history[].status_code` | number |
| `http.external_domain_redirection` | boolean |
| `http.external_fqdn_redirection` | boolean |
| `http.first_status_code` | number |
| `http.final_status_code` | number |
| `http.headers` | object |
| `http.headers.accept` | null |
| `http.headers.accept_encoding` | null |
| `http.headers.accept_language` | null |
| `http.headers.access_control_allow_credentials` | null |
| `http.headers.access_control_allow_headers` | null |
| `http.headers.access_control_allow_methods` | null |
| `http.headers.access_control_allow_origin` | string |
| `http.headers.access_control_expose_headers` | null |
| `http.headers.access_control_max_age` | null |
| `http.headers.alt_svc` | null |
| `http.headers.authorization` | null |
| `http.headers.cache_control` | string |
| `http.headers.clear_site_data` | null |
| `http.headers.content_disposition` | null |
| `http.headers.content_encoding` | string |
| `http.headers.content_language` | null |
| `http.headers.content_length` | null |
| `http.headers.content_range` | null |
| `http.headers.content_security_policy` | string |
| `http.headers.content_type` | string |
| `http.headers.cookie` | null |
| `http.headers.cross_origin_embedder_policy` | null |
| `http.headers.cross_origin_opener_policy` | null |
| `http.headers.cross_origin_resource_policy` | null |
| `http.headers.date` | string |
| `http.headers.early_data` | null |
| `http.headers.expect_ct` | null |
| `http.headers.expires` | null |
| `http.headers.feature_policy` | null |
| `http.headers.host` | null |
| `http.headers.if_modified_since` | null |
| `http.headers.if_none_match` | null |
| `http.headers.last_modified` | null |
| `http.headers.origin_isolation` | null |
| `http.headers.others` | array<object> |
| `http.headers.others[].name` | string |
| `http.headers.others[].value` | string |
| `http.headers.permission_policy` | null |
| `http.headers.permissions_policy` | string |
| `http.headers.pragma` | null |
| `http.headers.proxy_authenticate` | null |
| `http.headers.proxy_authorization` | null |
| `http.headers.public_key_pins` | null |
| `http.headers.range` | null |
| `http.headers.referer` | null |
| `http.headers.referrer_policy` | string |
| `http.headers.sec_fetch_dest` | null |
| `http.headers.sec_fetch_mode` | null |
| `http.headers.sec_fetch_site` | null |
| `http.headers.sec_fetch_user` | null |
| `http.headers.server` | string |
| `http.headers.set_cookie` | null |
| `http.headers.strict_transport_security` | string |
| `http.headers.te` | null |
| `http.headers.transfer_encoding` | string |
| `http.headers.upgrade` | null |
| `http.headers.user_agent` | null |
| `http.headers.vary` | string |
| `http.headers.www_authenticate` | null |
| `http.headers.x_content_type_options` | string |
| `http.headers.x_download_options` | null |
| `http.headers.x_frame_options` | string |
| `http.headers.x_permitted_cross_domain_policies` | null |
| `http.headers.x_powered_by` | null |
| `http.headers.x_xss_protection` | null |
| `http.cookies` | array |
| `http.html` | object |
| `http.html.source_code_hash` | string |
| `http_check_date` | string |
| `http_last_change_date` | string |
| `http_last_change_data` | array<string> |
| `webdata` | null |
| `webdata_check_date` | null |
| `webdata_last_change_date` | null |
| `webdata_last_change_data` | array |
| `ipwhois` | null |
| `ipwhois_check_date` | null |
| `ipwhois_last_change_date` | null |
| `ipwhois_last_change_data` | array |
| `ipdns` | null |
| `ipdns_check_date` | null |
| `ipdns_last_change_date` | null |
| `ipdns_last_change_data` | array |
| `subdomain_count` | number |
| `website_count` | number |
| `pointed_fqdn_count` | null |
| `redirected_domain_count` | number |
| `redirected_asset_count` | number |
| `average_issue_duration` | number |
| `average_fix_duration` | number |
| `is_parked` | boolean |
| `open_port_count` | number |
| `open_ports` | array<number> |
| `issue_state_stats` | object |
| `issue_state_stats.newly_detected` | number |
| `issue_state_stats.reappeared` | number |
| `issue_state_stats.unresolved` | number |
| `issue_state_stats.marked_as_resolved` | number |
| `issue_state_stats.risk_accepted` | number |
| `issue_state_stats.ignored` | number |
| `issue_state_stats.marked_as_false_positive` | number |
| `issue_state_stats.not_applicable` | number |
| `issue_state_stats.verified_resolved` | number |
| `issue_category_stats` | array<object> |
| `issue_category_stats[].name` | string |
| `issue_category_stats[].count` | number |
| `issue_category_stats[].severity_stats` | object |
| `issue_category_stats[].severity_stats.critical` | number |
| `issue_category_stats[].severity_stats.high` | number |
| `issue_category_stats[].severity_stats.medium` | number |
| `issue_category_stats[].severity_stats.low` | number |
| `issue_category_stats[].severity_stats.information` | number |
| `issue_count` | object |
| `issue_count.total` | number |
| `issue_count.active` | number |
| `issue_count.active_by_severity` | object |
| `issue_count.active_by_severity.critical` | number |
| `issue_count.active_by_severity.high` | number |
| `issue_count.active_by_severity.medium` | number |
| `issue_count.active_by_severity.low` | number |
| `issue_count.active_by_severity.information` | number |
| `technology_count` | object |
| `technology_count.total` | number |
| `technology_count.by_category` | array |
| `vulnerability_count` | object |
| `vulnerability_count.total` | number |
| `vulnerability_count.by_severity` | object |
| `vulnerability_count.by_severity.critical` | number |
| `vulnerability_count.by_severity.high` | number |
| `vulnerability_count.by_severity.medium` | number |
| `vulnerability_count.by_severity.low` | number |
| `vulnerability_count.by_severity.none` | number |
| `vulnerability_count.by_severity.unknown` | number |
| `security_score` | number |
| `weight` | number |
| `user_weight` | null |
| `system_weight` | number |
| `domain_snapshot` | object |
| `domain_snapshot.issue_count` | object |
| `domain_snapshot.issue_count.total` | number |
| `domain_snapshot.issue_count.active` | number |
| `domain_snapshot.issue_count.active_by_severity` | object |
| `domain_snapshot.issue_count.active_by_severity.critical` | number |
| `domain_snapshot.issue_count.active_by_severity.high` | number |
| `domain_snapshot.issue_count.active_by_severity.medium` | number |
| `domain_snapshot.issue_count.active_by_severity.low` | number |
| `domain_snapshot.issue_count.active_by_severity.information` | number |
| `domain_snapshot.issue_category_stats` | array<object> |
| `domain_snapshot.issue_category_stats[].name` | string |
| `domain_snapshot.issue_category_stats[].count` | number |
| `domain_snapshot.issue_category_stats[].severity_stats` | object |
| `domain_snapshot.issue_category_stats[].severity_stats.critical` | number |
| `domain_snapshot.issue_category_stats[].severity_stats.high` | number |
| `domain_snapshot.issue_category_stats[].severity_stats.medium` | number |
| `domain_snapshot.issue_category_stats[].severity_stats.low` | number |
| `domain_snapshot.issue_category_stats[].severity_stats.information` | number |
| `domain_snapshot.issue_state_stats` | object |
| `domain_snapshot.issue_state_stats.newly_detected` | number |
| `domain_snapshot.issue_state_stats.reappeared` | number |
| `domain_snapshot.issue_state_stats.unresolved` | number |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | number |
| `domain_snapshot.issue_state_stats.risk_accepted` | number |
| `domain_snapshot.issue_state_stats.ignored` | number |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | number |
| `domain_snapshot.issue_state_stats.not_applicable` | number |
| `domain_snapshot.issue_state_stats.verified_resolved` | number |
| `domain_snapshot.average_issue_duration` | number |
| `domain_snapshot.average_fix_duration` | number |
| `domain_snapshot.technology_count` | object |
| `domain_snapshot.technology_count.total` | number |
| `domain_snapshot.technology_count.by_category` | array<object> |
| `domain_snapshot.technology_count.by_category[].name` | string |
| `domain_snapshot.technology_count.by_category[].count` | number |
| `domain_snapshot.open_port_count` | number |
| `domain_snapshot.vulnerability_count` | object |
| `domain_snapshot.vulnerability_count.total` | number |
| `domain_snapshot.vulnerability_count.by_severity` | object |
| `domain_snapshot.vulnerability_count.by_severity.critical` | number |
| `domain_snapshot.vulnerability_count.by_severity.high` | number |
| `domain_snapshot.vulnerability_count.by_severity.medium` | number |
| `domain_snapshot.vulnerability_count.by_severity.low` | number |
| `domain_snapshot.vulnerability_count.by_severity.none` | number |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | number |
| `domain_snapshot.security_score` | number |
| `domain_asset` | object |
| `domain_asset.id` | string |
| `domain_asset.name` | string |
| `domain_asset.name_unicode` | string |
| `weight_last_update_date` | string |
| `user_weight_last_update_date` | null |
| `system_weight_last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-detail.md


---

# Asset Create

URL: https://docs.deepinfo.com/reference/easm/asset-create/

POST /easm/assets: Adds assets to monitoring. Send up to 1,000 domains, subdomains, IPs or website URLs in assets.

`POST https://api.deepinfo.com/v1/easm/assets`

Adds assets to monitoring. Send up to 1,000 domains, subdomains, IPs or website URLs in `assets`. The response lists which were `created`, which `already_existed` and which were `invalid`. New assets are scanned automatically.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `assets` | array | Required | min items `1`; max items `1000` |
| `description` | string | Optional |  |
| `portfolio_id` | string | Optional |  |

```json
{
  "assets": [
    "acme.example"
  ],
  "description": "Details of this record."
}
```

## Response Fields

| Field | Type |
|---|---|
| `created` | array of string |
| `already_existed` | array of string |
| `invalid` | array of string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `created` | array<string> |
| `already_existed` | array |
| `invalid` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-create.md


---

# Asset Delete

URL: https://docs.deepinfo.com/reference/easm/asset-delete/

POST /easm/assets/search:delete: Removes every asset matching filters from monitoring. Deleted assets are listed under Deleted Assets.

`POST https://api.deepinfo.com/v1/easm/assets/search:delete`

Removes every asset matching `filters` from monitoring. Deleted assets are listed under [Deleted Assets](/reference/easm/#group-deleted-assets).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the asset, such as a business unit or an environment; each tag is 3 to 100 characters long. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.name.unicode` | The host name without its extension, in Unicode: `acme` for `acme.example`, `www.acme` for `www.acme.example`. |
| `fqdn.name.latinized` | Latin-letter spellings of a name that has non-Latin or accented letters, so a search for `istanbul` also finds names written with `İ`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_sub.unicode` | The second-level part of a two-part extension, such as `co` in `co.uk`; empty for single-part extensions. |
| `website.path` | The URL path of a website asset, such as `/`. |
| `website.scheme` | The URL scheme of a website asset, such as `http`. |
| `website.parent_asset.id` | The ID of the domain or subdomain asset that a website asset belongs to. |
| `website.parent_asset.name` | The name of the domain or subdomain asset that a website asset belongs to. |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.name` | The registrant's name in WHOIS; often a privacy placeholder such as `redacted for privacy`. |
| `whois.registrant.country` | The registrant's country in WHOIS, as a two-letter code in lower case such as `us`. |
| `whois.registrant.state` | The registrant's state or province in WHOIS. |
| `whois.registrant.city` | The registrant's city in WHOIS. |
| `whois.registrant.street` | The registrant's street address in WHOIS. |
| `whois.registrant.postal_code` | The registrant's postal code in WHOIS. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `whois_registrant_email_historical` | Every registrant e-mail address seen for the domain over time, the current one included. |
| `whois_normalized.registrar` | The registrar reduced to a short normalized name, such as `godaddy` or `gandi`, so the same registrar matches across spellings. |
| `whois_normalized.registrant.email` | The registrant e-mail address after WHOIS normalization. |
| `whois_normalized.registrant.email_real` | Another normalized registrant e-mail field, set on fewer domains than `whois_normalized.registrant.email`; in the samples it is set only where `whois_privacy_enabled` is false, with the same address. |
| `whois_normalized.registrant.email_domain_apex` | The registrable domain of the registrant e-mail address: `acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.email_fqdn_apex` | The full host name after the `@` of the registrant e-mail address: `mail.acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.organization` | The registrant organization cleaned up across registrars: lower case, with spaces and punctuation removed, such as `domainsbyproxyllc`. |
| `whois_normalized.registrant.phone` | The registrant phone number reduced to its digits, such as `14805551234`. |
| `whois_last_change_data` | The WHOIS fields that changed in the last change seen, as field paths such as `whois.update_date` or `whois.domain_status`. |
| `dns.a.value` | The asset's current A records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.a.value_previous` | The asset's A records as they were before the last change, in the same text form as `dns.a.value`. |
| `dns.a.rcode` | The DNS response code returned for the asset's A lookup, such as `NOERROR`. |
| `dns.a.rcode_previous` | The DNS response code of the A lookup before it last changed. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.entities` | The handles of the registry contacts and organizations linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, when it is kept. |
| `dns.a.ip_addresses.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the A-record address. |
| `dns.a.ip_addresses.raw` | The raw IP WHOIS response for the A-record address, when it is kept; empty on every sampled asset. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.a.ip_addresses.network.start_address` | The first address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.end_address` | The last address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.handle` | The registry handle of the network that contains the A-record address, such as `NET-192-0-2-0-1`. |
| `dns.a.ip_addresses.network.ip_version` | The IP version of the network that contains the A-record address: `v4` or `v6`. |
| `dns.a.ip_addresses.network.links` | Links to the registry record of the network that contains the A-record address, such as its RDAP and WHOIS URLs. |
| `dns.a.ip_addresses.network.parent_handle` | The handle of the larger network block from which the network of the A-record address was allocated. |
| `dns.a.ip_addresses.network.raw` | The raw RDAP network object for the A-record address, when it is kept. |
| `dns.a.ip_addresses.network.status` | The registry status of the network that contains the A-record address, such as `active`. |
| `dns.a.ip_addresses.network.type` | The registry's allocation type for the network that contains the A-record address, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `dns.a.ip_addresses.network.notices.title` | The title of a notice the registry attached to the network record of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.network.notices.description` | The text of a notice the registry attached to the network record of the A-record address. |
| `dns.a.ip_addresses.network.notices.links` | Links given in a notice on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.title` | The title of a remark on the network record of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.network.remarks.description` | The text of a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.links` | Links given in a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.events.action` | An event in the history of the network record of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.network.events.actor` | Who performed an event on the network record of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the A-record address, such as `abuse`. |
| `dns.a.ip_addresses.objects.contact.email.value` | An e-mail address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.value` | A postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the A-record address, such as `voice` or `work`. |
| `dns.a.ip_addresses.objects.contact.phone.value` | A phone number of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.kind` | What kind of contact is linked to the network of the A-record address: `org`, `group` or `individual`. |
| `dns.a.ip_addresses.objects.contact.name` | The name of a contact or organization linked to the network of the A-record address, such as `Abuse` or a company name. |
| `dns.a.ip_addresses.objects.contact.role` | The role given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.title` | The title given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.entities` | Handles of further entities listed under a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.events.action` | An event in the history of a contact record linked to the network of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.objects.events.actor` | Who performed an event on a contact record linked to the network of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.events_actor` | Events in which a contact linked to the network of the A-record address is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `dns.a.ip_addresses.objects.handle` | The registry handle of a contact or organization linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.links` | Links to the registry record of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.title` | The title of a notice on a contact record linked to the network of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.objects.notices.description` | The text of a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.links` | Links given in a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.raw` | The raw RDAP object of a contact linked to the network of the A-record address, when it is kept. |
| `dns.a.ip_addresses.objects.remarks.title` | The title of a remark on a contact record linked to the network of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.objects.remarks.description` | The text of a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.roles` | The roles of a contact for the network of the A-record address, such as `registrant`, `abuse` or `technical`. |
| `dns.a.ip_addresses.objects.status` | The registry status of a contact linked to the network of the A-record address, such as `validated`. |
| `dns.a.ip_history` | Every IPv4 address seen in the asset's A records over time, the current ones included. |
| `dns.aaaa.value` | The asset's current AAAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.aaaa.value_previous` | The asset's AAAA records as they were before the last change, in the same text form as `dns.aaaa.value`. |
| `dns.aaaa.rcode` | The DNS response code returned for the asset's AAAA lookup, such as `NOERROR`. |
| `dns.aaaa.rcode_previous` | The DNS response code of the AAAA lookup before it last changed. |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the asset's AAAA records. |
| `dns.caa.value` | The asset's current CAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.caa.value_previous` | The asset's CAA records as they were before the last change, in the same text form as `dns.caa.value`. |
| `dns.caa.rcode` | The DNS response code returned for the asset's CAA lookup, such as `NOERROR`. |
| `dns.caa.rcode_previous` | The DNS response code of the CAA lookup before it last changed. |
| `dns.caa.issue_fqdns` | The certificate authorities allowed to issue certificates for the name, from the CAA `issue` tags, such as `fernhill.example` or `kestrel.example`. |
| `dns.caa.issuewild_fqdns` | The certificate authorities allowed to issue wildcard certificates for the name, from the CAA `issuewild` tags. |
| `dns.caa.iodef_emails` | The e-mail addresses from the CAA `iodef` tags, where certificate authorities report requests that break the CAA policy. |
| `dns.cname.value` | The asset's current CNAME records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.cname.value_previous` | The asset's CNAME records as they were before the last change, in the same text form as `dns.cname.value`. |
| `dns.cname.rcode` | The DNS response code returned for the asset's CNAME lookup, such as `NOERROR`. |
| `dns.cname.rcode_previous` | The DNS response code of the CNAME lookup before it last changed. |
| `dns.cname.canonical_fqdns` | The host names the asset's CNAME records point to (the alias targets). |
| `dns.dnskey.value` | The asset's current DNSKEY records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.dnskey.value_previous` | The asset's DNSKEY records as they were before the last change, in the same text form as `dns.dnskey.value`. |
| `dns.dnskey.rcode` | The DNS response code returned for the asset's DNSKEY lookup, such as `NOERROR`. |
| `dns.dnskey.rcode_previous` | The DNS response code of the DNSKEY lookup before it last changed. |
| `dns.dnskey.records.public_key` | The public key of a DNSKEY record, Base64-encoded and split into space-separated groups as in the zone-file text. |
| `dns.ds.value` | The asset's current DS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ds.value_previous` | The asset's DS records as they were before the last change, in the same text form as `dns.ds.value`. |
| `dns.ds.rcode` | The DNS response code returned for the asset's DS lookup, such as `NOERROR`. |
| `dns.ds.rcode_previous` | The DNS response code of the DS lookup before it last changed. |
| `dns.ds.records.digest` | The digest of a DS record, the hash of the DNSKEY it refers to. |
| `dns.mx.value` | The asset's current MX records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.mx.value_previous` | The asset's MX records as they were before the last change, in the same text form as `dns.mx.value`. |
| `dns.mx.rcode` | The DNS response code returned for the asset's MX lookup, such as `NOERROR`. |
| `dns.mx.rcode_previous` | The DNS response code of the MX lookup before it last changed. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns.mx.domains` | The registrable domains of the asset's mail servers, such as `acme.example`. |
| `dns.ns.value` | The asset's current NS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ns.value_previous` | The asset's NS records as they were before the last change, in the same text form as `dns.ns.value`. |
| `dns.ns.rcode` | The DNS response code returned for the asset's NS lookup, such as `NOERROR`. |
| `dns.ns.rcode_previous` | The DNS response code of the NS lookup before it last changed. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.ns.domains` | The registrable domains of the asset's name servers, such as `acme.example`. |
| `dns.nsec.value` | The asset's current NSEC records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec.value_previous` | The asset's NSEC records as they were before the last change, in the same text form as `dns.nsec.value`. |
| `dns.nsec.rcode` | The DNS response code returned for the asset's NSEC lookup, such as `NOERROR`. |
| `dns.nsec.rcode_previous` | The DNS response code of the NSEC lookup before it last changed. |
| `dns.nsec.records.next_domain` | The next name in the zone, from an NSEC record. |
| `dns.nsec.records.record_types` | The record types that exist at the name, from an NSEC record's type list, such as `A`, `NS` or `SOA`. |
| `dns.nsec3.value` | The asset's current NSEC3 records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec3.value_previous` | The asset's NSEC3 records as they were before the last change, in the same text form as `dns.nsec3.value`. |
| `dns.nsec3.rcode` | The DNS response code returned for the asset's NSEC3 lookup, such as `NOERROR`. |
| `dns.nsec3.rcode_previous` | The DNS response code of the NSEC3 lookup before it last changed. |
| `dns.nsec3.records.next_domain_hashed` | The hashed next name in the zone, from an NSEC3 record. |
| `dns.nsec3.records.record_types` | The record types that exist at the name, from an NSEC3 record's type list, such as `A` or `MX`. |
| `dns.rrsig.value` | The asset's current RRSIG records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.rrsig.value_previous` | The asset's RRSIG records as they were before the last change, in the same text form as `dns.rrsig.value`. |
| `dns.rrsig.rcode` | The DNS response code returned for the asset's RRSIG lookup, such as `NOERROR`. |
| `dns.rrsig.rcode_previous` | The DNS response code of the RRSIG lookup before it last changed. |
| `dns.rrsig.type_covered` | The record type that an RRSIG signature covers, such as `A` or `SOA`. |
| `dns.rrsig.signature` | The signature data of an RRSIG record, Base64-encoded. |
| `dns.soa.value` | The asset's current SOA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.soa.value_previous` | The asset's SOA records as they were before the last change, in the same text form as `dns.soa.value`. |
| `dns.soa.rcode` | The DNS response code returned for the asset's SOA lookup, such as `NOERROR`. |
| `dns.soa.rcode_previous` | The DNS response code of the SOA lookup before it last changed. |
| `dns.soa.mnames` | The MNAME of the SOA record: the primary name server of the zone, such as `ns1.acme.example`. |
| `dns.soa.rnames` | The RNAME of the SOA record, the zone administrator's mailbox in DNS form: `hostmaster.acme.example` stands for the mailbox `hostmaster` at `acme.example`. |
| `dns.soa.rname_emails` | The RNAME of the SOA record written as an e-mail address, such as `user@acme.example`. |
| `dns.srv.value` | The asset's current SRV records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.srv.value_previous` | The asset's SRV records as they were before the last change, in the same text form as `dns.srv.value`. |
| `dns.srv.rcode` | The DNS response code returned for the asset's SRV lookup, such as `NOERROR`. |
| `dns.srv.rcode_previous` | The DNS response code of the SRV lookup before it last changed. |
| `dns.srv.records.service` | The service named in an SRV record (the `_service` part of its name). |
| `dns.srv.records.protocol` | The protocol named in an SRV record (the `_proto` part of its name, such as TCP or UDP). |
| `dns.srv.records.target` | The host name an SRV record points to. |
| `dns.txt.value` | The asset's current TXT records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.txt.value_previous` | The asset's TXT records as they were before the last change, in the same text form as `dns.txt.value`. |
| `dns.txt.rcode` | The DNS response code returned for the asset's TXT lookup, such as `NOERROR`. |
| `dns.txt.rcode_previous` | The DNS response code of the TXT lookup before it last changed. |
| `dns.txt.values` | Each TXT record of the asset as its quoted text, such as `"v=spf1 include:_spf.acme.example ~all"`; the quotes are part of the value. |
| `dns.txt.spf_list.value` | The text of an SPF record (a TXT record that starts with `v=spf1`), quoted as in `dns.txt.values`. |
| `dns.txt.spf_list.allowed_domains` | The registrable domains that an SPF record refers to, such as `acme.example` for `include:_spf.acme.example`. |
| `dns.txt.spf_list.allowed_ips` | The IP addresses and ranges that an SPF record authorizes to send mail (its `ip4:` and `ip6:` entries). |
| `dns.txt.verifications.value` | The text of a site-verification TXT record, quoted as in `dns.txt.values`. |
| `dns.txt.verifications.domain` | The domain of the service a verification record is for, such as `acme.example`, `fernhill.example` or `kestrel.example`. |
| `dns.txt.verifications.name` | The name of a verification record, such as `site-verification` or `domain-verification`. |
| `dns_last_change_data` | The DNS fields that changed in the last change seen, as field paths such as `dns.soa.mnames`. |
| `ssl.target` | The host name that the asset's TLS certificate was collected from, normally the asset itself. |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the asset's TLS certificate, as lower-case hex; one fingerprint identifies one certificate. |
| `ssl.issuer.common_name` | The common name (CN) of the certificate authority that issued the asset's TLS certificate, such as `WE1` or `YE2`. |
| `ssl.issuer.country` | The country (C) of the certificate authority that issued the asset's TLS certificate, as a two-letter code such as `US`. |
| `ssl.issuer.state` | The state or province (ST) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.locality` | The locality or city (L) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.organization` | The organization (O) of the certificate authority that issued the asset's TLS certificate, such as `Let's Encrypt` or `Google Trust Services`. |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer_dn` | The full distinguished name of the issuer of the asset's TLS certificate, as one string such as `CN=WE1,O=Google Trust Services,C=US`. |
| `ssl.subject.common_name` | The common name (CN) of the subject (holder) of the asset's TLS certificate, usually a host name such as `acme.example`. |
| `ssl.subject.country` | The country (C) of the subject (holder) of the asset's TLS certificate, as a two-letter code. |
| `ssl.subject.state` | The state or province (ST) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.locality` | The locality or city (L) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organizational_unit` | The organizational unit (OU) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject_dn` | The full distinguished name of the subject of the asset's TLS certificate, such as `CN=acme.example`; one that starts with `CN=*.` belongs to a wildcard certificate. |
| `ssl.signature.value` | The signature of the asset's TLS certificate, Base64-encoded. |
| `ssl.signature.invalid_reason` | Why certificate validation failed, such as a host name mismatch or `unable to get issuer certificate`. |
| `ssl.signature.algorithm.name` | The hash algorithm of the signature on the asset's TLS certificate, such as `sha256` or `sha384`. |
| `ssl.signature.algorithm.oid` | The object identifier (OID) of the signature algorithm, such as `1.2.840.113549.1.1.11` (SHA-256 with RSA) or `1.2.840.10045.4.3.2` (ECDSA with SHA-256). |
| `ssl.extensions.authority_key_id` | The Authority Key Identifier extension, which identifies the issuer's key, Base64-encoded. |
| `ssl.extensions.certificate_policies` | The policy OIDs in the Certificate Policies extension, such as `2.23.140.1.2.1` (domain validated). |
| `ssl.extensions.signed_certificate_timestamps.log_id` | The ID of the Certificate Transparency log that issued a signed certificate timestamp (SCT) for the certificate, Base64-encoded. |
| `ssl.extensions.signed_certificate_timestamps.signature` | The log's signature on a signed certificate timestamp, Base64-encoded. |
| `ssl.extensions.subject_alt_name.dns_names` | The host names in the certificate's Subject Alternative Name extension, including wildcard names such as `*.acme.example`. |
| `ssl.extensions.subject_key_id` | The Subject Key Identifier extension, which identifies the certificate's own key, Base64-encoded. |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | The hash algorithm used for `ssl.subject_key_info.fingerprint.value`, such as `sha256` or `sha384`. |
| `ssl.subject_key_info.fingerprint.value` | A hex fingerprint recorded under the certificate's subject key information, made with the hash in `hash_algorithm`. In the samples it equals `ssl.fingerprint.sha256` when that hash is SHA-256. |
| `ssl.subject_key_info.key_algorithm.name` | The algorithm of the certificate's public key, such as `RSA` or `ECDSA`. |
| `ssl.version.name` | The X.509 version of the certificate, such as `v3`. |
| `ssl.version.value` | The X.509 version as encoded in the certificate, counted from zero: `2` means `v3`. |
| `ssl.tbs_fingerprint` | A SHA-256 fingerprint (hex) of the certificate's to-be-signed part, the certificate content without its signature. |
| `ssl.certificate` | The whole certificate, Base64-encoded (a PEM body without the header and footer lines). |
| `ssl.fqdn_list` | The host names the certificate covers, with the `*.` of wildcard names removed and duplicates merged, so `*.acme.example` and `acme.example` both give `acme.example`. |
| `ssl_last_change_data` | The certificate fields that changed in the last change seen, as field paths such as `ssl.validity.end_date`. |
| `http.requested_url` | The URL the HTTP check started from, such as `http://acme.example`. |
| `http.requested_domain` | The registrable domain of the URL the HTTP check started from. |
| `http.requested_fqdn` | The host name of the URL the HTTP check started from. |
| `http.final_url` | The URL the HTTP check ended on after following all redirects. |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.redirection_history.url` | A URL in the redirect chain of the HTTP check, listed in the order visited. |
| `http.headers.accept` | The `Accept` header, when it was returned in the HTTP check. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the HTTP check. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `http.headers.accept_language` | The `Accept-Language` header, when it was returned in the HTTP check. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the HTTP check; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the HTTP check; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the HTTP check; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the HTTP check; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the HTTP check; it lists the response headers that scripts from other origins may read (CORS). |
| `http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the HTTP check; it says how many seconds browsers may cache a CORS preflight result. |
| `http.headers.alt_svc` | The `Alt-Svc` header returned in the HTTP check; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `http.headers.authorization` | The `Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `http.headers.cache_control` | The `Cache-Control` header returned in the HTTP check; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the HTTP check; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `http.headers.content_disposition` | The `Content-Disposition` header returned in the HTTP check; it says whether the content is shown in the browser or downloaded as a file. |
| `http.headers.content_encoding` | The `Content-Encoding` header returned in the HTTP check; it names the compression applied to the response body, for example `gzip` or `br`. |
| `http.headers.content_language` | The `Content-Language` header returned in the HTTP check; it gives the language of the content, for example `en` or `tr`. |
| `http.headers.content_length` | The `Content-Length` header returned in the HTTP check; it gives the size of the response body in bytes. |
| `http.headers.content_range` | The `Content-Range` header returned in the HTTP check; it says which part of the full body a partial response holds. |
| `http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the HTTP check; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `http.headers.content_type` | The `Content-Type` header returned in the HTTP check; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `http.headers.cookie` | The `Cookie` header, when it was returned in the HTTP check. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the HTTP check; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the HTTP check; it controls whether the page shares its browsing context with cross-origin windows. |
| `http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the HTTP check; it controls which sites may load the resource. |
| `http.headers.date` | The `Date` header returned in the HTTP check; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `http.headers.early_data` | The `Early-Data` header, when it was returned in the HTTP check. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `http.headers.expect_ct` | The `Expect-CT` header returned in the HTTP check; it is a deprecated header about Certificate Transparency enforcement. |
| `http.headers.expires` | The `Expires` header returned in the HTTP check; it gives the date after which the response counts as stale, in HTTP date format. |
| `http.headers.feature_policy` | The `Feature-Policy` header returned in the HTTP check; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `http.headers.host` | The `Host` header, when it was returned in the HTTP check. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the HTTP check. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the HTTP check. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `http.headers.last_modified` | The `Last-Modified` header returned in the HTTP check; it gives the time the server says the resource last changed, in HTTP date format. |
| `http.headers.origin_isolation` | The `Origin-Isolation` header returned in the HTTP check; it is an experimental header that asks browsers to isolate the site's origin. |
| `http.headers.others.name` | The name of a header returned in the HTTP check that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `http.headers.others.value` | The value of a header listed in `headers.others` for the HTTP check. |
| `http.headers.permission_policy` | The `Permission-Policy` header returned in the HTTP check; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `http.headers.permissions_policy` | The `Permissions-Policy` header returned in the HTTP check; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `http.headers.pragma` | The `Pragma` header returned in the HTTP check; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the HTTP check; it tells a client how to authenticate to a proxy. |
| `http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the HTTP check; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `http.headers.range` | The `Range` header, when it was returned in the HTTP check. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `http.headers.referer` | The `Referer` header, when it was returned in the HTTP check. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `http.headers.referrer_policy` | The `Referrer-Policy` header returned in the HTTP check; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the HTTP check. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `http.headers.server` | The `Server` header returned in the HTTP check; it names the server software the site reports, for example `nginx` or `Apache`. |
| `http.headers.set_cookie` | The `Set-Cookie` header returned in the HTTP check; it sets cookies, with their attributes. |
| `http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the HTTP check; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `http.headers.te` | The `TE` header, when it was returned in the HTTP check. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the HTTP check; it says how the body is transferred, for example `chunked`. |
| `http.headers.upgrade` | The `Upgrade` header returned in the HTTP check; it offers or asks for a switch to another protocol. |
| `http.headers.user_agent` | The `User-Agent` header, when it was returned in the HTTP check. It is normally a request header (the client software), so it is rarely set. |
| `http.headers.vary` | The `Vary` header returned in the HTTP check; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the HTTP check; it tells a client how to authenticate, usually with a `401` response. |
| `http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the HTTP check; it stops browsers from guessing the content type when set to `nosniff`. |
| `http.headers.x_download_options` | The `X-Download-Options` header returned in the HTTP check; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `http.headers.x_frame_options` | The `X-Frame-Options` header returned in the HTTP check; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the HTTP check; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `http.headers.x_powered_by` | The `X-Powered-By` header returned in the HTTP check; it names the technology the server reports running on, for example `Express`. |
| `http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the HTTP check; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `http.cookies.name` | The name of a cookie set in the HTTP check. |
| `http.cookies.value` | The value of a cookie set in the HTTP check. |
| `http.html.source_code_hash` | A SHA-256 hash of the page source returned in the HTTP check; the same hash means the same source. |
| `http_last_change_data` | The HTTP check fields that changed in the last change seen, as field paths such as `http.html.source_code_hash`. |
| `webdata.requested_url` | The URL the web data scan started from, such as `http://acme.example`. |
| `webdata.requested_domain` | The registrable domain of the URL the web data scan started from. |
| `webdata.requested_fqdn` | The host name of the URL the web data scan started from. |
| `webdata.html.internal_links_fqdns` | The host names of links on the scanned page that stay within the site's own domain, such as other subdomains. |
| `webdata.html.external_links_domains` | The registrable domains of links on the scanned page that point to other domains, such as `kestrel.example`. |
| `webdata.html.external_links_fqdns` | The host names of links on the scanned page that point to other domains, such as `www.kestrel.example`. |
| `webdata.html.external_links` | The full URLs of links on the scanned page that point to other domains. |
| `webdata.html.script_links` | The URLs of the scripts the scanned page loads. |
| `webdata.html.iframe_links` | The URLs of the frames (iframes) embedded in the scanned page. |
| `webdata.html.trackers.name` | The name of an analytics or advertising tracker found on the scanned page, such as `google_adsense` or `google_tag_manager`. |
| `webdata.html.trackers.values` | The IDs found for a tracker, such as a Google Analytics ID that starts with `G-` or `UA-`. |
| `webdata.html.emails` | The e-mail addresses found on the scanned page. |
| `webdata.html.emails_internal` | The e-mail addresses found on the scanned page that belong to the site's own domain. |
| `webdata.html.source_code_hash` | A SHA-256 hash of the page source in the web data scan; the same hash means the same source. |
| `webdata.html.content_hash` | A SHA-256 hash of the page content in the web data scan, kept apart from `source_code_hash`, the hash of the raw source. |
| `webdata.html.content_top_keywords` | The most frequent words in the text of the scanned page. |
| `webdata.html.favicon_links` | The URLs of the icons the scanned page declares, such as its favicon and touch icons. |
| `webdata.html.html_meta.name` | The site or application name declared in the scanned page's metadata. |
| `webdata.html.html_meta.description` | The meta description of the scanned page. |
| `webdata.html.html_meta.language` | The language the scanned page declares, such as `en`, `tr` or `en-US`. |
| `webdata.html.html_meta.language_alternatives` | The languages of the alternative versions the scanned page links to, such as `en` or `ar`. |
| `webdata.html.html_meta.keywords` | The keywords listed in the keywords meta tag of the scanned page. |
| `webdata.html.html_meta.encoding` | The character encoding the scanned page declares, such as `utf-8`. |
| `webdata.html.html_meta.canonical_url` | The canonical URL the scanned page declares. |
| `webdata.html.html_meta.title` | The title of the scanned page. |
| `webdata.favicon.url` | The URL of a site icon (favicon) recorded by the web data scan. |
| `webdata.favicon.hash` | A SHA-256 hash of a site icon; the same hash means the same icon. |
| `webdata.http.final_url` | The URL the web data scan ended on after following all redirects. |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.redirection_history.url` | A URL in the redirect chain of the web data scan, listed in the order visited. |
| `webdata.http.redirection_history.method` | How a step of the web data scan's redirect chain was made; `http-header` (a redirect sent in the HTTP response) is the value in the samples. |
| `webdata.http.headers.accept` | The `Accept` header, when it was returned in the web data scan. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the web data scan. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_language` | The `Accept-Language` header, when it was returned in the web data scan. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `webdata.http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the web data scan; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `webdata.http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the web data scan; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `webdata.http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the web data scan; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `webdata.http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the web data scan; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `webdata.http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the web data scan; it lists the response headers that scripts from other origins may read (CORS). |
| `webdata.http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the web data scan; it says how many seconds browsers may cache a CORS preflight result. |
| `webdata.http.headers.alt_svc` | The `Alt-Svc` header returned in the web data scan; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `webdata.http.headers.authorization` | The `Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `webdata.http.headers.cache_control` | The `Cache-Control` header returned in the web data scan; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `webdata.http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the web data scan; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `webdata.http.headers.content_disposition` | The `Content-Disposition` header returned in the web data scan; it says whether the content is shown in the browser or downloaded as a file. |
| `webdata.http.headers.content_encoding` | The `Content-Encoding` header returned in the web data scan; it names the compression applied to the response body, for example `gzip` or `br`. |
| `webdata.http.headers.content_language` | The `Content-Language` header returned in the web data scan; it gives the language of the content, for example `en` or `tr`. |
| `webdata.http.headers.content_length` | The `Content-Length` header returned in the web data scan; it gives the size of the response body in bytes. |
| `webdata.http.headers.content_range` | The `Content-Range` header returned in the web data scan; it says which part of the full body a partial response holds. |
| `webdata.http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the web data scan; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `webdata.http.headers.content_type` | The `Content-Type` header returned in the web data scan; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `webdata.http.headers.cookie` | The `Cookie` header, when it was returned in the web data scan. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `webdata.http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the web data scan; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `webdata.http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the web data scan; it controls whether the page shares its browsing context with cross-origin windows. |
| `webdata.http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the web data scan; it controls which sites may load the resource. |
| `webdata.http.headers.date` | The `Date` header returned in the web data scan; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `webdata.http.headers.early_data` | The `Early-Data` header, when it was returned in the web data scan. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `webdata.http.headers.expect_ct` | The `Expect-CT` header returned in the web data scan; it is a deprecated header about Certificate Transparency enforcement. |
| `webdata.http.headers.expires` | The `Expires` header returned in the web data scan; it gives the date after which the response counts as stale, in HTTP date format. |
| `webdata.http.headers.feature_policy` | The `Feature-Policy` header returned in the web data scan; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `webdata.http.headers.host` | The `Host` header, when it was returned in the web data scan. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `webdata.http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the web data scan. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `webdata.http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the web data scan. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `webdata.http.headers.last_modified` | The `Last-Modified` header returned in the web data scan; it gives the time the server says the resource last changed, in HTTP date format. |
| `webdata.http.headers.origin_isolation` | The `Origin-Isolation` header returned in the web data scan; it is an experimental header that asks browsers to isolate the site's origin. |
| `webdata.http.headers.others.name` | The name of a header returned in the web data scan that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `webdata.http.headers.others.value` | The value of a header listed in `headers.others` for the web data scan. |
| `webdata.http.headers.permission_policy` | The `Permission-Policy` header returned in the web data scan; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `webdata.http.headers.permissions_policy` | The `Permissions-Policy` header returned in the web data scan; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `webdata.http.headers.pragma` | The `Pragma` header returned in the web data scan; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `webdata.http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the web data scan; it tells a client how to authenticate to a proxy. |
| `webdata.http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `webdata.http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the web data scan; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `webdata.http.headers.range` | The `Range` header, when it was returned in the web data scan. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `webdata.http.headers.referer` | The `Referer` header, when it was returned in the web data scan. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `webdata.http.headers.referrer_policy` | The `Referrer-Policy` header returned in the web data scan; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `webdata.http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `webdata.http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the web data scan. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `webdata.http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `webdata.http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the web data scan. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `webdata.http.headers.server` | The `Server` header returned in the web data scan; it names the server software the site reports, for example `nginx` or `Apache`. |
| `webdata.http.headers.set_cookie` | The `Set-Cookie` header returned in the web data scan; it sets cookies, with their attributes. |
| `webdata.http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the web data scan; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `webdata.http.headers.te` | The `TE` header, when it was returned in the web data scan. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `webdata.http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the web data scan; it says how the body is transferred, for example `chunked`. |
| `webdata.http.headers.upgrade` | The `Upgrade` header returned in the web data scan; it offers or asks for a switch to another protocol. |
| `webdata.http.headers.user_agent` | The `User-Agent` header, when it was returned in the web data scan. It is normally a request header (the client software), so it is rarely set. |
| `webdata.http.headers.vary` | The `Vary` header returned in the web data scan; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `webdata.http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the web data scan; it tells a client how to authenticate, usually with a `401` response. |
| `webdata.http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the web data scan; it stops browsers from guessing the content type when set to `nosniff`. |
| `webdata.http.headers.x_download_options` | The `X-Download-Options` header returned in the web data scan; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `webdata.http.headers.x_frame_options` | The `X-Frame-Options` header returned in the web data scan; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the web data scan; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `webdata.http.headers.x_powered_by` | The `X-Powered-By` header returned in the web data scan; it names the technology the server reports running on, for example `Express`. |
| `webdata.http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the web data scan; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `webdata.http.cookies.name` | The name of a cookie set in the web data scan. |
| `webdata.http.cookies.value` | The value of a cookie set in the web data scan. |
| `webdata.http.cookies.domain` | The domain a cookie set in the web data scan applies to, such as `.acme.example`. |
| `webdata.http.cookies.path` | The path a cookie set in the web data scan applies to, such as `/`. |
| `webdata.http.cookies.same_party` | The SameParty attribute of a cookie set in the web data scan; in the samples it always holds the same value as `same_site`, such as `Lax` or `None`. |
| `webdata.http.cookies.priority` | The Priority attribute of a cookie set in the web data scan (`Low`, `Medium` or `High` in Chromium-based browsers). |
| `webdata.http.cookies.same_site` | The SameSite attribute of a cookie set in the web data scan, such as `Lax`, `Strict` or `None`. |
| `webdata.technology.stacks.slug` | A short identifier of a technology detected on the site, such as `iis` or `windows-server`. |
| `webdata.technology.stacks.name` | The name of a technology detected on the site, such as `IIS` or `Microsoft ASP.NET`. |
| `webdata.technology.stacks.icon` | The file name of a detected technology's icon, such as `acme.png`. |
| `webdata.technology.stacks.website` | The website of a detected technology's vendor or project. |
| `webdata.technology.stacks.cpe` | The CPE identifier of a detected technology, such as `cpe:/a:acme:acme-portal`, used to match it to known vulnerabilities. |
| `webdata.technology.stacks.version` | The detected version of a technology, such as `1.0`. |
| `webdata.technology.stacks.categories` | The categories of a detected technology, such as `Web servers` or `Operating systems`. |
| `webdata.technology.stacks.description` | A short description of a detected technology. |
| `webdata_last_change_data` | The web data fields that changed in the last change seen, as field paths under `webdata`. |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.entities` | The handles of the registry contacts and organizations linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, when it is kept. |
| `ipwhois.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the IP address asset. |
| `ipwhois.raw` | The raw IP WHOIS response for the IP address asset, when it is kept; empty on every sampled asset. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `ipwhois.network.start_address` | The first address of the registered network block that contains the IP address asset. |
| `ipwhois.network.end_address` | The last address of the registered network block that contains the IP address asset. |
| `ipwhois.network.handle` | The registry handle of the network that contains the IP address asset, such as `NET-192-0-2-0-1`. |
| `ipwhois.network.ip_version` | The IP version of the network that contains the IP address asset: `v4` or `v6`. |
| `ipwhois.network.links` | Links to the registry record of the network that contains the IP address asset, such as its RDAP and WHOIS URLs. |
| `ipwhois.network.parent_handle` | The handle of the larger network block from which the network of the IP address asset was allocated. |
| `ipwhois.network.raw` | The raw RDAP network object for the IP address asset, when it is kept. |
| `ipwhois.network.status` | The registry status of the network that contains the IP address asset, such as `active`. |
| `ipwhois.network.type` | The registry's allocation type for the network that contains the IP address asset, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `ipwhois.network.notices.title` | The title of a notice the registry attached to the network record of the IP address asset, such as `Terms of Service`. |
| `ipwhois.network.notices.description` | The text of a notice the registry attached to the network record of the IP address asset. |
| `ipwhois.network.notices.links` | Links given in a notice on the network record of the IP address asset. |
| `ipwhois.network.remarks.title` | The title of a remark on the network record of the IP address asset, such as `Registration Comments`. |
| `ipwhois.network.remarks.description` | The text of a remark on the network record of the IP address asset. |
| `ipwhois.network.remarks.links` | Links given in a remark on the network record of the IP address asset. |
| `ipwhois.network.events.action` | An event in the history of the network record of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.network.events.actor` | Who performed an event on the network record of the IP address asset, when the registry names one. |
| `ipwhois.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the IP address asset, such as `abuse`. |
| `ipwhois.objects.contact.email.value` | An e-mail address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.value` | A postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the IP address asset, such as `voice` or `work`. |
| `ipwhois.objects.contact.phone.value` | A phone number of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.kind` | What kind of contact is linked to the network of the IP address asset: `org`, `group` or `individual`. |
| `ipwhois.objects.contact.name` | The name of a contact or organization linked to the network of the IP address asset, such as `Abuse` or a company name. |
| `ipwhois.objects.contact.role` | The role given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.contact.title` | The title given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.entities` | Handles of further entities listed under a contact linked to the network of the IP address asset. |
| `ipwhois.objects.events.action` | An event in the history of a contact record linked to the network of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.objects.events.actor` | Who performed an event on a contact record linked to the network of the IP address asset, when the registry names one. |
| `ipwhois.objects.events_actor` | Events in which a contact linked to the network of the IP address asset is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `ipwhois.objects.handle` | The registry handle of a contact or organization linked to the network of the IP address asset. |
| `ipwhois.objects.links` | Links to the registry record of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.notices.title` | The title of a notice on a contact record linked to the network of the IP address asset, such as `Terms of Service`. |
| `ipwhois.objects.notices.description` | The text of a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.notices.links` | Links given in a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.raw` | The raw RDAP object of a contact linked to the network of the IP address asset, when it is kept. |
| `ipwhois.objects.remarks.title` | The title of a remark on a contact record linked to the network of the IP address asset, such as `Registration Comments`. |
| `ipwhois.objects.remarks.description` | The text of a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.roles` | The roles of a contact for the network of the IP address asset, such as `registrant`, `abuse` or `technical`. |
| `ipwhois.objects.status` | The registry status of a contact linked to the network of the IP address asset, such as `validated`. |
| `ipwhois_last_change_data` | The IP WHOIS fields that changed in the last change seen, as field paths under `ipwhois`. |
| `ipdns.ptr_records` | The PTR (reverse DNS) host names of an IP address asset. |
| `ipdns_last_change_data` | The reverse DNS fields that changed in the last change seen, as field paths under `ipdns`. |
| `issue_category_stats.name` | The name of an issue category in the per-category issue counts of the asset, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. |
| `technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the asset, such as `Web servers` or `Analytics`. |
| `domain_snapshot.issue_category_stats.name` | The name of an issue category in the per-category issue counts of the domain and its subdomains together, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the domain and its subdomains together, such as `Web servers` or `Analytics`. Set on domain assets. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.name.length` | The number of characters in the name without the extension: `4` for `acme.example`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois_create_date_historical` | Every creation date seen for the domain over time, so a domain that was deleted and registered again keeps its earlier dates too (UTC date-times). |
| `whois_check_date` | When the WHOIS record of the asset was last checked (UTC date-time). |
| `whois_last_change_date` | When a change in the WHOIS record of the asset was last seen (UTC date-time). |
| `dns.a.value_last_change_date` | When the A record text (`dns.a.value`) last changed (UTC date-time). |
| `dns.a.rcode_last_change_date` | When the response code of the A lookup (`dns.a.rcode`) last changed (UTC date-time). |
| `dns.a.last_change_date` | When the asset's A records last changed, in their text or their response code (UTC date-time). |
| `dns.a.ip_addresses.asn_date` | The registry allocation date that the ASN lookup reports for the A-record address, as a date at midnight UTC. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was created (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was last updated (UTC date-time). |
| `dns.a.ip_addresses.network.events.timestamp` | When an event on the network record of the A-record address happened (UTC date-time). |
| `dns.a.ip_addresses.objects.events.timestamp` | When an event on a contact record linked to the network of the A-record address happened (UTC date-time). |
| `dns.aaaa.value_last_change_date` | When the AAAA record text (`dns.aaaa.value`) last changed (UTC date-time). |
| `dns.aaaa.rcode_last_change_date` | When the response code of the AAAA lookup (`dns.aaaa.rcode`) last changed (UTC date-time). |
| `dns.aaaa.last_change_date` | When the asset's AAAA records last changed, in their text or their response code (UTC date-time). |
| `dns.caa.value_last_change_date` | When the CAA record text (`dns.caa.value`) last changed (UTC date-time). |
| `dns.caa.rcode_last_change_date` | When the response code of the CAA lookup (`dns.caa.rcode`) last changed (UTC date-time). |
| `dns.caa.last_change_date` | When the asset's CAA records last changed, in their text or their response code (UTC date-time). |
| `dns.cname.value_last_change_date` | When the CNAME record text (`dns.cname.value`) last changed (UTC date-time). |
| `dns.cname.rcode_last_change_date` | When the response code of the CNAME lookup (`dns.cname.rcode`) last changed (UTC date-time). |
| `dns.cname.last_change_date` | When the asset's CNAME records last changed, in their text or their response code (UTC date-time). |
| `dns.dnskey.value_last_change_date` | When the DNSKEY record text (`dns.dnskey.value`) last changed (UTC date-time). |
| `dns.dnskey.rcode_last_change_date` | When the response code of the DNSKEY lookup (`dns.dnskey.rcode`) last changed (UTC date-time). |
| `dns.dnskey.last_change_date` | When the asset's DNSKEY records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.value_last_change_date` | When the DS record text (`dns.ds.value`) last changed (UTC date-time). |
| `dns.ds.rcode_last_change_date` | When the response code of the DS lookup (`dns.ds.rcode`) last changed (UTC date-time). |
| `dns.ds.last_change_date` | When the asset's DS records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.records.key_tag` | The key tag (a number) of the DNSKEY that a DS record refers to. |
| `dns.mx.value_last_change_date` | When the MX record text (`dns.mx.value`) last changed (UTC date-time). |
| `dns.mx.rcode_last_change_date` | When the response code of the MX lookup (`dns.mx.rcode`) last changed (UTC date-time). |
| `dns.mx.last_change_date` | When the asset's MX records last changed, in their text or their response code (UTC date-time). |
| `dns.ns.value_last_change_date` | When the NS record text (`dns.ns.value`) last changed (UTC date-time). |
| `dns.ns.rcode_last_change_date` | When the response code of the NS lookup (`dns.ns.rcode`) last changed (UTC date-time). |
| `dns.ns.last_change_date` | When the asset's NS records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec.value_last_change_date` | When the NSEC record text (`dns.nsec.value`) last changed (UTC date-time). |
| `dns.nsec.rcode_last_change_date` | When the response code of the NSEC lookup (`dns.nsec.rcode`) last changed (UTC date-time). |
| `dns.nsec.last_change_date` | When the asset's NSEC records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec3.value_last_change_date` | When the NSEC3 record text (`dns.nsec3.value`) last changed (UTC date-time). |
| `dns.nsec3.rcode_last_change_date` | When the response code of the NSEC3 lookup (`dns.nsec3.rcode`) last changed (UTC date-time). |
| `dns.nsec3.last_change_date` | When the asset's NSEC3 records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.value_last_change_date` | When the RRSIG record text (`dns.rrsig.value`) last changed (UTC date-time). |
| `dns.rrsig.rcode_last_change_date` | When the response code of the RRSIG lookup (`dns.rrsig.rcode`) last changed (UTC date-time). |
| `dns.rrsig.last_change_date` | When the asset's RRSIG records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.signature_inception` | When an RRSIG signature becomes valid (UTC date-time). |
| `dns.rrsig.signature_expiration` | When an RRSIG signature expires (UTC date-time). |
| `dns.soa.value_last_change_date` | When the SOA record text (`dns.soa.value`) last changed (UTC date-time). |
| `dns.soa.rcode_last_change_date` | When the response code of the SOA lookup (`dns.soa.rcode`) last changed (UTC date-time). |
| `dns.soa.last_change_date` | When the asset's SOA records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.value_last_change_date` | When the SRV record text (`dns.srv.value`) last changed (UTC date-time). |
| `dns.srv.rcode_last_change_date` | When the response code of the SRV lookup (`dns.srv.rcode`) last changed (UTC date-time). |
| `dns.srv.last_change_date` | When the asset's SRV records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.records.port` | The port an SRV record points to. |
| `dns.txt.value_last_change_date` | When the TXT record text (`dns.txt.value`) last changed (UTC date-time). |
| `dns.txt.rcode_last_change_date` | When the response code of the TXT lookup (`dns.txt.rcode`) last changed (UTC date-time). |
| `dns.txt.last_change_date` | When the asset's TXT records last changed, in their text or their response code (UTC date-time). |
| `dns_check_date` | When the DNS records of the asset were last checked (UTC date-time). |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.port` | The port that the asset's TLS certificate was collected on, such as `443`. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl.validity.length` | The validity period of the certificate in seconds: 7,776,000 seconds are 90 days. |
| `ssl.extensions.signed_certificate_timestamps.timestamp` | When a Certificate Transparency log recorded the certificate, from a signed certificate timestamp (UTC date-time). |
| `ssl.extensions.signed_certificate_timestamps.version` | The version of a signed certificate timestamp; `0` stands for version 1. |
| `ssl_check_date` | When the TLS certificate of the asset was last checked (UTC date-time). |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the HTTP check, such as `301` or `200`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_check_date` | When the HTTP check of the asset last ran (UTC date-time). |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the web data scan, such as `301` or `200`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata.http.cookies.size` | The size of a cookie set in the web data scan, in bytes (name plus value). |
| `webdata.http.cookies.expires` | When a cookie set in the web data scan expires (UTC date-time); session cookies show `1969-12-31T23:59:59Z`. |
| `webdata.technology.stacks.confidence` | How certain the detection of a technology is, from 0 to 100; every sampled detection has `100`. |
| `webdata.technology.stacks.clean_version` | The major version of a detected technology as a whole number, such as `1` for version `1.0`. |
| `webdata_check_date` | When the web data scan of the asset, which collects the page content, headers and technologies, last ran (UTC date-time). |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn_date` | The registry allocation date that the ASN lookup reports for the IP address asset, as a date at midnight UTC. |
| `ipwhois.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was created (UTC date-time). |
| `ipwhois.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was last updated (UTC date-time). |
| `ipwhois.network.events.timestamp` | When an event on the network record of the IP address asset happened (UTC date-time). |
| `ipwhois.objects.events.timestamp` | When an event on a contact record linked to the network of the IP address asset happened (UTC date-time). |
| `ipwhois_check_date` | When the IP WHOIS record of an IP address asset was last checked (UTC date-time). |
| `ipwhois_last_change_date` | When a change in the IP WHOIS record of an IP address asset was last seen (UTC date-time). |
| `ipdns_check_date` | When the reverse DNS (PTR) records of an IP address asset were last checked (UTC date-time). |
| `ipdns_last_change_date` | When a change in the reverse DNS (PTR) records of an IP address asset was last seen (UTC date-time). |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `open_port_count` | The number of open ports found on the asset. |
| `open_ports` | The open port numbers found on the asset, such as `80`, `443` or `8080`. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_category_stats.count` | The number of active issues in that category on the asset. |
| `issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the asset. |
| `issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the asset. |
| `issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the asset. |
| `issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the asset. |
| `issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the asset. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `issue_count.active_by_severity.low` | The number of active issues of low severity on the asset. |
| `issue_count.active_by_severity.information` | The number of active issues of information severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `technology_count.by_category.count` | The number of technologies in that category on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity on the asset. |
| `vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity on the asset. |
| `vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity on the asset. |
| `vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) on the asset whose severity is `none`. |
| `vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) on the asset whose severity is `unknown`. |
| `security_score` | The asset's External Attack Surface Management (EASM) security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.count` | The number of active issues in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.count` | The number of distinct technologies in that category across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `fqdn.is_idn` | True when the host name is an internationalized domain name (IDN) with non-ASCII characters. |
| `fqdn.name.contains_confusable` | True when the name contains confusable characters that look like other letters, such as Cyrillic `а` for Latin `a`, a common trick in look-alike domains. |
| `fqdn.name.contains_hyphen` | True when the name (without the extension) contains a hyphen. |
| `fqdn.name.contains_letter` | True when the name (without the extension) contains a letter. |
| `fqdn.name.contains_number` | True when the name (without the extension) contains a digit. |
| `fqdn.domain.is_idn` | True when the registrable domain is an internationalized domain name (IDN) with non-ASCII characters. |
| `whois_privacy_enabled` | True when the platform flagged WHOIS privacy protection on the domain's registrant details; set on domain assets. |
| `ssl.signature.is_valid` | True when the asset's TLS certificate passed validation for the host; when false, `ssl.signature.invalid_reason` says why. |
| `ssl.signature.is_valid_chain` | A flag for whether the certificate chain of the asset's TLS certificate is valid. It was true on every sampled certificate, even one whose validation failed with `unable to get issuer certificate`. |
| `ssl.signature.is_self_signed` | True when the asset's TLS certificate is self-signed, that is signed by its own key rather than by a certificate authority. |
| `ssl.extensions.basic_constraints.is_ca` | True when the certificate is a certificate authority (CA) certificate, from its Basic Constraints extension. |
| `ssl.extensions.extended_key_usage.client_auth` | True when the Extended Key Usage extension allows TLS client authentication. |
| `ssl.extensions.extended_key_usage.server_auth` | True when the Extended Key Usage extension allows TLS server authentication, as website certificates need. |
| `ssl.extensions.key_usage.content_commitment` | True when the Key Usage extension allows the certificate's key to be used for content commitment (non-repudiation). |
| `ssl.extensions.key_usage.crl_sign` | True when the Key Usage extension allows the certificate's key to be used for signing certificate revocation lists (CRL sign). |
| `ssl.extensions.key_usage.data_encipherment` | True when the Key Usage extension allows the certificate's key to be used for data encipherment. |
| `ssl.extensions.key_usage.digital_signature` | True when the Key Usage extension allows the certificate's key to be used for digital signatures. |
| `ssl.extensions.key_usage.key_agreement` | True when the Key Usage extension allows the certificate's key to be used for key agreement. |
| `ssl.extensions.key_usage.key_cert_sign` | True when the Key Usage extension allows the certificate's key to be used for signing other certificates (certificate sign). |
| `ssl.extensions.key_usage.key_encipherment` | True when the Key Usage extension allows the certificate's key to be used for key encipherment. |
| `ssl.has_expired` | True when the asset's TLS certificate is past its end date. |
| `http.external_domain_redirection` | True when the HTTP check ended on a different registrable domain than it started on. |
| `http.external_fqdn_redirection` | True when the HTTP check ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.html.inspect_disabled` | A flag of the web data scan that marks pages whose inspection was disabled; it was `false` on every sampled asset. |
| `webdata.html.html_meta.no_index_status` | True when the scanned page asks search engines not to index it (a `noindex` robots directive). |
| `webdata.http.external_domain_redirection` | True when the web data scan ended on a different registrable domain than it started on. |
| `webdata.http.external_fqdn_redirection` | True when the web data scan ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.http.cookies.secure` | True when a cookie set in the web data scan is sent over HTTPS only (Secure attribute). |
| `webdata.http.cookies.http_only` | True when scripts on the page cannot read a cookie set in the web data scan (HttpOnly attribute). |
| `webdata.http.cookies.session` | True when a cookie set in the web data scan is a session cookie, deleted when the browser closes. |
| `is_parked` | True when the asset is parked; Inventory marks it with a P badge whose tooltip shows where it redirects. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `dns.dnskey.records.key_type` | The role of a DNSKEY: `ZSK` (zone-signing key), `KSK` (key-signing key) or `KSK_REVOKED` (revoked key-signing key). |
| `dns.dnskey.records.algorithm` | The DNSSEC algorithm of a DNSKEY, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.algorithm` | The DNSSEC algorithm of the key that a DS record refers to, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.digest_type` | The hash used for a DS record's digest: `SHA1`, `SHA256`, `SHA384`, `GOST` or `NULL`. |
| `dns.rrsig.algorithm` | The DNSSEC algorithm of an RRSIG signature, such as `ECDSAP256SHA256` or `RSASHA256`. |

Operators: not measured

| Field | Description |
|---|---|
| `website.parent_asset.type` | The asset type of the website's parent asset, such as `subdomain`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `website_count` | The number of website assets (`host:port`) in your inventory that belong to this asset. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `open_port_count` | The number of open ports found on the asset. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `security_score` | The asset's EASM security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

## Response Fields

| Field | Type |
|---|---|
| `deleted_asset_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `deleted_asset_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-delete.md


---

# Asset Enable Discovery

URL: https://docs.deepinfo.com/reference/easm/asset-enable-discovery/

POST /easm/assets/search:enable-discovery: Enables (enabled=true) or disables discovery for every asset matching filters.

`POST https://api.deepinfo.com/v1/easm/assets/search:enable-discovery`

Enables (`enabled=true`) or disables discovery for every asset matching `filters`.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `enabled` | Required |  | `false` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the asset, such as a business unit or an environment; each tag is 3 to 100 characters long. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.name.unicode` | The host name without its extension, in Unicode: `acme` for `acme.example`, `www.acme` for `www.acme.example`. |
| `fqdn.name.latinized` | Latin-letter spellings of a name that has non-Latin or accented letters, so a search for `istanbul` also finds names written with `İ`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_sub.unicode` | The second-level part of a two-part extension, such as `co` in `co.uk`; empty for single-part extensions. |
| `website.path` | The URL path of a website asset, such as `/`. |
| `website.scheme` | The URL scheme of a website asset, such as `http`. |
| `website.parent_asset.id` | The ID of the domain or subdomain asset that a website asset belongs to. |
| `website.parent_asset.name` | The name of the domain or subdomain asset that a website asset belongs to. |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.name` | The registrant's name in WHOIS; often a privacy placeholder such as `redacted for privacy`. |
| `whois.registrant.country` | The registrant's country in WHOIS, as a two-letter code in lower case such as `us`. |
| `whois.registrant.state` | The registrant's state or province in WHOIS. |
| `whois.registrant.city` | The registrant's city in WHOIS. |
| `whois.registrant.street` | The registrant's street address in WHOIS. |
| `whois.registrant.postal_code` | The registrant's postal code in WHOIS. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `whois_registrant_email_historical` | Every registrant e-mail address seen for the domain over time, the current one included. |
| `whois_normalized.registrar` | The registrar reduced to a short normalized name, such as `godaddy` or `gandi`, so the same registrar matches across spellings. |
| `whois_normalized.registrant.email` | The registrant e-mail address after WHOIS normalization. |
| `whois_normalized.registrant.email_real` | Another normalized registrant e-mail field, set on fewer domains than `whois_normalized.registrant.email`; in the samples it is set only where `whois_privacy_enabled` is false, with the same address. |
| `whois_normalized.registrant.email_domain_apex` | The registrable domain of the registrant e-mail address: `acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.email_fqdn_apex` | The full host name after the `@` of the registrant e-mail address: `mail.acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.organization` | The registrant organization cleaned up across registrars: lower case, with spaces and punctuation removed, such as `domainsbyproxyllc`. |
| `whois_normalized.registrant.phone` | The registrant phone number reduced to its digits, such as `14805551234`. |
| `whois_last_change_data` | The WHOIS fields that changed in the last change seen, as field paths such as `whois.update_date` or `whois.domain_status`. |
| `dns.a.value` | The asset's current A records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.a.value_previous` | The asset's A records as they were before the last change, in the same text form as `dns.a.value`. |
| `dns.a.rcode` | The DNS response code returned for the asset's A lookup, such as `NOERROR`. |
| `dns.a.rcode_previous` | The DNS response code of the A lookup before it last changed. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.entities` | The handles of the registry contacts and organizations linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, when it is kept. |
| `dns.a.ip_addresses.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the A-record address. |
| `dns.a.ip_addresses.raw` | The raw IP WHOIS response for the A-record address, when it is kept; empty on every sampled asset. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.a.ip_addresses.network.start_address` | The first address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.end_address` | The last address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.handle` | The registry handle of the network that contains the A-record address, such as `NET-192-0-2-0-1`. |
| `dns.a.ip_addresses.network.ip_version` | The IP version of the network that contains the A-record address: `v4` or `v6`. |
| `dns.a.ip_addresses.network.links` | Links to the registry record of the network that contains the A-record address, such as its RDAP and WHOIS URLs. |
| `dns.a.ip_addresses.network.parent_handle` | The handle of the larger network block from which the network of the A-record address was allocated. |
| `dns.a.ip_addresses.network.raw` | The raw RDAP network object for the A-record address, when it is kept. |
| `dns.a.ip_addresses.network.status` | The registry status of the network that contains the A-record address, such as `active`. |
| `dns.a.ip_addresses.network.type` | The registry's allocation type for the network that contains the A-record address, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `dns.a.ip_addresses.network.notices.title` | The title of a notice the registry attached to the network record of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.network.notices.description` | The text of a notice the registry attached to the network record of the A-record address. |
| `dns.a.ip_addresses.network.notices.links` | Links given in a notice on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.title` | The title of a remark on the network record of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.network.remarks.description` | The text of a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.links` | Links given in a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.events.action` | An event in the history of the network record of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.network.events.actor` | Who performed an event on the network record of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the A-record address, such as `abuse`. |
| `dns.a.ip_addresses.objects.contact.email.value` | An e-mail address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.value` | A postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the A-record address, such as `voice` or `work`. |
| `dns.a.ip_addresses.objects.contact.phone.value` | A phone number of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.kind` | What kind of contact is linked to the network of the A-record address: `org`, `group` or `individual`. |
| `dns.a.ip_addresses.objects.contact.name` | The name of a contact or organization linked to the network of the A-record address, such as `Abuse` or a company name. |
| `dns.a.ip_addresses.objects.contact.role` | The role given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.title` | The title given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.entities` | Handles of further entities listed under a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.events.action` | An event in the history of a contact record linked to the network of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.objects.events.actor` | Who performed an event on a contact record linked to the network of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.events_actor` | Events in which a contact linked to the network of the A-record address is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `dns.a.ip_addresses.objects.handle` | The registry handle of a contact or organization linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.links` | Links to the registry record of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.title` | The title of a notice on a contact record linked to the network of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.objects.notices.description` | The text of a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.links` | Links given in a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.raw` | The raw RDAP object of a contact linked to the network of the A-record address, when it is kept. |
| `dns.a.ip_addresses.objects.remarks.title` | The title of a remark on a contact record linked to the network of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.objects.remarks.description` | The text of a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.roles` | The roles of a contact for the network of the A-record address, such as `registrant`, `abuse` or `technical`. |
| `dns.a.ip_addresses.objects.status` | The registry status of a contact linked to the network of the A-record address, such as `validated`. |
| `dns.a.ip_history` | Every IPv4 address seen in the asset's A records over time, the current ones included. |
| `dns.aaaa.value` | The asset's current AAAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.aaaa.value_previous` | The asset's AAAA records as they were before the last change, in the same text form as `dns.aaaa.value`. |
| `dns.aaaa.rcode` | The DNS response code returned for the asset's AAAA lookup, such as `NOERROR`. |
| `dns.aaaa.rcode_previous` | The DNS response code of the AAAA lookup before it last changed. |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the asset's AAAA records. |
| `dns.caa.value` | The asset's current CAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.caa.value_previous` | The asset's CAA records as they were before the last change, in the same text form as `dns.caa.value`. |
| `dns.caa.rcode` | The DNS response code returned for the asset's CAA lookup, such as `NOERROR`. |
| `dns.caa.rcode_previous` | The DNS response code of the CAA lookup before it last changed. |
| `dns.caa.issue_fqdns` | The certificate authorities allowed to issue certificates for the name, from the CAA `issue` tags, such as `fernhill.example` or `kestrel.example`. |
| `dns.caa.issuewild_fqdns` | The certificate authorities allowed to issue wildcard certificates for the name, from the CAA `issuewild` tags. |
| `dns.caa.iodef_emails` | The e-mail addresses from the CAA `iodef` tags, where certificate authorities report requests that break the CAA policy. |
| `dns.cname.value` | The asset's current CNAME records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.cname.value_previous` | The asset's CNAME records as they were before the last change, in the same text form as `dns.cname.value`. |
| `dns.cname.rcode` | The DNS response code returned for the asset's CNAME lookup, such as `NOERROR`. |
| `dns.cname.rcode_previous` | The DNS response code of the CNAME lookup before it last changed. |
| `dns.cname.canonical_fqdns` | The host names the asset's CNAME records point to (the alias targets). |
| `dns.dnskey.value` | The asset's current DNSKEY records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.dnskey.value_previous` | The asset's DNSKEY records as they were before the last change, in the same text form as `dns.dnskey.value`. |
| `dns.dnskey.rcode` | The DNS response code returned for the asset's DNSKEY lookup, such as `NOERROR`. |
| `dns.dnskey.rcode_previous` | The DNS response code of the DNSKEY lookup before it last changed. |
| `dns.dnskey.records.public_key` | The public key of a DNSKEY record, Base64-encoded and split into space-separated groups as in the zone-file text. |
| `dns.ds.value` | The asset's current DS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ds.value_previous` | The asset's DS records as they were before the last change, in the same text form as `dns.ds.value`. |
| `dns.ds.rcode` | The DNS response code returned for the asset's DS lookup, such as `NOERROR`. |
| `dns.ds.rcode_previous` | The DNS response code of the DS lookup before it last changed. |
| `dns.ds.records.digest` | The digest of a DS record, the hash of the DNSKEY it refers to. |
| `dns.mx.value` | The asset's current MX records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.mx.value_previous` | The asset's MX records as they were before the last change, in the same text form as `dns.mx.value`. |
| `dns.mx.rcode` | The DNS response code returned for the asset's MX lookup, such as `NOERROR`. |
| `dns.mx.rcode_previous` | The DNS response code of the MX lookup before it last changed. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns.mx.domains` | The registrable domains of the asset's mail servers, such as `acme.example`. |
| `dns.ns.value` | The asset's current NS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ns.value_previous` | The asset's NS records as they were before the last change, in the same text form as `dns.ns.value`. |
| `dns.ns.rcode` | The DNS response code returned for the asset's NS lookup, such as `NOERROR`. |
| `dns.ns.rcode_previous` | The DNS response code of the NS lookup before it last changed. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.ns.domains` | The registrable domains of the asset's name servers, such as `acme.example`. |
| `dns.nsec.value` | The asset's current NSEC records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec.value_previous` | The asset's NSEC records as they were before the last change, in the same text form as `dns.nsec.value`. |
| `dns.nsec.rcode` | The DNS response code returned for the asset's NSEC lookup, such as `NOERROR`. |
| `dns.nsec.rcode_previous` | The DNS response code of the NSEC lookup before it last changed. |
| `dns.nsec.records.next_domain` | The next name in the zone, from an NSEC record. |
| `dns.nsec.records.record_types` | The record types that exist at the name, from an NSEC record's type list, such as `A`, `NS` or `SOA`. |
| `dns.nsec3.value` | The asset's current NSEC3 records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec3.value_previous` | The asset's NSEC3 records as they were before the last change, in the same text form as `dns.nsec3.value`. |
| `dns.nsec3.rcode` | The DNS response code returned for the asset's NSEC3 lookup, such as `NOERROR`. |
| `dns.nsec3.rcode_previous` | The DNS response code of the NSEC3 lookup before it last changed. |
| `dns.nsec3.records.next_domain_hashed` | The hashed next name in the zone, from an NSEC3 record. |
| `dns.nsec3.records.record_types` | The record types that exist at the name, from an NSEC3 record's type list, such as `A` or `MX`. |
| `dns.rrsig.value` | The asset's current RRSIG records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.rrsig.value_previous` | The asset's RRSIG records as they were before the last change, in the same text form as `dns.rrsig.value`. |
| `dns.rrsig.rcode` | The DNS response code returned for the asset's RRSIG lookup, such as `NOERROR`. |
| `dns.rrsig.rcode_previous` | The DNS response code of the RRSIG lookup before it last changed. |
| `dns.rrsig.type_covered` | The record type that an RRSIG signature covers, such as `A` or `SOA`. |
| `dns.rrsig.signature` | The signature data of an RRSIG record, Base64-encoded. |
| `dns.soa.value` | The asset's current SOA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.soa.value_previous` | The asset's SOA records as they were before the last change, in the same text form as `dns.soa.value`. |
| `dns.soa.rcode` | The DNS response code returned for the asset's SOA lookup, such as `NOERROR`. |
| `dns.soa.rcode_previous` | The DNS response code of the SOA lookup before it last changed. |
| `dns.soa.mnames` | The MNAME of the SOA record: the primary name server of the zone, such as `ns1.acme.example`. |
| `dns.soa.rnames` | The RNAME of the SOA record, the zone administrator's mailbox in DNS form: `hostmaster.acme.example` stands for the mailbox `hostmaster` at `acme.example`. |
| `dns.soa.rname_emails` | The RNAME of the SOA record written as an e-mail address, such as `user@acme.example`. |
| `dns.srv.value` | The asset's current SRV records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.srv.value_previous` | The asset's SRV records as they were before the last change, in the same text form as `dns.srv.value`. |
| `dns.srv.rcode` | The DNS response code returned for the asset's SRV lookup, such as `NOERROR`. |
| `dns.srv.rcode_previous` | The DNS response code of the SRV lookup before it last changed. |
| `dns.srv.records.service` | The service named in an SRV record (the `_service` part of its name). |
| `dns.srv.records.protocol` | The protocol named in an SRV record (the `_proto` part of its name, such as TCP or UDP). |
| `dns.srv.records.target` | The host name an SRV record points to. |
| `dns.txt.value` | The asset's current TXT records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.txt.value_previous` | The asset's TXT records as they were before the last change, in the same text form as `dns.txt.value`. |
| `dns.txt.rcode` | The DNS response code returned for the asset's TXT lookup, such as `NOERROR`. |
| `dns.txt.rcode_previous` | The DNS response code of the TXT lookup before it last changed. |
| `dns.txt.values` | Each TXT record of the asset as its quoted text, such as `"v=spf1 include:_spf.acme.example ~all"`; the quotes are part of the value. |
| `dns.txt.spf_list.value` | The text of an SPF record (a TXT record that starts with `v=spf1`), quoted as in `dns.txt.values`. |
| `dns.txt.spf_list.allowed_domains` | The registrable domains that an SPF record refers to, such as `acme.example` for `include:_spf.acme.example`. |
| `dns.txt.spf_list.allowed_ips` | The IP addresses and ranges that an SPF record authorizes to send mail (its `ip4:` and `ip6:` entries). |
| `dns.txt.verifications.value` | The text of a site-verification TXT record, quoted as in `dns.txt.values`. |
| `dns.txt.verifications.domain` | The domain of the service a verification record is for, such as `acme.example`, `fernhill.example` or `kestrel.example`. |
| `dns.txt.verifications.name` | The name of a verification record, such as `site-verification` or `domain-verification`. |
| `dns_last_change_data` | The DNS fields that changed in the last change seen, as field paths such as `dns.soa.mnames`. |
| `ssl.target` | The host name that the asset's TLS certificate was collected from, normally the asset itself. |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the asset's TLS certificate, as lower-case hex; one fingerprint identifies one certificate. |
| `ssl.issuer.common_name` | The common name (CN) of the certificate authority that issued the asset's TLS certificate, such as `WE1` or `YE2`. |
| `ssl.issuer.country` | The country (C) of the certificate authority that issued the asset's TLS certificate, as a two-letter code such as `US`. |
| `ssl.issuer.state` | The state or province (ST) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.locality` | The locality or city (L) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.organization` | The organization (O) of the certificate authority that issued the asset's TLS certificate, such as `Let's Encrypt` or `Google Trust Services`. |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer_dn` | The full distinguished name of the issuer of the asset's TLS certificate, as one string such as `CN=WE1,O=Google Trust Services,C=US`. |
| `ssl.subject.common_name` | The common name (CN) of the subject (holder) of the asset's TLS certificate, usually a host name such as `acme.example`. |
| `ssl.subject.country` | The country (C) of the subject (holder) of the asset's TLS certificate, as a two-letter code. |
| `ssl.subject.state` | The state or province (ST) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.locality` | The locality or city (L) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organizational_unit` | The organizational unit (OU) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject_dn` | The full distinguished name of the subject of the asset's TLS certificate, such as `CN=acme.example`; one that starts with `CN=*.` belongs to a wildcard certificate. |
| `ssl.signature.value` | The signature of the asset's TLS certificate, Base64-encoded. |
| `ssl.signature.invalid_reason` | Why certificate validation failed, such as a host name mismatch or `unable to get issuer certificate`. |
| `ssl.signature.algorithm.name` | The hash algorithm of the signature on the asset's TLS certificate, such as `sha256` or `sha384`. |
| `ssl.signature.algorithm.oid` | The object identifier (OID) of the signature algorithm, such as `1.2.840.113549.1.1.11` (SHA-256 with RSA) or `1.2.840.10045.4.3.2` (ECDSA with SHA-256). |
| `ssl.extensions.authority_key_id` | The Authority Key Identifier extension, which identifies the issuer's key, Base64-encoded. |
| `ssl.extensions.certificate_policies` | The policy OIDs in the Certificate Policies extension, such as `2.23.140.1.2.1` (domain validated). |
| `ssl.extensions.signed_certificate_timestamps.log_id` | The ID of the Certificate Transparency log that issued a signed certificate timestamp (SCT) for the certificate, Base64-encoded. |
| `ssl.extensions.signed_certificate_timestamps.signature` | The log's signature on a signed certificate timestamp, Base64-encoded. |
| `ssl.extensions.subject_alt_name.dns_names` | The host names in the certificate's Subject Alternative Name extension, including wildcard names such as `*.acme.example`. |
| `ssl.extensions.subject_key_id` | The Subject Key Identifier extension, which identifies the certificate's own key, Base64-encoded. |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | The hash algorithm used for `ssl.subject_key_info.fingerprint.value`, such as `sha256` or `sha384`. |
| `ssl.subject_key_info.fingerprint.value` | A hex fingerprint recorded under the certificate's subject key information, made with the hash in `hash_algorithm`. In the samples it equals `ssl.fingerprint.sha256` when that hash is SHA-256. |
| `ssl.subject_key_info.key_algorithm.name` | The algorithm of the certificate's public key, such as `RSA` or `ECDSA`. |
| `ssl.version.name` | The X.509 version of the certificate, such as `v3`. |
| `ssl.version.value` | The X.509 version as encoded in the certificate, counted from zero: `2` means `v3`. |
| `ssl.tbs_fingerprint` | A SHA-256 fingerprint (hex) of the certificate's to-be-signed part, the certificate content without its signature. |
| `ssl.certificate` | The whole certificate, Base64-encoded (a PEM body without the header and footer lines). |
| `ssl.fqdn_list` | The host names the certificate covers, with the `*.` of wildcard names removed and duplicates merged, so `*.acme.example` and `acme.example` both give `acme.example`. |
| `ssl_last_change_data` | The certificate fields that changed in the last change seen, as field paths such as `ssl.validity.end_date`. |
| `http.requested_url` | The URL the HTTP check started from, such as `http://acme.example`. |
| `http.requested_domain` | The registrable domain of the URL the HTTP check started from. |
| `http.requested_fqdn` | The host name of the URL the HTTP check started from. |
| `http.final_url` | The URL the HTTP check ended on after following all redirects. |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.redirection_history.url` | A URL in the redirect chain of the HTTP check, listed in the order visited. |
| `http.headers.accept` | The `Accept` header, when it was returned in the HTTP check. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the HTTP check. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `http.headers.accept_language` | The `Accept-Language` header, when it was returned in the HTTP check. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the HTTP check; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the HTTP check; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the HTTP check; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the HTTP check; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the HTTP check; it lists the response headers that scripts from other origins may read (CORS). |
| `http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the HTTP check; it says how many seconds browsers may cache a CORS preflight result. |
| `http.headers.alt_svc` | The `Alt-Svc` header returned in the HTTP check; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `http.headers.authorization` | The `Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `http.headers.cache_control` | The `Cache-Control` header returned in the HTTP check; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the HTTP check; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `http.headers.content_disposition` | The `Content-Disposition` header returned in the HTTP check; it says whether the content is shown in the browser or downloaded as a file. |
| `http.headers.content_encoding` | The `Content-Encoding` header returned in the HTTP check; it names the compression applied to the response body, for example `gzip` or `br`. |
| `http.headers.content_language` | The `Content-Language` header returned in the HTTP check; it gives the language of the content, for example `en` or `tr`. |
| `http.headers.content_length` | The `Content-Length` header returned in the HTTP check; it gives the size of the response body in bytes. |
| `http.headers.content_range` | The `Content-Range` header returned in the HTTP check; it says which part of the full body a partial response holds. |
| `http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the HTTP check; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `http.headers.content_type` | The `Content-Type` header returned in the HTTP check; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `http.headers.cookie` | The `Cookie` header, when it was returned in the HTTP check. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the HTTP check; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the HTTP check; it controls whether the page shares its browsing context with cross-origin windows. |
| `http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the HTTP check; it controls which sites may load the resource. |
| `http.headers.date` | The `Date` header returned in the HTTP check; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `http.headers.early_data` | The `Early-Data` header, when it was returned in the HTTP check. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `http.headers.expect_ct` | The `Expect-CT` header returned in the HTTP check; it is a deprecated header about Certificate Transparency enforcement. |
| `http.headers.expires` | The `Expires` header returned in the HTTP check; it gives the date after which the response counts as stale, in HTTP date format. |
| `http.headers.feature_policy` | The `Feature-Policy` header returned in the HTTP check; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `http.headers.host` | The `Host` header, when it was returned in the HTTP check. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the HTTP check. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the HTTP check. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `http.headers.last_modified` | The `Last-Modified` header returned in the HTTP check; it gives the time the server says the resource last changed, in HTTP date format. |
| `http.headers.origin_isolation` | The `Origin-Isolation` header returned in the HTTP check; it is an experimental header that asks browsers to isolate the site's origin. |
| `http.headers.others.name` | The name of a header returned in the HTTP check that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `http.headers.others.value` | The value of a header listed in `headers.others` for the HTTP check. |
| `http.headers.permission_policy` | The `Permission-Policy` header returned in the HTTP check; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `http.headers.permissions_policy` | The `Permissions-Policy` header returned in the HTTP check; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `http.headers.pragma` | The `Pragma` header returned in the HTTP check; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the HTTP check; it tells a client how to authenticate to a proxy. |
| `http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the HTTP check; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `http.headers.range` | The `Range` header, when it was returned in the HTTP check. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `http.headers.referer` | The `Referer` header, when it was returned in the HTTP check. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `http.headers.referrer_policy` | The `Referrer-Policy` header returned in the HTTP check; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the HTTP check. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `http.headers.server` | The `Server` header returned in the HTTP check; it names the server software the site reports, for example `nginx` or `Apache`. |
| `http.headers.set_cookie` | The `Set-Cookie` header returned in the HTTP check; it sets cookies, with their attributes. |
| `http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the HTTP check; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `http.headers.te` | The `TE` header, when it was returned in the HTTP check. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the HTTP check; it says how the body is transferred, for example `chunked`. |
| `http.headers.upgrade` | The `Upgrade` header returned in the HTTP check; it offers or asks for a switch to another protocol. |
| `http.headers.user_agent` | The `User-Agent` header, when it was returned in the HTTP check. It is normally a request header (the client software), so it is rarely set. |
| `http.headers.vary` | The `Vary` header returned in the HTTP check; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the HTTP check; it tells a client how to authenticate, usually with a `401` response. |
| `http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the HTTP check; it stops browsers from guessing the content type when set to `nosniff`. |
| `http.headers.x_download_options` | The `X-Download-Options` header returned in the HTTP check; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `http.headers.x_frame_options` | The `X-Frame-Options` header returned in the HTTP check; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the HTTP check; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `http.headers.x_powered_by` | The `X-Powered-By` header returned in the HTTP check; it names the technology the server reports running on, for example `Express`. |
| `http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the HTTP check; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `http.cookies.name` | The name of a cookie set in the HTTP check. |
| `http.cookies.value` | The value of a cookie set in the HTTP check. |
| `http.html.source_code_hash` | A SHA-256 hash of the page source returned in the HTTP check; the same hash means the same source. |
| `http_last_change_data` | The HTTP check fields that changed in the last change seen, as field paths such as `http.html.source_code_hash`. |
| `webdata.requested_url` | The URL the web data scan started from, such as `http://acme.example`. |
| `webdata.requested_domain` | The registrable domain of the URL the web data scan started from. |
| `webdata.requested_fqdn` | The host name of the URL the web data scan started from. |
| `webdata.html.internal_links_fqdns` | The host names of links on the scanned page that stay within the site's own domain, such as other subdomains. |
| `webdata.html.external_links_domains` | The registrable domains of links on the scanned page that point to other domains, such as `kestrel.example`. |
| `webdata.html.external_links_fqdns` | The host names of links on the scanned page that point to other domains, such as `www.kestrel.example`. |
| `webdata.html.external_links` | The full URLs of links on the scanned page that point to other domains. |
| `webdata.html.script_links` | The URLs of the scripts the scanned page loads. |
| `webdata.html.iframe_links` | The URLs of the frames (iframes) embedded in the scanned page. |
| `webdata.html.trackers.name` | The name of an analytics or advertising tracker found on the scanned page, such as `google_adsense` or `google_tag_manager`. |
| `webdata.html.trackers.values` | The IDs found for a tracker, such as a Google Analytics ID that starts with `G-` or `UA-`. |
| `webdata.html.emails` | The e-mail addresses found on the scanned page. |
| `webdata.html.emails_internal` | The e-mail addresses found on the scanned page that belong to the site's own domain. |
| `webdata.html.source_code_hash` | A SHA-256 hash of the page source in the web data scan; the same hash means the same source. |
| `webdata.html.content_hash` | A SHA-256 hash of the page content in the web data scan, kept apart from `source_code_hash`, the hash of the raw source. |
| `webdata.html.content_top_keywords` | The most frequent words in the text of the scanned page. |
| `webdata.html.favicon_links` | The URLs of the icons the scanned page declares, such as its favicon and touch icons. |
| `webdata.html.html_meta.name` | The site or application name declared in the scanned page's metadata. |
| `webdata.html.html_meta.description` | The meta description of the scanned page. |
| `webdata.html.html_meta.language` | The language the scanned page declares, such as `en`, `tr` or `en-US`. |
| `webdata.html.html_meta.language_alternatives` | The languages of the alternative versions the scanned page links to, such as `en` or `ar`. |
| `webdata.html.html_meta.keywords` | The keywords listed in the keywords meta tag of the scanned page. |
| `webdata.html.html_meta.encoding` | The character encoding the scanned page declares, such as `utf-8`. |
| `webdata.html.html_meta.canonical_url` | The canonical URL the scanned page declares. |
| `webdata.html.html_meta.title` | The title of the scanned page. |
| `webdata.favicon.url` | The URL of a site icon (favicon) recorded by the web data scan. |
| `webdata.favicon.hash` | A SHA-256 hash of a site icon; the same hash means the same icon. |
| `webdata.http.final_url` | The URL the web data scan ended on after following all redirects. |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.redirection_history.url` | A URL in the redirect chain of the web data scan, listed in the order visited. |
| `webdata.http.redirection_history.method` | How a step of the web data scan's redirect chain was made; `http-header` (a redirect sent in the HTTP response) is the value in the samples. |
| `webdata.http.headers.accept` | The `Accept` header, when it was returned in the web data scan. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the web data scan. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_language` | The `Accept-Language` header, when it was returned in the web data scan. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `webdata.http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the web data scan; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `webdata.http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the web data scan; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `webdata.http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the web data scan; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `webdata.http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the web data scan; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `webdata.http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the web data scan; it lists the response headers that scripts from other origins may read (CORS). |
| `webdata.http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the web data scan; it says how many seconds browsers may cache a CORS preflight result. |
| `webdata.http.headers.alt_svc` | The `Alt-Svc` header returned in the web data scan; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `webdata.http.headers.authorization` | The `Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `webdata.http.headers.cache_control` | The `Cache-Control` header returned in the web data scan; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `webdata.http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the web data scan; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `webdata.http.headers.content_disposition` | The `Content-Disposition` header returned in the web data scan; it says whether the content is shown in the browser or downloaded as a file. |
| `webdata.http.headers.content_encoding` | The `Content-Encoding` header returned in the web data scan; it names the compression applied to the response body, for example `gzip` or `br`. |
| `webdata.http.headers.content_language` | The `Content-Language` header returned in the web data scan; it gives the language of the content, for example `en` or `tr`. |
| `webdata.http.headers.content_length` | The `Content-Length` header returned in the web data scan; it gives the size of the response body in bytes. |
| `webdata.http.headers.content_range` | The `Content-Range` header returned in the web data scan; it says which part of the full body a partial response holds. |
| `webdata.http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the web data scan; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `webdata.http.headers.content_type` | The `Content-Type` header returned in the web data scan; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `webdata.http.headers.cookie` | The `Cookie` header, when it was returned in the web data scan. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `webdata.http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the web data scan; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `webdata.http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the web data scan; it controls whether the page shares its browsing context with cross-origin windows. |
| `webdata.http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the web data scan; it controls which sites may load the resource. |
| `webdata.http.headers.date` | The `Date` header returned in the web data scan; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `webdata.http.headers.early_data` | The `Early-Data` header, when it was returned in the web data scan. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `webdata.http.headers.expect_ct` | The `Expect-CT` header returned in the web data scan; it is a deprecated header about Certificate Transparency enforcement. |
| `webdata.http.headers.expires` | The `Expires` header returned in the web data scan; it gives the date after which the response counts as stale, in HTTP date format. |
| `webdata.http.headers.feature_policy` | The `Feature-Policy` header returned in the web data scan; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `webdata.http.headers.host` | The `Host` header, when it was returned in the web data scan. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `webdata.http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the web data scan. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `webdata.http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the web data scan. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `webdata.http.headers.last_modified` | The `Last-Modified` header returned in the web data scan; it gives the time the server says the resource last changed, in HTTP date format. |
| `webdata.http.headers.origin_isolation` | The `Origin-Isolation` header returned in the web data scan; it is an experimental header that asks browsers to isolate the site's origin. |
| `webdata.http.headers.others.name` | The name of a header returned in the web data scan that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `webdata.http.headers.others.value` | The value of a header listed in `headers.others` for the web data scan. |
| `webdata.http.headers.permission_policy` | The `Permission-Policy` header returned in the web data scan; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `webdata.http.headers.permissions_policy` | The `Permissions-Policy` header returned in the web data scan; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `webdata.http.headers.pragma` | The `Pragma` header returned in the web data scan; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `webdata.http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the web data scan; it tells a client how to authenticate to a proxy. |
| `webdata.http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `webdata.http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the web data scan; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `webdata.http.headers.range` | The `Range` header, when it was returned in the web data scan. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `webdata.http.headers.referer` | The `Referer` header, when it was returned in the web data scan. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `webdata.http.headers.referrer_policy` | The `Referrer-Policy` header returned in the web data scan; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `webdata.http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `webdata.http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the web data scan. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `webdata.http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `webdata.http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the web data scan. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `webdata.http.headers.server` | The `Server` header returned in the web data scan; it names the server software the site reports, for example `nginx` or `Apache`. |
| `webdata.http.headers.set_cookie` | The `Set-Cookie` header returned in the web data scan; it sets cookies, with their attributes. |
| `webdata.http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the web data scan; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `webdata.http.headers.te` | The `TE` header, when it was returned in the web data scan. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `webdata.http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the web data scan; it says how the body is transferred, for example `chunked`. |
| `webdata.http.headers.upgrade` | The `Upgrade` header returned in the web data scan; it offers or asks for a switch to another protocol. |
| `webdata.http.headers.user_agent` | The `User-Agent` header, when it was returned in the web data scan. It is normally a request header (the client software), so it is rarely set. |
| `webdata.http.headers.vary` | The `Vary` header returned in the web data scan; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `webdata.http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the web data scan; it tells a client how to authenticate, usually with a `401` response. |
| `webdata.http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the web data scan; it stops browsers from guessing the content type when set to `nosniff`. |
| `webdata.http.headers.x_download_options` | The `X-Download-Options` header returned in the web data scan; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `webdata.http.headers.x_frame_options` | The `X-Frame-Options` header returned in the web data scan; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the web data scan; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `webdata.http.headers.x_powered_by` | The `X-Powered-By` header returned in the web data scan; it names the technology the server reports running on, for example `Express`. |
| `webdata.http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the web data scan; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `webdata.http.cookies.name` | The name of a cookie set in the web data scan. |
| `webdata.http.cookies.value` | The value of a cookie set in the web data scan. |
| `webdata.http.cookies.domain` | The domain a cookie set in the web data scan applies to, such as `.acme.example`. |
| `webdata.http.cookies.path` | The path a cookie set in the web data scan applies to, such as `/`. |
| `webdata.http.cookies.same_party` | The SameParty attribute of a cookie set in the web data scan; in the samples it always holds the same value as `same_site`, such as `Lax` or `None`. |
| `webdata.http.cookies.priority` | The Priority attribute of a cookie set in the web data scan (`Low`, `Medium` or `High` in Chromium-based browsers). |
| `webdata.http.cookies.same_site` | The SameSite attribute of a cookie set in the web data scan, such as `Lax`, `Strict` or `None`. |
| `webdata.technology.stacks.slug` | A short identifier of a technology detected on the site, such as `iis` or `windows-server`. |
| `webdata.technology.stacks.name` | The name of a technology detected on the site, such as `IIS` or `Microsoft ASP.NET`. |
| `webdata.technology.stacks.icon` | The file name of a detected technology's icon, such as `acme.png`. |
| `webdata.technology.stacks.website` | The website of a detected technology's vendor or project. |
| `webdata.technology.stacks.cpe` | The CPE identifier of a detected technology, such as `cpe:/a:acme:acme-portal`, used to match it to known vulnerabilities. |
| `webdata.technology.stacks.version` | The detected version of a technology, such as `1.0`. |
| `webdata.technology.stacks.categories` | The categories of a detected technology, such as `Web servers` or `Operating systems`. |
| `webdata.technology.stacks.description` | A short description of a detected technology. |
| `webdata_last_change_data` | The web data fields that changed in the last change seen, as field paths under `webdata`. |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.entities` | The handles of the registry contacts and organizations linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, when it is kept. |
| `ipwhois.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the IP address asset. |
| `ipwhois.raw` | The raw IP WHOIS response for the IP address asset, when it is kept; empty on every sampled asset. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `ipwhois.network.start_address` | The first address of the registered network block that contains the IP address asset. |
| `ipwhois.network.end_address` | The last address of the registered network block that contains the IP address asset. |
| `ipwhois.network.handle` | The registry handle of the network that contains the IP address asset, such as `NET-192-0-2-0-1`. |
| `ipwhois.network.ip_version` | The IP version of the network that contains the IP address asset: `v4` or `v6`. |
| `ipwhois.network.links` | Links to the registry record of the network that contains the IP address asset, such as its RDAP and WHOIS URLs. |
| `ipwhois.network.parent_handle` | The handle of the larger network block from which the network of the IP address asset was allocated. |
| `ipwhois.network.raw` | The raw RDAP network object for the IP address asset, when it is kept. |
| `ipwhois.network.status` | The registry status of the network that contains the IP address asset, such as `active`. |
| `ipwhois.network.type` | The registry's allocation type for the network that contains the IP address asset, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `ipwhois.network.notices.title` | The title of a notice the registry attached to the network record of the IP address asset, such as `Terms of Service`. |
| `ipwhois.network.notices.description` | The text of a notice the registry attached to the network record of the IP address asset. |
| `ipwhois.network.notices.links` | Links given in a notice on the network record of the IP address asset. |
| `ipwhois.network.remarks.title` | The title of a remark on the network record of the IP address asset, such as `Registration Comments`. |
| `ipwhois.network.remarks.description` | The text of a remark on the network record of the IP address asset. |
| `ipwhois.network.remarks.links` | Links given in a remark on the network record of the IP address asset. |
| `ipwhois.network.events.action` | An event in the history of the network record of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.network.events.actor` | Who performed an event on the network record of the IP address asset, when the registry names one. |
| `ipwhois.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the IP address asset, such as `abuse`. |
| `ipwhois.objects.contact.email.value` | An e-mail address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.value` | A postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the IP address asset, such as `voice` or `work`. |
| `ipwhois.objects.contact.phone.value` | A phone number of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.kind` | What kind of contact is linked to the network of the IP address asset: `org`, `group` or `individual`. |
| `ipwhois.objects.contact.name` | The name of a contact or organization linked to the network of the IP address asset, such as `Abuse` or a company name. |
| `ipwhois.objects.contact.role` | The role given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.contact.title` | The title given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.entities` | Handles of further entities listed under a contact linked to the network of the IP address asset. |
| `ipwhois.objects.events.action` | An event in the history of a contact record linked to the network of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.objects.events.actor` | Who performed an event on a contact record linked to the network of the IP address asset, when the registry names one. |
| `ipwhois.objects.events_actor` | Events in which a contact linked to the network of the IP address asset is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `ipwhois.objects.handle` | The registry handle of a contact or organization linked to the network of the IP address asset. |
| `ipwhois.objects.links` | Links to the registry record of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.notices.title` | The title of a notice on a contact record linked to the network of the IP address asset, such as `Terms of Service`. |
| `ipwhois.objects.notices.description` | The text of a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.notices.links` | Links given in a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.raw` | The raw RDAP object of a contact linked to the network of the IP address asset, when it is kept. |
| `ipwhois.objects.remarks.title` | The title of a remark on a contact record linked to the network of the IP address asset, such as `Registration Comments`. |
| `ipwhois.objects.remarks.description` | The text of a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.roles` | The roles of a contact for the network of the IP address asset, such as `registrant`, `abuse` or `technical`. |
| `ipwhois.objects.status` | The registry status of a contact linked to the network of the IP address asset, such as `validated`. |
| `ipwhois_last_change_data` | The IP WHOIS fields that changed in the last change seen, as field paths under `ipwhois`. |
| `ipdns.ptr_records` | The PTR (reverse DNS) host names of an IP address asset. |
| `ipdns_last_change_data` | The reverse DNS fields that changed in the last change seen, as field paths under `ipdns`. |
| `issue_category_stats.name` | The name of an issue category in the per-category issue counts of the asset, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. |
| `technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the asset, such as `Web servers` or `Analytics`. |
| `domain_snapshot.issue_category_stats.name` | The name of an issue category in the per-category issue counts of the domain and its subdomains together, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the domain and its subdomains together, such as `Web servers` or `Analytics`. Set on domain assets. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.name.length` | The number of characters in the name without the extension: `4` for `acme.example`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois_create_date_historical` | Every creation date seen for the domain over time, so a domain that was deleted and registered again keeps its earlier dates too (UTC date-times). |
| `whois_check_date` | When the WHOIS record of the asset was last checked (UTC date-time). |
| `whois_last_change_date` | When a change in the WHOIS record of the asset was last seen (UTC date-time). |
| `dns.a.value_last_change_date` | When the A record text (`dns.a.value`) last changed (UTC date-time). |
| `dns.a.rcode_last_change_date` | When the response code of the A lookup (`dns.a.rcode`) last changed (UTC date-time). |
| `dns.a.last_change_date` | When the asset's A records last changed, in their text or their response code (UTC date-time). |
| `dns.a.ip_addresses.asn_date` | The registry allocation date that the ASN lookup reports for the A-record address, as a date at midnight UTC. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was created (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was last updated (UTC date-time). |
| `dns.a.ip_addresses.network.events.timestamp` | When an event on the network record of the A-record address happened (UTC date-time). |
| `dns.a.ip_addresses.objects.events.timestamp` | When an event on a contact record linked to the network of the A-record address happened (UTC date-time). |
| `dns.aaaa.value_last_change_date` | When the AAAA record text (`dns.aaaa.value`) last changed (UTC date-time). |
| `dns.aaaa.rcode_last_change_date` | When the response code of the AAAA lookup (`dns.aaaa.rcode`) last changed (UTC date-time). |
| `dns.aaaa.last_change_date` | When the asset's AAAA records last changed, in their text or their response code (UTC date-time). |
| `dns.caa.value_last_change_date` | When the CAA record text (`dns.caa.value`) last changed (UTC date-time). |
| `dns.caa.rcode_last_change_date` | When the response code of the CAA lookup (`dns.caa.rcode`) last changed (UTC date-time). |
| `dns.caa.last_change_date` | When the asset's CAA records last changed, in their text or their response code (UTC date-time). |
| `dns.cname.value_last_change_date` | When the CNAME record text (`dns.cname.value`) last changed (UTC date-time). |
| `dns.cname.rcode_last_change_date` | When the response code of the CNAME lookup (`dns.cname.rcode`) last changed (UTC date-time). |
| `dns.cname.last_change_date` | When the asset's CNAME records last changed, in their text or their response code (UTC date-time). |
| `dns.dnskey.value_last_change_date` | When the DNSKEY record text (`dns.dnskey.value`) last changed (UTC date-time). |
| `dns.dnskey.rcode_last_change_date` | When the response code of the DNSKEY lookup (`dns.dnskey.rcode`) last changed (UTC date-time). |
| `dns.dnskey.last_change_date` | When the asset's DNSKEY records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.value_last_change_date` | When the DS record text (`dns.ds.value`) last changed (UTC date-time). |
| `dns.ds.rcode_last_change_date` | When the response code of the DS lookup (`dns.ds.rcode`) last changed (UTC date-time). |
| `dns.ds.last_change_date` | When the asset's DS records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.records.key_tag` | The key tag (a number) of the DNSKEY that a DS record refers to. |
| `dns.mx.value_last_change_date` | When the MX record text (`dns.mx.value`) last changed (UTC date-time). |
| `dns.mx.rcode_last_change_date` | When the response code of the MX lookup (`dns.mx.rcode`) last changed (UTC date-time). |
| `dns.mx.last_change_date` | When the asset's MX records last changed, in their text or their response code (UTC date-time). |
| `dns.ns.value_last_change_date` | When the NS record text (`dns.ns.value`) last changed (UTC date-time). |
| `dns.ns.rcode_last_change_date` | When the response code of the NS lookup (`dns.ns.rcode`) last changed (UTC date-time). |
| `dns.ns.last_change_date` | When the asset's NS records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec.value_last_change_date` | When the NSEC record text (`dns.nsec.value`) last changed (UTC date-time). |
| `dns.nsec.rcode_last_change_date` | When the response code of the NSEC lookup (`dns.nsec.rcode`) last changed (UTC date-time). |
| `dns.nsec.last_change_date` | When the asset's NSEC records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec3.value_last_change_date` | When the NSEC3 record text (`dns.nsec3.value`) last changed (UTC date-time). |
| `dns.nsec3.rcode_last_change_date` | When the response code of the NSEC3 lookup (`dns.nsec3.rcode`) last changed (UTC date-time). |
| `dns.nsec3.last_change_date` | When the asset's NSEC3 records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.value_last_change_date` | When the RRSIG record text (`dns.rrsig.value`) last changed (UTC date-time). |
| `dns.rrsig.rcode_last_change_date` | When the response code of the RRSIG lookup (`dns.rrsig.rcode`) last changed (UTC date-time). |
| `dns.rrsig.last_change_date` | When the asset's RRSIG records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.signature_inception` | When an RRSIG signature becomes valid (UTC date-time). |
| `dns.rrsig.signature_expiration` | When an RRSIG signature expires (UTC date-time). |
| `dns.soa.value_last_change_date` | When the SOA record text (`dns.soa.value`) last changed (UTC date-time). |
| `dns.soa.rcode_last_change_date` | When the response code of the SOA lookup (`dns.soa.rcode`) last changed (UTC date-time). |
| `dns.soa.last_change_date` | When the asset's SOA records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.value_last_change_date` | When the SRV record text (`dns.srv.value`) last changed (UTC date-time). |
| `dns.srv.rcode_last_change_date` | When the response code of the SRV lookup (`dns.srv.rcode`) last changed (UTC date-time). |
| `dns.srv.last_change_date` | When the asset's SRV records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.records.port` | The port an SRV record points to. |
| `dns.txt.value_last_change_date` | When the TXT record text (`dns.txt.value`) last changed (UTC date-time). |
| `dns.txt.rcode_last_change_date` | When the response code of the TXT lookup (`dns.txt.rcode`) last changed (UTC date-time). |
| `dns.txt.last_change_date` | When the asset's TXT records last changed, in their text or their response code (UTC date-time). |
| `dns_check_date` | When the DNS records of the asset were last checked (UTC date-time). |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.port` | The port that the asset's TLS certificate was collected on, such as `443`. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl.validity.length` | The validity period of the certificate in seconds: 7,776,000 seconds are 90 days. |
| `ssl.extensions.signed_certificate_timestamps.timestamp` | When a Certificate Transparency log recorded the certificate, from a signed certificate timestamp (UTC date-time). |
| `ssl.extensions.signed_certificate_timestamps.version` | The version of a signed certificate timestamp; `0` stands for version 1. |
| `ssl_check_date` | When the TLS certificate of the asset was last checked (UTC date-time). |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the HTTP check, such as `301` or `200`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_check_date` | When the HTTP check of the asset last ran (UTC date-time). |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the web data scan, such as `301` or `200`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata.http.cookies.size` | The size of a cookie set in the web data scan, in bytes (name plus value). |
| `webdata.http.cookies.expires` | When a cookie set in the web data scan expires (UTC date-time); session cookies show `1969-12-31T23:59:59Z`. |
| `webdata.technology.stacks.confidence` | How certain the detection of a technology is, from 0 to 100; every sampled detection has `100`. |
| `webdata.technology.stacks.clean_version` | The major version of a detected technology as a whole number, such as `1` for version `1.0`. |
| `webdata_check_date` | When the web data scan of the asset, which collects the page content, headers and technologies, last ran (UTC date-time). |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn_date` | The registry allocation date that the ASN lookup reports for the IP address asset, as a date at midnight UTC. |
| `ipwhois.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was created (UTC date-time). |
| `ipwhois.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was last updated (UTC date-time). |
| `ipwhois.network.events.timestamp` | When an event on the network record of the IP address asset happened (UTC date-time). |
| `ipwhois.objects.events.timestamp` | When an event on a contact record linked to the network of the IP address asset happened (UTC date-time). |
| `ipwhois_check_date` | When the IP WHOIS record of an IP address asset was last checked (UTC date-time). |
| `ipwhois_last_change_date` | When a change in the IP WHOIS record of an IP address asset was last seen (UTC date-time). |
| `ipdns_check_date` | When the reverse DNS (PTR) records of an IP address asset were last checked (UTC date-time). |
| `ipdns_last_change_date` | When a change in the reverse DNS (PTR) records of an IP address asset was last seen (UTC date-time). |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `open_port_count` | The number of open ports found on the asset. |
| `open_ports` | The open port numbers found on the asset, such as `80`, `443` or `8080`. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_category_stats.count` | The number of active issues in that category on the asset. |
| `issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the asset. |
| `issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the asset. |
| `issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the asset. |
| `issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the asset. |
| `issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the asset. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `issue_count.active_by_severity.low` | The number of active issues of low severity on the asset. |
| `issue_count.active_by_severity.information` | The number of active issues of information severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `technology_count.by_category.count` | The number of technologies in that category on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity on the asset. |
| `vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity on the asset. |
| `vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity on the asset. |
| `vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) on the asset whose severity is `none`. |
| `vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) on the asset whose severity is `unknown`. |
| `security_score` | The asset's External Attack Surface Management (EASM) security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.count` | The number of active issues in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.count` | The number of distinct technologies in that category across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `fqdn.is_idn` | True when the host name is an internationalized domain name (IDN) with non-ASCII characters. |
| `fqdn.name.contains_confusable` | True when the name contains confusable characters that look like other letters, such as Cyrillic `а` for Latin `a`, a common trick in look-alike domains. |
| `fqdn.name.contains_hyphen` | True when the name (without the extension) contains a hyphen. |
| `fqdn.name.contains_letter` | True when the name (without the extension) contains a letter. |
| `fqdn.name.contains_number` | True when the name (without the extension) contains a digit. |
| `fqdn.domain.is_idn` | True when the registrable domain is an internationalized domain name (IDN) with non-ASCII characters. |
| `whois_privacy_enabled` | True when the platform flagged WHOIS privacy protection on the domain's registrant details; set on domain assets. |
| `ssl.signature.is_valid` | True when the asset's TLS certificate passed validation for the host; when false, `ssl.signature.invalid_reason` says why. |
| `ssl.signature.is_valid_chain` | A flag for whether the certificate chain of the asset's TLS certificate is valid. It was true on every sampled certificate, even one whose validation failed with `unable to get issuer certificate`. |
| `ssl.signature.is_self_signed` | True when the asset's TLS certificate is self-signed, that is signed by its own key rather than by a certificate authority. |
| `ssl.extensions.basic_constraints.is_ca` | True when the certificate is a certificate authority (CA) certificate, from its Basic Constraints extension. |
| `ssl.extensions.extended_key_usage.client_auth` | True when the Extended Key Usage extension allows TLS client authentication. |
| `ssl.extensions.extended_key_usage.server_auth` | True when the Extended Key Usage extension allows TLS server authentication, as website certificates need. |
| `ssl.extensions.key_usage.content_commitment` | True when the Key Usage extension allows the certificate's key to be used for content commitment (non-repudiation). |
| `ssl.extensions.key_usage.crl_sign` | True when the Key Usage extension allows the certificate's key to be used for signing certificate revocation lists (CRL sign). |
| `ssl.extensions.key_usage.data_encipherment` | True when the Key Usage extension allows the certificate's key to be used for data encipherment. |
| `ssl.extensions.key_usage.digital_signature` | True when the Key Usage extension allows the certificate's key to be used for digital signatures. |
| `ssl.extensions.key_usage.key_agreement` | True when the Key Usage extension allows the certificate's key to be used for key agreement. |
| `ssl.extensions.key_usage.key_cert_sign` | True when the Key Usage extension allows the certificate's key to be used for signing other certificates (certificate sign). |
| `ssl.extensions.key_usage.key_encipherment` | True when the Key Usage extension allows the certificate's key to be used for key encipherment. |
| `ssl.has_expired` | True when the asset's TLS certificate is past its end date. |
| `http.external_domain_redirection` | True when the HTTP check ended on a different registrable domain than it started on. |
| `http.external_fqdn_redirection` | True when the HTTP check ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.html.inspect_disabled` | A flag of the web data scan that marks pages whose inspection was disabled; it was `false` on every sampled asset. |
| `webdata.html.html_meta.no_index_status` | True when the scanned page asks search engines not to index it (a `noindex` robots directive). |
| `webdata.http.external_domain_redirection` | True when the web data scan ended on a different registrable domain than it started on. |
| `webdata.http.external_fqdn_redirection` | True when the web data scan ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.http.cookies.secure` | True when a cookie set in the web data scan is sent over HTTPS only (Secure attribute). |
| `webdata.http.cookies.http_only` | True when scripts on the page cannot read a cookie set in the web data scan (HttpOnly attribute). |
| `webdata.http.cookies.session` | True when a cookie set in the web data scan is a session cookie, deleted when the browser closes. |
| `is_parked` | True when the asset is parked; Inventory marks it with a P badge whose tooltip shows where it redirects. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `dns.dnskey.records.key_type` | The role of a DNSKEY: `ZSK` (zone-signing key), `KSK` (key-signing key) or `KSK_REVOKED` (revoked key-signing key). |
| `dns.dnskey.records.algorithm` | The DNSSEC algorithm of a DNSKEY, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.algorithm` | The DNSSEC algorithm of the key that a DS record refers to, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.digest_type` | The hash used for a DS record's digest: `SHA1`, `SHA256`, `SHA384`, `GOST` or `NULL`. |
| `dns.rrsig.algorithm` | The DNSSEC algorithm of an RRSIG signature, such as `ECDSAP256SHA256` or `RSASHA256`. |

Operators: not measured

| Field | Description |
|---|---|
| `website.parent_asset.type` | The asset type of the website's parent asset, such as `subdomain`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `website_count` | The number of website assets (`host:port`) in your inventory that belong to this asset. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `open_port_count` | The number of open ports found on the asset. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `security_score` | The asset's EASM security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

## Response Fields

| Field | Type |
|---|---|
| `updated_count` | integer |
| `ignored_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `updated_count` | number |
| `ignored_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-enable-discovery.md


---

# Asset Instant Scan

URL: https://docs.deepinfo.com/reference/easm/asset-instant-scan/

POST /easm/assets/{asset_id}/instant-scan: Starts an on-demand scan of an asset. Track it with Asset Instant Scan Status.

`POST https://api.deepinfo.com/v1/easm/assets/{asset_id}/instant-scan`

Starts an on-demand scan of an asset. Track it with [Asset Instant Scan Status](/reference/easm/asset-instant-scan-status/).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-instant-scan.md


---

# Asset Set Tag

URL: https://docs.deepinfo.com/reference/easm/asset-set-tag/

POST /easm/assets/search:set-tag: Adds tags (1–10) to every asset matching filters.

`POST https://api.deepinfo.com/v1/easm/assets/search:set-tag`

Adds `tags` (1–10) to every asset matching `filters`.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |
| `tags` | array | Required | min items `1`; max items `10` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  },
  "tags": [
    "production"
  ]
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the asset, such as a business unit or an environment; each tag is 3 to 100 characters long. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.name.unicode` | The host name without its extension, in Unicode: `acme` for `acme.example`, `www.acme` for `www.acme.example`. |
| `fqdn.name.latinized` | Latin-letter spellings of a name that has non-Latin or accented letters, so a search for `istanbul` also finds names written with `İ`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_sub.unicode` | The second-level part of a two-part extension, such as `co` in `co.uk`; empty for single-part extensions. |
| `website.path` | The URL path of a website asset, such as `/`. |
| `website.scheme` | The URL scheme of a website asset, such as `http`. |
| `website.parent_asset.id` | The ID of the domain or subdomain asset that a website asset belongs to. |
| `website.parent_asset.name` | The name of the domain or subdomain asset that a website asset belongs to. |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.name` | The registrant's name in WHOIS; often a privacy placeholder such as `redacted for privacy`. |
| `whois.registrant.country` | The registrant's country in WHOIS, as a two-letter code in lower case such as `us`. |
| `whois.registrant.state` | The registrant's state or province in WHOIS. |
| `whois.registrant.city` | The registrant's city in WHOIS. |
| `whois.registrant.street` | The registrant's street address in WHOIS. |
| `whois.registrant.postal_code` | The registrant's postal code in WHOIS. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `whois_registrant_email_historical` | Every registrant e-mail address seen for the domain over time, the current one included. |
| `whois_normalized.registrar` | The registrar reduced to a short normalized name, such as `godaddy` or `gandi`, so the same registrar matches across spellings. |
| `whois_normalized.registrant.email` | The registrant e-mail address after WHOIS normalization. |
| `whois_normalized.registrant.email_real` | Another normalized registrant e-mail field, set on fewer domains than `whois_normalized.registrant.email`; in the samples it is set only where `whois_privacy_enabled` is false, with the same address. |
| `whois_normalized.registrant.email_domain_apex` | The registrable domain of the registrant e-mail address: `acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.email_fqdn_apex` | The full host name after the `@` of the registrant e-mail address: `mail.acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.organization` | The registrant organization cleaned up across registrars: lower case, with spaces and punctuation removed, such as `domainsbyproxyllc`. |
| `whois_normalized.registrant.phone` | The registrant phone number reduced to its digits, such as `14805551234`. |
| `whois_last_change_data` | The WHOIS fields that changed in the last change seen, as field paths such as `whois.update_date` or `whois.domain_status`. |
| `dns.a.value` | The asset's current A records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.a.value_previous` | The asset's A records as they were before the last change, in the same text form as `dns.a.value`. |
| `dns.a.rcode` | The DNS response code returned for the asset's A lookup, such as `NOERROR`. |
| `dns.a.rcode_previous` | The DNS response code of the A lookup before it last changed. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.entities` | The handles of the registry contacts and organizations linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, when it is kept. |
| `dns.a.ip_addresses.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the A-record address. |
| `dns.a.ip_addresses.raw` | The raw IP WHOIS response for the A-record address, when it is kept; empty on every sampled asset. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.a.ip_addresses.network.start_address` | The first address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.end_address` | The last address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.handle` | The registry handle of the network that contains the A-record address, such as `NET-192-0-2-0-1`. |
| `dns.a.ip_addresses.network.ip_version` | The IP version of the network that contains the A-record address: `v4` or `v6`. |
| `dns.a.ip_addresses.network.links` | Links to the registry record of the network that contains the A-record address, such as its RDAP and WHOIS URLs. |
| `dns.a.ip_addresses.network.parent_handle` | The handle of the larger network block from which the network of the A-record address was allocated. |
| `dns.a.ip_addresses.network.raw` | The raw RDAP network object for the A-record address, when it is kept. |
| `dns.a.ip_addresses.network.status` | The registry status of the network that contains the A-record address, such as `active`. |
| `dns.a.ip_addresses.network.type` | The registry's allocation type for the network that contains the A-record address, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `dns.a.ip_addresses.network.notices.title` | The title of a notice the registry attached to the network record of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.network.notices.description` | The text of a notice the registry attached to the network record of the A-record address. |
| `dns.a.ip_addresses.network.notices.links` | Links given in a notice on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.title` | The title of a remark on the network record of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.network.remarks.description` | The text of a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.links` | Links given in a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.events.action` | An event in the history of the network record of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.network.events.actor` | Who performed an event on the network record of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the A-record address, such as `abuse`. |
| `dns.a.ip_addresses.objects.contact.email.value` | An e-mail address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.value` | A postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the A-record address, such as `voice` or `work`. |
| `dns.a.ip_addresses.objects.contact.phone.value` | A phone number of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.kind` | What kind of contact is linked to the network of the A-record address: `org`, `group` or `individual`. |
| `dns.a.ip_addresses.objects.contact.name` | The name of a contact or organization linked to the network of the A-record address, such as `Abuse` or a company name. |
| `dns.a.ip_addresses.objects.contact.role` | The role given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.title` | The title given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.entities` | Handles of further entities listed under a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.events.action` | An event in the history of a contact record linked to the network of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.objects.events.actor` | Who performed an event on a contact record linked to the network of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.events_actor` | Events in which a contact linked to the network of the A-record address is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `dns.a.ip_addresses.objects.handle` | The registry handle of a contact or organization linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.links` | Links to the registry record of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.title` | The title of a notice on a contact record linked to the network of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.objects.notices.description` | The text of a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.links` | Links given in a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.raw` | The raw RDAP object of a contact linked to the network of the A-record address, when it is kept. |
| `dns.a.ip_addresses.objects.remarks.title` | The title of a remark on a contact record linked to the network of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.objects.remarks.description` | The text of a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.roles` | The roles of a contact for the network of the A-record address, such as `registrant`, `abuse` or `technical`. |
| `dns.a.ip_addresses.objects.status` | The registry status of a contact linked to the network of the A-record address, such as `validated`. |
| `dns.a.ip_history` | Every IPv4 address seen in the asset's A records over time, the current ones included. |
| `dns.aaaa.value` | The asset's current AAAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.aaaa.value_previous` | The asset's AAAA records as they were before the last change, in the same text form as `dns.aaaa.value`. |
| `dns.aaaa.rcode` | The DNS response code returned for the asset's AAAA lookup, such as `NOERROR`. |
| `dns.aaaa.rcode_previous` | The DNS response code of the AAAA lookup before it last changed. |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the asset's AAAA records. |
| `dns.caa.value` | The asset's current CAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.caa.value_previous` | The asset's CAA records as they were before the last change, in the same text form as `dns.caa.value`. |
| `dns.caa.rcode` | The DNS response code returned for the asset's CAA lookup, such as `NOERROR`. |
| `dns.caa.rcode_previous` | The DNS response code of the CAA lookup before it last changed. |
| `dns.caa.issue_fqdns` | The certificate authorities allowed to issue certificates for the name, from the CAA `issue` tags, such as `fernhill.example` or `kestrel.example`. |
| `dns.caa.issuewild_fqdns` | The certificate authorities allowed to issue wildcard certificates for the name, from the CAA `issuewild` tags. |
| `dns.caa.iodef_emails` | The e-mail addresses from the CAA `iodef` tags, where certificate authorities report requests that break the CAA policy. |
| `dns.cname.value` | The asset's current CNAME records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.cname.value_previous` | The asset's CNAME records as they were before the last change, in the same text form as `dns.cname.value`. |
| `dns.cname.rcode` | The DNS response code returned for the asset's CNAME lookup, such as `NOERROR`. |
| `dns.cname.rcode_previous` | The DNS response code of the CNAME lookup before it last changed. |
| `dns.cname.canonical_fqdns` | The host names the asset's CNAME records point to (the alias targets). |
| `dns.dnskey.value` | The asset's current DNSKEY records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.dnskey.value_previous` | The asset's DNSKEY records as they were before the last change, in the same text form as `dns.dnskey.value`. |
| `dns.dnskey.rcode` | The DNS response code returned for the asset's DNSKEY lookup, such as `NOERROR`. |
| `dns.dnskey.rcode_previous` | The DNS response code of the DNSKEY lookup before it last changed. |
| `dns.dnskey.records.public_key` | The public key of a DNSKEY record, Base64-encoded and split into space-separated groups as in the zone-file text. |
| `dns.ds.value` | The asset's current DS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ds.value_previous` | The asset's DS records as they were before the last change, in the same text form as `dns.ds.value`. |
| `dns.ds.rcode` | The DNS response code returned for the asset's DS lookup, such as `NOERROR`. |
| `dns.ds.rcode_previous` | The DNS response code of the DS lookup before it last changed. |
| `dns.ds.records.digest` | The digest of a DS record, the hash of the DNSKEY it refers to. |
| `dns.mx.value` | The asset's current MX records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.mx.value_previous` | The asset's MX records as they were before the last change, in the same text form as `dns.mx.value`. |
| `dns.mx.rcode` | The DNS response code returned for the asset's MX lookup, such as `NOERROR`. |
| `dns.mx.rcode_previous` | The DNS response code of the MX lookup before it last changed. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns.mx.domains` | The registrable domains of the asset's mail servers, such as `acme.example`. |
| `dns.ns.value` | The asset's current NS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ns.value_previous` | The asset's NS records as they were before the last change, in the same text form as `dns.ns.value`. |
| `dns.ns.rcode` | The DNS response code returned for the asset's NS lookup, such as `NOERROR`. |
| `dns.ns.rcode_previous` | The DNS response code of the NS lookup before it last changed. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.ns.domains` | The registrable domains of the asset's name servers, such as `acme.example`. |
| `dns.nsec.value` | The asset's current NSEC records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec.value_previous` | The asset's NSEC records as they were before the last change, in the same text form as `dns.nsec.value`. |
| `dns.nsec.rcode` | The DNS response code returned for the asset's NSEC lookup, such as `NOERROR`. |
| `dns.nsec.rcode_previous` | The DNS response code of the NSEC lookup before it last changed. |
| `dns.nsec.records.next_domain` | The next name in the zone, from an NSEC record. |
| `dns.nsec.records.record_types` | The record types that exist at the name, from an NSEC record's type list, such as `A`, `NS` or `SOA`. |
| `dns.nsec3.value` | The asset's current NSEC3 records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec3.value_previous` | The asset's NSEC3 records as they were before the last change, in the same text form as `dns.nsec3.value`. |
| `dns.nsec3.rcode` | The DNS response code returned for the asset's NSEC3 lookup, such as `NOERROR`. |
| `dns.nsec3.rcode_previous` | The DNS response code of the NSEC3 lookup before it last changed. |
| `dns.nsec3.records.next_domain_hashed` | The hashed next name in the zone, from an NSEC3 record. |
| `dns.nsec3.records.record_types` | The record types that exist at the name, from an NSEC3 record's type list, such as `A` or `MX`. |
| `dns.rrsig.value` | The asset's current RRSIG records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.rrsig.value_previous` | The asset's RRSIG records as they were before the last change, in the same text form as `dns.rrsig.value`. |
| `dns.rrsig.rcode` | The DNS response code returned for the asset's RRSIG lookup, such as `NOERROR`. |
| `dns.rrsig.rcode_previous` | The DNS response code of the RRSIG lookup before it last changed. |
| `dns.rrsig.type_covered` | The record type that an RRSIG signature covers, such as `A` or `SOA`. |
| `dns.rrsig.signature` | The signature data of an RRSIG record, Base64-encoded. |
| `dns.soa.value` | The asset's current SOA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.soa.value_previous` | The asset's SOA records as they were before the last change, in the same text form as `dns.soa.value`. |
| `dns.soa.rcode` | The DNS response code returned for the asset's SOA lookup, such as `NOERROR`. |
| `dns.soa.rcode_previous` | The DNS response code of the SOA lookup before it last changed. |
| `dns.soa.mnames` | The MNAME of the SOA record: the primary name server of the zone, such as `ns1.acme.example`. |
| `dns.soa.rnames` | The RNAME of the SOA record, the zone administrator's mailbox in DNS form: `hostmaster.acme.example` stands for the mailbox `hostmaster` at `acme.example`. |
| `dns.soa.rname_emails` | The RNAME of the SOA record written as an e-mail address, such as `user@acme.example`. |
| `dns.srv.value` | The asset's current SRV records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.srv.value_previous` | The asset's SRV records as they were before the last change, in the same text form as `dns.srv.value`. |
| `dns.srv.rcode` | The DNS response code returned for the asset's SRV lookup, such as `NOERROR`. |
| `dns.srv.rcode_previous` | The DNS response code of the SRV lookup before it last changed. |
| `dns.srv.records.service` | The service named in an SRV record (the `_service` part of its name). |
| `dns.srv.records.protocol` | The protocol named in an SRV record (the `_proto` part of its name, such as TCP or UDP). |
| `dns.srv.records.target` | The host name an SRV record points to. |
| `dns.txt.value` | The asset's current TXT records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.txt.value_previous` | The asset's TXT records as they were before the last change, in the same text form as `dns.txt.value`. |
| `dns.txt.rcode` | The DNS response code returned for the asset's TXT lookup, such as `NOERROR`. |
| `dns.txt.rcode_previous` | The DNS response code of the TXT lookup before it last changed. |
| `dns.txt.values` | Each TXT record of the asset as its quoted text, such as `"v=spf1 include:_spf.acme.example ~all"`; the quotes are part of the value. |
| `dns.txt.spf_list.value` | The text of an SPF record (a TXT record that starts with `v=spf1`), quoted as in `dns.txt.values`. |
| `dns.txt.spf_list.allowed_domains` | The registrable domains that an SPF record refers to, such as `acme.example` for `include:_spf.acme.example`. |
| `dns.txt.spf_list.allowed_ips` | The IP addresses and ranges that an SPF record authorizes to send mail (its `ip4:` and `ip6:` entries). |
| `dns.txt.verifications.value` | The text of a site-verification TXT record, quoted as in `dns.txt.values`. |
| `dns.txt.verifications.domain` | The domain of the service a verification record is for, such as `acme.example`, `fernhill.example` or `kestrel.example`. |
| `dns.txt.verifications.name` | The name of a verification record, such as `site-verification` or `domain-verification`. |
| `dns_last_change_data` | The DNS fields that changed in the last change seen, as field paths such as `dns.soa.mnames`. |
| `ssl.target` | The host name that the asset's TLS certificate was collected from, normally the asset itself. |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the asset's TLS certificate, as lower-case hex; one fingerprint identifies one certificate. |
| `ssl.issuer.common_name` | The common name (CN) of the certificate authority that issued the asset's TLS certificate, such as `WE1` or `YE2`. |
| `ssl.issuer.country` | The country (C) of the certificate authority that issued the asset's TLS certificate, as a two-letter code such as `US`. |
| `ssl.issuer.state` | The state or province (ST) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.locality` | The locality or city (L) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.organization` | The organization (O) of the certificate authority that issued the asset's TLS certificate, such as `Let's Encrypt` or `Google Trust Services`. |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer_dn` | The full distinguished name of the issuer of the asset's TLS certificate, as one string such as `CN=WE1,O=Google Trust Services,C=US`. |
| `ssl.subject.common_name` | The common name (CN) of the subject (holder) of the asset's TLS certificate, usually a host name such as `acme.example`. |
| `ssl.subject.country` | The country (C) of the subject (holder) of the asset's TLS certificate, as a two-letter code. |
| `ssl.subject.state` | The state or province (ST) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.locality` | The locality or city (L) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organizational_unit` | The organizational unit (OU) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject_dn` | The full distinguished name of the subject of the asset's TLS certificate, such as `CN=acme.example`; one that starts with `CN=*.` belongs to a wildcard certificate. |
| `ssl.signature.value` | The signature of the asset's TLS certificate, Base64-encoded. |
| `ssl.signature.invalid_reason` | Why certificate validation failed, such as a host name mismatch or `unable to get issuer certificate`. |
| `ssl.signature.algorithm.name` | The hash algorithm of the signature on the asset's TLS certificate, such as `sha256` or `sha384`. |
| `ssl.signature.algorithm.oid` | The object identifier (OID) of the signature algorithm, such as `1.2.840.113549.1.1.11` (SHA-256 with RSA) or `1.2.840.10045.4.3.2` (ECDSA with SHA-256). |
| `ssl.extensions.authority_key_id` | The Authority Key Identifier extension, which identifies the issuer's key, Base64-encoded. |
| `ssl.extensions.certificate_policies` | The policy OIDs in the Certificate Policies extension, such as `2.23.140.1.2.1` (domain validated). |
| `ssl.extensions.signed_certificate_timestamps.log_id` | The ID of the Certificate Transparency log that issued a signed certificate timestamp (SCT) for the certificate, Base64-encoded. |
| `ssl.extensions.signed_certificate_timestamps.signature` | The log's signature on a signed certificate timestamp, Base64-encoded. |
| `ssl.extensions.subject_alt_name.dns_names` | The host names in the certificate's Subject Alternative Name extension, including wildcard names such as `*.acme.example`. |
| `ssl.extensions.subject_key_id` | The Subject Key Identifier extension, which identifies the certificate's own key, Base64-encoded. |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | The hash algorithm used for `ssl.subject_key_info.fingerprint.value`, such as `sha256` or `sha384`. |
| `ssl.subject_key_info.fingerprint.value` | A hex fingerprint recorded under the certificate's subject key information, made with the hash in `hash_algorithm`. In the samples it equals `ssl.fingerprint.sha256` when that hash is SHA-256. |
| `ssl.subject_key_info.key_algorithm.name` | The algorithm of the certificate's public key, such as `RSA` or `ECDSA`. |
| `ssl.version.name` | The X.509 version of the certificate, such as `v3`. |
| `ssl.version.value` | The X.509 version as encoded in the certificate, counted from zero: `2` means `v3`. |
| `ssl.tbs_fingerprint` | A SHA-256 fingerprint (hex) of the certificate's to-be-signed part, the certificate content without its signature. |
| `ssl.certificate` | The whole certificate, Base64-encoded (a PEM body without the header and footer lines). |
| `ssl.fqdn_list` | The host names the certificate covers, with the `*.` of wildcard names removed and duplicates merged, so `*.acme.example` and `acme.example` both give `acme.example`. |
| `ssl_last_change_data` | The certificate fields that changed in the last change seen, as field paths such as `ssl.validity.end_date`. |
| `http.requested_url` | The URL the HTTP check started from, such as `http://acme.example`. |
| `http.requested_domain` | The registrable domain of the URL the HTTP check started from. |
| `http.requested_fqdn` | The host name of the URL the HTTP check started from. |
| `http.final_url` | The URL the HTTP check ended on after following all redirects. |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.redirection_history.url` | A URL in the redirect chain of the HTTP check, listed in the order visited. |
| `http.headers.accept` | The `Accept` header, when it was returned in the HTTP check. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the HTTP check. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `http.headers.accept_language` | The `Accept-Language` header, when it was returned in the HTTP check. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the HTTP check; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the HTTP check; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the HTTP check; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the HTTP check; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the HTTP check; it lists the response headers that scripts from other origins may read (CORS). |
| `http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the HTTP check; it says how many seconds browsers may cache a CORS preflight result. |
| `http.headers.alt_svc` | The `Alt-Svc` header returned in the HTTP check; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `http.headers.authorization` | The `Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `http.headers.cache_control` | The `Cache-Control` header returned in the HTTP check; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the HTTP check; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `http.headers.content_disposition` | The `Content-Disposition` header returned in the HTTP check; it says whether the content is shown in the browser or downloaded as a file. |
| `http.headers.content_encoding` | The `Content-Encoding` header returned in the HTTP check; it names the compression applied to the response body, for example `gzip` or `br`. |
| `http.headers.content_language` | The `Content-Language` header returned in the HTTP check; it gives the language of the content, for example `en` or `tr`. |
| `http.headers.content_length` | The `Content-Length` header returned in the HTTP check; it gives the size of the response body in bytes. |
| `http.headers.content_range` | The `Content-Range` header returned in the HTTP check; it says which part of the full body a partial response holds. |
| `http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the HTTP check; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `http.headers.content_type` | The `Content-Type` header returned in the HTTP check; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `http.headers.cookie` | The `Cookie` header, when it was returned in the HTTP check. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the HTTP check; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the HTTP check; it controls whether the page shares its browsing context with cross-origin windows. |
| `http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the HTTP check; it controls which sites may load the resource. |
| `http.headers.date` | The `Date` header returned in the HTTP check; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `http.headers.early_data` | The `Early-Data` header, when it was returned in the HTTP check. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `http.headers.expect_ct` | The `Expect-CT` header returned in the HTTP check; it is a deprecated header about Certificate Transparency enforcement. |
| `http.headers.expires` | The `Expires` header returned in the HTTP check; it gives the date after which the response counts as stale, in HTTP date format. |
| `http.headers.feature_policy` | The `Feature-Policy` header returned in the HTTP check; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `http.headers.host` | The `Host` header, when it was returned in the HTTP check. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the HTTP check. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the HTTP check. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `http.headers.last_modified` | The `Last-Modified` header returned in the HTTP check; it gives the time the server says the resource last changed, in HTTP date format. |
| `http.headers.origin_isolation` | The `Origin-Isolation` header returned in the HTTP check; it is an experimental header that asks browsers to isolate the site's origin. |
| `http.headers.others.name` | The name of a header returned in the HTTP check that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `http.headers.others.value` | The value of a header listed in `headers.others` for the HTTP check. |
| `http.headers.permission_policy` | The `Permission-Policy` header returned in the HTTP check; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `http.headers.permissions_policy` | The `Permissions-Policy` header returned in the HTTP check; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `http.headers.pragma` | The `Pragma` header returned in the HTTP check; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the HTTP check; it tells a client how to authenticate to a proxy. |
| `http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the HTTP check; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `http.headers.range` | The `Range` header, when it was returned in the HTTP check. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `http.headers.referer` | The `Referer` header, when it was returned in the HTTP check. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `http.headers.referrer_policy` | The `Referrer-Policy` header returned in the HTTP check; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the HTTP check. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `http.headers.server` | The `Server` header returned in the HTTP check; it names the server software the site reports, for example `nginx` or `Apache`. |
| `http.headers.set_cookie` | The `Set-Cookie` header returned in the HTTP check; it sets cookies, with their attributes. |
| `http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the HTTP check; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `http.headers.te` | The `TE` header, when it was returned in the HTTP check. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the HTTP check; it says how the body is transferred, for example `chunked`. |
| `http.headers.upgrade` | The `Upgrade` header returned in the HTTP check; it offers or asks for a switch to another protocol. |
| `http.headers.user_agent` | The `User-Agent` header, when it was returned in the HTTP check. It is normally a request header (the client software), so it is rarely set. |
| `http.headers.vary` | The `Vary` header returned in the HTTP check; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the HTTP check; it tells a client how to authenticate, usually with a `401` response. |
| `http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the HTTP check; it stops browsers from guessing the content type when set to `nosniff`. |
| `http.headers.x_download_options` | The `X-Download-Options` header returned in the HTTP check; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `http.headers.x_frame_options` | The `X-Frame-Options` header returned in the HTTP check; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the HTTP check; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `http.headers.x_powered_by` | The `X-Powered-By` header returned in the HTTP check; it names the technology the server reports running on, for example `Express`. |
| `http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the HTTP check; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `http.cookies.name` | The name of a cookie set in the HTTP check. |
| `http.cookies.value` | The value of a cookie set in the HTTP check. |
| `http.html.source_code_hash` | A SHA-256 hash of the page source returned in the HTTP check; the same hash means the same source. |
| `http_last_change_data` | The HTTP check fields that changed in the last change seen, as field paths such as `http.html.source_code_hash`. |
| `webdata.requested_url` | The URL the web data scan started from, such as `http://acme.example`. |
| `webdata.requested_domain` | The registrable domain of the URL the web data scan started from. |
| `webdata.requested_fqdn` | The host name of the URL the web data scan started from. |
| `webdata.html.internal_links_fqdns` | The host names of links on the scanned page that stay within the site's own domain, such as other subdomains. |
| `webdata.html.external_links_domains` | The registrable domains of links on the scanned page that point to other domains, such as `kestrel.example`. |
| `webdata.html.external_links_fqdns` | The host names of links on the scanned page that point to other domains, such as `www.kestrel.example`. |
| `webdata.html.external_links` | The full URLs of links on the scanned page that point to other domains. |
| `webdata.html.script_links` | The URLs of the scripts the scanned page loads. |
| `webdata.html.iframe_links` | The URLs of the frames (iframes) embedded in the scanned page. |
| `webdata.html.trackers.name` | The name of an analytics or advertising tracker found on the scanned page, such as `google_adsense` or `google_tag_manager`. |
| `webdata.html.trackers.values` | The IDs found for a tracker, such as a Google Analytics ID that starts with `G-` or `UA-`. |
| `webdata.html.emails` | The e-mail addresses found on the scanned page. |
| `webdata.html.emails_internal` | The e-mail addresses found on the scanned page that belong to the site's own domain. |
| `webdata.html.source_code_hash` | A SHA-256 hash of the page source in the web data scan; the same hash means the same source. |
| `webdata.html.content_hash` | A SHA-256 hash of the page content in the web data scan, kept apart from `source_code_hash`, the hash of the raw source. |
| `webdata.html.content_top_keywords` | The most frequent words in the text of the scanned page. |
| `webdata.html.favicon_links` | The URLs of the icons the scanned page declares, such as its favicon and touch icons. |
| `webdata.html.html_meta.name` | The site or application name declared in the scanned page's metadata. |
| `webdata.html.html_meta.description` | The meta description of the scanned page. |
| `webdata.html.html_meta.language` | The language the scanned page declares, such as `en`, `tr` or `en-US`. |
| `webdata.html.html_meta.language_alternatives` | The languages of the alternative versions the scanned page links to, such as `en` or `ar`. |
| `webdata.html.html_meta.keywords` | The keywords listed in the keywords meta tag of the scanned page. |
| `webdata.html.html_meta.encoding` | The character encoding the scanned page declares, such as `utf-8`. |
| `webdata.html.html_meta.canonical_url` | The canonical URL the scanned page declares. |
| `webdata.html.html_meta.title` | The title of the scanned page. |
| `webdata.favicon.url` | The URL of a site icon (favicon) recorded by the web data scan. |
| `webdata.favicon.hash` | A SHA-256 hash of a site icon; the same hash means the same icon. |
| `webdata.http.final_url` | The URL the web data scan ended on after following all redirects. |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.redirection_history.url` | A URL in the redirect chain of the web data scan, listed in the order visited. |
| `webdata.http.redirection_history.method` | How a step of the web data scan's redirect chain was made; `http-header` (a redirect sent in the HTTP response) is the value in the samples. |
| `webdata.http.headers.accept` | The `Accept` header, when it was returned in the web data scan. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the web data scan. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_language` | The `Accept-Language` header, when it was returned in the web data scan. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `webdata.http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the web data scan; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `webdata.http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the web data scan; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `webdata.http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the web data scan; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `webdata.http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the web data scan; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `webdata.http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the web data scan; it lists the response headers that scripts from other origins may read (CORS). |
| `webdata.http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the web data scan; it says how many seconds browsers may cache a CORS preflight result. |
| `webdata.http.headers.alt_svc` | The `Alt-Svc` header returned in the web data scan; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `webdata.http.headers.authorization` | The `Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `webdata.http.headers.cache_control` | The `Cache-Control` header returned in the web data scan; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `webdata.http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the web data scan; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `webdata.http.headers.content_disposition` | The `Content-Disposition` header returned in the web data scan; it says whether the content is shown in the browser or downloaded as a file. |
| `webdata.http.headers.content_encoding` | The `Content-Encoding` header returned in the web data scan; it names the compression applied to the response body, for example `gzip` or `br`. |
| `webdata.http.headers.content_language` | The `Content-Language` header returned in the web data scan; it gives the language of the content, for example `en` or `tr`. |
| `webdata.http.headers.content_length` | The `Content-Length` header returned in the web data scan; it gives the size of the response body in bytes. |
| `webdata.http.headers.content_range` | The `Content-Range` header returned in the web data scan; it says which part of the full body a partial response holds. |
| `webdata.http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the web data scan; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `webdata.http.headers.content_type` | The `Content-Type` header returned in the web data scan; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `webdata.http.headers.cookie` | The `Cookie` header, when it was returned in the web data scan. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `webdata.http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the web data scan; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `webdata.http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the web data scan; it controls whether the page shares its browsing context with cross-origin windows. |
| `webdata.http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the web data scan; it controls which sites may load the resource. |
| `webdata.http.headers.date` | The `Date` header returned in the web data scan; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `webdata.http.headers.early_data` | The `Early-Data` header, when it was returned in the web data scan. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `webdata.http.headers.expect_ct` | The `Expect-CT` header returned in the web data scan; it is a deprecated header about Certificate Transparency enforcement. |
| `webdata.http.headers.expires` | The `Expires` header returned in the web data scan; it gives the date after which the response counts as stale, in HTTP date format. |
| `webdata.http.headers.feature_policy` | The `Feature-Policy` header returned in the web data scan; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `webdata.http.headers.host` | The `Host` header, when it was returned in the web data scan. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `webdata.http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the web data scan. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `webdata.http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the web data scan. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `webdata.http.headers.last_modified` | The `Last-Modified` header returned in the web data scan; it gives the time the server says the resource last changed, in HTTP date format. |
| `webdata.http.headers.origin_isolation` | The `Origin-Isolation` header returned in the web data scan; it is an experimental header that asks browsers to isolate the site's origin. |
| `webdata.http.headers.others.name` | The name of a header returned in the web data scan that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `webdata.http.headers.others.value` | The value of a header listed in `headers.others` for the web data scan. |
| `webdata.http.headers.permission_policy` | The `Permission-Policy` header returned in the web data scan; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `webdata.http.headers.permissions_policy` | The `Permissions-Policy` header returned in the web data scan; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `webdata.http.headers.pragma` | The `Pragma` header returned in the web data scan; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `webdata.http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the web data scan; it tells a client how to authenticate to a proxy. |
| `webdata.http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `webdata.http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the web data scan; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `webdata.http.headers.range` | The `Range` header, when it was returned in the web data scan. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `webdata.http.headers.referer` | The `Referer` header, when it was returned in the web data scan. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `webdata.http.headers.referrer_policy` | The `Referrer-Policy` header returned in the web data scan; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `webdata.http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `webdata.http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the web data scan. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `webdata.http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `webdata.http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the web data scan. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `webdata.http.headers.server` | The `Server` header returned in the web data scan; it names the server software the site reports, for example `nginx` or `Apache`. |
| `webdata.http.headers.set_cookie` | The `Set-Cookie` header returned in the web data scan; it sets cookies, with their attributes. |
| `webdata.http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the web data scan; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `webdata.http.headers.te` | The `TE` header, when it was returned in the web data scan. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `webdata.http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the web data scan; it says how the body is transferred, for example `chunked`. |
| `webdata.http.headers.upgrade` | The `Upgrade` header returned in the web data scan; it offers or asks for a switch to another protocol. |
| `webdata.http.headers.user_agent` | The `User-Agent` header, when it was returned in the web data scan. It is normally a request header (the client software), so it is rarely set. |
| `webdata.http.headers.vary` | The `Vary` header returned in the web data scan; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `webdata.http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the web data scan; it tells a client how to authenticate, usually with a `401` response. |
| `webdata.http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the web data scan; it stops browsers from guessing the content type when set to `nosniff`. |
| `webdata.http.headers.x_download_options` | The `X-Download-Options` header returned in the web data scan; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `webdata.http.headers.x_frame_options` | The `X-Frame-Options` header returned in the web data scan; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the web data scan; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `webdata.http.headers.x_powered_by` | The `X-Powered-By` header returned in the web data scan; it names the technology the server reports running on, for example `Express`. |
| `webdata.http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the web data scan; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `webdata.http.cookies.name` | The name of a cookie set in the web data scan. |
| `webdata.http.cookies.value` | The value of a cookie set in the web data scan. |
| `webdata.http.cookies.domain` | The domain a cookie set in the web data scan applies to, such as `.acme.example`. |
| `webdata.http.cookies.path` | The path a cookie set in the web data scan applies to, such as `/`. |
| `webdata.http.cookies.same_party` | The SameParty attribute of a cookie set in the web data scan; in the samples it always holds the same value as `same_site`, such as `Lax` or `None`. |
| `webdata.http.cookies.priority` | The Priority attribute of a cookie set in the web data scan (`Low`, `Medium` or `High` in Chromium-based browsers). |
| `webdata.http.cookies.same_site` | The SameSite attribute of a cookie set in the web data scan, such as `Lax`, `Strict` or `None`. |
| `webdata.technology.stacks.slug` | A short identifier of a technology detected on the site, such as `iis` or `windows-server`. |
| `webdata.technology.stacks.name` | The name of a technology detected on the site, such as `IIS` or `Microsoft ASP.NET`. |
| `webdata.technology.stacks.icon` | The file name of a detected technology's icon, such as `acme.png`. |
| `webdata.technology.stacks.website` | The website of a detected technology's vendor or project. |
| `webdata.technology.stacks.cpe` | The CPE identifier of a detected technology, such as `cpe:/a:acme:acme-portal`, used to match it to known vulnerabilities. |
| `webdata.technology.stacks.version` | The detected version of a technology, such as `1.0`. |
| `webdata.technology.stacks.categories` | The categories of a detected technology, such as `Web servers` or `Operating systems`. |
| `webdata.technology.stacks.description` | A short description of a detected technology. |
| `webdata_last_change_data` | The web data fields that changed in the last change seen, as field paths under `webdata`. |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.entities` | The handles of the registry contacts and organizations linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, when it is kept. |
| `ipwhois.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the IP address asset. |
| `ipwhois.raw` | The raw IP WHOIS response for the IP address asset, when it is kept; empty on every sampled asset. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `ipwhois.network.start_address` | The first address of the registered network block that contains the IP address asset. |
| `ipwhois.network.end_address` | The last address of the registered network block that contains the IP address asset. |
| `ipwhois.network.handle` | The registry handle of the network that contains the IP address asset, such as `NET-192-0-2-0-1`. |
| `ipwhois.network.ip_version` | The IP version of the network that contains the IP address asset: `v4` or `v6`. |
| `ipwhois.network.links` | Links to the registry record of the network that contains the IP address asset, such as its RDAP and WHOIS URLs. |
| `ipwhois.network.parent_handle` | The handle of the larger network block from which the network of the IP address asset was allocated. |
| `ipwhois.network.raw` | The raw RDAP network object for the IP address asset, when it is kept. |
| `ipwhois.network.status` | The registry status of the network that contains the IP address asset, such as `active`. |
| `ipwhois.network.type` | The registry's allocation type for the network that contains the IP address asset, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `ipwhois.network.notices.title` | The title of a notice the registry attached to the network record of the IP address asset, such as `Terms of Service`. |
| `ipwhois.network.notices.description` | The text of a notice the registry attached to the network record of the IP address asset. |
| `ipwhois.network.notices.links` | Links given in a notice on the network record of the IP address asset. |
| `ipwhois.network.remarks.title` | The title of a remark on the network record of the IP address asset, such as `Registration Comments`. |
| `ipwhois.network.remarks.description` | The text of a remark on the network record of the IP address asset. |
| `ipwhois.network.remarks.links` | Links given in a remark on the network record of the IP address asset. |
| `ipwhois.network.events.action` | An event in the history of the network record of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.network.events.actor` | Who performed an event on the network record of the IP address asset, when the registry names one. |
| `ipwhois.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the IP address asset, such as `abuse`. |
| `ipwhois.objects.contact.email.value` | An e-mail address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.value` | A postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the IP address asset, such as `voice` or `work`. |
| `ipwhois.objects.contact.phone.value` | A phone number of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.kind` | What kind of contact is linked to the network of the IP address asset: `org`, `group` or `individual`. |
| `ipwhois.objects.contact.name` | The name of a contact or organization linked to the network of the IP address asset, such as `Abuse` or a company name. |
| `ipwhois.objects.contact.role` | The role given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.contact.title` | The title given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.entities` | Handles of further entities listed under a contact linked to the network of the IP address asset. |
| `ipwhois.objects.events.action` | An event in the history of a contact record linked to the network of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.objects.events.actor` | Who performed an event on a contact record linked to the network of the IP address asset, when the registry names one. |
| `ipwhois.objects.events_actor` | Events in which a contact linked to the network of the IP address asset is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `ipwhois.objects.handle` | The registry handle of a contact or organization linked to the network of the IP address asset. |
| `ipwhois.objects.links` | Links to the registry record of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.notices.title` | The title of a notice on a contact record linked to the network of the IP address asset, such as `Terms of Service`. |
| `ipwhois.objects.notices.description` | The text of a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.notices.links` | Links given in a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.raw` | The raw RDAP object of a contact linked to the network of the IP address asset, when it is kept. |
| `ipwhois.objects.remarks.title` | The title of a remark on a contact record linked to the network of the IP address asset, such as `Registration Comments`. |
| `ipwhois.objects.remarks.description` | The text of a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.roles` | The roles of a contact for the network of the IP address asset, such as `registrant`, `abuse` or `technical`. |
| `ipwhois.objects.status` | The registry status of a contact linked to the network of the IP address asset, such as `validated`. |
| `ipwhois_last_change_data` | The IP WHOIS fields that changed in the last change seen, as field paths under `ipwhois`. |
| `ipdns.ptr_records` | The PTR (reverse DNS) host names of an IP address asset. |
| `ipdns_last_change_data` | The reverse DNS fields that changed in the last change seen, as field paths under `ipdns`. |
| `issue_category_stats.name` | The name of an issue category in the per-category issue counts of the asset, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. |
| `technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the asset, such as `Web servers` or `Analytics`. |
| `domain_snapshot.issue_category_stats.name` | The name of an issue category in the per-category issue counts of the domain and its subdomains together, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the domain and its subdomains together, such as `Web servers` or `Analytics`. Set on domain assets. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.name.length` | The number of characters in the name without the extension: `4` for `acme.example`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois_create_date_historical` | Every creation date seen for the domain over time, so a domain that was deleted and registered again keeps its earlier dates too (UTC date-times). |
| `whois_check_date` | When the WHOIS record of the asset was last checked (UTC date-time). |
| `whois_last_change_date` | When a change in the WHOIS record of the asset was last seen (UTC date-time). |
| `dns.a.value_last_change_date` | When the A record text (`dns.a.value`) last changed (UTC date-time). |
| `dns.a.rcode_last_change_date` | When the response code of the A lookup (`dns.a.rcode`) last changed (UTC date-time). |
| `dns.a.last_change_date` | When the asset's A records last changed, in their text or their response code (UTC date-time). |
| `dns.a.ip_addresses.asn_date` | The registry allocation date that the ASN lookup reports for the A-record address, as a date at midnight UTC. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was created (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was last updated (UTC date-time). |
| `dns.a.ip_addresses.network.events.timestamp` | When an event on the network record of the A-record address happened (UTC date-time). |
| `dns.a.ip_addresses.objects.events.timestamp` | When an event on a contact record linked to the network of the A-record address happened (UTC date-time). |
| `dns.aaaa.value_last_change_date` | When the AAAA record text (`dns.aaaa.value`) last changed (UTC date-time). |
| `dns.aaaa.rcode_last_change_date` | When the response code of the AAAA lookup (`dns.aaaa.rcode`) last changed (UTC date-time). |
| `dns.aaaa.last_change_date` | When the asset's AAAA records last changed, in their text or their response code (UTC date-time). |
| `dns.caa.value_last_change_date` | When the CAA record text (`dns.caa.value`) last changed (UTC date-time). |
| `dns.caa.rcode_last_change_date` | When the response code of the CAA lookup (`dns.caa.rcode`) last changed (UTC date-time). |
| `dns.caa.last_change_date` | When the asset's CAA records last changed, in their text or their response code (UTC date-time). |
| `dns.cname.value_last_change_date` | When the CNAME record text (`dns.cname.value`) last changed (UTC date-time). |
| `dns.cname.rcode_last_change_date` | When the response code of the CNAME lookup (`dns.cname.rcode`) last changed (UTC date-time). |
| `dns.cname.last_change_date` | When the asset's CNAME records last changed, in their text or their response code (UTC date-time). |
| `dns.dnskey.value_last_change_date` | When the DNSKEY record text (`dns.dnskey.value`) last changed (UTC date-time). |
| `dns.dnskey.rcode_last_change_date` | When the response code of the DNSKEY lookup (`dns.dnskey.rcode`) last changed (UTC date-time). |
| `dns.dnskey.last_change_date` | When the asset's DNSKEY records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.value_last_change_date` | When the DS record text (`dns.ds.value`) last changed (UTC date-time). |
| `dns.ds.rcode_last_change_date` | When the response code of the DS lookup (`dns.ds.rcode`) last changed (UTC date-time). |
| `dns.ds.last_change_date` | When the asset's DS records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.records.key_tag` | The key tag (a number) of the DNSKEY that a DS record refers to. |
| `dns.mx.value_last_change_date` | When the MX record text (`dns.mx.value`) last changed (UTC date-time). |
| `dns.mx.rcode_last_change_date` | When the response code of the MX lookup (`dns.mx.rcode`) last changed (UTC date-time). |
| `dns.mx.last_change_date` | When the asset's MX records last changed, in their text or their response code (UTC date-time). |
| `dns.ns.value_last_change_date` | When the NS record text (`dns.ns.value`) last changed (UTC date-time). |
| `dns.ns.rcode_last_change_date` | When the response code of the NS lookup (`dns.ns.rcode`) last changed (UTC date-time). |
| `dns.ns.last_change_date` | When the asset's NS records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec.value_last_change_date` | When the NSEC record text (`dns.nsec.value`) last changed (UTC date-time). |
| `dns.nsec.rcode_last_change_date` | When the response code of the NSEC lookup (`dns.nsec.rcode`) last changed (UTC date-time). |
| `dns.nsec.last_change_date` | When the asset's NSEC records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec3.value_last_change_date` | When the NSEC3 record text (`dns.nsec3.value`) last changed (UTC date-time). |
| `dns.nsec3.rcode_last_change_date` | When the response code of the NSEC3 lookup (`dns.nsec3.rcode`) last changed (UTC date-time). |
| `dns.nsec3.last_change_date` | When the asset's NSEC3 records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.value_last_change_date` | When the RRSIG record text (`dns.rrsig.value`) last changed (UTC date-time). |
| `dns.rrsig.rcode_last_change_date` | When the response code of the RRSIG lookup (`dns.rrsig.rcode`) last changed (UTC date-time). |
| `dns.rrsig.last_change_date` | When the asset's RRSIG records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.signature_inception` | When an RRSIG signature becomes valid (UTC date-time). |
| `dns.rrsig.signature_expiration` | When an RRSIG signature expires (UTC date-time). |
| `dns.soa.value_last_change_date` | When the SOA record text (`dns.soa.value`) last changed (UTC date-time). |
| `dns.soa.rcode_last_change_date` | When the response code of the SOA lookup (`dns.soa.rcode`) last changed (UTC date-time). |
| `dns.soa.last_change_date` | When the asset's SOA records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.value_last_change_date` | When the SRV record text (`dns.srv.value`) last changed (UTC date-time). |
| `dns.srv.rcode_last_change_date` | When the response code of the SRV lookup (`dns.srv.rcode`) last changed (UTC date-time). |
| `dns.srv.last_change_date` | When the asset's SRV records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.records.port` | The port an SRV record points to. |
| `dns.txt.value_last_change_date` | When the TXT record text (`dns.txt.value`) last changed (UTC date-time). |
| `dns.txt.rcode_last_change_date` | When the response code of the TXT lookup (`dns.txt.rcode`) last changed (UTC date-time). |
| `dns.txt.last_change_date` | When the asset's TXT records last changed, in their text or their response code (UTC date-time). |
| `dns_check_date` | When the DNS records of the asset were last checked (UTC date-time). |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.port` | The port that the asset's TLS certificate was collected on, such as `443`. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl.validity.length` | The validity period of the certificate in seconds: 7,776,000 seconds are 90 days. |
| `ssl.extensions.signed_certificate_timestamps.timestamp` | When a Certificate Transparency log recorded the certificate, from a signed certificate timestamp (UTC date-time). |
| `ssl.extensions.signed_certificate_timestamps.version` | The version of a signed certificate timestamp; `0` stands for version 1. |
| `ssl_check_date` | When the TLS certificate of the asset was last checked (UTC date-time). |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the HTTP check, such as `301` or `200`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_check_date` | When the HTTP check of the asset last ran (UTC date-time). |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the web data scan, such as `301` or `200`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata.http.cookies.size` | The size of a cookie set in the web data scan, in bytes (name plus value). |
| `webdata.http.cookies.expires` | When a cookie set in the web data scan expires (UTC date-time); session cookies show `1969-12-31T23:59:59Z`. |
| `webdata.technology.stacks.confidence` | How certain the detection of a technology is, from 0 to 100; every sampled detection has `100`. |
| `webdata.technology.stacks.clean_version` | The major version of a detected technology as a whole number, such as `1` for version `1.0`. |
| `webdata_check_date` | When the web data scan of the asset, which collects the page content, headers and technologies, last ran (UTC date-time). |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn_date` | The registry allocation date that the ASN lookup reports for the IP address asset, as a date at midnight UTC. |
| `ipwhois.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was created (UTC date-time). |
| `ipwhois.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was last updated (UTC date-time). |
| `ipwhois.network.events.timestamp` | When an event on the network record of the IP address asset happened (UTC date-time). |
| `ipwhois.objects.events.timestamp` | When an event on a contact record linked to the network of the IP address asset happened (UTC date-time). |
| `ipwhois_check_date` | When the IP WHOIS record of an IP address asset was last checked (UTC date-time). |
| `ipwhois_last_change_date` | When a change in the IP WHOIS record of an IP address asset was last seen (UTC date-time). |
| `ipdns_check_date` | When the reverse DNS (PTR) records of an IP address asset were last checked (UTC date-time). |
| `ipdns_last_change_date` | When a change in the reverse DNS (PTR) records of an IP address asset was last seen (UTC date-time). |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `open_port_count` | The number of open ports found on the asset. |
| `open_ports` | The open port numbers found on the asset, such as `80`, `443` or `8080`. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_category_stats.count` | The number of active issues in that category on the asset. |
| `issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the asset. |
| `issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the asset. |
| `issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the asset. |
| `issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the asset. |
| `issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the asset. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `issue_count.active_by_severity.low` | The number of active issues of low severity on the asset. |
| `issue_count.active_by_severity.information` | The number of active issues of information severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `technology_count.by_category.count` | The number of technologies in that category on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity on the asset. |
| `vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity on the asset. |
| `vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity on the asset. |
| `vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) on the asset whose severity is `none`. |
| `vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) on the asset whose severity is `unknown`. |
| `security_score` | The asset's External Attack Surface Management (EASM) security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.count` | The number of active issues in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.count` | The number of distinct technologies in that category across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `fqdn.is_idn` | True when the host name is an internationalized domain name (IDN) with non-ASCII characters. |
| `fqdn.name.contains_confusable` | True when the name contains confusable characters that look like other letters, such as Cyrillic `а` for Latin `a`, a common trick in look-alike domains. |
| `fqdn.name.contains_hyphen` | True when the name (without the extension) contains a hyphen. |
| `fqdn.name.contains_letter` | True when the name (without the extension) contains a letter. |
| `fqdn.name.contains_number` | True when the name (without the extension) contains a digit. |
| `fqdn.domain.is_idn` | True when the registrable domain is an internationalized domain name (IDN) with non-ASCII characters. |
| `whois_privacy_enabled` | True when the platform flagged WHOIS privacy protection on the domain's registrant details; set on domain assets. |
| `ssl.signature.is_valid` | True when the asset's TLS certificate passed validation for the host; when false, `ssl.signature.invalid_reason` says why. |
| `ssl.signature.is_valid_chain` | A flag for whether the certificate chain of the asset's TLS certificate is valid. It was true on every sampled certificate, even one whose validation failed with `unable to get issuer certificate`. |
| `ssl.signature.is_self_signed` | True when the asset's TLS certificate is self-signed, that is signed by its own key rather than by a certificate authority. |
| `ssl.extensions.basic_constraints.is_ca` | True when the certificate is a certificate authority (CA) certificate, from its Basic Constraints extension. |
| `ssl.extensions.extended_key_usage.client_auth` | True when the Extended Key Usage extension allows TLS client authentication. |
| `ssl.extensions.extended_key_usage.server_auth` | True when the Extended Key Usage extension allows TLS server authentication, as website certificates need. |
| `ssl.extensions.key_usage.content_commitment` | True when the Key Usage extension allows the certificate's key to be used for content commitment (non-repudiation). |
| `ssl.extensions.key_usage.crl_sign` | True when the Key Usage extension allows the certificate's key to be used for signing certificate revocation lists (CRL sign). |
| `ssl.extensions.key_usage.data_encipherment` | True when the Key Usage extension allows the certificate's key to be used for data encipherment. |
| `ssl.extensions.key_usage.digital_signature` | True when the Key Usage extension allows the certificate's key to be used for digital signatures. |
| `ssl.extensions.key_usage.key_agreement` | True when the Key Usage extension allows the certificate's key to be used for key agreement. |
| `ssl.extensions.key_usage.key_cert_sign` | True when the Key Usage extension allows the certificate's key to be used for signing other certificates (certificate sign). |
| `ssl.extensions.key_usage.key_encipherment` | True when the Key Usage extension allows the certificate's key to be used for key encipherment. |
| `ssl.has_expired` | True when the asset's TLS certificate is past its end date. |
| `http.external_domain_redirection` | True when the HTTP check ended on a different registrable domain than it started on. |
| `http.external_fqdn_redirection` | True when the HTTP check ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.html.inspect_disabled` | A flag of the web data scan that marks pages whose inspection was disabled; it was `false` on every sampled asset. |
| `webdata.html.html_meta.no_index_status` | True when the scanned page asks search engines not to index it (a `noindex` robots directive). |
| `webdata.http.external_domain_redirection` | True when the web data scan ended on a different registrable domain than it started on. |
| `webdata.http.external_fqdn_redirection` | True when the web data scan ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.http.cookies.secure` | True when a cookie set in the web data scan is sent over HTTPS only (Secure attribute). |
| `webdata.http.cookies.http_only` | True when scripts on the page cannot read a cookie set in the web data scan (HttpOnly attribute). |
| `webdata.http.cookies.session` | True when a cookie set in the web data scan is a session cookie, deleted when the browser closes. |
| `is_parked` | True when the asset is parked; Inventory marks it with a P badge whose tooltip shows where it redirects. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `dns.dnskey.records.key_type` | The role of a DNSKEY: `ZSK` (zone-signing key), `KSK` (key-signing key) or `KSK_REVOKED` (revoked key-signing key). |
| `dns.dnskey.records.algorithm` | The DNSSEC algorithm of a DNSKEY, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.algorithm` | The DNSSEC algorithm of the key that a DS record refers to, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.digest_type` | The hash used for a DS record's digest: `SHA1`, `SHA256`, `SHA384`, `GOST` or `NULL`. |
| `dns.rrsig.algorithm` | The DNSSEC algorithm of an RRSIG signature, such as `ECDSAP256SHA256` or `RSASHA256`. |

Operators: not measured

| Field | Description |
|---|---|
| `website.parent_asset.type` | The asset type of the website's parent asset, such as `subdomain`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `website_count` | The number of website assets (`host:port`) in your inventory that belong to this asset. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `open_port_count` | The number of open ports found on the asset. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `security_score` | The asset's EASM security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

## Response Fields

| Field | Type |
|---|---|
| `asset_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-set-tag.md


---

# Asset Set Weight

URL: https://docs.deepinfo.com/reference/easm/asset-set-weight/

POST /easm/assets/search:set-weight: Sets a business-importance weight (0–1000) on every asset matching filters. Weights influence prioritization and scores.

`POST https://api.deepinfo.com/v1/easm/assets/search:set-weight`

Sets a business-importance `weight` (0–1000) on every asset matching `filters`. Weights influence prioritization and scores.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `weight` | Optional | Min `0`, max `1000`. | `100` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the asset, such as a business unit or an environment; each tag is 3 to 100 characters long. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.name.unicode` | The host name without its extension, in Unicode: `acme` for `acme.example`, `www.acme` for `www.acme.example`. |
| `fqdn.name.latinized` | Latin-letter spellings of a name that has non-Latin or accented letters, so a search for `istanbul` also finds names written with `İ`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_sub.unicode` | The second-level part of a two-part extension, such as `co` in `co.uk`; empty for single-part extensions. |
| `website.path` | The URL path of a website asset, such as `/`. |
| `website.scheme` | The URL scheme of a website asset, such as `http`. |
| `website.parent_asset.id` | The ID of the domain or subdomain asset that a website asset belongs to. |
| `website.parent_asset.name` | The name of the domain or subdomain asset that a website asset belongs to. |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.name` | The registrant's name in WHOIS; often a privacy placeholder such as `redacted for privacy`. |
| `whois.registrant.country` | The registrant's country in WHOIS, as a two-letter code in lower case such as `us`. |
| `whois.registrant.state` | The registrant's state or province in WHOIS. |
| `whois.registrant.city` | The registrant's city in WHOIS. |
| `whois.registrant.street` | The registrant's street address in WHOIS. |
| `whois.registrant.postal_code` | The registrant's postal code in WHOIS. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `whois_registrant_email_historical` | Every registrant e-mail address seen for the domain over time, the current one included. |
| `whois_normalized.registrar` | The registrar reduced to a short normalized name, such as `godaddy` or `gandi`, so the same registrar matches across spellings. |
| `whois_normalized.registrant.email` | The registrant e-mail address after WHOIS normalization. |
| `whois_normalized.registrant.email_real` | Another normalized registrant e-mail field, set on fewer domains than `whois_normalized.registrant.email`; in the samples it is set only where `whois_privacy_enabled` is false, with the same address. |
| `whois_normalized.registrant.email_domain_apex` | The registrable domain of the registrant e-mail address: `acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.email_fqdn_apex` | The full host name after the `@` of the registrant e-mail address: `mail.acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.organization` | The registrant organization cleaned up across registrars: lower case, with spaces and punctuation removed, such as `domainsbyproxyllc`. |
| `whois_normalized.registrant.phone` | The registrant phone number reduced to its digits, such as `14805551234`. |
| `whois_last_change_data` | The WHOIS fields that changed in the last change seen, as field paths such as `whois.update_date` or `whois.domain_status`. |
| `dns.a.value` | The asset's current A records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.a.value_previous` | The asset's A records as they were before the last change, in the same text form as `dns.a.value`. |
| `dns.a.rcode` | The DNS response code returned for the asset's A lookup, such as `NOERROR`. |
| `dns.a.rcode_previous` | The DNS response code of the A lookup before it last changed. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.entities` | The handles of the registry contacts and organizations linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, when it is kept. |
| `dns.a.ip_addresses.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the A-record address. |
| `dns.a.ip_addresses.raw` | The raw IP WHOIS response for the A-record address, when it is kept; empty on every sampled asset. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.a.ip_addresses.network.start_address` | The first address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.end_address` | The last address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.handle` | The registry handle of the network that contains the A-record address, such as `NET-192-0-2-0-1`. |
| `dns.a.ip_addresses.network.ip_version` | The IP version of the network that contains the A-record address: `v4` or `v6`. |
| `dns.a.ip_addresses.network.links` | Links to the registry record of the network that contains the A-record address, such as its RDAP and WHOIS URLs. |
| `dns.a.ip_addresses.network.parent_handle` | The handle of the larger network block from which the network of the A-record address was allocated. |
| `dns.a.ip_addresses.network.raw` | The raw RDAP network object for the A-record address, when it is kept. |
| `dns.a.ip_addresses.network.status` | The registry status of the network that contains the A-record address, such as `active`. |
| `dns.a.ip_addresses.network.type` | The registry's allocation type for the network that contains the A-record address, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `dns.a.ip_addresses.network.notices.title` | The title of a notice the registry attached to the network record of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.network.notices.description` | The text of a notice the registry attached to the network record of the A-record address. |
| `dns.a.ip_addresses.network.notices.links` | Links given in a notice on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.title` | The title of a remark on the network record of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.network.remarks.description` | The text of a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.links` | Links given in a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.events.action` | An event in the history of the network record of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.network.events.actor` | Who performed an event on the network record of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the A-record address, such as `abuse`. |
| `dns.a.ip_addresses.objects.contact.email.value` | An e-mail address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.value` | A postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the A-record address, such as `voice` or `work`. |
| `dns.a.ip_addresses.objects.contact.phone.value` | A phone number of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.kind` | What kind of contact is linked to the network of the A-record address: `org`, `group` or `individual`. |
| `dns.a.ip_addresses.objects.contact.name` | The name of a contact or organization linked to the network of the A-record address, such as `Abuse` or a company name. |
| `dns.a.ip_addresses.objects.contact.role` | The role given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.title` | The title given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.entities` | Handles of further entities listed under a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.events.action` | An event in the history of a contact record linked to the network of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.objects.events.actor` | Who performed an event on a contact record linked to the network of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.events_actor` | Events in which a contact linked to the network of the A-record address is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `dns.a.ip_addresses.objects.handle` | The registry handle of a contact or organization linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.links` | Links to the registry record of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.title` | The title of a notice on a contact record linked to the network of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.objects.notices.description` | The text of a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.links` | Links given in a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.raw` | The raw RDAP object of a contact linked to the network of the A-record address, when it is kept. |
| `dns.a.ip_addresses.objects.remarks.title` | The title of a remark on a contact record linked to the network of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.objects.remarks.description` | The text of a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.roles` | The roles of a contact for the network of the A-record address, such as `registrant`, `abuse` or `technical`. |
| `dns.a.ip_addresses.objects.status` | The registry status of a contact linked to the network of the A-record address, such as `validated`. |
| `dns.a.ip_history` | Every IPv4 address seen in the asset's A records over time, the current ones included. |
| `dns.aaaa.value` | The asset's current AAAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.aaaa.value_previous` | The asset's AAAA records as they were before the last change, in the same text form as `dns.aaaa.value`. |
| `dns.aaaa.rcode` | The DNS response code returned for the asset's AAAA lookup, such as `NOERROR`. |
| `dns.aaaa.rcode_previous` | The DNS response code of the AAAA lookup before it last changed. |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the asset's AAAA records. |
| `dns.caa.value` | The asset's current CAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.caa.value_previous` | The asset's CAA records as they were before the last change, in the same text form as `dns.caa.value`. |
| `dns.caa.rcode` | The DNS response code returned for the asset's CAA lookup, such as `NOERROR`. |
| `dns.caa.rcode_previous` | The DNS response code of the CAA lookup before it last changed. |
| `dns.caa.issue_fqdns` | The certificate authorities allowed to issue certificates for the name, from the CAA `issue` tags, such as `fernhill.example` or `kestrel.example`. |
| `dns.caa.issuewild_fqdns` | The certificate authorities allowed to issue wildcard certificates for the name, from the CAA `issuewild` tags. |
| `dns.caa.iodef_emails` | The e-mail addresses from the CAA `iodef` tags, where certificate authorities report requests that break the CAA policy. |
| `dns.cname.value` | The asset's current CNAME records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.cname.value_previous` | The asset's CNAME records as they were before the last change, in the same text form as `dns.cname.value`. |
| `dns.cname.rcode` | The DNS response code returned for the asset's CNAME lookup, such as `NOERROR`. |
| `dns.cname.rcode_previous` | The DNS response code of the CNAME lookup before it last changed. |
| `dns.cname.canonical_fqdns` | The host names the asset's CNAME records point to (the alias targets). |
| `dns.dnskey.value` | The asset's current DNSKEY records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.dnskey.value_previous` | The asset's DNSKEY records as they were before the last change, in the same text form as `dns.dnskey.value`. |
| `dns.dnskey.rcode` | The DNS response code returned for the asset's DNSKEY lookup, such as `NOERROR`. |
| `dns.dnskey.rcode_previous` | The DNS response code of the DNSKEY lookup before it last changed. |
| `dns.dnskey.records.public_key` | The public key of a DNSKEY record, Base64-encoded and split into space-separated groups as in the zone-file text. |
| `dns.ds.value` | The asset's current DS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ds.value_previous` | The asset's DS records as they were before the last change, in the same text form as `dns.ds.value`. |
| `dns.ds.rcode` | The DNS response code returned for the asset's DS lookup, such as `NOERROR`. |
| `dns.ds.rcode_previous` | The DNS response code of the DS lookup before it last changed. |
| `dns.ds.records.digest` | The digest of a DS record, the hash of the DNSKEY it refers to. |
| `dns.mx.value` | The asset's current MX records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.mx.value_previous` | The asset's MX records as they were before the last change, in the same text form as `dns.mx.value`. |
| `dns.mx.rcode` | The DNS response code returned for the asset's MX lookup, such as `NOERROR`. |
| `dns.mx.rcode_previous` | The DNS response code of the MX lookup before it last changed. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns.mx.domains` | The registrable domains of the asset's mail servers, such as `acme.example`. |
| `dns.ns.value` | The asset's current NS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ns.value_previous` | The asset's NS records as they were before the last change, in the same text form as `dns.ns.value`. |
| `dns.ns.rcode` | The DNS response code returned for the asset's NS lookup, such as `NOERROR`. |
| `dns.ns.rcode_previous` | The DNS response code of the NS lookup before it last changed. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.ns.domains` | The registrable domains of the asset's name servers, such as `acme.example`. |
| `dns.nsec.value` | The asset's current NSEC records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec.value_previous` | The asset's NSEC records as they were before the last change, in the same text form as `dns.nsec.value`. |
| `dns.nsec.rcode` | The DNS response code returned for the asset's NSEC lookup, such as `NOERROR`. |
| `dns.nsec.rcode_previous` | The DNS response code of the NSEC lookup before it last changed. |
| `dns.nsec.records.next_domain` | The next name in the zone, from an NSEC record. |
| `dns.nsec.records.record_types` | The record types that exist at the name, from an NSEC record's type list, such as `A`, `NS` or `SOA`. |
| `dns.nsec3.value` | The asset's current NSEC3 records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec3.value_previous` | The asset's NSEC3 records as they were before the last change, in the same text form as `dns.nsec3.value`. |
| `dns.nsec3.rcode` | The DNS response code returned for the asset's NSEC3 lookup, such as `NOERROR`. |
| `dns.nsec3.rcode_previous` | The DNS response code of the NSEC3 lookup before it last changed. |
| `dns.nsec3.records.next_domain_hashed` | The hashed next name in the zone, from an NSEC3 record. |
| `dns.nsec3.records.record_types` | The record types that exist at the name, from an NSEC3 record's type list, such as `A` or `MX`. |
| `dns.rrsig.value` | The asset's current RRSIG records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.rrsig.value_previous` | The asset's RRSIG records as they were before the last change, in the same text form as `dns.rrsig.value`. |
| `dns.rrsig.rcode` | The DNS response code returned for the asset's RRSIG lookup, such as `NOERROR`. |
| `dns.rrsig.rcode_previous` | The DNS response code of the RRSIG lookup before it last changed. |
| `dns.rrsig.type_covered` | The record type that an RRSIG signature covers, such as `A` or `SOA`. |
| `dns.rrsig.signature` | The signature data of an RRSIG record, Base64-encoded. |
| `dns.soa.value` | The asset's current SOA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.soa.value_previous` | The asset's SOA records as they were before the last change, in the same text form as `dns.soa.value`. |
| `dns.soa.rcode` | The DNS response code returned for the asset's SOA lookup, such as `NOERROR`. |
| `dns.soa.rcode_previous` | The DNS response code of the SOA lookup before it last changed. |
| `dns.soa.mnames` | The MNAME of the SOA record: the primary name server of the zone, such as `ns1.acme.example`. |
| `dns.soa.rnames` | The RNAME of the SOA record, the zone administrator's mailbox in DNS form: `hostmaster.acme.example` stands for the mailbox `hostmaster` at `acme.example`. |
| `dns.soa.rname_emails` | The RNAME of the SOA record written as an e-mail address, such as `user@acme.example`. |
| `dns.srv.value` | The asset's current SRV records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.srv.value_previous` | The asset's SRV records as they were before the last change, in the same text form as `dns.srv.value`. |
| `dns.srv.rcode` | The DNS response code returned for the asset's SRV lookup, such as `NOERROR`. |
| `dns.srv.rcode_previous` | The DNS response code of the SRV lookup before it last changed. |
| `dns.srv.records.service` | The service named in an SRV record (the `_service` part of its name). |
| `dns.srv.records.protocol` | The protocol named in an SRV record (the `_proto` part of its name, such as TCP or UDP). |
| `dns.srv.records.target` | The host name an SRV record points to. |
| `dns.txt.value` | The asset's current TXT records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.txt.value_previous` | The asset's TXT records as they were before the last change, in the same text form as `dns.txt.value`. |
| `dns.txt.rcode` | The DNS response code returned for the asset's TXT lookup, such as `NOERROR`. |
| `dns.txt.rcode_previous` | The DNS response code of the TXT lookup before it last changed. |
| `dns.txt.values` | Each TXT record of the asset as its quoted text, such as `"v=spf1 include:_spf.acme.example ~all"`; the quotes are part of the value. |
| `dns.txt.spf_list.value` | The text of an SPF record (a TXT record that starts with `v=spf1`), quoted as in `dns.txt.values`. |
| `dns.txt.spf_list.allowed_domains` | The registrable domains that an SPF record refers to, such as `acme.example` for `include:_spf.acme.example`. |
| `dns.txt.spf_list.allowed_ips` | The IP addresses and ranges that an SPF record authorizes to send mail (its `ip4:` and `ip6:` entries). |
| `dns.txt.verifications.value` | The text of a site-verification TXT record, quoted as in `dns.txt.values`. |
| `dns.txt.verifications.domain` | The domain of the service a verification record is for, such as `acme.example`, `fernhill.example` or `kestrel.example`. |
| `dns.txt.verifications.name` | The name of a verification record, such as `site-verification` or `domain-verification`. |
| `dns_last_change_data` | The DNS fields that changed in the last change seen, as field paths such as `dns.soa.mnames`. |
| `ssl.target` | The host name that the asset's TLS certificate was collected from, normally the asset itself. |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the asset's TLS certificate, as lower-case hex; one fingerprint identifies one certificate. |
| `ssl.issuer.common_name` | The common name (CN) of the certificate authority that issued the asset's TLS certificate, such as `WE1` or `YE2`. |
| `ssl.issuer.country` | The country (C) of the certificate authority that issued the asset's TLS certificate, as a two-letter code such as `US`. |
| `ssl.issuer.state` | The state or province (ST) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.locality` | The locality or city (L) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.organization` | The organization (O) of the certificate authority that issued the asset's TLS certificate, such as `Let's Encrypt` or `Google Trust Services`. |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer_dn` | The full distinguished name of the issuer of the asset's TLS certificate, as one string such as `CN=WE1,O=Google Trust Services,C=US`. |
| `ssl.subject.common_name` | The common name (CN) of the subject (holder) of the asset's TLS certificate, usually a host name such as `acme.example`. |
| `ssl.subject.country` | The country (C) of the subject (holder) of the asset's TLS certificate, as a two-letter code. |
| `ssl.subject.state` | The state or province (ST) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.locality` | The locality or city (L) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organizational_unit` | The organizational unit (OU) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject_dn` | The full distinguished name of the subject of the asset's TLS certificate, such as `CN=acme.example`; one that starts with `CN=*.` belongs to a wildcard certificate. |
| `ssl.signature.value` | The signature of the asset's TLS certificate, Base64-encoded. |
| `ssl.signature.invalid_reason` | Why certificate validation failed, such as a host name mismatch or `unable to get issuer certificate`. |
| `ssl.signature.algorithm.name` | The hash algorithm of the signature on the asset's TLS certificate, such as `sha256` or `sha384`. |
| `ssl.signature.algorithm.oid` | The object identifier (OID) of the signature algorithm, such as `1.2.840.113549.1.1.11` (SHA-256 with RSA) or `1.2.840.10045.4.3.2` (ECDSA with SHA-256). |
| `ssl.extensions.authority_key_id` | The Authority Key Identifier extension, which identifies the issuer's key, Base64-encoded. |
| `ssl.extensions.certificate_policies` | The policy OIDs in the Certificate Policies extension, such as `2.23.140.1.2.1` (domain validated). |
| `ssl.extensions.signed_certificate_timestamps.log_id` | The ID of the Certificate Transparency log that issued a signed certificate timestamp (SCT) for the certificate, Base64-encoded. |
| `ssl.extensions.signed_certificate_timestamps.signature` | The log's signature on a signed certificate timestamp, Base64-encoded. |
| `ssl.extensions.subject_alt_name.dns_names` | The host names in the certificate's Subject Alternative Name extension, including wildcard names such as `*.acme.example`. |
| `ssl.extensions.subject_key_id` | The Subject Key Identifier extension, which identifies the certificate's own key, Base64-encoded. |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | The hash algorithm used for `ssl.subject_key_info.fingerprint.value`, such as `sha256` or `sha384`. |
| `ssl.subject_key_info.fingerprint.value` | A hex fingerprint recorded under the certificate's subject key information, made with the hash in `hash_algorithm`. In the samples it equals `ssl.fingerprint.sha256` when that hash is SHA-256. |
| `ssl.subject_key_info.key_algorithm.name` | The algorithm of the certificate's public key, such as `RSA` or `ECDSA`. |
| `ssl.version.name` | The X.509 version of the certificate, such as `v3`. |
| `ssl.version.value` | The X.509 version as encoded in the certificate, counted from zero: `2` means `v3`. |
| `ssl.tbs_fingerprint` | A SHA-256 fingerprint (hex) of the certificate's to-be-signed part, the certificate content without its signature. |
| `ssl.certificate` | The whole certificate, Base64-encoded (a PEM body without the header and footer lines). |
| `ssl.fqdn_list` | The host names the certificate covers, with the `*.` of wildcard names removed and duplicates merged, so `*.acme.example` and `acme.example` both give `acme.example`. |
| `ssl_last_change_data` | The certificate fields that changed in the last change seen, as field paths such as `ssl.validity.end_date`. |
| `http.requested_url` | The URL the HTTP check started from, such as `http://acme.example`. |
| `http.requested_domain` | The registrable domain of the URL the HTTP check started from. |
| `http.requested_fqdn` | The host name of the URL the HTTP check started from. |
| `http.final_url` | The URL the HTTP check ended on after following all redirects. |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.redirection_history.url` | A URL in the redirect chain of the HTTP check, listed in the order visited. |
| `http.headers.accept` | The `Accept` header, when it was returned in the HTTP check. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the HTTP check. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `http.headers.accept_language` | The `Accept-Language` header, when it was returned in the HTTP check. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the HTTP check; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the HTTP check; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the HTTP check; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the HTTP check; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the HTTP check; it lists the response headers that scripts from other origins may read (CORS). |
| `http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the HTTP check; it says how many seconds browsers may cache a CORS preflight result. |
| `http.headers.alt_svc` | The `Alt-Svc` header returned in the HTTP check; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `http.headers.authorization` | The `Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `http.headers.cache_control` | The `Cache-Control` header returned in the HTTP check; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the HTTP check; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `http.headers.content_disposition` | The `Content-Disposition` header returned in the HTTP check; it says whether the content is shown in the browser or downloaded as a file. |
| `http.headers.content_encoding` | The `Content-Encoding` header returned in the HTTP check; it names the compression applied to the response body, for example `gzip` or `br`. |
| `http.headers.content_language` | The `Content-Language` header returned in the HTTP check; it gives the language of the content, for example `en` or `tr`. |
| `http.headers.content_length` | The `Content-Length` header returned in the HTTP check; it gives the size of the response body in bytes. |
| `http.headers.content_range` | The `Content-Range` header returned in the HTTP check; it says which part of the full body a partial response holds. |
| `http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the HTTP check; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `http.headers.content_type` | The `Content-Type` header returned in the HTTP check; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `http.headers.cookie` | The `Cookie` header, when it was returned in the HTTP check. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the HTTP check; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the HTTP check; it controls whether the page shares its browsing context with cross-origin windows. |
| `http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the HTTP check; it controls which sites may load the resource. |
| `http.headers.date` | The `Date` header returned in the HTTP check; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `http.headers.early_data` | The `Early-Data` header, when it was returned in the HTTP check. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `http.headers.expect_ct` | The `Expect-CT` header returned in the HTTP check; it is a deprecated header about Certificate Transparency enforcement. |
| `http.headers.expires` | The `Expires` header returned in the HTTP check; it gives the date after which the response counts as stale, in HTTP date format. |
| `http.headers.feature_policy` | The `Feature-Policy` header returned in the HTTP check; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `http.headers.host` | The `Host` header, when it was returned in the HTTP check. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the HTTP check. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the HTTP check. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `http.headers.last_modified` | The `Last-Modified` header returned in the HTTP check; it gives the time the server says the resource last changed, in HTTP date format. |
| `http.headers.origin_isolation` | The `Origin-Isolation` header returned in the HTTP check; it is an experimental header that asks browsers to isolate the site's origin. |
| `http.headers.others.name` | The name of a header returned in the HTTP check that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `http.headers.others.value` | The value of a header listed in `headers.others` for the HTTP check. |
| `http.headers.permission_policy` | The `Permission-Policy` header returned in the HTTP check; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `http.headers.permissions_policy` | The `Permissions-Policy` header returned in the HTTP check; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `http.headers.pragma` | The `Pragma` header returned in the HTTP check; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the HTTP check; it tells a client how to authenticate to a proxy. |
| `http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the HTTP check; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `http.headers.range` | The `Range` header, when it was returned in the HTTP check. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `http.headers.referer` | The `Referer` header, when it was returned in the HTTP check. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `http.headers.referrer_policy` | The `Referrer-Policy` header returned in the HTTP check; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the HTTP check. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `http.headers.server` | The `Server` header returned in the HTTP check; it names the server software the site reports, for example `nginx` or `Apache`. |
| `http.headers.set_cookie` | The `Set-Cookie` header returned in the HTTP check; it sets cookies, with their attributes. |
| `http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the HTTP check; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `http.headers.te` | The `TE` header, when it was returned in the HTTP check. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the HTTP check; it says how the body is transferred, for example `chunked`. |
| `http.headers.upgrade` | The `Upgrade` header returned in the HTTP check; it offers or asks for a switch to another protocol. |
| `http.headers.user_agent` | The `User-Agent` header, when it was returned in the HTTP check. It is normally a request header (the client software), so it is rarely set. |
| `http.headers.vary` | The `Vary` header returned in the HTTP check; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the HTTP check; it tells a client how to authenticate, usually with a `401` response. |
| `http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the HTTP check; it stops browsers from guessing the content type when set to `nosniff`. |
| `http.headers.x_download_options` | The `X-Download-Options` header returned in the HTTP check; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `http.headers.x_frame_options` | The `X-Frame-Options` header returned in the HTTP check; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the HTTP check; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `http.headers.x_powered_by` | The `X-Powered-By` header returned in the HTTP check; it names the technology the server reports running on, for example `Express`. |
| `http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the HTTP check; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `http.cookies.name` | The name of a cookie set in the HTTP check. |
| `http.cookies.value` | The value of a cookie set in the HTTP check. |
| `http.html.source_code_hash` | A SHA-256 hash of the page source returned in the HTTP check; the same hash means the same source. |
| `http_last_change_data` | The HTTP check fields that changed in the last change seen, as field paths such as `http.html.source_code_hash`. |
| `webdata.requested_url` | The URL the web data scan started from, such as `http://acme.example`. |
| `webdata.requested_domain` | The registrable domain of the URL the web data scan started from. |
| `webdata.requested_fqdn` | The host name of the URL the web data scan started from. |
| `webdata.html.internal_links_fqdns` | The host names of links on the scanned page that stay within the site's own domain, such as other subdomains. |
| `webdata.html.external_links_domains` | The registrable domains of links on the scanned page that point to other domains, such as `kestrel.example`. |
| `webdata.html.external_links_fqdns` | The host names of links on the scanned page that point to other domains, such as `www.kestrel.example`. |
| `webdata.html.external_links` | The full URLs of links on the scanned page that point to other domains. |
| `webdata.html.script_links` | The URLs of the scripts the scanned page loads. |
| `webdata.html.iframe_links` | The URLs of the frames (iframes) embedded in the scanned page. |
| `webdata.html.trackers.name` | The name of an analytics or advertising tracker found on the scanned page, such as `google_adsense` or `google_tag_manager`. |
| `webdata.html.trackers.values` | The IDs found for a tracker, such as a Google Analytics ID that starts with `G-` or `UA-`. |
| `webdata.html.emails` | The e-mail addresses found on the scanned page. |
| `webdata.html.emails_internal` | The e-mail addresses found on the scanned page that belong to the site's own domain. |
| `webdata.html.source_code_hash` | A SHA-256 hash of the page source in the web data scan; the same hash means the same source. |
| `webdata.html.content_hash` | A SHA-256 hash of the page content in the web data scan, kept apart from `source_code_hash`, the hash of the raw source. |
| `webdata.html.content_top_keywords` | The most frequent words in the text of the scanned page. |
| `webdata.html.favicon_links` | The URLs of the icons the scanned page declares, such as its favicon and touch icons. |
| `webdata.html.html_meta.name` | The site or application name declared in the scanned page's metadata. |
| `webdata.html.html_meta.description` | The meta description of the scanned page. |
| `webdata.html.html_meta.language` | The language the scanned page declares, such as `en`, `tr` or `en-US`. |
| `webdata.html.html_meta.language_alternatives` | The languages of the alternative versions the scanned page links to, such as `en` or `ar`. |
| `webdata.html.html_meta.keywords` | The keywords listed in the keywords meta tag of the scanned page. |
| `webdata.html.html_meta.encoding` | The character encoding the scanned page declares, such as `utf-8`. |
| `webdata.html.html_meta.canonical_url` | The canonical URL the scanned page declares. |
| `webdata.html.html_meta.title` | The title of the scanned page. |
| `webdata.favicon.url` | The URL of a site icon (favicon) recorded by the web data scan. |
| `webdata.favicon.hash` | A SHA-256 hash of a site icon; the same hash means the same icon. |
| `webdata.http.final_url` | The URL the web data scan ended on after following all redirects. |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.redirection_history.url` | A URL in the redirect chain of the web data scan, listed in the order visited. |
| `webdata.http.redirection_history.method` | How a step of the web data scan's redirect chain was made; `http-header` (a redirect sent in the HTTP response) is the value in the samples. |
| `webdata.http.headers.accept` | The `Accept` header, when it was returned in the web data scan. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the web data scan. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_language` | The `Accept-Language` header, when it was returned in the web data scan. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `webdata.http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the web data scan; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `webdata.http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the web data scan; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `webdata.http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the web data scan; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `webdata.http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the web data scan; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `webdata.http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the web data scan; it lists the response headers that scripts from other origins may read (CORS). |
| `webdata.http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the web data scan; it says how many seconds browsers may cache a CORS preflight result. |
| `webdata.http.headers.alt_svc` | The `Alt-Svc` header returned in the web data scan; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `webdata.http.headers.authorization` | The `Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `webdata.http.headers.cache_control` | The `Cache-Control` header returned in the web data scan; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `webdata.http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the web data scan; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `webdata.http.headers.content_disposition` | The `Content-Disposition` header returned in the web data scan; it says whether the content is shown in the browser or downloaded as a file. |
| `webdata.http.headers.content_encoding` | The `Content-Encoding` header returned in the web data scan; it names the compression applied to the response body, for example `gzip` or `br`. |
| `webdata.http.headers.content_language` | The `Content-Language` header returned in the web data scan; it gives the language of the content, for example `en` or `tr`. |
| `webdata.http.headers.content_length` | The `Content-Length` header returned in the web data scan; it gives the size of the response body in bytes. |
| `webdata.http.headers.content_range` | The `Content-Range` header returned in the web data scan; it says which part of the full body a partial response holds. |
| `webdata.http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the web data scan; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `webdata.http.headers.content_type` | The `Content-Type` header returned in the web data scan; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `webdata.http.headers.cookie` | The `Cookie` header, when it was returned in the web data scan. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `webdata.http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the web data scan; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `webdata.http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the web data scan; it controls whether the page shares its browsing context with cross-origin windows. |
| `webdata.http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the web data scan; it controls which sites may load the resource. |
| `webdata.http.headers.date` | The `Date` header returned in the web data scan; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `webdata.http.headers.early_data` | The `Early-Data` header, when it was returned in the web data scan. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `webdata.http.headers.expect_ct` | The `Expect-CT` header returned in the web data scan; it is a deprecated header about Certificate Transparency enforcement. |
| `webdata.http.headers.expires` | The `Expires` header returned in the web data scan; it gives the date after which the response counts as stale, in HTTP date format. |
| `webdata.http.headers.feature_policy` | The `Feature-Policy` header returned in the web data scan; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `webdata.http.headers.host` | The `Host` header, when it was returned in the web data scan. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `webdata.http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the web data scan. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `webdata.http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the web data scan. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `webdata.http.headers.last_modified` | The `Last-Modified` header returned in the web data scan; it gives the time the server says the resource last changed, in HTTP date format. |
| `webdata.http.headers.origin_isolation` | The `Origin-Isolation` header returned in the web data scan; it is an experimental header that asks browsers to isolate the site's origin. |
| `webdata.http.headers.others.name` | The name of a header returned in the web data scan that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `webdata.http.headers.others.value` | The value of a header listed in `headers.others` for the web data scan. |
| `webdata.http.headers.permission_policy` | The `Permission-Policy` header returned in the web data scan; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `webdata.http.headers.permissions_policy` | The `Permissions-Policy` header returned in the web data scan; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `webdata.http.headers.pragma` | The `Pragma` header returned in the web data scan; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `webdata.http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the web data scan; it tells a client how to authenticate to a proxy. |
| `webdata.http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `webdata.http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the web data scan; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `webdata.http.headers.range` | The `Range` header, when it was returned in the web data scan. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `webdata.http.headers.referer` | The `Referer` header, when it was returned in the web data scan. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `webdata.http.headers.referrer_policy` | The `Referrer-Policy` header returned in the web data scan; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `webdata.http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `webdata.http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the web data scan. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `webdata.http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `webdata.http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the web data scan. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `webdata.http.headers.server` | The `Server` header returned in the web data scan; it names the server software the site reports, for example `nginx` or `Apache`. |
| `webdata.http.headers.set_cookie` | The `Set-Cookie` header returned in the web data scan; it sets cookies, with their attributes. |
| `webdata.http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the web data scan; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `webdata.http.headers.te` | The `TE` header, when it was returned in the web data scan. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `webdata.http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the web data scan; it says how the body is transferred, for example `chunked`. |
| `webdata.http.headers.upgrade` | The `Upgrade` header returned in the web data scan; it offers or asks for a switch to another protocol. |
| `webdata.http.headers.user_agent` | The `User-Agent` header, when it was returned in the web data scan. It is normally a request header (the client software), so it is rarely set. |
| `webdata.http.headers.vary` | The `Vary` header returned in the web data scan; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `webdata.http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the web data scan; it tells a client how to authenticate, usually with a `401` response. |
| `webdata.http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the web data scan; it stops browsers from guessing the content type when set to `nosniff`. |
| `webdata.http.headers.x_download_options` | The `X-Download-Options` header returned in the web data scan; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `webdata.http.headers.x_frame_options` | The `X-Frame-Options` header returned in the web data scan; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the web data scan; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `webdata.http.headers.x_powered_by` | The `X-Powered-By` header returned in the web data scan; it names the technology the server reports running on, for example `Express`. |
| `webdata.http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the web data scan; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `webdata.http.cookies.name` | The name of a cookie set in the web data scan. |
| `webdata.http.cookies.value` | The value of a cookie set in the web data scan. |
| `webdata.http.cookies.domain` | The domain a cookie set in the web data scan applies to, such as `.acme.example`. |
| `webdata.http.cookies.path` | The path a cookie set in the web data scan applies to, such as `/`. |
| `webdata.http.cookies.same_party` | The SameParty attribute of a cookie set in the web data scan; in the samples it always holds the same value as `same_site`, such as `Lax` or `None`. |
| `webdata.http.cookies.priority` | The Priority attribute of a cookie set in the web data scan (`Low`, `Medium` or `High` in Chromium-based browsers). |
| `webdata.http.cookies.same_site` | The SameSite attribute of a cookie set in the web data scan, such as `Lax`, `Strict` or `None`. |
| `webdata.technology.stacks.slug` | A short identifier of a technology detected on the site, such as `iis` or `windows-server`. |
| `webdata.technology.stacks.name` | The name of a technology detected on the site, such as `IIS` or `Microsoft ASP.NET`. |
| `webdata.technology.stacks.icon` | The file name of a detected technology's icon, such as `acme.png`. |
| `webdata.technology.stacks.website` | The website of a detected technology's vendor or project. |
| `webdata.technology.stacks.cpe` | The CPE identifier of a detected technology, such as `cpe:/a:acme:acme-portal`, used to match it to known vulnerabilities. |
| `webdata.technology.stacks.version` | The detected version of a technology, such as `1.0`. |
| `webdata.technology.stacks.categories` | The categories of a detected technology, such as `Web servers` or `Operating systems`. |
| `webdata.technology.stacks.description` | A short description of a detected technology. |
| `webdata_last_change_data` | The web data fields that changed in the last change seen, as field paths under `webdata`. |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.entities` | The handles of the registry contacts and organizations linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, when it is kept. |
| `ipwhois.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the IP address asset. |
| `ipwhois.raw` | The raw IP WHOIS response for the IP address asset, when it is kept; empty on every sampled asset. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `ipwhois.network.start_address` | The first address of the registered network block that contains the IP address asset. |
| `ipwhois.network.end_address` | The last address of the registered network block that contains the IP address asset. |
| `ipwhois.network.handle` | The registry handle of the network that contains the IP address asset, such as `NET-192-0-2-0-1`. |
| `ipwhois.network.ip_version` | The IP version of the network that contains the IP address asset: `v4` or `v6`. |
| `ipwhois.network.links` | Links to the registry record of the network that contains the IP address asset, such as its RDAP and WHOIS URLs. |
| `ipwhois.network.parent_handle` | The handle of the larger network block from which the network of the IP address asset was allocated. |
| `ipwhois.network.raw` | The raw RDAP network object for the IP address asset, when it is kept. |
| `ipwhois.network.status` | The registry status of the network that contains the IP address asset, such as `active`. |
| `ipwhois.network.type` | The registry's allocation type for the network that contains the IP address asset, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `ipwhois.network.notices.title` | The title of a notice the registry attached to the network record of the IP address asset, such as `Terms of Service`. |
| `ipwhois.network.notices.description` | The text of a notice the registry attached to the network record of the IP address asset. |
| `ipwhois.network.notices.links` | Links given in a notice on the network record of the IP address asset. |
| `ipwhois.network.remarks.title` | The title of a remark on the network record of the IP address asset, such as `Registration Comments`. |
| `ipwhois.network.remarks.description` | The text of a remark on the network record of the IP address asset. |
| `ipwhois.network.remarks.links` | Links given in a remark on the network record of the IP address asset. |
| `ipwhois.network.events.action` | An event in the history of the network record of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.network.events.actor` | Who performed an event on the network record of the IP address asset, when the registry names one. |
| `ipwhois.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the IP address asset, such as `abuse`. |
| `ipwhois.objects.contact.email.value` | An e-mail address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.value` | A postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the IP address asset, such as `voice` or `work`. |
| `ipwhois.objects.contact.phone.value` | A phone number of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.kind` | What kind of contact is linked to the network of the IP address asset: `org`, `group` or `individual`. |
| `ipwhois.objects.contact.name` | The name of a contact or organization linked to the network of the IP address asset, such as `Abuse` or a company name. |
| `ipwhois.objects.contact.role` | The role given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.contact.title` | The title given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.entities` | Handles of further entities listed under a contact linked to the network of the IP address asset. |
| `ipwhois.objects.events.action` | An event in the history of a contact record linked to the network of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.objects.events.actor` | Who performed an event on a contact record linked to the network of the IP address asset, when the registry names one. |
| `ipwhois.objects.events_actor` | Events in which a contact linked to the network of the IP address asset is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `ipwhois.objects.handle` | The registry handle of a contact or organization linked to the network of the IP address asset. |
| `ipwhois.objects.links` | Links to the registry record of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.notices.title` | The title of a notice on a contact record linked to the network of the IP address asset, such as `Terms of Service`. |
| `ipwhois.objects.notices.description` | The text of a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.notices.links` | Links given in a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.raw` | The raw RDAP object of a contact linked to the network of the IP address asset, when it is kept. |
| `ipwhois.objects.remarks.title` | The title of a remark on a contact record linked to the network of the IP address asset, such as `Registration Comments`. |
| `ipwhois.objects.remarks.description` | The text of a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.roles` | The roles of a contact for the network of the IP address asset, such as `registrant`, `abuse` or `technical`. |
| `ipwhois.objects.status` | The registry status of a contact linked to the network of the IP address asset, such as `validated`. |
| `ipwhois_last_change_data` | The IP WHOIS fields that changed in the last change seen, as field paths under `ipwhois`. |
| `ipdns.ptr_records` | The PTR (reverse DNS) host names of an IP address asset. |
| `ipdns_last_change_data` | The reverse DNS fields that changed in the last change seen, as field paths under `ipdns`. |
| `issue_category_stats.name` | The name of an issue category in the per-category issue counts of the asset, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. |
| `technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the asset, such as `Web servers` or `Analytics`. |
| `domain_snapshot.issue_category_stats.name` | The name of an issue category in the per-category issue counts of the domain and its subdomains together, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the domain and its subdomains together, such as `Web servers` or `Analytics`. Set on domain assets. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.name.length` | The number of characters in the name without the extension: `4` for `acme.example`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois_create_date_historical` | Every creation date seen for the domain over time, so a domain that was deleted and registered again keeps its earlier dates too (UTC date-times). |
| `whois_check_date` | When the WHOIS record of the asset was last checked (UTC date-time). |
| `whois_last_change_date` | When a change in the WHOIS record of the asset was last seen (UTC date-time). |
| `dns.a.value_last_change_date` | When the A record text (`dns.a.value`) last changed (UTC date-time). |
| `dns.a.rcode_last_change_date` | When the response code of the A lookup (`dns.a.rcode`) last changed (UTC date-time). |
| `dns.a.last_change_date` | When the asset's A records last changed, in their text or their response code (UTC date-time). |
| `dns.a.ip_addresses.asn_date` | The registry allocation date that the ASN lookup reports for the A-record address, as a date at midnight UTC. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was created (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was last updated (UTC date-time). |
| `dns.a.ip_addresses.network.events.timestamp` | When an event on the network record of the A-record address happened (UTC date-time). |
| `dns.a.ip_addresses.objects.events.timestamp` | When an event on a contact record linked to the network of the A-record address happened (UTC date-time). |
| `dns.aaaa.value_last_change_date` | When the AAAA record text (`dns.aaaa.value`) last changed (UTC date-time). |
| `dns.aaaa.rcode_last_change_date` | When the response code of the AAAA lookup (`dns.aaaa.rcode`) last changed (UTC date-time). |
| `dns.aaaa.last_change_date` | When the asset's AAAA records last changed, in their text or their response code (UTC date-time). |
| `dns.caa.value_last_change_date` | When the CAA record text (`dns.caa.value`) last changed (UTC date-time). |
| `dns.caa.rcode_last_change_date` | When the response code of the CAA lookup (`dns.caa.rcode`) last changed (UTC date-time). |
| `dns.caa.last_change_date` | When the asset's CAA records last changed, in their text or their response code (UTC date-time). |
| `dns.cname.value_last_change_date` | When the CNAME record text (`dns.cname.value`) last changed (UTC date-time). |
| `dns.cname.rcode_last_change_date` | When the response code of the CNAME lookup (`dns.cname.rcode`) last changed (UTC date-time). |
| `dns.cname.last_change_date` | When the asset's CNAME records last changed, in their text or their response code (UTC date-time). |
| `dns.dnskey.value_last_change_date` | When the DNSKEY record text (`dns.dnskey.value`) last changed (UTC date-time). |
| `dns.dnskey.rcode_last_change_date` | When the response code of the DNSKEY lookup (`dns.dnskey.rcode`) last changed (UTC date-time). |
| `dns.dnskey.last_change_date` | When the asset's DNSKEY records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.value_last_change_date` | When the DS record text (`dns.ds.value`) last changed (UTC date-time). |
| `dns.ds.rcode_last_change_date` | When the response code of the DS lookup (`dns.ds.rcode`) last changed (UTC date-time). |
| `dns.ds.last_change_date` | When the asset's DS records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.records.key_tag` | The key tag (a number) of the DNSKEY that a DS record refers to. |
| `dns.mx.value_last_change_date` | When the MX record text (`dns.mx.value`) last changed (UTC date-time). |
| `dns.mx.rcode_last_change_date` | When the response code of the MX lookup (`dns.mx.rcode`) last changed (UTC date-time). |
| `dns.mx.last_change_date` | When the asset's MX records last changed, in their text or their response code (UTC date-time). |
| `dns.ns.value_last_change_date` | When the NS record text (`dns.ns.value`) last changed (UTC date-time). |
| `dns.ns.rcode_last_change_date` | When the response code of the NS lookup (`dns.ns.rcode`) last changed (UTC date-time). |
| `dns.ns.last_change_date` | When the asset's NS records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec.value_last_change_date` | When the NSEC record text (`dns.nsec.value`) last changed (UTC date-time). |
| `dns.nsec.rcode_last_change_date` | When the response code of the NSEC lookup (`dns.nsec.rcode`) last changed (UTC date-time). |
| `dns.nsec.last_change_date` | When the asset's NSEC records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec3.value_last_change_date` | When the NSEC3 record text (`dns.nsec3.value`) last changed (UTC date-time). |
| `dns.nsec3.rcode_last_change_date` | When the response code of the NSEC3 lookup (`dns.nsec3.rcode`) last changed (UTC date-time). |
| `dns.nsec3.last_change_date` | When the asset's NSEC3 records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.value_last_change_date` | When the RRSIG record text (`dns.rrsig.value`) last changed (UTC date-time). |
| `dns.rrsig.rcode_last_change_date` | When the response code of the RRSIG lookup (`dns.rrsig.rcode`) last changed (UTC date-time). |
| `dns.rrsig.last_change_date` | When the asset's RRSIG records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.signature_inception` | When an RRSIG signature becomes valid (UTC date-time). |
| `dns.rrsig.signature_expiration` | When an RRSIG signature expires (UTC date-time). |
| `dns.soa.value_last_change_date` | When the SOA record text (`dns.soa.value`) last changed (UTC date-time). |
| `dns.soa.rcode_last_change_date` | When the response code of the SOA lookup (`dns.soa.rcode`) last changed (UTC date-time). |
| `dns.soa.last_change_date` | When the asset's SOA records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.value_last_change_date` | When the SRV record text (`dns.srv.value`) last changed (UTC date-time). |
| `dns.srv.rcode_last_change_date` | When the response code of the SRV lookup (`dns.srv.rcode`) last changed (UTC date-time). |
| `dns.srv.last_change_date` | When the asset's SRV records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.records.port` | The port an SRV record points to. |
| `dns.txt.value_last_change_date` | When the TXT record text (`dns.txt.value`) last changed (UTC date-time). |
| `dns.txt.rcode_last_change_date` | When the response code of the TXT lookup (`dns.txt.rcode`) last changed (UTC date-time). |
| `dns.txt.last_change_date` | When the asset's TXT records last changed, in their text or their response code (UTC date-time). |
| `dns_check_date` | When the DNS records of the asset were last checked (UTC date-time). |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.port` | The port that the asset's TLS certificate was collected on, such as `443`. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl.validity.length` | The validity period of the certificate in seconds: 7,776,000 seconds are 90 days. |
| `ssl.extensions.signed_certificate_timestamps.timestamp` | When a Certificate Transparency log recorded the certificate, from a signed certificate timestamp (UTC date-time). |
| `ssl.extensions.signed_certificate_timestamps.version` | The version of a signed certificate timestamp; `0` stands for version 1. |
| `ssl_check_date` | When the TLS certificate of the asset was last checked (UTC date-time). |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the HTTP check, such as `301` or `200`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_check_date` | When the HTTP check of the asset last ran (UTC date-time). |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the web data scan, such as `301` or `200`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata.http.cookies.size` | The size of a cookie set in the web data scan, in bytes (name plus value). |
| `webdata.http.cookies.expires` | When a cookie set in the web data scan expires (UTC date-time); session cookies show `1969-12-31T23:59:59Z`. |
| `webdata.technology.stacks.confidence` | How certain the detection of a technology is, from 0 to 100; every sampled detection has `100`. |
| `webdata.technology.stacks.clean_version` | The major version of a detected technology as a whole number, such as `1` for version `1.0`. |
| `webdata_check_date` | When the web data scan of the asset, which collects the page content, headers and technologies, last ran (UTC date-time). |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn_date` | The registry allocation date that the ASN lookup reports for the IP address asset, as a date at midnight UTC. |
| `ipwhois.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was created (UTC date-time). |
| `ipwhois.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was last updated (UTC date-time). |
| `ipwhois.network.events.timestamp` | When an event on the network record of the IP address asset happened (UTC date-time). |
| `ipwhois.objects.events.timestamp` | When an event on a contact record linked to the network of the IP address asset happened (UTC date-time). |
| `ipwhois_check_date` | When the IP WHOIS record of an IP address asset was last checked (UTC date-time). |
| `ipwhois_last_change_date` | When a change in the IP WHOIS record of an IP address asset was last seen (UTC date-time). |
| `ipdns_check_date` | When the reverse DNS (PTR) records of an IP address asset were last checked (UTC date-time). |
| `ipdns_last_change_date` | When a change in the reverse DNS (PTR) records of an IP address asset was last seen (UTC date-time). |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `open_port_count` | The number of open ports found on the asset. |
| `open_ports` | The open port numbers found on the asset, such as `80`, `443` or `8080`. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_category_stats.count` | The number of active issues in that category on the asset. |
| `issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the asset. |
| `issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the asset. |
| `issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the asset. |
| `issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the asset. |
| `issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the asset. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `issue_count.active_by_severity.low` | The number of active issues of low severity on the asset. |
| `issue_count.active_by_severity.information` | The number of active issues of information severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `technology_count.by_category.count` | The number of technologies in that category on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity on the asset. |
| `vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity on the asset. |
| `vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity on the asset. |
| `vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) on the asset whose severity is `none`. |
| `vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) on the asset whose severity is `unknown`. |
| `security_score` | The asset's External Attack Surface Management (EASM) security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.count` | The number of active issues in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.count` | The number of distinct technologies in that category across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `fqdn.is_idn` | True when the host name is an internationalized domain name (IDN) with non-ASCII characters. |
| `fqdn.name.contains_confusable` | True when the name contains confusable characters that look like other letters, such as Cyrillic `а` for Latin `a`, a common trick in look-alike domains. |
| `fqdn.name.contains_hyphen` | True when the name (without the extension) contains a hyphen. |
| `fqdn.name.contains_letter` | True when the name (without the extension) contains a letter. |
| `fqdn.name.contains_number` | True when the name (without the extension) contains a digit. |
| `fqdn.domain.is_idn` | True when the registrable domain is an internationalized domain name (IDN) with non-ASCII characters. |
| `whois_privacy_enabled` | True when the platform flagged WHOIS privacy protection on the domain's registrant details; set on domain assets. |
| `ssl.signature.is_valid` | True when the asset's TLS certificate passed validation for the host; when false, `ssl.signature.invalid_reason` says why. |
| `ssl.signature.is_valid_chain` | A flag for whether the certificate chain of the asset's TLS certificate is valid. It was true on every sampled certificate, even one whose validation failed with `unable to get issuer certificate`. |
| `ssl.signature.is_self_signed` | True when the asset's TLS certificate is self-signed, that is signed by its own key rather than by a certificate authority. |
| `ssl.extensions.basic_constraints.is_ca` | True when the certificate is a certificate authority (CA) certificate, from its Basic Constraints extension. |
| `ssl.extensions.extended_key_usage.client_auth` | True when the Extended Key Usage extension allows TLS client authentication. |
| `ssl.extensions.extended_key_usage.server_auth` | True when the Extended Key Usage extension allows TLS server authentication, as website certificates need. |
| `ssl.extensions.key_usage.content_commitment` | True when the Key Usage extension allows the certificate's key to be used for content commitment (non-repudiation). |
| `ssl.extensions.key_usage.crl_sign` | True when the Key Usage extension allows the certificate's key to be used for signing certificate revocation lists (CRL sign). |
| `ssl.extensions.key_usage.data_encipherment` | True when the Key Usage extension allows the certificate's key to be used for data encipherment. |
| `ssl.extensions.key_usage.digital_signature` | True when the Key Usage extension allows the certificate's key to be used for digital signatures. |
| `ssl.extensions.key_usage.key_agreement` | True when the Key Usage extension allows the certificate's key to be used for key agreement. |
| `ssl.extensions.key_usage.key_cert_sign` | True when the Key Usage extension allows the certificate's key to be used for signing other certificates (certificate sign). |
| `ssl.extensions.key_usage.key_encipherment` | True when the Key Usage extension allows the certificate's key to be used for key encipherment. |
| `ssl.has_expired` | True when the asset's TLS certificate is past its end date. |
| `http.external_domain_redirection` | True when the HTTP check ended on a different registrable domain than it started on. |
| `http.external_fqdn_redirection` | True when the HTTP check ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.html.inspect_disabled` | A flag of the web data scan that marks pages whose inspection was disabled; it was `false` on every sampled asset. |
| `webdata.html.html_meta.no_index_status` | True when the scanned page asks search engines not to index it (a `noindex` robots directive). |
| `webdata.http.external_domain_redirection` | True when the web data scan ended on a different registrable domain than it started on. |
| `webdata.http.external_fqdn_redirection` | True when the web data scan ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.http.cookies.secure` | True when a cookie set in the web data scan is sent over HTTPS only (Secure attribute). |
| `webdata.http.cookies.http_only` | True when scripts on the page cannot read a cookie set in the web data scan (HttpOnly attribute). |
| `webdata.http.cookies.session` | True when a cookie set in the web data scan is a session cookie, deleted when the browser closes. |
| `is_parked` | True when the asset is parked; Inventory marks it with a P badge whose tooltip shows where it redirects. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `dns.dnskey.records.key_type` | The role of a DNSKEY: `ZSK` (zone-signing key), `KSK` (key-signing key) or `KSK_REVOKED` (revoked key-signing key). |
| `dns.dnskey.records.algorithm` | The DNSSEC algorithm of a DNSKEY, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.algorithm` | The DNSSEC algorithm of the key that a DS record refers to, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.digest_type` | The hash used for a DS record's digest: `SHA1`, `SHA256`, `SHA384`, `GOST` or `NULL`. |
| `dns.rrsig.algorithm` | The DNSSEC algorithm of an RRSIG signature, such as `ECDSAP256SHA256` or `RSASHA256`. |

Operators: not measured

| Field | Description |
|---|---|
| `website.parent_asset.type` | The asset type of the website's parent asset, such as `subdomain`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `website_count` | The number of website assets (`host:port`) in your inventory that belong to this asset. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `open_port_count` | The number of open ports found on the asset. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `security_score` | The asset's EASM security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

## Response Fields

| Field | Type |
|---|---|
| `asset_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-set-weight.md


---

# Asset Instant Scan Status

URL: https://docs.deepinfo.com/reference/easm/asset-instant-scan-status/

GET /easm/assets/{asset_id}/instant-scan-status: Returns the state of the latest on-demand scan: pending, queued, monitoring, failed, issue_queued or finished.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/instant-scan-status`

Returns the state of the latest on-demand scan: `pending`, `queued`, `monitoring`, `failed`, `issue_queued` or `finished`. Returns **404** if no instant scan was ever triggered for the asset.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `asset` | string |  |
| `asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `state` | string | One of `pending`, `queued`, `monitoring`, `failed`, `issue_queued`, `finished` |
| `state_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset` | string |
| `asset_type` | string |
| `state` | string |
| `state_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-instant-scan-status.md


---

# Asset Update

URL: https://docs.deepinfo.com/reference/easm/asset-update/

PUT /easm/assets/{asset_id}: Updates an asset's settings: discovery_enabled (use the asset as a discovery seed) and is_main_asset.

`PUT https://api.deepinfo.com/v1/easm/assets/{asset_id}`

Updates an asset's settings: `discovery_enabled` (use the asset as a discovery seed) and `is_main_asset`.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Request Body

| Parameter | Type | Required |
|---|---|---|
| `discovery_enabled` | boolean | Required |
| `is_main_asset` | boolean | Required |

```json
{
  "discovery_enabled": true,
  "is_main_asset": true
}
```

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-update.md


---

# Asset Remove Tag

URL: https://docs.deepinfo.com/reference/easm/asset-remove-tag/

DELETE /easm/assets/{asset_id}/tags/{tag_id}: Removes one tag from one asset. tag_id is the tag name.

`DELETE https://api.deepinfo.com/v1/easm/assets/{asset_id}/tags/{tag_id}`

Removes one tag from one asset. `tag_id` is the **tag name**. The tag itself stays in [Asset Tags](/reference/easm/#group-asset-tags) until you delete it there.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `tag_id` | Required |  | `acme-tag` |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-remove-tag.md


---

# Asset Tag List

URL: https://docs.deepinfo.com/reference/easm/asset-tag-list/

GET /easm/asset-tags: Lists the tags used on your assets (tag names).

`GET https://api.deepinfo.com/v1/easm/asset-tags`

Lists the tags used on your assets (tag names).

## Authentication

Send your API key in the `apikey` request header.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-tag-list.md


---

# Asset Tag Update

URL: https://docs.deepinfo.com/reference/easm/asset-tag-update/

PUT /easm/asset-tags/{tag_id}: Renames a tag on every asset that has it. tag_id is the current tag name; tag (3–100 characters) is the new name.

`PUT https://api.deepinfo.com/v1/easm/asset-tags/{tag_id}`

Renames a tag on every asset that has it. `tag_id` is the current **tag name**; `tag` (3–100 characters) is the new name.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `tag_id` | Required |  | `acme-tag` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `tag` | string | Required | min length `3`; max length `100` |

```json
{
  "tag": "production"
}
```

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-tag-update.md


---

# Asset Tag Delete

URL: https://docs.deepinfo.com/reference/easm/asset-tag-delete/

DELETE /easm/asset-tags/{tag_id}: Deletes a tag and removes it from all assets. tag_id is the tag name.

`DELETE https://api.deepinfo.com/v1/easm/asset-tags/{tag_id}`

Deletes a tag and removes it from all assets. `tag_id` is the **tag name**.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `tag_id` | Required |  | `acme-tag` |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-tag-delete.md


---

# Deleted Asset Search

URL: https://docs.deepinfo.com/reference/easm/deleted-asset-search/

POST /easm/deleted-assets/search: Searches assets that were removed from monitoring, with their deleted_date.

`POST https://api.deepinfo.com/v1/easm/deleted-assets/search`

Searches assets that were removed from monitoring, with their `deleted_date`.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory, before it was removed (UTC date-time). |
| `deleted_date` | When the asset was removed from your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned before it was removed (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True when the asset was set as a main asset, the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the asset seemed inactive: no active DNS records or WHOIS information were found (for a subdomain: no DNS records). The Deleted Assets list flags such assets. |
| `discovery_enabled` | True when discovery used the asset as a starting point to find related assets. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The removed asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the removed asset, such as a business unit or an environment. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The removed asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `added_date` | When the asset was added to your inventory, before it was removed (UTC date-time). |
| `deleted_date` | When the asset was removed from your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned before it was removed (UTC date-time). |
| `is_main_asset` | True when the asset was set as a main asset, the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the asset seemed inactive: no active DNS records or WHOIS information were found (for a subdomain: no DNS records). The Deleted Assets list flags such assets. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery used the asset as a starting point to find related assets. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].asset` | string |  |
| `results[].asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `results[].added_date` | string | date-time |
| `results[].deleted_date` | string | date-time |
| `results[].tags` | array of string |  |
| `results[].creation_method` | string | One of `manually_added`, `manually_approved`, `auto_approved` |
| `results[].latest_scan_date` | string | date-time |
| `results[].is_main_asset` | boolean |  |
| `results[].seems_inactive` | boolean |  |
| `results[].seems_inactive_first_seen` | string | date-time |
| `results[].seems_inactive_last_seen` | string | date-time |
| `results[].discovery_enabled` | boolean |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].asset` | string |
| `results[].asset_type` | string |
| `results[].added_date` | string |
| `results[].deleted_date` | string |
| `results[].tags` | array |
| `results[].creation_method` | string |
| `results[].latest_scan_date` | string |
| `results[].is_main_asset` | boolean |
| `results[].seems_inactive` | boolean |
| `results[].seems_inactive_first_seen` | null |
| `results[].seems_inactive_last_seen` | null |
| `results[].discovery_enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/deleted-asset-search.md


---

# Deleted Asset Export

URL: https://docs.deepinfo.com/reference/easm/deleted-asset-export/

POST /easm/deleted-assets/search:export: Exports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array.

`POST https://api.deepinfo.com/v1/easm/deleted-assets/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory, before it was removed (UTC date-time). |
| `deleted_date` | When the asset was removed from your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned before it was removed (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True when the asset was set as a main asset, the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the asset seemed inactive: no active DNS records or WHOIS information were found (for a subdomain: no DNS records). The Deleted Assets list flags such assets. |
| `discovery_enabled` | True when discovery used the asset as a starting point to find related assets. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The removed asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the removed asset, such as a business unit or an environment. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The removed asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `added_date` | When the asset was added to your inventory, before it was removed (UTC date-time). |
| `deleted_date` | When the asset was removed from your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned before it was removed (UTC date-time). |
| `is_main_asset` | True when the asset was set as a main asset, the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the asset seemed inactive: no active DNS records or WHOIS information were found (for a subdomain: no DNS records). The Deleted Assets list flags such assets. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery used the asset as a starting point to find related assets. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/deleted-asset-export.md


---

# Asset DNS History List

URL: https://docs.deepinfo.com/reference/easm/asset-dns-history-list/

GET /easm/assets/{asset_id}/dns-history: Lists the DNS snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/dns-history`

Lists the DNS snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-dns-history-list.md


---

# Asset HTTP History List

URL: https://docs.deepinfo.com/reference/easm/asset-http-history-list/

GET /easm/assets/{asset_id}/http-history: Lists the HTTP snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/http-history`

Lists the HTTP snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-http-history-list.md


---

# Asset IP DNS PTR History List

URL: https://docs.deepinfo.com/reference/easm/asset-ip-dns-ptr-history-list/

GET /easm/assets/{asset_id}/ipdns-history: Lists the IP DNS (PTR) snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/ipdns-history`

Lists the IP DNS (PTR) snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `<asset_id>` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-ip-dns-ptr-history-list.md


---

# Asset IP Whois History List

URL: https://docs.deepinfo.com/reference/easm/asset-ip-whois-history-list/

GET /easm/assets/{asset_id}/ipwhois-history: Lists the IP WHOIS snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/ipwhois-history`

Lists the IP WHOIS snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `<asset_id>` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-ip-whois-history-list.md


---

# Asset Port Scan History List

URL: https://docs.deepinfo.com/reference/easm/asset-port-scan-history-list/

GET /easm/assets/{asset_id}/port-scan-history: Lists the port scan snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/port-scan-history`

Lists the port scan snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-port-scan-history-list.md


---

# Asset SSL History List

URL: https://docs.deepinfo.com/reference/easm/asset-ssl-history-list/

GET /easm/assets/{asset_id}/ssl-history: Lists the SSL certificate snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/ssl-history`

Lists the SSL certificate snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-ssl-history-list.md


---

# Asset Webdata History List

URL: https://docs.deepinfo.com/reference/easm/asset-webdata-history-list/

Lists the web data (page content, technologies, headers) snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/webdata-history`

Lists the web data (page content, technologies, headers) snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-webdata-history-list.md


---

# Asset Whois History List

URL: https://docs.deepinfo.com/reference/easm/asset-whois-history-list/

GET /easm/assets/{asset_id}/whois-history: Lists the WHOIS snapshots recorded for an asset (newest first): id and check_date of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/whois-history`

Lists the WHOIS snapshots recorded for an asset (newest first): `id` and `check_date` of each.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-whois-history-list.md


---

# Asset DNS History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-dns-history-detail/

GET /easm/assets/{asset_id}/dns-history/{history_id}: Returns one DNS snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/dns-history/{history_id}`

Returns one DNS snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `history_id` | Required |  | `00000000000000000000000ebd470001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `result` | object |
| `result.fqdn` | string |
| `result.requested_types` | array<string> |
| `result.responses` | array<object> |
| `result.responses[].type` | string |
| `result.responses[].conn_status` | string |
| `result.responses[].rcode` | string |
| `result.responses[].raw` | string |
| `result.responses[].values` | array<string> |
| `result.responses[].server` | string |
| `result.servers` | array<string> |
| `result.check_date` | string |
| `status` | boolean |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-dns-history-detail.md


---

# Asset HTTP History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-http-history-detail/

GET /easm/assets/{asset_id}/http-history/{history_id}: Returns one HTTP snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/http-history/{history_id}`

Returns one HTTP snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `history_id` | Required |  | `00000000000000000000000ebd470001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `result` | object |
| `result.requested_url` | string |
| `result.version` | number |
| `result.check_date` | string |
| `result.connection_status` | string |
| `result.requested_domain` | string |
| `result.final_url` | string |
| `result.final_domain` | string |
| `result.http` | object |
| `result.http.redirection_history` | array<object> |
| `result.http.redirection_history[].url` | string |
| `result.http.redirection_history[].status_code` | number |
| `result.http.headers` | array<object> |
| `result.http.headers[].name` | string |
| `result.http.headers[].value` | string |
| `result.http.cookies` | array |
| `result.html` | object |
| `result.html.source_hash_code` | string |
| `result.final_status_code` | number |
| `status` | boolean |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-http-history-detail.md


---

# Asset IP DNS PTR History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-ip-dns-ptr-history-detail/

GET /easm/assets/{asset_id}/ipdns-history/{history_id}: Returns one IP DNS (PTR) snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/ipdns-history/{history_id}`

Returns one IP DNS (PTR) snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `<asset_id>` |
| `history_id` | Required |  | `<history_id>` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-ip-dns-ptr-history-detail.md


---

# Asset IP Whois History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-ip-whois-history-detail/

GET /easm/assets/{asset_id}/ipwhois-history/{history_id}: Returns one IP WHOIS snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/ipwhois-history/{history_id}`

Returns one IP WHOIS snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `<asset_id>` |
| `history_id` | Required |  | `<history_id>` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-ip-whois-history-detail.md


---

# Asset Port Scan History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-port-scan-history-detail/

GET /easm/assets/{asset_id}/port-scan-history/{history_id}: Returns one port scan snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/port-scan-history/{history_id}`

Returns one port scan snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `history_id` | Required |  | `00000000000000000000000ebd470001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `result` | object |
| `result.status` | string |
| `result.target` | string |
| `result.target_ip` | string |
| `result.check_date` | string |
| `result.port_data` | object |
| `result.port_data.tcp` | array<object> |
| `result.port_data.tcp[].port_number` | number |
| `result.port_data.tcp[].service_name` | string |
| `result.port_data.tcp[].service_product` | null |
| `result.port_data.tcp[].service_version` | null |
| `result.port_data.tcp[].state` | string |
| `result.port_data.tcp[].extra_data` | object |
| `result.port_data.udp` | array |
| `result.os` | array |
| `status` | boolean |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-port-scan-history-detail.md


---

# Asset SSL History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-ssl-history-detail/

GET /easm/assets/{asset_id}/ssl-history/{history_id}: Returns one SSL certificate snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/ssl-history/{history_id}`

Returns one SSL certificate snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `history_id` | Required |  | `00000000000000000000000ebd470001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `result` | object |
| `result.target` | string |
| `result.port` | number |
| `result.check_date` | string |
| `result.connection_status` | string |
| `result.parsed` | object |
| `result.parsed.version` | object |
| `result.parsed.version.name` | string |
| `result.parsed.version.value` | string |
| `result.parsed.fingerprint_sha1` | string |
| `result.parsed.fingerprint_sha256` | string |
| `result.parsed.fingerprint_md5` | string |
| `result.parsed.subject` | object |
| `result.parsed.subject.dn` | string |
| `result.parsed.subject.common_name` | string |
| `result.parsed.subject.country_name` | null |
| `result.parsed.subject.locality` | null |
| `result.parsed.subject.organization` | null |
| `result.parsed.subject.organizational_unit` | null |
| `result.parsed.subject.state` | null |
| `result.parsed.signature` | object |
| `result.parsed.signature.value` | string |
| `result.parsed.signature.self_signed` | boolean |
| `result.parsed.signature.valid` | boolean |
| `result.parsed.signature.valid_chain` | boolean |
| `result.parsed.signature.invalid_reason` | null |
| `result.parsed.signature.signature_algorithm` | object |
| `result.parsed.signature.signature_algorithm.oid` | string |
| `result.parsed.signature.signature_algorithm.name` | string |
| `result.parsed.validity` | object |
| `result.parsed.validity.start` | string |
| `result.parsed.validity.length` | number |
| `result.parsed.validity.end` | string |
| `result.parsed.issuer` | object |
| `result.parsed.issuer.dn` | string |
| `result.parsed.issuer.common_name` | string |
| `result.parsed.issuer.country_name` | string |
| `result.parsed.issuer.locality` | null |
| `result.parsed.issuer.organization` | string |
| `result.parsed.issuer.organizational_unit` | null |
| `result.parsed.issuer.state` | null |
| `result.parsed.extensions` | object |
| `result.parsed.extensions.key_usage` | object |
| `result.parsed.extensions.key_usage.digital_signature` | boolean |
| `result.parsed.extensions.key_usage.content_commitment` | boolean |
| `result.parsed.extensions.key_usage.key_agreement` | boolean |
| `result.parsed.extensions.key_usage.data_encipherment` | boolean |
| `result.parsed.extensions.key_usage.key_encipherment` | boolean |
| `result.parsed.extensions.key_usage.key_cert_sign` | boolean |
| `result.parsed.extensions.key_usage.crl_sign` | boolean |
| `result.parsed.extensions.extended_key_usage` | object |
| `result.parsed.extensions.extended_key_usage.server_auth` | boolean |
| `result.parsed.extensions.basic_constraints` | object |
| `result.parsed.extensions.basic_constraints.is_ca` | boolean |
| `result.parsed.extensions.subject_key_identifier` | object |
| `result.parsed.extensions.subject_key_identifier.digest` | string |
| `result.parsed.extensions.authority_key_identifier` | object |
| `result.parsed.extensions.authority_key_identifier.key_identifier` | string |
| `result.parsed.extensions.authority_info_access` | object |
| `result.parsed.extensions.authority_info_access.caissuers_urls` | string |
| `result.parsed.extensions.subject_alt_name` | object |
| `result.parsed.extensions.subject_alt_name.dns_names` | array<string> |
| `result.parsed.extensions.certificate_policies` | array<string> |
| `result.parsed.extensions.crl_distribution_points` | array<string> |
| `result.parsed.extensions.signed_certificate_timestamp` | array<object> |
| `result.parsed.extensions.signed_certificate_timestamp[].log_id` | string |
| `result.parsed.extensions.signed_certificate_timestamp[].timestamp` | number |
| `result.parsed.extensions.signed_certificate_timestamp[].version` | number |
| `result.parsed.extensions.signed_certificate_timestamp[].signature` | string |
| `result.parsed.extensions.other_extensions` | array |
| `result.parsed.serial_number` | string |
| `result.parsed.tbs_fingerprint` | string |
| `result.parsed.subject_key_info` | object |
| `result.parsed.subject_key_info.fingerprint` | object |
| `result.parsed.subject_key_info.fingerprint.hash_algorithm_name` | string |
| `result.parsed.subject_key_info.fingerprint.value` | string |
| `result.parsed.subject_key_info.key_algorithm` | object |
| `result.parsed.subject_key_info.key_algorithm.name` | string |
| `result.parsed.subject_key_info.ecdsa_public_key` | object |
| `result.parsed.subject_key_info.ecdsa_public_key.length` | string |
| `result.parsed.subject_key_info.ecdsa_public_key.x` | string |
| `result.parsed.subject_key_info.ecdsa_public_key.y` | string |
| `result.parsed.has_expired` | boolean |
| `result.parsed.fqdn_list` | array<string> |
| `result.certificate` | string |
| `result.parse_errors` | array |
| `status` | boolean |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-ssl-history-detail.md


---

# Asset Webdata History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-webdata-history-detail/

Returns one web data (page content, technologies, headers) snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/webdata-history/{history_id}`

Returns one web data (page content, technologies, headers) snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `history_id` | Required |  | `00000000000000000000000ebd470001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `result` | object |
| `result.html` | object |
| `result.html.meta` | object |
| `result.html.meta.name` | null |
| `result.html.meta.language` | null |
| `result.html.meta.language_alternatives` | array |
| `result.html.meta.keywords` | array |
| `result.html.meta.noindex_status` | boolean |
| `result.html.meta.encoding` | null |
| `result.html.meta.canonical_url` | null |
| `result.html.meta.title` | string |
| `result.html.meta.json_ld` | array |
| `result.html.meta.og` | array |
| `result.html.internal_links_fqdns` | array |
| `result.html.external_links_fqdns` | array |
| `result.html.external_links_domains` | array |
| `result.html.external_links` | array |
| `result.html.script_links` | array |
| `result.html.iframe_links` | array |
| `result.html.trackers` | array |
| `result.html.emails` | array |
| `result.html.emails_internal` | array |
| `result.html.favicon_links` | array |
| `result.html.inspect_disabled` | boolean |
| `result.html.source_code` | string |
| `result.html.source_code_hash` | string |
| `result.html.content` | string |
| `result.html.content_keywords` | array<string> |
| `result.html.content_hash` | string |
| `result.http` | object |
| `result.http.redirection_history` | array<object> |
| `result.http.redirection_history[].url` | string |
| `result.http.redirection_history[].status_code` | number |
| `result.http.cookies` | array |
| `result.http.headers` | array<object> |
| `result.http.headers[].name` | string |
| `result.http.headers[].value` | string |
| `result.url` | string |
| `result.favicon` | array |
| `result.robots_txt` | null |
| `result.version` | number |
| `result.check_date` | string |
| `result.connection_status` | string |
| `result.technology` | object |
| `result.technology.stacks` | array<object> |
| `result.technology.stacks[].slug` | string |
| `result.technology.stacks[].name` | string |
| `result.technology.stacks[].confidence` | number |
| `result.technology.stacks[].icon` | string |
| `result.technology.stacks[].website` | string |
| `result.technology.stacks[].cpe` | string |
| `result.technology.stacks[].version` | string |
| `result.technology.stacks[].categories` | array<string> |
| `result.technology.stacks[].description` | string |
| `result.technology.stacks[].alternative_cpe_names` | array |
| `result.technology.stacks[].clean_version` | null |
| `result.screenshot` | string |
| `status` | boolean |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-webdata-history-detail.md


---

# Asset Whois History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-whois-history-detail/

GET /easm/assets/{asset_id}/whois-history/{history_id}: Returns one WHOIS snapshot of an asset, by the history_id returned by the list endpoint.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/whois-history/{history_id}`

Returns one WHOIS snapshot of an asset, by the `history_id` returned by the list endpoint.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `history_id` | Required |  | `00000000000000000000000ebd470001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `result` | object |  |
| `status` | boolean |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `result` | object |
| `result.domain_name` | string |
| `result.raw` | string |
| `result.parsed` | object |
| `result.parsed.uid` | string |
| `result.parsed.create_date` | string |
| `result.parsed.update_date` | string |
| `result.parsed.expiry_date` | string |
| `result.parsed.registrar` | string |
| `result.parsed.registrant` | object |
| `result.parsed.registrant.name` | string |
| `result.parsed.registrant.organization` | string |
| `result.parsed.registrant.street` | string |
| `result.parsed.registrant.city` | string |
| `result.parsed.registrant.state` | string |
| `result.parsed.registrant.postal_code` | string |
| `result.parsed.registrant.country` | string |
| `result.parsed.registrant.phone` | string |
| `result.parsed.registrant.email` | string |
| `result.parsed.name_servers` | array<string> |
| `result.parsed.domain_status` | array<string> |
| `result.parsed.whois_server` | string |
| `result.check_date` | string |
| `result.parse_code` | null |
| `status` | boolean |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-whois-history-detail.md


---

# Asset Open Port History List

URL: https://docs.deepinfo.com/reference/easm/asset-open-port-history-list/

GET /easm/assets/{asset_id}/open-ports/history: Lists the port scan snapshots of an asset: id and check_date.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/open-ports/history`

Lists the port scan snapshots of an asset: `id` and `check_date`.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-open-port-history-list.md


---

# Asset Open Port List

URL: https://docs.deepinfo.com/reference/easm/asset-open-port-list/

GET /easm/assets/{asset_id}/open-ports: Lists the ports found on an asset, with the state and protocol of each.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/open-ports`

Lists the ports found on an asset, with the `state` and `protocol` of each. Filter and sort with the optional query parameters.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `state__in` | Optional |  | `open` |
| `protocol__in` | Optional |  | `tcp` |
| `ordering` | Optional |  | `port` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `port__in` | Optional |  |  |
| `port__nin` | Optional |  |  |
| `state__nin` | Optional |  |  |
| `protocol__nin` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].port` | integer |  |
| `results[].state` | string | One of `open`, `closed`, `filtered`, `unfiltered`, `open\|filtered`, `closed\|filtered` |
| `results[].protocol` | string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].port` | number |
| `results[].state` | string |
| `results[].protocol` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-open-port-list.md


---

# Asset Open Port History Detail

URL: https://docs.deepinfo.com/reference/easm/asset-open-port-history-detail/

GET /easm/assets/{asset_id}/open-ports/history/{history_id}: Returns the ports of one historical port scan. Same filters as Asset Open Port List.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/open-ports/history/{history_id}`

Returns the ports of one historical port scan. Same filters as [Asset Open Port List](/reference/easm/asset-open-port-list/).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |
| `history_id` | Required |  | `00000000000000000000000ebd470001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `port__in` | Optional |  |  |
| `port__nin` | Optional |  |  |
| `state__in` | Optional |  |  |
| `state__nin` | Optional |  |  |
| `protocol__in` | Optional |  |  |
| `protocol__nin` | Optional |  |  |
| `ordering` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].port` | integer |  |
| `results[].state` | string | One of `open`, `closed`, `filtered`, `unfiltered`, `open\|filtered`, `closed\|filtered` |
| `results[].protocol` | string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].port` | number |
| `results[].state` | string |
| `results[].protocol` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-open-port-history-detail.md


---

# Asset Instant Open Port Scan

URL: https://docs.deepinfo.com/reference/easm/asset-instant-open-port-scan/

Runs a port scan of the asset right away and returns the result in the response (status is host_down if the host did not respond).

`POST https://api.deepinfo.com/v1/easm/assets/{asset_id}/open-ports/instant-scan`

Runs a port scan of the asset right away and returns the result in the response (`status` is `host_down` if the host did not respond).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `target` | string |  |
| `check_date` | string | date-time |
| `status` | string |  |
| `target_ip` | string |  |
| `port_data` | object |  |
| `os` | array of string |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `target` | string |
| `check_date` | string |
| `status` | string |
| `target_ip` | null |
| `port_data` | null |
| `os` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-instant-open-port-scan.md


---

# Asset Open Port Count Timeline

URL: https://docs.deepinfo.com/reference/easm/asset-open-port-count-timeline/

GET /easm/assets/{asset_id}/open-ports/count-timeline: Time series of the number of open ports on an asset.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/open-ports/count-timeline`

Time series of the number of open ports on an asset.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-open-port-count-timeline.md


---

# Asset Open Port State Stats

URL: https://docs.deepinfo.com/reference/easm/asset-open-port-state-stats/

GET /easm/assets/{asset_id}/stats/open-port-state: Counts the asset's ports per state (open, closed, filtered, unfiltered, open_filtered, closed_filtered).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/open-port-state`

Counts the asset's ports per state (`open`, `closed`, `filtered`, `unfiltered`, `open_filtered`, `closed_filtered`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

| Field | Type |
|---|---|
| `open` | integer |
| `closed` | integer |
| `filtered` | integer |
| `unfiltered` | integer |
| `open_filtered` | integer |
| `closed_filtered` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `open` | number |
| `closed` | number |
| `filtered` | number |
| `unfiltered` | number |
| `open_filtered` | number |
| `closed_filtered` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-open-port-state-stats.md


---

# Asset Issue Severity Stats Timeline

URL: https://docs.deepinfo.com/reference/easm/asset-issue-severity-stats-timeline/

GET /easm/assets/{asset_id}/stats/issue-severity-timeline: Time series of issue severity for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/issue-severity-timeline`

Time series of issue severity for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `severities` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].severities` | array<object> |
| `[].severities[].name` | string |
| `[].severities[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-issue-severity-stats-timeline.md


---

# Asset Security Score Timeline

URL: https://docs.deepinfo.com/reference/easm/asset-security-score-timeline/

GET /easm/assets/{asset_id}/stats/security-score-timeline: Time series of security score for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/security-score-timeline`

Time series of security score for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `score` | number |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].score` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-security-score-timeline.md


---

# Asset Technology Count Timeline

URL: https://docs.deepinfo.com/reference/easm/asset-technology-count-timeline/

GET /easm/assets/{asset_id}/stats/technology-count-timeline: Time series of technology count for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/technology-count-timeline`

Time series of technology count for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-technology-count-timeline.md


---

# Asset Vulnerability Severity Stats Timeline

URL: https://docs.deepinfo.com/reference/easm/asset-vulnerability-severity-stats-timeline/

GET /easm/assets/{asset_id}/stats/vulnerability-severity-timeline: Time series of vulnerability severity for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/vulnerability-severity-timeline`

Time series of vulnerability severity for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `severities` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].severities` | array<object> |
| `[].severities[].name` | string |
| `[].severities[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-vulnerability-severity-stats-timeline.md


---

# Asset Website Count Timeline

URL: https://docs.deepinfo.com/reference/easm/asset-website-count-timeline/

GET /easm/assets/{asset_id}/stats/website-count-timeline: Time series of website count for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/website-count-timeline`

Time series of website count for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-website-count-timeline.md


---

# Domain Security Score Timeline

URL: https://docs.deepinfo.com/reference/easm/domain-security-score-timeline/

GET /easm/assets/{asset_id}/stats/domain-security-score-timeline: Time series of domain security score for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/domain-security-score-timeline`

Time series of domain security score for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `score` | number |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].score` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/domain-security-score-timeline.md


---

# Domain Subdomain Count Timeline

URL: https://docs.deepinfo.com/reference/easm/domain-subdomain-count-timeline/

GET /easm/assets/{asset_id}/stats/subdomain-count-timeline: Time series of subdomain count for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/stats/subdomain-count-timeline`

Time series of subdomain count for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/domain-subdomain-count-timeline.md


---

# Asset Instant Snapshot

URL: https://docs.deepinfo.com/reference/easm/asset-instant-snapshot/

POST /easm/assets/{asset_id}/instant-snapshot: Recalculates the asset snapshot now.

`POST https://api.deepinfo.com/v1/easm/assets/{asset_id}/instant-snapshot`

Recalculates the asset snapshot now.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-instant-snapshot.md


---

# Asset Latest Snapshot

URL: https://docs.deepinfo.com/reference/easm/asset-latest-snapshot/

GET /easm/assets/{asset_id}/latest-snapshot: Returns the latest pre-computed summary of an asset (security score and statistics) in snapshot.

`GET https://api.deepinfo.com/v1/easm/assets/{asset_id}/latest-snapshot`

Returns the latest pre-computed summary of an asset (security score and statistics) in `snapshot`.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `000000000000000ea4f90001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `stats` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `snapshot` | object |  |
| `date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `snapshot` | object |
| `snapshot.subdomain_count` | number |
| `snapshot.pointed_fqdn_count` | null |
| `snapshot.redirected_domain_count` | number |
| `snapshot.redirected_asset_count` | number |
| `snapshot.website_count` | number |
| `snapshot.total_issue_count` | number |
| `snapshot.active_issue_count` | number |
| `snapshot.issue_severity_stats` | array<object> |
| `snapshot.issue_severity_stats[].name` | string |
| `snapshot.issue_severity_stats[].count` | number |
| `snapshot.issue_category_stats` | array<object> |
| `snapshot.issue_category_stats[].name` | string |
| `snapshot.issue_category_stats[].count` | number |
| `snapshot.issue_category_stats[].severity_stats` | array<object> |
| `snapshot.issue_category_stats[].severity_stats[].name` | string |
| `snapshot.issue_category_stats[].severity_stats[].count` | number |
| `snapshot.issue_state_stats` | array<object> |
| `snapshot.issue_state_stats[].name` | string |
| `snapshot.issue_state_stats[].count` | number |
| `snapshot.average_issue_duration` | number |
| `snapshot.average_fix_duration` | number |
| `snapshot.technology_count` | number |
| `snapshot.technology_category_stats` | null |
| `snapshot.open_port_count` | number |
| `snapshot.vulnerability_count` | number |
| `snapshot.vulnerability_severity_stats` | array<object> |
| `snapshot.vulnerability_severity_stats[].name` | string |
| `snapshot.vulnerability_severity_stats[].count` | number |
| `snapshot.security_score` | number |
| `date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-latest-snapshot.md


---

# Domain Instant Snapshot

URL: https://docs.deepinfo.com/reference/easm/domain-instant-snapshot/

POST /easm/assets/{domain_id}/domain-instant-snapshot: Recalculates the domain snapshot now.

`POST https://api.deepinfo.com/v1/easm/assets/{domain_id}/domain-instant-snapshot`

Recalculates the domain snapshot now.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain_id` | Required |  | `000000000000000e79cf0001` |

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/domain-instant-snapshot.md


---

# Domain Latest Snapshot

URL: https://docs.deepinfo.com/reference/easm/domain-latest-snapshot/

GET /easm/assets/{domain_id}/domain-latest-snapshot: Returns the latest summary of a domain including all its subdomains and websites.

`GET https://api.deepinfo.com/v1/easm/assets/{domain_id}/domain-latest-snapshot`

Returns the latest summary of a **domain** including all its subdomains and websites. `domain_id` is the asset id of a domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `domain_id` | Required |  | `000000000000000e79cf0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `stats` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `snapshot` | object |  |
| `date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `snapshot` | object |
| `snapshot.total_issue_count` | number |
| `snapshot.active_issue_count` | number |
| `snapshot.issue_severity_stats` | array<object> |
| `snapshot.issue_severity_stats[].name` | string |
| `snapshot.issue_severity_stats[].count` | number |
| `snapshot.issue_category_stats` | array<object> |
| `snapshot.issue_category_stats[].name` | string |
| `snapshot.issue_category_stats[].count` | number |
| `snapshot.issue_category_stats[].severity_stats` | array<object> |
| `snapshot.issue_category_stats[].severity_stats[].name` | string |
| `snapshot.issue_category_stats[].severity_stats[].count` | number |
| `snapshot.issue_state_stats` | array<object> |
| `snapshot.issue_state_stats[].name` | string |
| `snapshot.issue_state_stats[].count` | number |
| `snapshot.average_issue_duration` | number |
| `snapshot.average_fix_duration` | number |
| `snapshot.technology_count` | number |
| `snapshot.technology_category_stats` | array<object> |
| `snapshot.technology_category_stats[].name` | string |
| `snapshot.technology_category_stats[].count` | number |
| `snapshot.open_port_count` | number |
| `snapshot.vulnerability_count` | number |
| `snapshot.vulnerability_severity_stats` | array<object> |
| `snapshot.vulnerability_severity_stats[].name` | string |
| `snapshot.vulnerability_severity_stats[].count` | number |
| `snapshot.security_score` | number |
| `date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/domain-latest-snapshot.md


---

# Instant Snapshot

URL: https://docs.deepinfo.com/reference/easm/instant-snapshot/

POST /easm/instant-snapshot: Recalculates the attack-surface snapshot now.

`POST https://api.deepinfo.com/v1/easm/instant-snapshot`

Recalculates the attack-surface snapshot now.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/instant-snapshot.md


---

# Latest Snapshot

URL: https://docs.deepinfo.com/reference/easm/latest-snapshot/

GET /easm/latest-snapshot: Returns the latest summary of your whole attack surface.

`GET https://api.deepinfo.com/v1/easm/latest-snapshot`

Returns the latest summary of your whole attack surface.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `stats` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `snapshot` | object |  |
| `date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `snapshot` | object |
| `snapshot.asset_type_stats` | array<object> |
| `snapshot.asset_type_stats[].name` | string |
| `snapshot.asset_type_stats[].count` | number |
| `snapshot.total_issue_count` | number |
| `snapshot.active_issue_count` | number |
| `snapshot.issue_severity_stats` | array<object> |
| `snapshot.issue_severity_stats[].name` | string |
| `snapshot.issue_severity_stats[].count` | number |
| `snapshot.technology_count` | number |
| `snapshot.technology_category_stats` | array<object> |
| `snapshot.technology_category_stats[].name` | string |
| `snapshot.technology_category_stats[].count` | number |
| `snapshot.open_port_count` | number |
| `snapshot.vulnerability_count` | number |
| `snapshot.vulnerability_severity_stats` | array<object> |
| `snapshot.vulnerability_severity_stats[].name` | string |
| `snapshot.vulnerability_severity_stats[].count` | number |
| `snapshot.security_score` | number |
| `date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/latest-snapshot.md


---

# Assets With Most Issues

URL: https://docs.deepinfo.com/reference/easm/assets-with-most-issues/

GET /easm/assets/stats/most-issues: Lists your assets with the most active issues.

`GET https://api.deepinfo.com/v1/easm/assets/stats/most-issues`

Lists your assets with the most active issues.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `asset` | string |  |
| `asset_unicode` | string |  |
| `asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `favicon` | string |  |
| `added_date` | string | date-time |
| `issue_count` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].asset` | string |
| `[].asset_unicode` | string |
| `[].asset_type` | string |
| `[].favicon` | null |
| `[].added_date` | string |
| `[].issue_count` | object |
| `[].issue_count.total` | number |
| `[].issue_count.active` | number |
| `[].issue_count.active_by_severity` | object |
| `[].issue_count.active_by_severity.critical` | number |
| `[].issue_count.active_by_severity.high` | number |
| `[].issue_count.active_by_severity.medium` | number |
| `[].issue_count.active_by_severity.low` | number |
| `[].issue_count.active_by_severity.information` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/assets-with-most-issues.md


---

# Assets With Most Websites

URL: https://docs.deepinfo.com/reference/easm/assets-with-most-websites/

GET /easm/assets/stats/most-websites: Lists your assets with the most websites.

`GET https://api.deepinfo.com/v1/easm/assets/stats/most-websites`

Lists your assets with the most websites.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `id` | string |
| `asset` | string |
| `asset_unicode` | string |
| `website_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].asset` | string |
| `[].asset_unicode` | string |
| `[].website_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/assets-with-most-websites.md


---

# Domains With Most Subdomains

URL: https://docs.deepinfo.com/reference/easm/domains-with-most-subdomains/

GET /easm/assets/stats/most-subdomains: Lists your domains with the most subdomains.

`GET https://api.deepinfo.com/v1/easm/assets/stats/most-subdomains`

Lists your domains with the most subdomains.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `id` | string |
| `domain` | string |
| `domain_unicode` | string |
| `subdomain_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].domain` | string |
| `[].domain_unicode` | string |
| `[].subdomain_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/domains-with-most-subdomains.md


---

# Latest Added Assets

URL: https://docs.deepinfo.com/reference/easm/latest-added-assets/

GET /easm/assets/stats/latest: Lists the most recently added assets.

`GET https://api.deepinfo.com/v1/easm/assets/stats/latest`

Lists the most recently added assets.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `asset` | string |  |
| `asset_unicode` | string |  |
| `asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `favicon` | string |  |
| `added_date` | string | date-time |
| `issue_count` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].asset` | string |
| `[].asset_unicode` | string |
| `[].asset_type` | string |
| `[].favicon` | string |
| `[].added_date` | string |
| `[].issue_count` | object |
| `[].issue_count.total` | number |
| `[].issue_count.active` | number |
| `[].issue_count.active_by_severity` | object |
| `[].issue_count.active_by_severity.critical` | number |
| `[].issue_count.active_by_severity.high` | number |
| `[].issue_count.active_by_severity.medium` | number |
| `[].issue_count.active_by_severity.low` | number |
| `[].issue_count.active_by_severity.information` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/latest-added-assets.md


---

# Asset Type Stats

URL: https://docs.deepinfo.com/reference/easm/asset-type-stats/

GET /easm/assets/stats/type: Counts your assets per type (domain, subdomain, ip, website).

`GET https://api.deepinfo.com/v1/easm/assets/stats/type`

Counts your assets per type (`domain`, `subdomain`, `ip`, `website`).

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `domain` | integer |
| `subdomain` | integer |
| `ip` | integer |
| `website` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `domain` | number |
| `subdomain` | number |
| `ip` | number |
| `website` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-type-stats.md


---

# Asset Type Stats Timeline

URL: https://docs.deepinfo.com/reference/easm/asset-type-stats-timeline/

GET /easm/assets/stats/type-timeline: Time series of your asset counts per type.

`GET https://api.deepinfo.com/v1/easm/assets/stats/type-timeline`

Time series of your asset counts per type.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `types` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].types` | array<object> |
| `[].types[].name` | string |
| `[].types[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-type-stats-timeline.md


---

# Insight Stats

URL: https://docs.deepinfo.com/reference/easm/insight-stats/

GET /easm/assets/stats/insights: Groups assets of an asset_type by an attribute (insight_by: registrar, expiry date, registrant organization, IP, name server…

`GET https://api.deepinfo.com/v1/easm/assets/stats/insights`

Groups assets of an `asset_type` by an attribute (`insight_by`: registrar, expiry date, registrant organization, IP, name server, mail server, ASN, SSL certificate, SSL issuer, SSL subject organization or HTTP status) and counts them.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_type` | Required | One of: `domain`, `subdomain`, `ip`, `website`. | `domain` |
| `insight_by` | Required | One of: `whois_registrar`, `whois_expiry_date`, `whois_registrant_organization`, `dns_ip_address`, `dns_name_server`, `dns_mail_server`, `asn`, `ssl_certificate`, `ssl_issuer`, `ssl_subject_organization`, `http_status`. | `whois_registrar` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `name` | string |
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].name` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/insight-stats.md


---

# Open Port Count Timeline

URL: https://docs.deepinfo.com/reference/easm/open-port-count-timeline/

GET /easm/stats/open-port-count-timeline: Time series of open ports across all your assets.

`GET https://api.deepinfo.com/v1/easm/stats/open-port-count-timeline`

Time series of open ports across all your assets.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/open-port-count-timeline.md


---

# Security Score Timeline

URL: https://docs.deepinfo.com/reference/easm/security-score-timeline/

GET /easm/stats/security-score-timeline: Time series of your overall security score.

`GET https://api.deepinfo.com/v1/easm/stats/security-score-timeline`

Time series of your overall security score.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `score` | number |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].score` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/security-score-timeline.md


---

# Discovered Asset Search

URL: https://docs.deepinfo.com/reference/easm/discovered-asset-search/

POST /easm/discovery/assets/search: Searches discovered assets (candidates found by discovery rules) and their state.

`POST https://api.deepinfo.com/v1/easm/discovery/assets/search`

Searches discovered assets (candidates found by discovery rules) and their state.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history.id` | The ID of a discovery rule that found the asset, a 32-character hex string; the Discovery page's rule name filter sends this ID. |
| `discovery_history.seed_value` | The seed value a rule started from when it found the asset, such as an IP address, a certificate fingerprint, a phone number or an organization name. |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The discovered asset's type: `domain`, `subdomain`, `ip` or `website`. |
| `state` | The review state: `in_review` (found by a rule, waiting for a decision), `approved` (added to your inventory) or `ignored` (dismissed; it stays out of your inventory). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `state` | The review state: `in_review` (found by a rule, waiting for a decision), `approved` (added to your inventory) or `ignored` (dismissed; it stays out of your inventory). |
| `discovery_history` | The rule matches that found the asset, each with the rule ID, rule name, rule type (`smart_discovery`, `smart_monitoring` or `custom`), seed value and discovery date. |
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].asset` | string |  |
| `results[].asset_unicode` | string |  |
| `results[].state` | string | One of `in_review`, `approved`, `ignored` |
| `results[].asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `results[].discovery_history` | array of object |  |
| `results[].last_discovery_date` | string | date-time |
| `results[].organization_name` | string |  |
| `results[].ignore_date` | string | date-time |
| `results[].approve_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].asset` | string |
| `results[].asset_unicode` | string |
| `results[].state` | string |
| `results[].asset_type` | string |
| `results[].discovery_history` | array<object> |
| `results[].discovery_history[].id` | string |
| `results[].discovery_history[].rule` | string |
| `results[].discovery_history[].rule_type` | string |
| `results[].discovery_history[].enabled` | boolean |
| `results[].discovery_history[].deleted` | boolean |
| `results[].discovery_history[].seed_value` | string |
| `results[].discovery_history[].description` | null |
| `results[].discovery_history[].discovery_date` | string |
| `results[].last_discovery_date` | string |
| `results[].organization_name` | null |
| `results[].ignore_date` | null |
| `results[].approve_date` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/discovered-asset-search.md


---

# Discovered Asset Export

URL: https://docs.deepinfo.com/reference/easm/discovered-asset-export/

POST /easm/discovery/assets/search:export: Exports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array.

`POST https://api.deepinfo.com/v1/easm/discovery/assets/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "approved"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history.id` | The ID of a discovery rule that found the asset, a 32-character hex string; the Discovery page's rule name filter sends this ID. |
| `discovery_history.seed_value` | The seed value a rule started from when it found the asset, such as an IP address, a certificate fingerprint, a phone number or an organization name. |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The discovered asset's type: `domain`, `subdomain`, `ip` or `website`. |
| `state` | The review state: `in_review` (found by a rule, waiting for a decision), `approved` (added to your inventory) or `ignored` (dismissed; it stays out of your inventory). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `state` | The review state: `in_review` (found by a rule, waiting for a decision), `approved` (added to your inventory) or `ignored` (dismissed; it stays out of your inventory). |
| `discovery_history` | The rule matches that found the asset, each with the rule ID, rule name, rule type (`smart_discovery`, `smart_monitoring` or `custom`), seed value and discovery date. |
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/discovered-asset-export.md


---

# Discovered Asset Detail

URL: https://docs.deepinfo.com/reference/easm/discovered-asset-detail/

GET /easm/discovery/assets/{asset_id}: Returns one discovered asset with the rules and seeds that discovered it.

`GET https://api.deepinfo.com/v1/easm/discovery/assets/{asset_id}`

Returns one discovered asset with the rules and seeds that discovered it.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset_id` | Required |  | `00000000000000000000000ea4f90001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `asset` | string |  |
| `asset_unicode` | string |  |
| `asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `state` | string | One of `in_review`, `approved`, `ignored` |
| `discovery_history` | array of object |  |
| `last_discovery_date` | string | date-time |
| `monitoring` | object |  |
| `approve_date` | string | date-time |
| `ignore_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `asset` | string |
| `asset_unicode` | string |
| `asset_type` | string |
| `state` | string |
| `discovery_history` | array<object> |
| `discovery_history[].id` | string |
| `discovery_history[].rule` | string |
| `discovery_history[].rule_type` | string |
| `discovery_history[].enabled` | boolean |
| `discovery_history[].deleted` | boolean |
| `discovery_history[].seed_value` | string |
| `discovery_history[].description` | null |
| `discovery_history[].discovery_date` | string |
| `last_discovery_date` | string |
| `monitoring` | object |
| `monitoring.whois` | null |
| `monitoring.dns` | object |
| `monitoring.dns.fqdn` | string |
| `monitoring.dns.requested_types` | array<string> |
| `monitoring.dns.responses` | array<object> |
| `monitoring.dns.responses[].type` | string |
| `monitoring.dns.responses[].conn_status` | string |
| `monitoring.dns.responses[].rcode` | string |
| `monitoring.dns.responses[].raw` | string \| null |
| `monitoring.dns.responses[].values` | array<string> \| null |
| `monitoring.dns.responses[].server` | string |
| `monitoring.dns.servers` | array<string> |
| `monitoring.dns.check_date` | string |
| `monitoring.ssl` | object |
| `monitoring.ssl.target` | string |
| `monitoring.ssl.port` | number |
| `monitoring.ssl.check_date` | string |
| `monitoring.ssl.connection_status` | string |
| `monitoring.ssl.parsed` | object |
| `monitoring.ssl.parsed.version` | object |
| `monitoring.ssl.parsed.version.name` | string |
| `monitoring.ssl.parsed.version.value` | string |
| `monitoring.ssl.parsed.fingerprint_sha1` | string |
| `monitoring.ssl.parsed.fingerprint_sha256` | string |
| `monitoring.ssl.parsed.fingerprint_md5` | string |
| `monitoring.ssl.parsed.subject` | object |
| `monitoring.ssl.parsed.subject.dn` | string |
| `monitoring.ssl.parsed.subject.common_name` | string |
| `monitoring.ssl.parsed.subject.country_name` | null |
| `monitoring.ssl.parsed.subject.locality` | null |
| `monitoring.ssl.parsed.subject.organization` | null |
| `monitoring.ssl.parsed.subject.organizational_unit` | null |
| `monitoring.ssl.parsed.subject.state` | null |
| `monitoring.ssl.parsed.signature` | object |
| `monitoring.ssl.parsed.signature.value` | string |
| `monitoring.ssl.parsed.signature.self_signed` | boolean |
| `monitoring.ssl.parsed.signature.valid` | boolean |
| `monitoring.ssl.parsed.signature.valid_chain` | boolean |
| `monitoring.ssl.parsed.signature.invalid_reason` | null |
| `monitoring.ssl.parsed.signature.signature_algorithm` | object |
| `monitoring.ssl.parsed.signature.signature_algorithm.oid` | string |
| `monitoring.ssl.parsed.signature.signature_algorithm.name` | string |
| `monitoring.ssl.parsed.validity` | object |
| `monitoring.ssl.parsed.validity.start` | string |
| `monitoring.ssl.parsed.validity.length` | number |
| `monitoring.ssl.parsed.validity.end` | string |
| `monitoring.ssl.parsed.issuer` | object |
| `monitoring.ssl.parsed.issuer.dn` | string |
| `monitoring.ssl.parsed.issuer.common_name` | string |
| `monitoring.ssl.parsed.issuer.country_name` | string |
| `monitoring.ssl.parsed.issuer.locality` | null |
| `monitoring.ssl.parsed.issuer.organization` | string |
| `monitoring.ssl.parsed.issuer.organizational_unit` | null |
| `monitoring.ssl.parsed.issuer.state` | null |
| `monitoring.ssl.parsed.extensions` | object |
| `monitoring.ssl.parsed.extensions.key_usage` | object |
| `monitoring.ssl.parsed.extensions.key_usage.digital_signature` | boolean |
| `monitoring.ssl.parsed.extensions.key_usage.content_commitment` | boolean |
| `monitoring.ssl.parsed.extensions.key_usage.key_agreement` | boolean |
| `monitoring.ssl.parsed.extensions.key_usage.data_encipherment` | boolean |
| `monitoring.ssl.parsed.extensions.key_usage.key_encipherment` | boolean |
| `monitoring.ssl.parsed.extensions.key_usage.key_cert_sign` | boolean |
| `monitoring.ssl.parsed.extensions.key_usage.crl_sign` | boolean |
| `monitoring.ssl.parsed.extensions.extended_key_usage` | object |
| `monitoring.ssl.parsed.extensions.extended_key_usage.server_auth` | boolean |
| `monitoring.ssl.parsed.extensions.basic_constraints` | object |
| `monitoring.ssl.parsed.extensions.basic_constraints.is_ca` | boolean |
| `monitoring.ssl.parsed.extensions.subject_key_identifier` | object |
| `monitoring.ssl.parsed.extensions.subject_key_identifier.digest` | string |
| `monitoring.ssl.parsed.extensions.authority_key_identifier` | object |
| `monitoring.ssl.parsed.extensions.authority_key_identifier.key_identifier` | string |
| `monitoring.ssl.parsed.extensions.authority_info_access` | object |
| `monitoring.ssl.parsed.extensions.authority_info_access.caissuers_urls` | string |
| `monitoring.ssl.parsed.extensions.subject_alt_name` | object |
| `monitoring.ssl.parsed.extensions.subject_alt_name.dns_names` | array<string> |
| `monitoring.ssl.parsed.extensions.certificate_policies` | array<string> |
| `monitoring.ssl.parsed.extensions.crl_distribution_points` | array<string> |
| `monitoring.ssl.parsed.extensions.signed_certificate_timestamp` | array<object> |
| `monitoring.ssl.parsed.extensions.signed_certificate_timestamp[].log_id` | string |
| `monitoring.ssl.parsed.extensions.signed_certificate_timestamp[].timestamp` | number |
| `monitoring.ssl.parsed.extensions.signed_certificate_timestamp[].version` | number |
| `monitoring.ssl.parsed.extensions.signed_certificate_timestamp[].signature` | string |
| `monitoring.ssl.parsed.extensions.other_extensions` | array |
| `monitoring.ssl.parsed.serial_number` | string |
| `monitoring.ssl.parsed.tbs_fingerprint` | string |
| `monitoring.ssl.parsed.subject_key_info` | object |
| `monitoring.ssl.parsed.subject_key_info.fingerprint` | object |
| `monitoring.ssl.parsed.subject_key_info.fingerprint.hash_algorithm_name` | string |
| `monitoring.ssl.parsed.subject_key_info.fingerprint.value` | string |
| `monitoring.ssl.parsed.subject_key_info.key_algorithm` | object |
| `monitoring.ssl.parsed.subject_key_info.key_algorithm.name` | string |
| `monitoring.ssl.parsed.subject_key_info.rsa_public_key` | object |
| `monitoring.ssl.parsed.subject_key_info.rsa_public_key.length` | string |
| `monitoring.ssl.parsed.subject_key_info.rsa_public_key.modulus` | string |
| `monitoring.ssl.parsed.subject_key_info.rsa_public_key.exponent` | string |
| `monitoring.ssl.parsed.has_expired` | boolean |
| `monitoring.ssl.parsed.fqdn_list` | array<string> |
| `monitoring.ssl.certificate` | string |
| `monitoring.ssl.parse_errors` | array |
| `monitoring.http` | object |
| `monitoring.http.requested_url` | string |
| `monitoring.http.version` | number |
| `monitoring.http.check_date` | string |
| `monitoring.http.connection_status` | string |
| `monitoring.http.requested_domain` | string |
| `monitoring.http.final_url` | string |
| `monitoring.http.final_domain` | string |
| `monitoring.http.http` | object |
| `monitoring.http.http.redirection_history` | array<object> |
| `monitoring.http.http.redirection_history[].url` | string |
| `monitoring.http.http.redirection_history[].status_code` | number |
| `monitoring.http.http.headers` | array<object> |
| `monitoring.http.http.headers[].name` | string |
| `monitoring.http.http.headers[].value` | string |
| `monitoring.http.http.cookies` | array |
| `monitoring.http.html` | object |
| `monitoring.http.html.source_hash_code` | string |
| `monitoring.http.final_status_code` | number |
| `monitoring.ipwhois` | null |
| `monitoring.ipdns` | null |
| `approve_date` | null |
| `ignore_date` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/discovered-asset-detail.md


---

# Discovered Asset Approve

URL: https://docs.deepinfo.com/reference/easm/discovered-asset-approve/

POST /easm/discovery/assets/search:approve: Approves the discovered assets that match filters (approved). Approved assets are added to your monitored assets.

`POST https://api.deepinfo.com/v1/easm/discovery/assets/search:approve`

Approves the discovered assets that match `filters` (`approved`). Approved assets are **added to your monitored assets**. An approval cannot be reverted; delete the asset instead.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history.id` | The ID of a discovery rule that found the asset, a 32-character hex string; the Discovery page's rule name filter sends this ID. |
| `discovery_history.seed_value` | The seed value a rule started from when it found the asset, such as an IP address, a certificate fingerprint, a phone number or an organization name. |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The discovered asset's type: `domain`, `subdomain`, `ip` or `website`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history` | The rule matches that found the asset, each with the rule ID, rule name, rule type (`smart_discovery`, `smart_monitoring` or `custom`), seed value and discovery date. |
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

## Response Fields

| Field | Type |
|---|---|
| `discovered_asset_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `discovered_asset_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/discovered-asset-approve.md


---

# Discovered Asset Ignore

URL: https://docs.deepinfo.com/reference/easm/discovered-asset-ignore/

POST /easm/discovery/assets/search:ignore: Ignores the discovered assets that match filters (ignored).

`POST https://api.deepinfo.com/v1/easm/discovery/assets/search:ignore`

Ignores the discovered assets that match `filters` (`ignored`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history.id` | The ID of a discovery rule that found the asset, a 32-character hex string; the Discovery page's rule name filter sends this ID. |
| `discovery_history.seed_value` | The seed value a rule started from when it found the asset, such as an IP address, a certificate fingerprint, a phone number or an organization name. |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The discovered asset's type: `domain`, `subdomain`, `ip` or `website`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history` | The rule matches that found the asset, each with the rule ID, rule name, rule type (`smart_discovery`, `smart_monitoring` or `custom`), seed value and discovery date. |
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

## Response Fields

| Field | Type |
|---|---|
| `discovered_asset_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `discovered_asset_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/discovered-asset-ignore.md


---

# Discovered Asset Revert

URL: https://docs.deepinfo.com/reference/easm/discovered-asset-revert/

POST /easm/discovery/assets/search:revert: Reverts the discovered assets that match filters to their previous, active state.

`POST https://api.deepinfo.com/v1/easm/discovery/assets/search:revert`

Reverts the discovered assets that match `filters` to their previous, active state. Only states set by a user can be reverted.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history.id` | The ID of a discovery rule that found the asset, a 32-character hex string; the Discovery page's rule name filter sends this ID. |
| `discovery_history.seed_value` | The seed value a rule started from when it found the asset, such as an IP address, a certificate fingerprint, a phone number or an organization name. |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The discovered asset's type: `domain`, `subdomain`, `ip` or `website`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The discovered asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `discovery_history` | The rule matches that found the asset, each with the rule ID, rule name, rule type (`smart_discovery`, `smart_monitoring` or `custom`), seed value and discovery date. |
| `last_discovery_date` | When a rule last found the asset, shown as the discovery date in Discovery (UTC date-time). |
| `organization_name` | An organization name recorded for the discovered asset; in the samples it is set only on some domains and holds WHOIS-style values such as `redacted for privacy`. |
| `ignore_date` | When the asset was ignored in Discovery (UTC date-time); empty unless it is ignored. |
| `approve_date` | When the asset was approved into your inventory (UTC date-time); empty unless it is approved. |

## Response Fields

| Field | Type |
|---|---|
| `discovered_asset_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `discovered_asset_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/discovered-asset-revert.md


---

# Discovered Asset State Stats

URL: https://docs.deepinfo.com/reference/easm/discovered-asset-state-stats/

GET /easm/discovery/stats/asset-state: Counts discovered assets per state, overall and per rule type.

`GET https://api.deepinfo.com/v1/easm/discovery/stats/asset-state`

Counts discovered assets per state, overall and per rule type.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `in_review` | integer |
| `approved` | integer |
| `ignored` | integer |
| `by_rule_type` | object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `in_review` | number |
| `approved` | number |
| `ignored` | number |
| `by_rule_type` | object |
| `by_rule_type.custom` | object |
| `by_rule_type.custom.in_review` | number |
| `by_rule_type.custom.approved` | number |
| `by_rule_type.custom.ignored` | number |
| `by_rule_type.smart_discovery` | object |
| `by_rule_type.smart_discovery.in_review` | number |
| `by_rule_type.smart_discovery.approved` | number |
| `by_rule_type.smart_discovery.ignored` | number |
| `by_rule_type.smart_monitoring` | object |
| `by_rule_type.smart_monitoring.in_review` | number |
| `by_rule_type.smart_monitoring.approved` | number |
| `by_rule_type.smart_monitoring.ignored` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/discovered-asset-state-stats.md


---

# Asset Discovery Custom Discovery Rule Search

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-search/

POST /easm/discovery/custom-rules/search: Lists your custom discovery rules.

`POST https://api.deepinfo.com/v1/easm/discovery/custom-rules/search`

Lists your custom discovery rules.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | object | Optional | One `{field, order}` object |

```json
{}
```

## Filtering

This search takes `filters` as an object with one key per field, not as a `must` list. Each field takes the operators of its filter type as keys, and fields combine with AND. `sort` is one `{field, order}` object, not a list. Example body:

```json
{
  "filters": {
    "name": {
      "equals": [
        "<value>"
      ]
    }
  },
  "sort": {
    "field": "name",
    "order": "desc"
  }
}
```

Operators by field:

| Field | Operators |
|---|---|
| `name` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `discovered_asset_count` | `gt`, `gte`, `lt`, `lte` |
| `tags` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `enabled` | a plain boolean value |
| `create_date` | `gt`, `gte`, `lt`, `lte` |
| `last_update_date` | `gt`, `gte`, `lt`, `lte` |

### Searchable Fields

| Field | Description |
|---|---|
| `name` | The custom discovery rule's name, as you gave it. Matching is case-insensitive. |
| `discovered_asset_count` | How many assets the rule has discovered. |
| `tags` | The tags on the rule. |
| `enabled` | `true` for rules that are switched on, `false` for rules that are switched off. |
| `create_date` | When the rule was created (ISO 8601 date-time). |
| `last_update_date` | When the rule was last changed (ISO 8601 date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `name` | The custom discovery rule's name, as you gave it. Matching is case-insensitive. |
| `discovered_asset_count` | How many assets the rule has discovered. |
| `tags` | The tags on the rule. |
| `enabled` | `true` for rules that are switched on, `false` for rules that are switched off. |
| `create_date` | When the rule was created (ISO 8601 date-time). |
| `last_update_date` | When the rule was last changed (ISO 8601 date-time). |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `discovered_asset_count` | integer |  |
| `tags` | array of string |  |
| `enabled` | boolean |  |
| `create_date` | string | date-time |
| `last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].name` | string |
| `[].discovered_asset_count` | number |
| `[].tags` | array<string> |
| `[].enabled` | boolean |
| `[].create_date` | string |
| `[].last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-search.md


---

# Asset Discovery Rule List

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-rule-list/

GET /easm/discovery/rules: Lists all discovery rules (smart discovery, smart monitoring and custom) with their counts.

`GET https://api.deepinfo.com/v1/easm/discovery/rules`

Lists all discovery rules (smart discovery, smart monitoring and custom) with their counts.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `type` | string | One of `smart_discovery`, `smart_monitoring`, `custom` |
| `enabled` | boolean |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].name` | string |
| `[].type` | string |
| `[].enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-rule-list.md


---

# Asset Discovery Smart Discovery Rule List

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-discovery-rule-list/

GET /easm/discovery/smart-discovery-rules: Lists the smart discovery rules Deepinfo runs for you.

`GET https://api.deepinfo.com/v1/easm/discovery/smart-discovery-rules`

Lists the smart discovery rules Deepinfo runs for you.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | string |
| `discovered_asset_count` | integer |
| `enabled` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].name` | string |
| `[].description` | null |
| `[].discovered_asset_count` | number |
| `[].enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-discovery-rule-list.md


---

# Asset Discovery Smart Monitoring Rule List

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-monitoring-rule-list/

GET /easm/discovery/smart-monitoring-rules: Lists the smart monitoring rules Deepinfo runs for you.

`GET https://api.deepinfo.com/v1/easm/discovery/smart-monitoring-rules`

Lists the smart monitoring rules Deepinfo runs for you.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | string |
| `discovered_asset_count` | integer |
| `enabled` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].name` | string |
| `[].description` | null |
| `[].discovered_asset_count` | number |
| `[].enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-monitoring-rule-list.md


---

# Asset Discovery Custom Discovery Rule Detail

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-detail/

GET /easm/discovery/custom-rules/{rule_id}: Returns one custom discovery rule.

`GET https://api.deepinfo.com/v1/easm/discovery/custom-rules/{rule_id}`

Returns one custom discovery rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `00000000000000000000000e8e040001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `filters` | object |  |
| `tags` | array of string |  |
| `auto_approval` | boolean |  |
| `enabled` | boolean |  |
| `create_date` | string | date-time |
| `last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `filters` | object |
| `filters.must` | array<object> |
| `filters.must[].name` | string |
| `filters.must[].value` | string |
| `filters.must[].type` | string |
| `filters.must_not` | array |
| `filters.should` | array |
| `tags` | array<string> |
| `auto_approval` | boolean |
| `enabled` | boolean |
| `create_date` | string |
| `last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-detail.md


---

# Asset Discovery Smart Discovery Rule Detail

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-discovery-rule-detail/

GET /easm/discovery/smart-discovery-rules/{rule_id}: Returns one smart discovery rule.

`GET https://api.deepinfo.com/v1/easm/discovery/smart-discovery-rules/{rule_id}`

Returns one smart discovery rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `00000000000000000000000e8e040001` |

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | string |
| `excluded_seed_assets` | array of string |
| `excluded_seed_values` | array of string |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | null |
| `excluded_seed_assets` | array |
| `excluded_seed_values` | array |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-discovery-rule-detail.md


---

# Asset Discovery Smart Monitoring Rule Detail

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-monitoring-rule-detail/

GET /easm/discovery/smart-monitoring-rules/{rule_id}: Returns one smart monitoring rule.

`GET https://api.deepinfo.com/v1/easm/discovery/smart-monitoring-rules/{rule_id}`

Returns one smart monitoring rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `00000000000000000000000e8e040001` |

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | string |
| `excluded_seed_assets` | array of string |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | null |
| `excluded_seed_assets` | array |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-monitoring-rule-detail.md


---

# Asset Discovery Custom Discovery Rule Create

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-create/

POST /easm/discovery/custom-rules: Creates a custom discovery rule.

`POST https://api.deepinfo.com/v1/easm/discovery/custom-rules`

Creates a custom discovery rule. `filters` select which domains in Deepinfo's dataset become candidates; `auto_approval` adds them to your assets directly.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `255` |
| `filters` | object | Required | The filters of the rule; see the example request body |
| `tags` | array | Optional | max items `10` |
| `auto_approval` | boolean | Required |  |
| `enabled` | boolean | Required |  |

```json
{
  "name": "Main domains",
  "filters": {
    "must": [
      {
        "name": "webdata.http.final_domain",
        "value": "acme.example",
        "type": "eq"
      }
    ],
    "must_not": [],
    "should": []
  },
  "tags": [],
  "auto_approval": false,
  "enabled": true
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `filters` | object |  |
| `tags` | array of string |  |
| `auto_approval` | boolean |  |
| `enabled` | boolean |  |
| `create_date` | string | date-time |
| `last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `filters` | object |
| `filters.must` | array<object> |
| `filters.must[].name` | string |
| `filters.must[].value` | string |
| `filters.must[].type` | string |
| `filters.must_not` | array |
| `filters.should` | array |
| `tags` | array |
| `auto_approval` | boolean |
| `enabled` | boolean |
| `create_date` | string |
| `last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-create.md


---

# Asset Discovery Custom Discovery Rule Update

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-update/

PUT /easm/discovery/custom-rules/{rule_id}: Updates a custom discovery rule (send all fields).

`PUT https://api.deepinfo.com/v1/easm/discovery/custom-rules/{rule_id}`

Updates a custom discovery rule (send all fields).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `00000000000000000000000e8e040001` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `255` |
| `filters` | object | Required | The filters of the rule; see the example request body |
| `tags` | array | Optional | max items `10` |
| `auto_approval` | boolean | Required |  |
| `enabled` | boolean | Required |  |

```json
{
  "name": "Main domains",
  "filters": {
    "must": [
      {
        "name": "webdata.http.final_domain",
        "value": "acme.example",
        "type": "eq"
      }
    ],
    "must_not": [],
    "should": []
  },
  "tags": [],
  "auto_approval": false,
  "enabled": true
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `filters` | object |  |
| `tags` | array of string |  |
| `auto_approval` | boolean |  |
| `enabled` | boolean |  |
| `create_date` | string | date-time |
| `last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `filters` | object |
| `filters.must` | array<object> |
| `filters.must[].name` | string |
| `filters.must[].value` | string |
| `filters.must[].type` | string |
| `filters.must_not` | array |
| `filters.should` | array |
| `tags` | array |
| `auto_approval` | boolean |
| `enabled` | boolean |
| `create_date` | string |
| `last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-update.md


---

# Asset Discovery Smart Discovery Rule Update

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-discovery-rule-update/

PUT /easm/discovery/smart-discovery-rules/{rule_id}: Tunes a smart discovery rule with the settings in the request body.

`PUT https://api.deepinfo.com/v1/easm/discovery/smart-discovery-rules/{rule_id}`

Tunes a smart discovery rule with the settings in the request body.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `00000000000000000000000e8e040001` |

## Request Body

| Parameter | Type | Required |
|---|---|---|
| `excluded_seed_assets` | array | Optional |
| `excluded_seed_values` | array | Optional |
| `auto_approval` | boolean | Required |
| `global_blocklist` | boolean | Required |
| `enabled` | boolean | Required |

```json
{
  "excluded_seed_assets": [],
  "excluded_seed_values": [],
  "auto_approval": false,
  "global_blocklist": true,
  "enabled": true
}
```

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | string |
| `excluded_seed_assets` | array of string |
| `excluded_seed_values` | array of string |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | null |
| `excluded_seed_assets` | array |
| `excluded_seed_values` | array |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-discovery-rule-update.md


---

# Asset Discovery Smart Monitoring Rule Update

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-monitoring-rule-update/

PUT /easm/discovery/smart-monitoring-rules/{rule_id}: Tunes a smart monitoring rule with the settings in the request body.

`PUT https://api.deepinfo.com/v1/easm/discovery/smart-monitoring-rules/{rule_id}`

Tunes a smart monitoring rule with the settings in the request body.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `00000000000000000000000e8e040001` |

## Request Body

| Parameter | Type | Required |
|---|---|---|
| `excluded_seed_assets` | array | Optional |
| `auto_approval` | boolean | Required |
| `global_blocklist` | boolean | Required |
| `enabled` | boolean | Required |

```json
{
  "excluded_seed_assets": [],
  "auto_approval": false,
  "global_blocklist": true,
  "enabled": true
}
```

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | string |
| `excluded_seed_assets` | array of string |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | null |
| `excluded_seed_assets` | array |
| `auto_approval` | boolean |
| `global_blocklist` | boolean |
| `enabled` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-smart-monitoring-rule-update.md


---

# Asset Discovery Custom Discovery Rule Delete

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-delete/

DELETE /easm/discovery/custom-rules/{rule_id}: Deletes a custom discovery rule.

`DELETE https://api.deepinfo.com/v1/easm/discovery/custom-rules/{rule_id}`

Deletes a custom discovery rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `00000000000000000000000e8e040001` |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-custom-discovery-rule-delete.md


---

# Asset Discovery Settings Detail

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-settings-detail/

GET /easm/discovery/settings: Returns discovery settings: ignored_assets are never proposed as candidates.

`GET https://api.deepinfo.com/v1/easm/discovery/settings`

Returns discovery settings: `ignored_assets` are never proposed as candidates.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `ignored_assets` | array of string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `ignored_assets` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-settings-detail.md


---

# Asset Discovery Settings Update

URL: https://docs.deepinfo.com/reference/easm/asset-discovery-settings-update/

PUT /easm/discovery/settings: Replaces discovery settings. Send the full ignored_assets list.

`PUT https://api.deepinfo.com/v1/easm/discovery/settings`

Replaces discovery settings. Send the **full** `ignored_assets` list.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required |
|---|---|---|
| `ignored_assets` | array | Required |

```json
{
  "ignored_assets": []
}
```

## Response Fields

| Field | Type |
|---|---|
| `ignored_assets` | array of string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `ignored_assets` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/asset-discovery-settings-update.md


---

# Issue Search

URL: https://docs.deepinfo.com/reference/easm/issue-search/

POST /easm/issues/search: Searches issues on your assets by state, severity, type, category, asset and dates.

`POST https://api.deepinfo.com/v1/easm/issues/search`

Searches issues on your assets by state, severity, type, category, asset and dates.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset.id` | The ID of the asset the issue was found on, a 24-character hexadecimal string; it is the same ID that Asset Search returns for that asset. |
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.tags` | Your own tags on the asset the issue was found on, as a list of strings (the asset's `tags` in Asset Search). |
| `asset.domain_asset.id` | The ID of the domain asset the issue's asset belongs to; for a domain it is the asset's own ID. `asset.domain_asset` is null when the asset's domain is not one of your assets. |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `type.id` | The ID of the issue type, a 24-character hexadecimal string. Pass it to Issue Type Detail (`GET /easm/issues/types/{issue_type_id}`), or filter on it to list every asset with that issue type. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.category.id` | The ID of the issue type's category, a 24-character hexadecimal string, as listed by Issue Categories (`GET /easm/issues/categories/list`). |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The issue's ID, a 24-character hexadecimal string. Pass it to Issue Detail (`GET /easm/issues/{issue_id}`), or filter on it with `in` to select exact issues. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].asset` | object |  |
| `results[].state` | string | One of `newly_detected`, `reappeared`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `results[].severity` | string | One of `Critical`, `High`, `Medium`, `Low`, `Information` |
| `results[].first_seen_date` | string | date-time |
| `results[].last_seen_date` | string | date-time |
| `results[].last_check_date` | string | date-time |
| `results[].type` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].asset` | object |
| `results[].asset.id` | string |
| `results[].asset.name` | string |
| `results[].asset.name_unicode` | string |
| `results[].asset.type` | string |
| `results[].asset.tags` | array |
| `results[].asset.domain_asset` | object \| null |
| `results[].asset.domain_asset.id` | string |
| `results[].asset.domain_asset.name` | string |
| `results[].asset.domain_asset.name_unicode` | string |
| `results[].state` | string |
| `results[].severity` | string |
| `results[].first_seen_date` | string |
| `results[].last_seen_date` | string |
| `results[].last_check_date` | string |
| `results[].type` | object |
| `results[].type.id` | string |
| `results[].type.name` | string |
| `results[].type.severity` | string |
| `results[].type.category` | object |
| `results[].type.category.id` | string |
| `results[].type.category.name` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-search.md


---

# Issue Export

URL: https://docs.deepinfo.com/reference/easm/issue-export/

POST /easm/issues/search:export: Exports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array.

`POST https://api.deepinfo.com/v1/easm/issues/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset.id` | The ID of the asset the issue was found on, a 24-character hexadecimal string; it is the same ID that Asset Search returns for that asset. |
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.tags` | Your own tags on the asset the issue was found on, as a list of strings (the asset's `tags` in Asset Search). |
| `asset.domain_asset.id` | The ID of the domain asset the issue's asset belongs to; for a domain it is the asset's own ID. `asset.domain_asset` is null when the asset's domain is not one of your assets. |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `type.id` | The ID of the issue type, a 24-character hexadecimal string. Pass it to Issue Type Detail (`GET /easm/issues/types/{issue_type_id}`), or filter on it to list every asset with that issue type. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.category.id` | The ID of the issue type's category, a 24-character hexadecimal string, as listed by Issue Categories (`GET /easm/issues/categories/list`). |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The issue's ID, a 24-character hexadecimal string. Pass it to Issue Detail (`GET /easm/issues/{issue_id}`), or filter on it with `in` to select exact issues. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-export.md


---

# Issue Detail

URL: https://docs.deepinfo.com/reference/easm/issue-detail/

GET /easm/issues/{issue_id}: Returns one issue with its asset, type, state history and evidence.

`GET https://api.deepinfo.com/v1/easm/issues/{issue_id}`

Returns one issue with its asset, type, state history and evidence.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_id` | Required |  | `000000000000000e8a020001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `asset` | object |  |
| `state` | string | One of `newly_detected`, `reappeared`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `severity` | string | One of `Critical`, `High`, `Medium`, `Low`, `Information` |
| `proof` | object |  |
| `context` | object |  |
| `first_seen_date` | string | date-time |
| `last_seen_date` | string | date-time |
| `last_check_date` | string | date-time |
| `labels` | array of string |  |
| `type` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `asset` | object |
| `asset.id` | string |
| `asset.name` | string |
| `asset.name_unicode` | string |
| `asset.type` | string |
| `asset.tags` | array |
| `asset.favicon` | string |
| `asset.domain_asset` | object |
| `asset.domain_asset.id` | string |
| `asset.domain_asset.name` | string |
| `asset.domain_asset.name_unicode` | string |
| `asset.portfolio_id` | string |
| `state` | string |
| `severity` | string |
| `proof` | object |
| `proof.monitoring_asset_id` | string |
| `proof.associated_scopes` | array<string> |
| `context` | object |
| `context.type` | string |
| `context.tech_id` | string |
| `context.version` | null |
| `context.latest_version` | string |
| `first_seen_date` | string |
| `last_seen_date` | string |
| `last_check_date` | string |
| `labels` | array |
| `type` | object |
| `type.id` | string |
| `type.name` | string |
| `type.category` | object |
| `type.category.id` | string |
| `type.category.name` | string |
| `type.category.description` | string |
| `type.certainty` | number |
| `type.severity` | string |
| `type.description` | string |
| `type.impact` | string |
| `type.remedy` | string |
| `type.external_references` | null |
| `type.classifications` | array<object> |
| `type.classifications[].type` | string |
| `type.classifications[].name` | string |
| `type.classifications[].description` | string |
| `type.classifications[].url` | string |
| `type.cvss` | null |
| `type.code` | string |
| `type.scopes` | array<string> |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-detail.md


---

# Issue Accept Risk

URL: https://docs.deepinfo.com/reference/easm/issue-accept-risk/

POST /easm/issues/search:accept-risk: Accepts the risk of the issues that match filters (risk_accepted).

`POST https://api.deepinfo.com/v1/easm/issues/search:accept-risk`

Accepts the risk of the issues that match `filters` (`risk_accepted`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e8a020001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset.id` | The ID of the asset the issue was found on, a 24-character hexadecimal string; it is the same ID that Asset Search returns for that asset. |
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.tags` | Your own tags on the asset the issue was found on, as a list of strings (the asset's `tags` in Asset Search). |
| `asset.domain_asset.id` | The ID of the domain asset the issue's asset belongs to; for a domain it is the asset's own ID. `asset.domain_asset` is null when the asset's domain is not one of your assets. |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `type.id` | The ID of the issue type, a 24-character hexadecimal string. Pass it to Issue Type Detail (`GET /easm/issues/types/{issue_type_id}`), or filter on it to list every asset with that issue type. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.category.id` | The ID of the issue type's category, a 24-character hexadecimal string, as listed by Issue Categories (`GET /easm/issues/categories/list`). |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The issue's ID, a 24-character hexadecimal string. Pass it to Issue Detail (`GET /easm/issues/{issue_id}`), or filter on it with `in` to select exact issues. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

## Response Fields

| Field | Type |
|---|---|
| `issue_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `issue_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-accept-risk.md


---

# Issue Ignore

URL: https://docs.deepinfo.com/reference/easm/issue-ignore/

POST /easm/issues/search:ignore: Ignores the issues that match filters (ignored).

`POST https://api.deepinfo.com/v1/easm/issues/search:ignore`

Ignores the issues that match `filters` (`ignored`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e8a020001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset.id` | The ID of the asset the issue was found on, a 24-character hexadecimal string; it is the same ID that Asset Search returns for that asset. |
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.tags` | Your own tags on the asset the issue was found on, as a list of strings (the asset's `tags` in Asset Search). |
| `asset.domain_asset.id` | The ID of the domain asset the issue's asset belongs to; for a domain it is the asset's own ID. `asset.domain_asset` is null when the asset's domain is not one of your assets. |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `type.id` | The ID of the issue type, a 24-character hexadecimal string. Pass it to Issue Type Detail (`GET /easm/issues/types/{issue_type_id}`), or filter on it to list every asset with that issue type. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.category.id` | The ID of the issue type's category, a 24-character hexadecimal string, as listed by Issue Categories (`GET /easm/issues/categories/list`). |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The issue's ID, a 24-character hexadecimal string. Pass it to Issue Detail (`GET /easm/issues/{issue_id}`), or filter on it with `in` to select exact issues. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

## Response Fields

| Field | Type |
|---|---|
| `issue_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `issue_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-ignore.md


---

# Issue Mark False Positive

URL: https://docs.deepinfo.com/reference/easm/issue-mark-false-positive/

POST /easm/issues/search:mark-false-positive: Marks the issues that match filters as false positive (marked_as_false_positive).

`POST https://api.deepinfo.com/v1/easm/issues/search:mark-false-positive`

Marks the issues that match `filters` as false positive (`marked_as_false_positive`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e8a020001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset.id` | The ID of the asset the issue was found on, a 24-character hexadecimal string; it is the same ID that Asset Search returns for that asset. |
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.tags` | Your own tags on the asset the issue was found on, as a list of strings (the asset's `tags` in Asset Search). |
| `asset.domain_asset.id` | The ID of the domain asset the issue's asset belongs to; for a domain it is the asset's own ID. `asset.domain_asset` is null when the asset's domain is not one of your assets. |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `type.id` | The ID of the issue type, a 24-character hexadecimal string. Pass it to Issue Type Detail (`GET /easm/issues/types/{issue_type_id}`), or filter on it to list every asset with that issue type. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.category.id` | The ID of the issue type's category, a 24-character hexadecimal string, as listed by Issue Categories (`GET /easm/issues/categories/list`). |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The issue's ID, a 24-character hexadecimal string. Pass it to Issue Detail (`GET /easm/issues/{issue_id}`), or filter on it with `in` to select exact issues. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

## Response Fields

| Field | Type |
|---|---|
| `issue_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `issue_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-mark-false-positive.md


---

# Issue Mark Resolved

URL: https://docs.deepinfo.com/reference/easm/issue-mark-resolved/

POST /easm/issues/search:mark-resolved: Marks the issues that match filters as resolved (marked_as_resolved).

`POST https://api.deepinfo.com/v1/easm/issues/search:mark-resolved`

Marks the issues that match `filters` as resolved (`marked_as_resolved`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e8a020001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset.id` | The ID of the asset the issue was found on, a 24-character hexadecimal string; it is the same ID that Asset Search returns for that asset. |
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.tags` | Your own tags on the asset the issue was found on, as a list of strings (the asset's `tags` in Asset Search). |
| `asset.domain_asset.id` | The ID of the domain asset the issue's asset belongs to; for a domain it is the asset's own ID. `asset.domain_asset` is null when the asset's domain is not one of your assets. |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `type.id` | The ID of the issue type, a 24-character hexadecimal string. Pass it to Issue Type Detail (`GET /easm/issues/types/{issue_type_id}`), or filter on it to list every asset with that issue type. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.category.id` | The ID of the issue type's category, a 24-character hexadecimal string, as listed by Issue Categories (`GET /easm/issues/categories/list`). |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The issue's ID, a 24-character hexadecimal string. Pass it to Issue Detail (`GET /easm/issues/{issue_id}`), or filter on it with `in` to select exact issues. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

## Response Fields

| Field | Type |
|---|---|
| `issue_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `issue_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-mark-resolved.md


---

# Issue Revert

URL: https://docs.deepinfo.com/reference/easm/issue-revert/

POST /easm/issues/search:revert: Reverts the issues that match filters to their previous, active state. Only states set by a user can be reverted.

`POST https://api.deepinfo.com/v1/easm/issues/search:revert`

Reverts the issues that match `filters` to their previous, active state. Only states set by a user can be reverted.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e8a020001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset.id` | The ID of the asset the issue was found on, a 24-character hexadecimal string; it is the same ID that Asset Search returns for that asset. |
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.tags` | Your own tags on the asset the issue was found on, as a list of strings (the asset's `tags` in Asset Search). |
| `asset.domain_asset.id` | The ID of the domain asset the issue's asset belongs to; for a domain it is the asset's own ID. `asset.domain_asset` is null when the asset's domain is not one of your assets. |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `type.id` | The ID of the issue type, a 24-character hexadecimal string. Pass it to Issue Type Detail (`GET /easm/issues/types/{issue_type_id}`), or filter on it to list every asset with that issue type. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.category.id` | The ID of the issue type's category, a 24-character hexadecimal string, as listed by Issue Categories (`GET /easm/issues/categories/list`). |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The issue's ID, a 24-character hexadecimal string. Pass it to Issue Detail (`GET /easm/issues/{issue_id}`), or filter on it with `in` to select exact issues. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The name of the asset the issue was found on: a domain, subdomain or IP address, or for a website asset `host:port`. The Issue List shows it as ASSET. |
| `asset.type` | The type of the asset the issue was found on: `domain`, `subdomain`, `ip` or `website` (shown as Domain, Subdomain, IP Address and Website). |
| `asset.domain_asset.name` | The name of the domain asset the issue's asset belongs to, such as `acme.example` for `www.acme.example`; for a domain it is the asset's own name. Null when the asset's domain is not one of your assets. |
| `state` | The issue's state: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `severity` | The severity of this issue: `Critical`, `High`, `Medium`, `Low` or `Information`; the Issue List severity tabs filter on it. It usually matches `type.severity` but can be higher, as seen on some issues about vulnerabilities detected on a technology. |
| `type.name` | The name of the issue type, for example `Missing SPF Record` or `SSL/TLS Not Implemented`; the Issue List's SEARCH box matches it. |
| `type.severity` | The severity of the issue type: `Critical`, `High`, `Medium`, `Low` or `Information`. Each issue also has its own `severity`, which usually matches it. |
| `type.category.name` | The name of the issue type's category, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois`, `Network` or `Database Server`. |
| `first_seen_date` | When the issue was first detected on the asset, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). The platform's ACTIVE DAYS runs from this date to `last_seen_date`. |
| `last_seen_date` | When the issue was most recently detected on the asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this issue, in ISO 8601 UTC; while the issue is still found it equals `last_seen_date`. |

## Response Fields

| Field | Type |
|---|---|
| `issue_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `issue_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-revert.md


---

# Issue Asset Type Stats

URL: https://docs.deepinfo.com/reference/easm/issue-asset-type-stats/

GET /easm/issues/stats/asset-type: Counts issues per asset type.

`GET https://api.deepinfo.com/v1/easm/issues/stats/asset-type`

Counts issues per asset type.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `type_id` | Optional |  |  |
| `type_category_id` | Optional |  |  |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].asset_type` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-asset-type-stats.md


---

# Issue Category Stats

URL: https://docs.deepinfo.com/reference/easm/issue-category-stats/

GET /easm/issues/stats/category-type: Counts issues per category and type.

`GET https://api.deepinfo.com/v1/easm/issues/stats/category-type`

Counts issues per category and type.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `category` | string |
| `count` | integer |
| `severity_stats` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].category` | string |
| `[].count` | number |
| `[].severity_stats` | array<object> |
| `[].severity_stats[].severity` | string |
| `[].severity_stats[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-category-stats.md


---

# Issue Duration Stats

URL: https://docs.deepinfo.com/reference/easm/issue-duration-stats/

GET /easm/issues/stats/duration: Average time issues stay open and time to fix.

`GET https://api.deepinfo.com/v1/easm/issues/stats/duration`

Average time issues stay open and time to fix.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |
| `type_id` | Optional |  |  |
| `type_category_id` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `first_seen_date` | string | date-time |
| `last_seen_date` | string | date-time |
| `average_issue_duration` | integer |  |
| `average_fix_duration` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `first_seen_date` | string |
| `last_seen_date` | string |
| `average_issue_duration` | number |
| `average_fix_duration` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-duration-stats.md


---

# Issue Severity Stats

URL: https://docs.deepinfo.com/reference/easm/issue-severity-stats/

GET /easm/issues/stats/severity: Counts active issues per severity.

`GET https://api.deepinfo.com/v1/easm/issues/stats/severity`

Counts active issues per severity.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |
| `type_id` | Optional |  |  |
| `type_category_id` | Optional |  |  |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `severity` | string | One of `Critical`, `High`, `Medium`, `Low`, `Information` |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].severity` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-severity-stats.md


---

# Issue Severity Stats Timeline

URL: https://docs.deepinfo.com/reference/easm/issue-severity-stats-timeline/

GET /easm/issues/stats/severity-timeline: Time series of severity for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/issues/stats/severity-timeline`

Time series of severity for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `severities` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].severities` | array<object> |
| `[].severities[].name` | string |
| `[].severities[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-severity-stats-timeline.md


---

# Issue State Stats

URL: https://docs.deepinfo.com/reference/easm/issue-state-stats/

GET /easm/issues/stats/state: Counts issues per state.

`GET https://api.deepinfo.com/v1/easm/issues/stats/state`

Counts issues per state.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |
| `type_id` | Optional |  |  |
| `type_category_id` | Optional |  |  |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `state` | string | One of `newly_detected`, `reappeared`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].state` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-state-stats.md


---

# Issue Type Stats

URL: https://docs.deepinfo.com/reference/easm/issue-type-stats/

GET /easm/issues/stats/type: Counts issues per issue type (filter by severity, sort with ordering).

`GET https://api.deepinfo.com/v1/easm/issues/stats/type`

Counts issues per issue type (filter by `severity`, sort with `ordering`).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `severity` | Optional |  |  |
| `type_id` | Optional |  |  |
| `type_category_id` | Optional |  |  |
| `ordering` | Optional |  |  |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `severity` | string | One of `Critical`, `High`, `Medium`, `Low`, `Information` |
| `type` | object |  |
| `affected_asset_count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].severity` | string |
| `[].type` | object |
| `[].type.id` | string |
| `[].type.name` | string |
| `[].type.category` | object |
| `[].type.category.id` | string |
| `[].type.category.name` | string |
| `[].type.severity` | string |
| `[].affected_asset_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-type-stats.md


---

# Issue Type Detail

URL: https://docs.deepinfo.com/reference/easm/issue-type-detail/

GET /easm/issues/types/{issue_type_id}: Returns an issue type: description, severity, category and remediation.

`GET https://api.deepinfo.com/v1/easm/issues/types/{issue_type_id}`

Returns an issue type: description, severity, category and remediation.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_type_id` | Required |  | `000000000000000e03c80001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `category` | object |  |
| `certainty` | integer | One of `50`, `95`, `100` |
| `severity` | string | One of `Critical`, `High`, `Medium`, `Low`, `Information` |
| `context` | object |  |
| `description` | string |  |
| `impact` | string |  |
| `remedy` | string |  |
| `external_references` | string |  |
| `classifications` | array of object |  |
| `cvss` | string |  |
| `scopes` | array of string |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `category` | object |
| `category.id` | string |
| `category.name` | string |
| `category.description` | string |
| `certainty` | number |
| `severity` | string |
| `context` | object |
| `context.tech_id` | string |
| `description` | string |
| `impact` | string |
| `remedy` | string |
| `external_references` | null |
| `classifications` | array<object> |
| `classifications[].id` | string |
| `classifications[].type` | string |
| `classifications[].name` | string |
| `classifications[].description` | string |
| `classifications[].url` | string |
| `cvss` | null |
| `scopes` | array<string> |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-type-detail.md


---

# Issue Type Instant Snapshot

URL: https://docs.deepinfo.com/reference/easm/issue-type-instant-snapshot/

POST /easm/issues/types/{issue_type_id}/instant-snapshot: Recalculates the issue type snapshot now.

`POST https://api.deepinfo.com/v1/easm/issues/types/{issue_type_id}/instant-snapshot`

Recalculates the issue type snapshot now.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_type_id` | Required |  | `000000000000000e03c80001` |

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-type-instant-snapshot.md


---

# Issue Type Latest Snapshot

URL: https://docs.deepinfo.com/reference/easm/issue-type-latest-snapshot/

GET /easm/issues/types/{issue_type_id}/latest-snapshot: Latest summary of one issue type across your assets.

`GET https://api.deepinfo.com/v1/easm/issues/types/{issue_type_id}/latest-snapshot`

Latest summary of one issue type across your assets.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_type_id` | Required |  | `000000000000000e03c80001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `stats` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `snapshot` | object |  |
| `date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `snapshot` | object |
| `snapshot.security_score` | number |
| `snapshot.average_issue_duration` | number |
| `snapshot.average_fix_duration` | number |
| `snapshot.issue_state_stats` | array<object> |
| `snapshot.issue_state_stats[].name` | string |
| `snapshot.issue_state_stats[].count` | number |
| `snapshot.asset_type_stats` | array<object> |
| `snapshot.asset_type_stats[].name` | string |
| `snapshot.asset_type_stats[].count` | number |
| `date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-type-latest-snapshot.md


---

# Issue Type Security Score Timeline

URL: https://docs.deepinfo.com/reference/easm/issue-type-security-score-timeline/

GET /easm/issues/types/{issue_type_id}/security-score-timeline: Time series of the security score for one issue type. interval: daily, weekly, monthly.

`GET https://api.deepinfo.com/v1/easm/issues/types/{issue_type_id}/security-score-timeline`

Time series of the security score for one issue type. `interval`: `daily`, `weekly`, `monthly`. Can take several seconds.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_type_id` | Required |  | `000000000000000e03c80001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `score` | number |  |
| `date` | string | date |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].score` | number |
| `[].date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-type-security-score-timeline.md


---

# Issue Categories

URL: https://docs.deepinfo.com/reference/easm/issue-categories/

GET /easm/issues/categories/list: Lists issue categories.

`GET https://api.deepinfo.com/v1/easm/issues/categories/list`

Lists issue categories.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `description` | string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].name` | string |
| `[].description` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-categories.md


---

# Issue Categories Instant Snapshot

URL: https://docs.deepinfo.com/reference/easm/issue-categories-instant-snapshot/

POST /easm/issues/categories/{issue_type_category_id}/instant-snapshot: Recalculates the issue category snapshot now.

`POST https://api.deepinfo.com/v1/easm/issues/categories/{issue_type_category_id}/instant-snapshot`

Recalculates the issue category snapshot now.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_type_category_id` | Required |  | `000000000000000e17420001` |

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-categories-instant-snapshot.md


---

# Issue Categories Latest Snapshot

URL: https://docs.deepinfo.com/reference/easm/issue-categories-latest-snapshot/

GET /easm/issues/categories/{issue_type_category_id}/latest-snapshot: Latest summary of one issue category.

`GET https://api.deepinfo.com/v1/easm/issues/categories/{issue_type_category_id}/latest-snapshot`

Latest summary of one issue category.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_type_category_id` | Required |  | `000000000000000e17420001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `stats` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `snapshot` | object |  |
| `date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `snapshot` | object |
| `snapshot.security_score` | number |
| `snapshot.average_issue_duration` | number |
| `snapshot.average_fix_duration` | number |
| `snapshot.issue_state_stats` | array<object> |
| `snapshot.issue_state_stats[].name` | string |
| `snapshot.issue_state_stats[].count` | number |
| `snapshot.issue_severity_stats` | array<object> |
| `snapshot.issue_severity_stats[].name` | string |
| `snapshot.issue_severity_stats[].count` | number |
| `date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-categories-latest-snapshot.md


---

# Issue Categories Security Score Timeline

URL: https://docs.deepinfo.com/reference/easm/issue-categories-security-score-timeline/

GET /easm/issues/categories/{issue_type_category_id}/security-score-timeline: Time series of the security score for one issue category.

`GET https://api.deepinfo.com/v1/easm/issues/categories/{issue_type_category_id}/security-score-timeline`

Time series of the security score for one issue category. `interval`: `daily`, `weekly`, `monthly`.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `issue_type_category_id` | Required |  | `000000000000000e17420001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `score` | number |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].score` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/issue-categories-security-score-timeline.md


---

# Vulnerability Asset Search

URL: https://docs.deepinfo.com/reference/easm/vulnerability-asset-search/

POST /easm/vulnerabilities/asset-search: Searches vulnerabilities per asset (one record per asset + CVE), with state.

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/asset-search`

Searches vulnerabilities per asset (one record per asset + CVE), with state.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The affected asset's name, for filtering: a domain, subdomain or IP address, or for a website asset `host:port`. Filter with `eq` and the exact name to get one asset's CVEs; responses carry it in `asset.name`. |
| `domain_asset` | The name of the domain asset the affected asset belongs to, for filtering (for a domain, its own name); responses carry it in `asset.domain_asset.name`. |
| `asset_tags` | Your own tags on the affected asset, for filtering; responses carry them in `asset.tags`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this CVE, in ISO 8601 UTC; it equals `last_seen_date` while the CVE is still found and is later once the CVE is `verified_resolved`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The affected asset's type, for filtering: `domain`, `subdomain`, `ip` or `website`; responses carry it in `asset.type`. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The affected asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. Sort only; filter with `asset`. |
| `asset.type` | The affected asset's type: `domain`, `subdomain`, `ip` or `website`. Sort only; filter with `asset_type`. |
| `asset.domain_asset.name` | The name of the domain asset the affected asset belongs to (for a domain, its own name); null when the asset's domain is not one of your assets. Sort only; filter with `domain_asset`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].asset` | object |  |
| `results[].technologies` | array of object |  |
| `results[].cve` | object |  |
| `results[].first_seen_date` | string | date-time |
| `results[].last_seen_date` | string | date-time |
| `results[].last_check_date` | string | date-time |
| `results[].state` | string | One of `newly_detected`, `reappeared`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `results[].is_certain` | boolean |  |
| `results[].is_potential` | boolean |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].asset` | object |
| `results[].asset.id` | string |
| `results[].asset.name` | string |
| `results[].asset.name_unicode` | string |
| `results[].asset.type` | string |
| `results[].asset.domain_asset` | object |
| `results[].asset.domain_asset.id` | string |
| `results[].asset.domain_asset.name` | string |
| `results[].asset.domain_asset.name_unicode` | string |
| `results[].asset.tags` | array |
| `results[].technologies` | array<object> |
| `results[].technologies[].vendor` | string |
| `results[].technologies[].product` | string |
| `results[].technologies[].version` | string \| null |
| `results[].cve` | object |
| `results[].cve.id` | string |
| `results[].cve.published` | string |
| `results[].cve.last_modified` | string |
| `results[].cve.enrichment` | object |
| `results[].cve.enrichment.cwe` | array<object> |
| `results[].cve.enrichment.cwe[].id` | number |
| `results[].cve.enrichment.cwe[].owasptop10_2021` | string |
| `results[].cve.enrichment.cwe[].name` | string |
| `results[].cve.enrichment.cwe[].description` | string |
| `results[].cve.enrichment.cwe[].capec_id` | array<number> |
| `results[].cve.enrichment.cwe[].scope` | array<string> |
| `results[].cve.enrichment.cwe[].impact` | array<string> |
| `results[].cve.enrichment.cwe[].detection_method` | array |
| `results[].cve.enrichment.epss_score` | object |
| `results[].cve.enrichment.epss_score.epss` | number |
| `results[].cve.enrichment.epss_score.percentile` | number |
| `results[].cve.enrichment.epss_score.date` | string |
| `results[].cve.enrichment.cisa_kev` | null |
| `results[].cve.enrichment.vdeep_metric` | object |
| `results[].cve.enrichment.vdeep_metric.cvss_version` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data` | object |
| `results[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data.base_score` | number |
| `results[].cve.enrichment.vdeep_metric.cvss_data.base_severity` | string |
| `results[].first_seen_date` | string |
| `results[].last_seen_date` | string |
| `results[].last_check_date` | string |
| `results[].state` | string |
| `results[].is_certain` | boolean |
| `results[].is_potential` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-asset-search.md


---

# Vulnerability Search

URL: https://docs.deepinfo.com/reference/easm/vulnerability-search/

POST /easm/vulnerabilities/search: Searches vulnerabilities (CVEs) affecting your assets, one record per CVE.

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/search`

Searches vulnerabilities (CVEs) affecting your assets, one record per CVE.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "cve.id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `affected_asset_count.total` | Number of your assets the CVE is active on (state `newly_detected`, `unresolved` or `reappeared`); the Vulnerability List shows it as ASSETS. |
| `affected_asset_count.domain` | Number of domain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.subdomain` | Number of subdomain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.ip` | Number of IP address assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.website` | Number of website assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_domain_asset_count` | Number of domain assets the CVE is active on; in the samples it always equals `affected_asset_count.domain`. |
| `first_seen_date` | When the CVE was first detected on any of your assets, in ISO 8601 UTC: the earliest `first_seen_date` of its per-asset records. The platform marks a CVE first seen in the last 7 days as NEW. |
| `last_seen_date` | When the CVE was most recently detected on any of your assets, in ISO 8601 UTC: the latest `last_seen_date` of its per-asset records. |
| `last_check_date` | When your assets were last checked for the CVE, in ISO 8601 UTC: the latest `last_check_date` of its per-asset records. |
| `certainly_affected_asset_count.total` | Number of your assets on which the CVE is certain (verified through testing and confirmed as valid), whatever the per-asset state, active or inactive. |
| `certainly_affected_asset_count.domain` | Number of domain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.ip` | Number of IP address assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.website` | Number of website assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `potentially_affected_asset_count.total` | Number of your assets on which the CVE is potential (identified through testing but not yet confirmed), whatever the per-asset state, active or inactive. |
| `potentially_affected_asset_count.domain` | Number of domain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.ip` | Number of IP address assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.website` | Number of website assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; the Vulnerability List's SEARCH box matches it. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |
| `affected_asset_tags` | Your own tags on the assets the CVE affects, as a list of strings; filter on it to find CVEs on assets with a given tag. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | Whether the CVE is still active on at least one of your assets: `active` or `inactive`. The per-asset states are in Vulnerability Asset Search, and the Vulnerability List shows `active` CVEs only. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE is certain on at least one of your assets, that is, verified through testing and confirmed as valid; see `certainly_affected_asset_count`. |
| `is_potential` | `true` when the CVE is potential on at least one of your assets, that is, identified through testing but not yet confirmed; see `potentially_affected_asset_count`. |

### Sortable Fields

| Field | Description |
|---|---|
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; the Vulnerability List's SEARCH box matches it. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `affected_asset_count.total` | Number of your assets the CVE is active on (state `newly_detected`, `unresolved` or `reappeared`); the Vulnerability List shows it as ASSETS. |
| `affected_asset_count.domain` | Number of domain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.subdomain` | Number of subdomain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.ip` | Number of IP address assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.website` | Number of website assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_domain_asset_count` | Number of domain assets the CVE is active on; in the samples it always equals `affected_asset_count.domain`. |
| `first_seen_date` | When the CVE was first detected on any of your assets, in ISO 8601 UTC: the earliest `first_seen_date` of its per-asset records. The platform marks a CVE first seen in the last 7 days as NEW. |
| `last_seen_date` | When the CVE was most recently detected on any of your assets, in ISO 8601 UTC: the latest `last_seen_date` of its per-asset records. |
| `state` | Whether the CVE is still active on at least one of your assets: `active` or `inactive`. The per-asset states are in Vulnerability Asset Search, and the Vulnerability List shows `active` CVEs only. |
| `is_certain` | `true` when the CVE is certain on at least one of your assets, that is, verified through testing and confirmed as valid; see `certainly_affected_asset_count`. |
| `is_potential` | `true` when the CVE is potential on at least one of your assets, that is, identified through testing but not yet confirmed; see `potentially_affected_asset_count`. |
| `certainly_affected_asset_count.total` | Number of your assets on which the CVE is certain (verified through testing and confirmed as valid), whatever the per-asset state, active or inactive. |
| `certainly_affected_asset_count.domain` | Number of domain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.ip` | Number of IP address assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.website` | Number of website assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `potentially_affected_asset_count.total` | Number of your assets on which the CVE is potential (identified through testing but not yet confirmed), whatever the per-asset state, active or inactive. |
| `potentially_affected_asset_count.domain` | Number of domain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.ip` | Number of IP address assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.website` | Number of website assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].cve` | object |  |
| `results[].affected_asset_count` | object |  |
| `results[].affected_domain_asset_count` | integer |  |
| `results[].affected_asset_tags` | array of string |  |
| `results[].first_seen_date` | string | date-time |
| `results[].last_seen_date` | string | date-time |
| `results[].last_check_date` | string | date-time |
| `results[].state` | string | One of `active`, `inactive` |
| `results[].is_certain` | boolean |  |
| `results[].is_potential` | boolean |  |
| `results[].certainly_affected_asset_count` | object |  |
| `results[].potentially_affected_asset_count` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].cve` | object |
| `results[].cve.id` | string |
| `results[].cve.published` | string |
| `results[].cve.last_modified` | string |
| `results[].cve.enrichment` | object |
| `results[].cve.enrichment.cwe` | array<object> |
| `results[].cve.enrichment.cwe[].id` | number |
| `results[].cve.enrichment.cwe[].owasptop10_2021` | null |
| `results[].cve.enrichment.cwe[].name` | string |
| `results[].cve.enrichment.cwe[].description` | string |
| `results[].cve.enrichment.cwe[].capec_id` | array<number> |
| `results[].cve.enrichment.cwe[].scope` | array<string> |
| `results[].cve.enrichment.cwe[].impact` | array<string> |
| `results[].cve.enrichment.cwe[].detection_method` | array<string> |
| `results[].cve.enrichment.epss_score` | object |
| `results[].cve.enrichment.epss_score.epss` | number |
| `results[].cve.enrichment.epss_score.percentile` | number |
| `results[].cve.enrichment.epss_score.date` | string |
| `results[].cve.enrichment.cisa_kev` | null |
| `results[].cve.enrichment.vdeep_metric` | object |
| `results[].cve.enrichment.vdeep_metric.cvss_version` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data` | object |
| `results[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | string |
| `results[].cve.enrichment.vdeep_metric.cvss_data.base_score` | number |
| `results[].cve.enrichment.vdeep_metric.cvss_data.base_severity` | string |
| `results[].affected_asset_count` | object |
| `results[].affected_asset_count.total` | number |
| `results[].affected_asset_count.domain` | number |
| `results[].affected_asset_count.subdomain` | number |
| `results[].affected_asset_count.ip` | number |
| `results[].affected_asset_count.website` | number |
| `results[].affected_domain_asset_count` | number |
| `results[].affected_asset_tags` | array |
| `results[].first_seen_date` | string |
| `results[].last_seen_date` | string |
| `results[].last_check_date` | string |
| `results[].state` | string |
| `results[].is_certain` | boolean |
| `results[].is_potential` | boolean |
| `results[].certainly_affected_asset_count` | object |
| `results[].certainly_affected_asset_count.total` | number |
| `results[].certainly_affected_asset_count.domain` | number |
| `results[].certainly_affected_asset_count.subdomain` | number |
| `results[].certainly_affected_asset_count.ip` | number |
| `results[].certainly_affected_asset_count.website` | number |
| `results[].potentially_affected_asset_count` | object |
| `results[].potentially_affected_asset_count.total` | number |
| `results[].potentially_affected_asset_count.domain` | number |
| `results[].potentially_affected_asset_count.subdomain` | number |
| `results[].potentially_affected_asset_count.ip` | number |
| `results[].potentially_affected_asset_count.website` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-search.md


---

# Vulnerability Asset Export

URL: https://docs.deepinfo.com/reference/easm/vulnerability-asset-export/

POST /easm/vulnerabilities/asset-search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/asset-search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The affected asset's name, for filtering: a domain, subdomain or IP address, or for a website asset `host:port`. Filter with `eq` and the exact name to get one asset's CVEs; responses carry it in `asset.name`. |
| `domain_asset` | The name of the domain asset the affected asset belongs to, for filtering (for a domain, its own name); responses carry it in `asset.domain_asset.name`. |
| `asset_tags` | Your own tags on the affected asset, for filtering; responses carry them in `asset.tags`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this CVE, in ISO 8601 UTC; it equals `last_seen_date` while the CVE is still found and is later once the CVE is `verified_resolved`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The affected asset's type, for filtering: `domain`, `subdomain`, `ip` or `website`; responses carry it in `asset.type`. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The affected asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. Sort only; filter with `asset`. |
| `asset.type` | The affected asset's type: `domain`, `subdomain`, `ip` or `website`. Sort only; filter with `asset_type`. |
| `asset.domain_asset.name` | The name of the domain asset the affected asset belongs to (for a domain, its own name); null when the asset's domain is not one of your assets. Sort only; filter with `domain_asset`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-asset-export.md


---

# Vulnerability Export

URL: https://docs.deepinfo.com/reference/easm/vulnerability-export/

POST /easm/vulnerabilities/search:export: Exports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array.

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "cve.id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `affected_asset_count.total` | Number of your assets the CVE is active on (state `newly_detected`, `unresolved` or `reappeared`); the Vulnerability List shows it as ASSETS. |
| `affected_asset_count.domain` | Number of domain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.subdomain` | Number of subdomain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.ip` | Number of IP address assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.website` | Number of website assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_domain_asset_count` | Number of domain assets the CVE is active on; in the samples it always equals `affected_asset_count.domain`. |
| `first_seen_date` | When the CVE was first detected on any of your assets, in ISO 8601 UTC: the earliest `first_seen_date` of its per-asset records. The platform marks a CVE first seen in the last 7 days as NEW. |
| `last_seen_date` | When the CVE was most recently detected on any of your assets, in ISO 8601 UTC: the latest `last_seen_date` of its per-asset records. |
| `last_check_date` | When your assets were last checked for the CVE, in ISO 8601 UTC: the latest `last_check_date` of its per-asset records. |
| `certainly_affected_asset_count.total` | Number of your assets on which the CVE is certain (verified through testing and confirmed as valid), whatever the per-asset state, active or inactive. |
| `certainly_affected_asset_count.domain` | Number of domain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.ip` | Number of IP address assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.website` | Number of website assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `potentially_affected_asset_count.total` | Number of your assets on which the CVE is potential (identified through testing but not yet confirmed), whatever the per-asset state, active or inactive. |
| `potentially_affected_asset_count.domain` | Number of domain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.ip` | Number of IP address assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.website` | Number of website assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; the Vulnerability List's SEARCH box matches it. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |
| `affected_asset_tags` | Your own tags on the assets the CVE affects, as a list of strings; filter on it to find CVEs on assets with a given tag. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | Whether the CVE is still active on at least one of your assets: `active` or `inactive`. The per-asset states are in Vulnerability Asset Search, and the Vulnerability List shows `active` CVEs only. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE is certain on at least one of your assets, that is, verified through testing and confirmed as valid; see `certainly_affected_asset_count`. |
| `is_potential` | `true` when the CVE is potential on at least one of your assets, that is, identified through testing but not yet confirmed; see `potentially_affected_asset_count`. |

### Sortable Fields

| Field | Description |
|---|---|
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; the Vulnerability List's SEARCH box matches it. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `affected_asset_count.total` | Number of your assets the CVE is active on (state `newly_detected`, `unresolved` or `reappeared`); the Vulnerability List shows it as ASSETS. |
| `affected_asset_count.domain` | Number of domain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.subdomain` | Number of subdomain assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.ip` | Number of IP address assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_asset_count.website` | Number of website assets the CVE is active on; part of `affected_asset_count.total`. |
| `affected_domain_asset_count` | Number of domain assets the CVE is active on; in the samples it always equals `affected_asset_count.domain`. |
| `first_seen_date` | When the CVE was first detected on any of your assets, in ISO 8601 UTC: the earliest `first_seen_date` of its per-asset records. The platform marks a CVE first seen in the last 7 days as NEW. |
| `last_seen_date` | When the CVE was most recently detected on any of your assets, in ISO 8601 UTC: the latest `last_seen_date` of its per-asset records. |
| `state` | Whether the CVE is still active on at least one of your assets: `active` or `inactive`. The per-asset states are in Vulnerability Asset Search, and the Vulnerability List shows `active` CVEs only. |
| `is_certain` | `true` when the CVE is certain on at least one of your assets, that is, verified through testing and confirmed as valid; see `certainly_affected_asset_count`. |
| `is_potential` | `true` when the CVE is potential on at least one of your assets, that is, identified through testing but not yet confirmed; see `potentially_affected_asset_count`. |
| `certainly_affected_asset_count.total` | Number of your assets on which the CVE is certain (verified through testing and confirmed as valid), whatever the per-asset state, active or inactive. |
| `certainly_affected_asset_count.domain` | Number of domain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.ip` | Number of IP address assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `certainly_affected_asset_count.website` | Number of website assets on which the CVE is certain, active or inactive; part of `certainly_affected_asset_count.total`. |
| `potentially_affected_asset_count.total` | Number of your assets on which the CVE is potential (identified through testing but not yet confirmed), whatever the per-asset state, active or inactive. |
| `potentially_affected_asset_count.domain` | Number of domain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.subdomain` | Number of subdomain assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.ip` | Number of IP address assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |
| `potentially_affected_asset_count.website` | Number of website assets on which the CVE is potential, active or inactive; part of `potentially_affected_asset_count.total`. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-export.md


---

# Vulnerability Detail

URL: https://docs.deepinfo.com/reference/easm/vulnerability-detail/

GET /easm/vulnerabilities/{vulnerability_id}: Returns one vulnerability with CVE details and affected assets.

`GET https://api.deepinfo.com/v1/easm/vulnerabilities/{vulnerability_id}`

Returns one vulnerability with CVE details and affected assets.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `vulnerability_id` | Required |  | `00000000000000000000000e0c9d0001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `cve` | object |  |
| `affected_asset_count` | object |  |
| `affected_domain_asset_count` | integer |  |
| `affected_asset_tags` | array of string |  |
| `first_seen_date` | string | date-time |
| `last_seen_date` | string | date-time |
| `last_check_date` | string | date-time |
| `state` | string | One of `active`, `inactive` |
| `is_certain` | boolean |  |
| `is_potential` | boolean |  |
| `certainly_affected_asset_count` | object |  |
| `potentially_affected_asset_count` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `cve` | object |
| `cve.id` | string |
| `cve.published` | string |
| `cve.last_modified` | string |
| `cve.enrichment` | object |
| `cve.enrichment.cwe` | array |
| `cve.enrichment.epss_score` | object |
| `cve.enrichment.epss_score.epss` | number |
| `cve.enrichment.epss_score.percentile` | number |
| `cve.enrichment.epss_score.date` | string |
| `cve.enrichment.cisa_kev` | null |
| `cve.enrichment.vdeep_metric` | object |
| `cve.enrichment.vdeep_metric.cvss_version` | string |
| `cve.enrichment.vdeep_metric.cvss_data` | object |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | string |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | string |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | string |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | number |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | string |
| `affected_asset_count` | object |
| `affected_asset_count.total` | number |
| `affected_asset_count.domain` | number |
| `affected_asset_count.subdomain` | number |
| `affected_asset_count.ip` | number |
| `affected_asset_count.website` | number |
| `affected_domain_asset_count` | number |
| `affected_asset_tags` | array |
| `first_seen_date` | string |
| `last_seen_date` | string |
| `last_check_date` | string |
| `state` | string |
| `is_certain` | boolean |
| `is_potential` | boolean |
| `certainly_affected_asset_count` | object |
| `certainly_affected_asset_count.total` | number |
| `certainly_affected_asset_count.domain` | number |
| `certainly_affected_asset_count.subdomain` | number |
| `certainly_affected_asset_count.ip` | number |
| `certainly_affected_asset_count.website` | number |
| `potentially_affected_asset_count` | object |
| `potentially_affected_asset_count.total` | number |
| `potentially_affected_asset_count.domain` | number |
| `potentially_affected_asset_count.subdomain` | number |
| `potentially_affected_asset_count.ip` | number |
| `potentially_affected_asset_count.website` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-detail.md


---

# Vulnerability Accept Risk

URL: https://docs.deepinfo.com/reference/easm/vulnerability-accept-risk/

POST /easm/vulnerabilities/search:accept-risk: Accepts the risk of the asset vulnerabilities that match filters (risk_accepted).

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/search:accept-risk`

Accepts the risk of the asset vulnerabilities that match `filters` (`risk_accepted`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      },
      {
        "name": "cve.id",
        "type": "eq",
        "value": "CVE-0000-0002"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The affected asset's name, for filtering: a domain, subdomain or IP address, or for a website asset `host:port`. Filter with `eq` and the exact name to get one asset's CVEs; responses carry it in `asset.name`. |
| `domain_asset` | The name of the domain asset the affected asset belongs to, for filtering (for a domain, its own name); responses carry it in `asset.domain_asset.name`. |
| `asset_tags` | Your own tags on the affected asset, for filtering; responses carry them in `asset.tags`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this CVE, in ISO 8601 UTC; it equals `last_seen_date` while the CVE is still found and is later once the CVE is `verified_resolved`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The affected asset's type, for filtering: `domain`, `subdomain`, `ip` or `website`; responses carry it in `asset.type`. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The affected asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. Sort only; filter with `asset`. |
| `asset.type` | The affected asset's type: `domain`, `subdomain`, `ip` or `website`. Sort only; filter with `asset_type`. |
| `asset.domain_asset.name` | The name of the domain asset the affected asset belongs to (for a domain, its own name); null when the asset's domain is not one of your assets. Sort only; filter with `domain_asset`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

## Response Fields

| Field | Type |
|---|---|
| `asset_vulnerability_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset_vulnerability_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-accept-risk.md


---

# Vulnerability Ignore

URL: https://docs.deepinfo.com/reference/easm/vulnerability-ignore/

POST /easm/vulnerabilities/search:ignore: Ignores the asset vulnerabilities that match filters (ignored).

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/search:ignore`

Ignores the asset vulnerabilities that match `filters` (`ignored`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      },
      {
        "name": "cve.id",
        "type": "eq",
        "value": "CVE-0000-0002"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The affected asset's name, for filtering: a domain, subdomain or IP address, or for a website asset `host:port`. Filter with `eq` and the exact name to get one asset's CVEs; responses carry it in `asset.name`. |
| `domain_asset` | The name of the domain asset the affected asset belongs to, for filtering (for a domain, its own name); responses carry it in `asset.domain_asset.name`. |
| `asset_tags` | Your own tags on the affected asset, for filtering; responses carry them in `asset.tags`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this CVE, in ISO 8601 UTC; it equals `last_seen_date` while the CVE is still found and is later once the CVE is `verified_resolved`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The affected asset's type, for filtering: `domain`, `subdomain`, `ip` or `website`; responses carry it in `asset.type`. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The affected asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. Sort only; filter with `asset`. |
| `asset.type` | The affected asset's type: `domain`, `subdomain`, `ip` or `website`. Sort only; filter with `asset_type`. |
| `asset.domain_asset.name` | The name of the domain asset the affected asset belongs to (for a domain, its own name); null when the asset's domain is not one of your assets. Sort only; filter with `domain_asset`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

## Response Fields

| Field | Type |
|---|---|
| `asset_vulnerability_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset_vulnerability_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-ignore.md


---

# Vulnerability Mark False Positive

URL: https://docs.deepinfo.com/reference/easm/vulnerability-mark-false-positive/

POST /easm/vulnerabilities/search:mark-false-positive: Marks the asset vulnerabilities that match filters as false positive (marked_as_false_positive).

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/search:mark-false-positive`

Marks the asset vulnerabilities that match `filters` as false positive (`marked_as_false_positive`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      },
      {
        "name": "cve.id",
        "type": "eq",
        "value": "CVE-0000-0002"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The affected asset's name, for filtering: a domain, subdomain or IP address, or for a website asset `host:port`. Filter with `eq` and the exact name to get one asset's CVEs; responses carry it in `asset.name`. |
| `domain_asset` | The name of the domain asset the affected asset belongs to, for filtering (for a domain, its own name); responses carry it in `asset.domain_asset.name`. |
| `asset_tags` | Your own tags on the affected asset, for filtering; responses carry them in `asset.tags`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this CVE, in ISO 8601 UTC; it equals `last_seen_date` while the CVE is still found and is later once the CVE is `verified_resolved`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The affected asset's type, for filtering: `domain`, `subdomain`, `ip` or `website`; responses carry it in `asset.type`. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The affected asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. Sort only; filter with `asset`. |
| `asset.type` | The affected asset's type: `domain`, `subdomain`, `ip` or `website`. Sort only; filter with `asset_type`. |
| `asset.domain_asset.name` | The name of the domain asset the affected asset belongs to (for a domain, its own name); null when the asset's domain is not one of your assets. Sort only; filter with `domain_asset`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

## Response Fields

| Field | Type |
|---|---|
| `asset_vulnerability_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset_vulnerability_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-mark-false-positive.md


---

# Vulnerability Mark Resolved

URL: https://docs.deepinfo.com/reference/easm/vulnerability-mark-resolved/

POST /easm/vulnerabilities/search:mark-resolved: Marks the asset vulnerabilities that match filters as resolved (marked_as_resolved).

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/search:mark-resolved`

Marks the asset vulnerabilities that match `filters` as resolved (`marked_as_resolved`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      },
      {
        "name": "cve.id",
        "type": "eq",
        "value": "CVE-0000-0002"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The affected asset's name, for filtering: a domain, subdomain or IP address, or for a website asset `host:port`. Filter with `eq` and the exact name to get one asset's CVEs; responses carry it in `asset.name`. |
| `domain_asset` | The name of the domain asset the affected asset belongs to, for filtering (for a domain, its own name); responses carry it in `asset.domain_asset.name`. |
| `asset_tags` | Your own tags on the affected asset, for filtering; responses carry them in `asset.tags`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this CVE, in ISO 8601 UTC; it equals `last_seen_date` while the CVE is still found and is later once the CVE is `verified_resolved`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The affected asset's type, for filtering: `domain`, `subdomain`, `ip` or `website`; responses carry it in `asset.type`. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The affected asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. Sort only; filter with `asset`. |
| `asset.type` | The affected asset's type: `domain`, `subdomain`, `ip` or `website`. Sort only; filter with `asset_type`. |
| `asset.domain_asset.name` | The name of the domain asset the affected asset belongs to (for a domain, its own name); null when the asset's domain is not one of your assets. Sort only; filter with `domain_asset`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

## Response Fields

| Field | Type |
|---|---|
| `asset_vulnerability_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset_vulnerability_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-mark-resolved.md


---

# Vulnerability Revert

URL: https://docs.deepinfo.com/reference/easm/vulnerability-revert/

POST /easm/vulnerabilities/search:revert: Reverts the asset vulnerabilities that match filters to their previous, active state.

`POST https://api.deepinfo.com/v1/easm/vulnerabilities/search:revert`

Reverts the asset vulnerabilities that match `filters` to their previous, active state. Only states set by a user can be reverted.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "acme.example"
      },
      {
        "name": "cve.id",
        "type": "eq",
        "value": "CVE-0000-0002"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset.name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The affected asset's name, for filtering: a domain, subdomain or IP address, or for a website asset `host:port`. Filter with `eq` and the exact name to get one asset's CVEs; responses carry it in `asset.name`. |
| `domain_asset` | The name of the domain asset the affected asset belongs to, for filtering (for a domain, its own name); responses carry it in `asset.domain_asset.name`. |
| `asset_tags` | Your own tags on the affected asset, for filtering; responses carry them in `asset.tags`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.enrichment.vdeep_metric.cvss_version` | CVSS version of the CVE's main CVSS assessment, the one the `cvss_data` fields come from, for example `3.1`, `3.0` or `2.0`. |
| `cve.enrichment.cwe.owasptop10_2021` | OWASP Top 10 (2021) category of a CWE weakness linked to the CVE, for example `A03 Injection` or `A01 Broken Access Control`; empty when the CWE has none. The platform shows it as the OWASP chip. |
| `cve.enrichment.cwe.name` | Name of a CWE weakness linked to the CVE, for example `Out-of-bounds Write` or `Improper Input Validation`. |
| `cve.enrichment.cwe.description` | The CWE catalog's description of a weakness linked to the CVE. |
| `cve.enrichment.cwe.scope` | Security areas a CWE weakness of the CVE can affect, from the CWE entry. Values seen: `Confidentiality`, `Integrity`, `Availability`, `Access Control`, `Authentication`, `Authorization`, `Accountability`, `Non-Repudiation`, `Other`. |
| `cve.enrichment.cwe.impact` | Technical impacts a CWE weakness of the CVE can have, from the CWE entry, for example `Execute Unauthorized Code or Commands`, `Read Memory` or `DoS: Crash, Exit, or Restart`. |
| `cve.enrichment.cwe.detection_method` | Methods that can detect a CWE weakness of the CVE, from the CWE entry, for example `Automated Static Analysis`, `Fuzzing` or `Manual Analysis`; the platform shows them as DETECTION METHOD. |
| `cve.enrichment.cisa_kev.vendor_project` | Vendor or project named in the CVE's CISA Known Exploited Vulnerabilities (KEV) catalog entry, for example `Apache` or `Microsoft`; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.product` | Product named in the CVE's CISA KEV entry, for example `Log4j2` or `Multiple Products`. |
| `cve.enrichment.cisa_kev.vulnerability_name` | Name of the vulnerability in the CVE's CISA KEV entry, for example `Apache Log4j2 Remote Code Execution Vulnerability`. |
| `cve.enrichment.cisa_kev.short_description` | CISA's short description of the vulnerability in the CVE's KEV entry. |
| `cve.enrichment.cisa_kev.required_action` | Action CISA requires in the CVE's KEV entry, for example `Apply updates per vendor instructions.` |
| `cve.enrichment.cisa_kev.known_ransomware_campaign_use` | Whether the CVE's CISA KEV entry reports use in ransomware campaigns: `Known` or `Unknown`; the platform adds a RANSOMWARE badge for `Known`. |
| `cve.enrichment.cisa_kev.notes` | Notes in the CVE's CISA KEV entry, often reference URLs. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.cwe.capec_id` | IDs of CAPEC attack patterns related to a CWE weakness of the CVE, as numbers; the platform shows them as `CAPEC-<id>` under ATTACK STAGES. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.epss_score.percentile` | Percentile of the CVE's EPSS score among all scored CVEs, from 0 to 1 (`0.95` means 95% of them have the same or a lower score). |
| `cve.enrichment.epss_score.date` | Date of the CVE's EPSS score, as a UTC date-time at midnight (for example `2026-09-23T00:00:00Z`); the platform shows it as ANALYSIS DATE. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `cve.enrichment.cisa_kev.due_date` | Remediation due date in the CVE's CISA KEV entry, as a UTC date-time at midnight, shown as REMEDIATION DUE. CVEs that have it get the red EXPLOITABLE pill. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `last_check_date` | When the asset was last checked for this CVE, in ISO 8601 UTC; it equals `last_seen_date` while the CVE is still found and is later once the CVE is `verified_resolved`. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The affected asset's type, for filtering: `domain`, `subdomain`, `ip` or `website`; responses carry it in `asset.type`. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | Confidentiality impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the C of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | Integrity impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the I of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | Availability impact of the CVE's main CVSS assessment: `NONE`, `PARTIAL` or `COMPLETE` for CVSS 2.0, `NONE`, `LOW` or `HIGH` for CVSS 3.x. The platform shows it as the A of the C/I/A chip. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

### Sortable Fields

| Field | Description |
|---|---|
| `asset.name` | The affected asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. Sort only; filter with `asset`. |
| `asset.type` | The affected asset's type: `domain`, `subdomain`, `ip` or `website`. Sort only; filter with `asset_type`. |
| `asset.domain_asset.name` | The name of the domain asset the affected asset belongs to (for a domain, its own name); null when the asset's domain is not one of your assets. Sort only; filter with `domain_asset`. |
| `technologies.vendor` | Vendor of a technology detected on the affected asset, as a lower-case identifier such as `apache`, `php` or `jquery`. In the samples every CVE record of the same asset carries the same technology list, so the list describes the asset, not the CVE. |
| `technologies.product` | Product name of a technology detected on the affected asset, as a lower-case identifier such as `http_server`, `php` or `bootstrap`. |
| `technologies.version` | Detected version of that technology on the affected asset, such as `1.0.0`; empty when no version was detected. |
| `cve.id` | The CVE identifier, such as `CVE-2021-44228`; filter on it to list the assets the CVE affects. |
| `cve.published` | When the CVE was first published, in ISO 8601 UTC (for example `2025-06-01T08:00:00Z`). |
| `cve.last_modified` | When the CVE record was last changed, in ISO 8601 UTC. |
| `cve.enrichment.vdeep_metric.cvss_data.base_score` | CVSS base score of the CVE's main CVSS assessment, from 0 to 10. The platform shows it as SCORE/SEVERITY. |
| `cve.enrichment.vdeep_metric.cvss_data.base_severity` | Severity of the CVE's main CVSS assessment: `critical`, `high`, `medium`, `low`, `none` or `unknown`; CVSS 2.0 has no `critical`, so a 2.0 score of 10 is `high`. The Vulnerability List severity tabs filter on it. |
| `cve.enrichment.cwe.id` | Number of a CWE weakness linked to the CVE, for example `787` for CWE-787; a CVE can have several CWEs or none. The platform shows it as `CWE-<id>` after the CWE name. |
| `cve.enrichment.epss_score.epss` | EPSS score of the CVE: the estimated probability, from 0 to 1, that it will be exploited in the next 30 days. The platform shows it as a percentage. |
| `cve.enrichment.cisa_kev.date_added` | Date the CVE was added to the CISA KEV catalog, as a UTC date-time at midnight, shown as ADDED TO KEV; empty for CVEs not in the catalog. |
| `first_seen_date` | When the CVE was first detected on this asset, in ISO 8601 UTC. |
| `last_seen_date` | When the CVE was most recently detected on this asset, in ISO 8601 UTC. |
| `state` | The CVE's state on this asset: `newly_detected`, `unresolved` and `reappeared` are active states set by the platform; `not_applicable` and `verified_resolved` are inactive states set by the platform, and `ignored`, `risk_accepted`, `marked_as_resolved` and `marked_as_false_positive` are inactive states you set. |
| `is_certain` | `true` when the CVE on this asset has been verified through testing and confirmed as valid (Certain). In the samples each record is either certain or potential, never both. |
| `is_potential` | `true` when the CVE on this asset has been identified through testing but not yet confirmed (Potential). |

## Response Fields

| Field | Type |
|---|---|
| `asset_vulnerability_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `asset_vulnerability_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-revert.md


---

# Vulnerability Exploitability Score Stats

URL: https://docs.deepinfo.com/reference/easm/vulnerability-exploitability-score-stats/

GET /easm/vulnerabilities/stats/exploitability-score: Distribution of vulnerabilities by exploitability score.

`GET https://api.deepinfo.com/v1/easm/vulnerabilities/stats/exploitability-score`

Distribution of vulnerabilities by exploitability score.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |
| `vendor` | Optional |  |  |
| `product` | Optional |  |  |
| `version` | Optional |  |  |

## Response Fields

| Field | Type |
|---|---|
| `average_exploitability_score_cve` | number |
| `average_exploitability_score_asset_cve` | number |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `average_exploitability_score_cve` | number |
| `average_exploitability_score_asset_cve` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-exploitability-score-stats.md


---

# Vulnerability Known Exploitable Stats

URL: https://docs.deepinfo.com/reference/easm/vulnerability-known-exploitable-stats/

GET /easm/vulnerabilities/stats/known-exploitable: Counts known-exploited (CISA KEV) vulnerabilities.

`GET https://api.deepinfo.com/v1/easm/vulnerabilities/stats/known-exploitable`

Counts known-exploited (CISA KEV) vulnerabilities.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |
| `vendor` | Optional |  |  |
| `product` | Optional |  |  |
| `version` | Optional |  |  |

## Response Fields

| Field | Type |
|---|---|
| `total_cve_count` | integer |
| `total_asset_count` | integer |
| `total_asset_cve_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `total_cve_count` | number |
| `total_asset_count` | number |
| `total_asset_cve_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-known-exploitable-stats.md


---

# Vulnerability Severity Stats

URL: https://docs.deepinfo.com/reference/easm/vulnerability-severity-stats/

GET /easm/vulnerabilities/stats/severity: Counts vulnerabilities per severity.

`GET https://api.deepinfo.com/v1/easm/vulnerabilities/stats/severity`

Counts vulnerabilities per severity.

Filters:

- `asset`
- `vendor`
- `product`
- `version`

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |
| `vendor` | Optional |  |  |
| `product` | Optional |  |  |
| `version` | Optional |  |  |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `severity` | string | One of `critical`, `high`, `medium`, `low`, `none`, `unknown` |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].severity` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-severity-stats.md


---

# Vulnerability Severity Stats Timeline

URL: https://docs.deepinfo.com/reference/easm/vulnerability-severity-stats-timeline/

GET /easm/vulnerabilities/stats/severity-timeline: Time series of severity for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/vulnerabilities/stats/severity-timeline`

Time series of severity for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `severities` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].severities` | array<object> |
| `[].severities[].name` | string |
| `[].severities[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/vulnerability-severity-stats-timeline.md


---

# Technology Asset Search

URL: https://docs.deepinfo.com/reference/easm/technology-asset-search/

POST /easm/technologies/asset-search: Searches technologies per asset (one record per asset + technology).

`POST https://api.deepinfo.com/v1/easm/technologies/asset-search`

Searches technologies per asset (one record per asset + technology).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | object | Optional | One `{field, order}` object |

```json
{}
```

## Filtering

This search takes `filters` as an object with one key per field, not as a `must` list. Each field takes the operators of its filter type as keys, and fields combine with AND. `sort` is one `{field, order}` object, not a list. Example body:

```json
{
  "filters": {
    "technology": {
      "equals": [
        "<value>"
      ]
    }
  },
  "sort": {
    "field": "technology",
    "order": "desc"
  }
}
```

Operators by field:

| Field | Operators |
|---|---|
| `technology` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `asset` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `categories` | `equals`, `not_equals`, `contains`, `not_contains` |
| `versions` | `equals`, `not_equals`; each takes a list of values |
| `latest_version` | `equals`, `not_equals` |
| `vulnerabilities` | `gt`, `gte`, `lt`, `lte` |

### Searchable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP`. Matching is case-insensitive. |
| `asset` | The name of the asset the technology was found on, such as `www.acme.example`. |
| `categories` | The technology's categories, such as `Web servers`. |
| `versions` | The versions of the technology found on this asset, such as `1.0.0`; `unknown` when no version was detected. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerabilities` | The number of known vulnerabilities of the technology's versions on this asset (`vulnerability_stats.total` in the response). |

### Sortable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP`. Matching is case-insensitive. |
| `asset` | The name of the asset the technology was found on, such as `www.acme.example`. |
| `categories` | The technology's categories, such as `Web servers`. |
| `versions` | The versions of the technology found on this asset, such as `1.0.0`; `unknown` when no version was detected. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerabilities` | The number of known vulnerabilities of the technology's versions on this asset (`vulnerability_stats.total` in the response). |

## Response Fields

| Field | Type |
|---|---|
| `page` | integer |
| `page_size` | integer |
| `result_count` | integer |
| `results` | array of object |
| `results[].id` | string |
| `results[].technology` | string |
| `results[].favicon` | string |
| `results[].asset` | object |
| `results[].categories` | array of string |
| `results[].versions` | array of object |
| `results[].latest_version` | string |
| `results[].vulnerability_stats` | object |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].technology` | string |
| `results[].favicon` | string |
| `results[].asset` | object |
| `results[].asset.id` | string |
| `results[].asset.name` | string |
| `results[].asset.name_unicode` | string |
| `results[].asset.type` | string |
| `results[].categories` | array<string> |
| `results[].versions` | array<object> |
| `results[].versions[].version` | string |
| `results[].versions[].has_vulnerability` | boolean |
| `results[].latest_version` | string |
| `results[].vulnerability_stats` | object |
| `results[].vulnerability_stats.total` | number |
| `results[].vulnerability_stats.by_severity` | object |
| `results[].vulnerability_stats.by_severity.critical` | number |
| `results[].vulnerability_stats.by_severity.high` | number |
| `results[].vulnerability_stats.by_severity.medium` | number |
| `results[].vulnerability_stats.by_severity.low` | number |
| `results[].vulnerability_stats.by_severity.none` | number |
| `results[].vulnerability_stats.by_severity.unknown` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-asset-search.md


---

# Technology Search

URL: https://docs.deepinfo.com/reference/easm/technology-search/

POST /easm/technologies/search: Searches technologies detected on your assets, with versions and vulnerability counts.

`POST https://api.deepinfo.com/v1/easm/technologies/search`

Searches technologies detected on your assets, with versions and vulnerability counts.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | object | Optional | One `{field, order}` object |

```json
{}
```

## Filtering

This search takes `filters` as an object with one key per field, not as a `must` list. Each field takes the operators of its filter type as keys, and fields combine with AND. `sort` is one `{field, order}` object, not a list. Example body:

```json
{
  "filters": {
    "technology": {
      "equals": "<value>"
    }
  },
  "sort": {
    "field": "technology",
    "order": "desc"
  }
}
```

Operators by field:

| Field | Operators |
|---|---|
| `technology` | `equals`, `not_equals`, `contains`, `not_contains` |
| `categories` | `equals`, `not_equals`, `contains`, `not_contains` |
| `affected_asset_count` | `gt`, `gte`, `lt`, `lte` |
| `versions` | `equals`, `not_equals`; each takes a list of values |
| `version_scope` | a plain value: `all`, `out_of_date` |
| `latest_version` | `equals`, `not_equals` |
| `vulnerability_stats` | `gt`, `gte`, `lt`, `lte` |

### Searchable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP` or `nginx`; the list's TECHNOLOGY column. Matching is case-insensitive. |
| `categories` | The technology's categories, such as `Web servers` or `JavaScript libraries`. A technology can have several. |
| `affected_asset_count` | How many of your assets use the technology. |
| `versions` | The versions of the technology found on your assets, such as `1.0.0`; `unknown` when no version was detected. Each version says whether it has known vulnerabilities. |
| `version_scope` | `out_of_date` keeps only technologies with a version older than the latest one; `all` (the default) keeps every technology. The platform's VERSION SCOPE filter. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerability_stats` | The number of known vulnerabilities of the technology's versions on your assets (`vulnerability_stats.total` in the response); the platform's TOTAL VULN. COUNT. |

### Sortable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP` or `nginx`; the list's TECHNOLOGY column. Matching is case-insensitive. |
| `categories` | The technology's categories, such as `Web servers` or `JavaScript libraries`. A technology can have several. |
| `affected_asset_count` | How many of your assets use the technology. |
| `versions` | The versions of the technology found on your assets, such as `1.0.0`; `unknown` when no version was detected. Each version says whether it has known vulnerabilities. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerability_stats` | The number of known vulnerabilities of the technology's versions on your assets (`vulnerability_stats.total` in the response); the platform's TOTAL VULN. COUNT. |

## Response Fields

| Field | Type |
|---|---|
| `page` | integer |
| `page_size` | integer |
| `result_count` | integer |
| `results` | array of object |
| `results[].id` | string |
| `results[].technology` | string |
| `results[].favicon` | string |
| `results[].categories` | array of string |
| `results[].affected_asset_count` | integer |
| `results[].versions` | array of object |
| `results[].latest_version` | string |
| `results[].vulnerability_stats` | object |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].technology` | string |
| `results[].favicon` | string |
| `results[].categories` | array<string> |
| `results[].affected_asset_count` | number |
| `results[].versions` | array<object> |
| `results[].versions[].version` | string |
| `results[].versions[].has_vulnerability` | boolean |
| `results[].latest_version` | string |
| `results[].vulnerability_stats` | object |
| `results[].vulnerability_stats.total` | number |
| `results[].vulnerability_stats.by_severity` | object |
| `results[].vulnerability_stats.by_severity.critical` | number |
| `results[].vulnerability_stats.by_severity.high` | number |
| `results[].vulnerability_stats.by_severity.medium` | number |
| `results[].vulnerability_stats.by_severity.low` | number |
| `results[].vulnerability_stats.by_severity.none` | number |
| `results[].vulnerability_stats.by_severity.unknown` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-search.md


---

# Technology Asset Export

URL: https://docs.deepinfo.com/reference/easm/technology-asset-export/

POST /easm/technologies/asset-search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/easm/technologies/asset-search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | object | Optional | One `{field, order}` object |

```json
{}
```

## Filtering

This search takes `filters` as an object with one key per field, not as a `must` list. Each field takes the operators of its filter type as keys, and fields combine with AND. `sort` is one `{field, order}` object, not a list. Example body:

```json
{
  "filters": {
    "technology": {
      "equals": [
        "<value>"
      ]
    }
  },
  "sort": {
    "field": "technology",
    "order": "desc"
  }
}
```

Operators by field:

| Field | Operators |
|---|---|
| `technology` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `asset` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `categories` | `equals`, `not_equals`, `contains`, `not_contains` |
| `versions` | `equals`, `not_equals`; each takes a list of values |
| `latest_version` | `equals`, `not_equals` |
| `vulnerabilities` | `gt`, `gte`, `lt`, `lte` |

### Searchable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP`. Matching is case-insensitive. |
| `asset` | The name of the asset the technology was found on, such as `www.acme.example`. |
| `categories` | The technology's categories, such as `Web servers`. |
| `versions` | The versions of the technology found on this asset, such as `1.0.0`; `unknown` when no version was detected. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerabilities` | The number of known vulnerabilities of the technology's versions on this asset (`vulnerability_stats.total` in the response). |

### Sortable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP`. Matching is case-insensitive. |
| `asset` | The name of the asset the technology was found on, such as `www.acme.example`. |
| `categories` | The technology's categories, such as `Web servers`. |
| `versions` | The versions of the technology found on this asset, such as `1.0.0`; `unknown` when no version was detected. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerabilities` | The number of known vulnerabilities of the technology's versions on this asset (`vulnerability_stats.total` in the response). |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-asset-export.md


---

# Technology Export

URL: https://docs.deepinfo.com/reference/easm/technology-export/

POST /easm/technologies/search:export: Exports every record matching filters (no pagination). format=csv returns CSV text; format=json returns a JSON array.

`POST https://api.deepinfo.com/v1/easm/technologies/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | object | Optional | One `{field, order}` object |

```json
{}
```

## Filtering

This search takes `filters` as an object with one key per field, not as a `must` list. Each field takes the operators of its filter type as keys, and fields combine with AND. `sort` is one `{field, order}` object, not a list. Example body:

```json
{
  "filters": {
    "technology": {
      "equals": "<value>"
    }
  },
  "sort": {
    "field": "technology",
    "order": "desc"
  }
}
```

Operators by field:

| Field | Operators |
|---|---|
| `technology` | `equals`, `not_equals`, `contains`, `not_contains` |
| `categories` | `equals`, `not_equals`, `contains`, `not_contains` |
| `affected_asset_count` | `gt`, `gte`, `lt`, `lte` |
| `versions` | `equals`, `not_equals`; each takes a list of values |
| `version_scope` | a plain value: `all`, `out_of_date` |
| `latest_version` | `equals`, `not_equals` |
| `vulnerability_stats` | `gt`, `gte`, `lt`, `lte` |

### Searchable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP` or `nginx`; the list's TECHNOLOGY column. Matching is case-insensitive. |
| `categories` | The technology's categories, such as `Web servers` or `JavaScript libraries`. A technology can have several. |
| `affected_asset_count` | How many of your assets use the technology. |
| `versions` | The versions of the technology found on your assets, such as `1.0.0`; `unknown` when no version was detected. Each version says whether it has known vulnerabilities. |
| `version_scope` | `out_of_date` keeps only technologies with a version older than the latest one; `all` (the default) keeps every technology. The platform's VERSION SCOPE filter. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerability_stats` | The number of known vulnerabilities of the technology's versions on your assets (`vulnerability_stats.total` in the response); the platform's TOTAL VULN. COUNT. |

### Sortable Fields

| Field | Description |
|---|---|
| `technology` | The technology's name, such as `PHP` or `nginx`; the list's TECHNOLOGY column. Matching is case-insensitive. |
| `categories` | The technology's categories, such as `Web servers` or `JavaScript libraries`. A technology can have several. |
| `affected_asset_count` | How many of your assets use the technology. |
| `versions` | The versions of the technology found on your assets, such as `1.0.0`; `unknown` when no version was detected. Each version says whether it has known vulnerabilities. |
| `latest_version` | The latest released version of the technology, such as `1.2.3`; `unknown` when it is not known. |
| `vulnerability_stats` | The number of known vulnerabilities of the technology's versions on your assets (`vulnerability_stats.total` in the response); the platform's TOTAL VULN. COUNT. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-export.md


---

# Technology Detail

URL: https://docs.deepinfo.com/reference/easm/technology-detail/

GET /easm/technologies/{tech_id}: Returns one technology with its versions and affected assets.

`GET https://api.deepinfo.com/v1/easm/technologies/{tech_id}`

Returns one technology with its versions and affected assets.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `tech_id` | Required |  | `00000000000000000000000e2cc20001` |

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `icon` | string |
| `categories` | array of string |
| `official_website` | string |
| `description` | string |
| `latest_version` | string |
| `vendor` | string |
| `product` | string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `icon` | string |
| `categories` | array<string> |
| `official_website` | string |
| `description` | string |
| `latest_version` | string |
| `vendor` | string |
| `product` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-detail.md


---

# Most Vulnerable Technologies

URL: https://docs.deepinfo.com/reference/easm/most-vulnerable-technologies/

GET /easm/technologies/stats/most-vulnerable: Lists the technologies with the most vulnerabilities.

`GET https://api.deepinfo.com/v1/easm/technologies/stats/most-vulnerable`

Lists the technologies with the most vulnerabilities.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `id` | string |
| `technology` | string |
| `favicon` | string |
| `vulnerability_stats` | object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].technology` | string |
| `[].favicon` | string |
| `[].vulnerability_stats` | object |
| `[].vulnerability_stats.total` | number |
| `[].vulnerability_stats.severity_stats` | array<object> |
| `[].vulnerability_stats.severity_stats[].severity` | string |
| `[].vulnerability_stats.severity_stats[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/most-vulnerable-technologies.md


---

# Technology End of Life Status

URL: https://docs.deepinfo.com/reference/easm/technology-end-of-life-status/

GET /easm/technologies/eol/{product}: Returns end-of-life information for a product (e.g. nginx, php).

`GET https://api.deepinfo.com/v1/easm/technologies/eol/{product}`

Returns end-of-life information for a product (e.g. `nginx`, `php`).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `product` | Required |  | `acme-portal` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `product` | string |  |
| `cycles` | array of object |  |
| `check_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `product` | string |
| `cycles` | array<object> |
| `cycles[].cycle` | string |
| `cycles[].release_codename` | null |
| `cycles[].release_label` | null |
| `cycles[].release_link` | string \| null |
| `cycles[].release_date` | string |
| `cycles[].latest_release` | string |
| `cycles[].latest_release_date` | string |
| `cycles[].eol` | boolean |
| `cycles[].eol_date` | string |
| `cycles[].lts` | boolean |
| `cycles[].lts_date` | null |
| `cycles[].support` | null |
| `cycles[].support_date` | null |
| `cycles[].extended_support` | null |
| `cycles[].extended_support_date` | null |
| `cycles[].discontinued` | null |
| `cycles[].discontinued_date` | null |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-end-of-life-status.md


---

# Technology Vulnerabilities

URL: https://docs.deepinfo.com/reference/easm/technology-vulnerabilities/

GET /easm/technologies/vulnerabilities: Lists vulnerabilities of a technology (tech_id), optionally for a version and severity.

`GET https://api.deepinfo.com/v1/easm/technologies/vulnerabilities`

Lists vulnerabilities of a technology (`tech_id`), optionally for a `version` and `severity`.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `tech_id` | Required |  | `00000000000000000000000e2cc20001` |
| `version` | Optional |  |  |
| `severity` | Optional | One of: `critical`, `high`, `medium`, `low`, `none`, `unknown`. |  |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].cve_id` | string |  |
| `results[].cvss_v3_score` | number |  |
| `results[].cvss_v3_severity` | string | One of `critical`, `high`, `medium`, `low`, `none`, `unknown` |
| `results[].published_date` | string | date-time |
| `results[].last_modified_date` | string | date-time |
| `results[].description` | string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-vulnerabilities.md


---

# Technology Asset Stats

URL: https://docs.deepinfo.com/reference/easm/technology-asset-stats/

GET /easm/technologies/stats/assets: Counts assets per technology.

`GET https://api.deepinfo.com/v1/easm/technologies/stats/assets`

Counts assets per technology.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `by_technology` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `by_technology` | array<object> |
| `by_technology[].name` | string |
| `by_technology[].value` | number |
| `by_technology[].favicon` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-asset-stats.md


---

# Technology Category Stats

URL: https://docs.deepinfo.com/reference/easm/technology-category-stats/

GET /easm/technologies/stats/category: Counts technologies per category.

`GET https://api.deepinfo.com/v1/easm/technologies/stats/category`

Counts technologies per category.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `asset` | Optional |  |  |

## Response Fields

| Field | Type |
|---|---|
| `total` | integer |
| `by_category` | array of object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `total` | number |
| `by_category` | array<object> |
| `by_category[].name` | string |
| `by_category[].value` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-category-stats.md


---

# Technology Count Timeline

URL: https://docs.deepinfo.com/reference/easm/technology-count-timeline/

GET /easm/technologies/stats/count-timeline: Time series of count for the selected interval (daily, weekly, monthly).

`GET https://api.deepinfo.com/v1/easm/technologies/stats/count-timeline`

Time series of count for the selected `interval` (`daily`, `weekly`, `monthly`).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-count-timeline.md


---

# Technology Vulnerability Stats

URL: https://docs.deepinfo.com/reference/easm/technology-vulnerability-stats/

GET /easm/technologies/stats/vulnerability: Vulnerability statistics for technologies (filter by tech_id, version).

`GET https://api.deepinfo.com/v1/easm/technologies/stats/vulnerability`

Vulnerability statistics for technologies (filter by `tech_id`, `version`).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `tech_id` | Optional |  |  |
| `version` | Optional |  |  |

## Response Fields

| Field | Type |
|---|---|
| `total` | integer |
| `by_severity` | object |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `total` | number |
| `by_severity` | object |
| `by_severity.critical` | number |
| `by_severity.high` | number |
| `by_severity.medium` | number |
| `by_severity.low` | number |
| `by_severity.none` | number |
| `by_severity.unknown` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/easm/technology-vulnerability-stats.md


---

# Cyber Threat Intelligence (CTI)

URL: https://docs.deepinfo.com/reference/cti/

Cyber Threat Intelligence: email breaches, compromised employee/client/payment credentials, compromised devices, threat actors and security news relevant…

Email breaches, compromised employee/client/payment credentials, compromised devices, threat actors and security news relevant to your organization.

## Email Breaches

Public data breaches that include email addresses on your domains.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Breached Account List](/reference/cti/breached-account-list/) | `/cti/email-breaches/accounts` |
| GET | [Email Breach List](/reference/cti/email-breach-list/) | `/cti/email-breaches/breaches` |
| GET | [Breached Account Detail](/reference/cti/breached-account-detail/) | `/cti/email-breaches/accounts/{account_id}` |
| GET | [Email Breach Detail](/reference/cti/email-breach-detail/) | `/cti/email-breaches/breaches/{breach_id}` |
| GET | [Email Breach Account Titles](/reference/cti/email-breach-account-titles/) | `/cti/email-breaches/account-titles` |
| GET | [Email Breach Data Types](/reference/cti/email-breach-data-types/) | `/cti/email-breaches/data-types` |
| GET | [Latest Email Breaches](/reference/cti/latest-email-breaches/) | `/cti/email-breaches/breaches/latest` |
| GET | [Breached Account Stats](/reference/cti/breached-account-stats/) | `/cti/email-breaches/accounts/{account_id}/stats` |
| GET | [Breached Accounts Domain Stats](/reference/cti/breached-accounts-domain-stats/) | `/cti/email-breaches/accounts/stats/domain` |
| GET | [Email Breach Stats](/reference/cti/email-breach-stats/) | `/cti/email-breaches/breaches/stats` |
| PUT | [Breached Account Update](/reference/cti/breached-account-update/) | `/cti/email-breaches/accounts/{account_id}` |

## Compromised Employee Accounts

Employee accounts found in leaked credential data.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Compromised Employee Account Search](/reference/cti/compromised-employee-account-search/) | `/cti/compromised-employee-accounts/search` |
| POST | [Compromised Employee Account Export](/reference/cti/compromised-employee-account-export/) | `/cti/compromised-employee-accounts/search:export` |
| GET | [Compromised Employee Account Detail](/reference/cti/compromised-employee-account-detail/) | `/cti/compromised-employee-accounts/{account_id}` |
| GET | [Compromised Employee Account Risk Distribution Stats](/reference/cti/compromised-employee-account-risk-distribution-stats/) | `/cti/compromised-employee-accounts/stats/risk-distribution` |
| GET | [Compromised Employee Accounts Domain Stats](/reference/cti/compromised-employee-accounts-domain-stats/) | `/cti/compromised-employee-accounts/stats/domain` |
| PUT | [Compromised Employee Account Update](/reference/cti/compromised-employee-account-update/) | `/cti/compromised-employee-accounts/{account_id}` |

## Compromised Employee Credentials

Leaked credentials of your employees.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Compromised Employee Credential Search](/reference/cti/compromised-employee-credential-search/) | `/cti/compromised-employee-credentials/search` |
| POST | [Compromised Employee Credential Export](/reference/cti/compromised-employee-credential-export/) | `/cti/compromised-employee-credentials/search:export` |
| POST | [Compromised Employee Credential Accept Risk](/reference/cti/compromised-employee-credential-accept-risk/) | `/cti/compromised-employee-credentials/search:accept-risk` |
| POST | [Compromised Employee Credential Ignore](/reference/cti/compromised-employee-credential-ignore/) | `/cti/compromised-employee-credentials/search:ignore` |
| POST | [Compromised Employee Credential Mark False Positive](/reference/cti/compromised-employee-credential-mark-false-positive/) | `/cti/compromised-employee-credentials/search:mark-false-positive` |
| POST | [Compromised Employee Credential Mark Resolved](/reference/cti/compromised-employee-credential-mark-resolved/) | `/cti/compromised-employee-credentials/search:mark-resolved` |
| POST | [Compromised Employee Credential Revert](/reference/cti/compromised-employee-credential-revert/) | `/cti/compromised-employee-credentials/search:revert` |
| GET | [Compromised Employee Credential Exposure Timeline](/reference/cti/compromised-employee-credential-exposure-timeline/) | `/cti/compromised-employee-credentials/stats/exposure-timeline` |
| GET | [Compromised Employee Credential Stats](/reference/cti/compromised-employee-credential-stats/) | `/cti/compromised-employee-credentials/stats` |
| GET | [Compromised Employee Credential Status Stats](/reference/cti/compromised-employee-credential-status-stats/) | `/cti/compromised-employee-credentials/stats/status` |

## Compromised Client Credentials

Leaked credentials of your customers on your services.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Compromised Client Credential Search](/reference/cti/compromised-client-credential-search/) | `/cti/compromised-client-credentials/search` |
| POST | [Compromised Client Credential Export](/reference/cti/compromised-client-credential-export/) | `/cti/compromised-client-credentials/search:export` |
| POST | [Compromised Client Credential Accept Risk](/reference/cti/compromised-client-credential-accept-risk/) | `/cti/compromised-client-credentials/search:accept-risk` |
| POST | [Compromised Client Credential Ignore](/reference/cti/compromised-client-credential-ignore/) | `/cti/compromised-client-credentials/search:ignore` |
| POST | [Compromised Client Credential Mark False Positive](/reference/cti/compromised-client-credential-mark-false-positive/) | `/cti/compromised-client-credentials/search:mark-false-positive` |
| POST | [Compromised Client Credential Mark Resolved](/reference/cti/compromised-client-credential-mark-resolved/) | `/cti/compromised-client-credentials/search:mark-resolved` |
| POST | [Compromised Client Credential Revert](/reference/cti/compromised-client-credential-revert/) | `/cti/compromised-client-credentials/search:revert` |
| GET | [Compromised Client Credential Stats](/reference/cti/compromised-client-credential-stats/) | `/cti/compromised-client-credentials/stats` |

## Compromised Payment Credentials

Leaked payment card data related to your organization.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Compromised Payment Credential Search](/reference/cti/compromised-payment-credential-search/) | `/cti/compromised-payment-credentials/search` |
| POST | [Compromised Payment Credential Export](/reference/cti/compromised-payment-credential-export/) | `/cti/compromised-payment-credentials/search:export` |
| GET | [Compromised Payment Credential Detail](/reference/cti/compromised-payment-credential-detail/) | `/cti/compromised-payment-credentials/{credential_id}` |
| POST | [Compromised Payment Credential Accept Risk](/reference/cti/compromised-payment-credential-accept-risk/) | `/cti/compromised-payment-credentials/search:accept-risk` |
| POST | [Compromised Payment Credential Ignore](/reference/cti/compromised-payment-credential-ignore/) | `/cti/compromised-payment-credentials/search:ignore` |
| POST | [Compromised Payment Credential Mark False Positive](/reference/cti/compromised-payment-credential-mark-false-positive/) | `/cti/compromised-payment-credentials/search:mark-false-positive` |
| POST | [Compromised Payment Credential Mark Resolved](/reference/cti/compromised-payment-credential-mark-resolved/) | `/cti/compromised-payment-credentials/search:mark-resolved` |
| POST | [Compromised Payment Credential Revert](/reference/cti/compromised-payment-credential-revert/) | `/cti/compromised-payment-credentials/search:revert` |
| GET | [Compromised Payment Credential Stats](/reference/cti/compromised-payment-credential-stats/) | `/cti/compromised-payment-credentials/stats` |

## Compromised Devices

Infected devices (infostealer logs) linked to your employees.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Compromised Device Search](/reference/cti/compromised-device-search/) | `/cti/compromised-devices` |
| GET | [Compromised Device Detail](/reference/cti/compromised-device-detail/) | `/cti/compromised-devices/{compromised_employee_device_id}` |

## Threat Actors

Threat actors and what they target.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Threat Actor Search](/reference/cti/threat-actor-search/) | `/cti/threat-actors/search` |
| GET | [Threat Actor Detail](/reference/cti/threat-actor-detail/) | `/cti/threat-actors/{threat_actor_id}` |
| GET | [Most Actor Hosting Countries by Threat Actors](/reference/cti/most-actor-hosting-countries-by-threat-actors/) | `/cti/threat-actors/stats/most-actor-hosting-countries` |
| GET | [Most Targeted Countries by Threat Actors](/reference/cti/most-targeted-countries-by-threat-actors/) | `/cti/threat-actors/stats/most-targeted-countries` |
| GET | [Most Targeted Industries by Threat Actors](/reference/cti/most-targeted-industries-by-threat-actors/) | `/cti/threat-actors/stats/most-targeted-industries` |
| GET | [Most Targeted Organizations by Threat Actors](/reference/cti/most-targeted-organizations-by-threat-actors/) | `/cti/threat-actors/stats/most-targeted-organizations` |
| GET | [Most Used CVEs by Threat Actors](/reference/cti/most-used-cves-by-threat-actors/) | `/cti/threat-actors/stats/most-used-cves` |
| GET | [Most Used Tools by Threat Actors](/reference/cti/most-used-tools-by-threat-actors/) | `/cti/threat-actors/stats/most-used-tools` |

## Security News

Curated cybersecurity news.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Security News Search](/reference/cti/security-news-search/) | `/cti/news/search` |
| GET | [Security News Detail](/reference/cti/security-news-detail/) | `/cti/news/{id}` |


---

# Breached Account List

URL: https://docs.deepinfo.com/reference/cti/breached-account-list/

GET /cti/email-breaches/accounts: Lists your breached email accounts. Filter and sort with the optional query parameters.

`GET https://api.deepinfo.com/v1/cti/email-breaches/accounts`

Lists your breached email accounts. Filter and sort with the optional query parameters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `email__contains` | Optional |  |  |
| `email__not_contains` | Optional |  |  |
| `domain__contains` | Optional |  |  |
| `domain__not_contains` | Optional |  |  |
| `vip` | Optional |  |  |
| `first_name__contains` | Optional |  |  |
| `first_name__not_contains` | Optional |  |  |
| `last_name__contains` | Optional |  |  |
| `last_name__not_contains` | Optional |  |  |
| `title__in` | Optional |  |  |
| `title__nin` | Optional |  |  |
| `first_breach_date__lte` | Optional |  |  |
| `first_breach_date__gte` | Optional |  |  |
| `last_breach_date__lte` | Optional |  |  |
| `last_breach_date__gte` | Optional |  |  |
| `last_added_date__lte` | Optional |  |  |
| `last_added_date__gte` | Optional |  |  |
| `breach` | Optional |  |  |
| `breach__contains` | Optional |  |  |
| `breach__not_contains` | Optional |  |  |
| `breach_count__lte` | Optional |  |  |
| `breach_count__gte` | Optional |  |  |
| `data_types__in` | Optional |  |  |
| `data_types__nin` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].email` | string |  |
| `results[].domain` | string |  |
| `results[].vip` | boolean |  |
| `results[].first_name` | string |  |
| `results[].last_name` | string |  |
| `results[].title` | string |  |
| `results[].linkedin_url` | string |  |
| `results[].first_breach_date` | string | date-time |
| `results[].last_breach_date` | string | date-time |
| `results[].last_added_date` | string | date-time |
| `results[].breaches` | array of object |  |
| `results[].breach_count` | integer |  |
| `results[].data_types` | array of string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].email` | string |
| `results[].domain` | string |
| `results[].vip` | boolean |
| `results[].first_name` | null |
| `results[].last_name` | null |
| `results[].title` | null |
| `results[].linkedin_url` | null |
| `results[].first_breach_date` | string |
| `results[].last_breach_date` | string |
| `results[].last_added_date` | string |
| `results[].breaches` | array<object> |
| `results[].breaches[].id` | string |
| `results[].breaches[].name` | string |
| `results[].breaches[].title` | string |
| `results[].breaches[].domain` | string |
| `results[].breach_count` | number |
| `results[].data_types` | array<string> |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/breached-account-list.md


---

# Email Breach List

URL: https://docs.deepinfo.com/reference/cti/email-breach-list/

GET /cti/email-breaches/breaches: Lists breaches that include your email addresses. Filter and sort with the optional query parameters.

`GET https://api.deepinfo.com/v1/cti/email-breaches/breaches`

Lists breaches that include your email addresses. Filter and sort with the optional query parameters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `title__contains` | Optional |  |  |
| `title__not_contains` | Optional |  |  |
| `domain__contains` | Optional |  |  |
| `domain__not_contains` | Optional |  |  |
| `breach_date__lt` | Optional |  |  |
| `breach_date__gt` | Optional |  |  |
| `added_date__lt` | Optional |  |  |
| `added_date__gt` | Optional |  |  |
| `total_breached_account_count__lt` | Optional |  |  |
| `total_breached_account_count__gt` | Optional |  |  |
| `data_types__in` | Optional |  |  |
| `data_types__nin` | Optional |  |  |
| `is_verified` | Optional |  |  |
| `is_fabricated` | Optional |  |  |
| `is_sensitive` | Optional |  |  |
| `is_retired` | Optional |  |  |
| `is_spam_list` | Optional |  |  |
| `is_malware` | Optional |  |  |
| `breached_account` | Optional |  |  |
| `breached_account__contains` | Optional |  |  |
| `breached_account__not_contains` | Optional |  |  |
| `breached_account_count__lt` | Optional |  |  |
| `breached_account_count__gt` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].name` | string |  |
| `results[].title` | string |  |
| `results[].domain` | string |  |
| `results[].breach_date` | string | date-time |
| `results[].added_date` | string | date-time |
| `results[].modified_date` | string | date-time |
| `results[].total_breached_account_count` | integer |  |
| `results[].logo_path` | string |  |
| `results[].data_types` | array of string |  |
| `results[].is_verified` | boolean |  |
| `results[].is_fabricated` | boolean |  |
| `results[].is_sensitive` | boolean |  |
| `results[].is_retired` | boolean |  |
| `results[].is_spam_list` | boolean |  |
| `results[].is_malware` | boolean |  |
| `results[].is_subscription_free` | boolean |  |
| `results[].breached_account_count` | integer |  |
| `results[].breached_domains` | array of object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].name` | string |
| `results[].title` | string |
| `results[].domain` | string |
| `results[].breach_date` | string |
| `results[].added_date` | string |
| `results[].modified_date` | string |
| `results[].total_breached_account_count` | number |
| `results[].logo_path` | string |
| `results[].data_types` | array<string> |
| `results[].is_verified` | boolean |
| `results[].is_fabricated` | boolean |
| `results[].is_sensitive` | boolean |
| `results[].is_retired` | boolean |
| `results[].is_spam_list` | boolean |
| `results[].is_malware` | boolean |
| `results[].is_subscription_free` | boolean |
| `results[].breached_account_count` | number |
| `results[].breached_domains` | array<object> |
| `results[].breached_domains[].domain` | string |
| `results[].breached_domains[].favicon` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/email-breach-list.md


---

# Breached Account Detail

URL: https://docs.deepinfo.com/reference/cti/breached-account-detail/

GET /cti/email-breaches/accounts/{account_id}: Returns one breached account and its breaches.

`GET https://api.deepinfo.com/v1/cti/email-breaches/accounts/{account_id}`

Returns one breached account and its breaches.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `account_id` | Required |  | `00000000000000000000000ec9430001` |

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `email` | string |
| `vip` | boolean |
| `first_name` | string |
| `last_name` | string |
| `title` | string |
| `linkedin_url` | string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `email` | string |
| `vip` | boolean |
| `first_name` | null |
| `last_name` | null |
| `title` | null |
| `linkedin_url` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/breached-account-detail.md


---

# Email Breach Detail

URL: https://docs.deepinfo.com/reference/cti/email-breach-detail/

GET /cti/email-breaches/breaches/{breach_id}: Returns one breach: date, description, data types and affected accounts count.

`GET https://api.deepinfo.com/v1/cti/email-breaches/breaches/{breach_id}`

Returns one breach: date, description, data types and affected accounts count.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `breach_id` | Required |  | `acme-breach` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `title` | string |  |
| `domain` | string |  |
| `breach_date` | string | date-time |
| `added_date` | string | date-time |
| `modified_date` | string | date-time |
| `total_breached_account_count` | integer |  |
| `description` | string |  |
| `logo_path` | string |  |
| `data_types` | array of string |  |
| `is_verified` | boolean |  |
| `is_fabricated` | boolean |  |
| `is_sensitive` | boolean |  |
| `is_retired` | boolean |  |
| `is_spam_list` | boolean |  |
| `is_malware` | boolean |  |
| `is_subscription_free` | boolean |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `title` | string |
| `domain` | string |
| `breach_date` | string |
| `added_date` | string |
| `modified_date` | string |
| `total_breached_account_count` | number |
| `description` | string |
| `logo_path` | string |
| `data_types` | array<string> |
| `is_verified` | boolean |
| `is_fabricated` | boolean |
| `is_sensitive` | boolean |
| `is_retired` | boolean |
| `is_spam_list` | boolean |
| `is_malware` | boolean |
| `is_subscription_free` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/email-breach-detail.md


---

# Email Breach Account Titles

URL: https://docs.deepinfo.com/reference/cti/email-breach-account-titles/

GET /cti/email-breaches/account-titles: Lists the job titles set on breached accounts.

`GET https://api.deepinfo.com/v1/cti/email-breaches/account-titles`

Lists the job titles set on breached accounts.

## Authentication

Send your API key in the `apikey` request header.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/email-breach-account-titles.md


---

# Email Breach Data Types

URL: https://docs.deepinfo.com/reference/cti/email-breach-data-types/

GET /cti/email-breaches/data-types: Lists every data type (kind of exposed data) found in breaches.

`GET https://api.deepinfo.com/v1/cti/email-breaches/data-types`

Lists every data type (kind of exposed data) found in breaches.

## Authentication

Send your API key in the `apikey` request header.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/email-breach-data-types.md


---

# Latest Email Breaches

URL: https://docs.deepinfo.com/reference/cti/latest-email-breaches/

GET /cti/email-breaches/breaches/latest: Lists the most recent breaches affecting you.

`GET https://api.deepinfo.com/v1/cti/email-breaches/breaches/latest`

Lists the most recent breaches affecting you.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `title` | string |  |
| `domain` | string |  |
| `breach_date` | string | date-time |
| `added_date` | string | date-time |
| `modified_date` | string | date-time |
| `total_breached_account_count` | integer |  |
| `description` | string |  |
| `logo_path` | string |  |
| `data_types` | array of string |  |
| `is_verified` | boolean |  |
| `is_fabricated` | boolean |  |
| `is_sensitive` | boolean |  |
| `is_retired` | boolean |  |
| `is_spam_list` | boolean |  |
| `is_malware` | boolean |  |
| `is_subscription_free` | boolean |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `title` | string |
| `domain` | string |
| `breach_date` | string |
| `added_date` | string |
| `modified_date` | string |
| `total_breached_account_count` | number |
| `description` | string |
| `logo_path` | string |
| `data_types` | array<string> |
| `is_verified` | boolean |
| `is_fabricated` | boolean |
| `is_sensitive` | boolean |
| `is_retired` | boolean |
| `is_spam_list` | boolean |
| `is_malware` | boolean |
| `is_subscription_free` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/latest-email-breaches.md


---

# Breached Account Stats

URL: https://docs.deepinfo.com/reference/cti/breached-account-stats/

GET /cti/email-breaches/accounts/{account_id}/stats: Breach statistics for one account.

`GET https://api.deepinfo.com/v1/cti/email-breaches/accounts/{account_id}/stats`

Breach statistics for one account.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `account_id` | Required |  | `00000000000000000000000ec9430001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `breach_count` | integer |  |
| `first_breach_date` | string | date-time |
| `last_breach_date` | string | date-time |
| `data_types` | array of string |  |
| `timeline` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `breach_count` | number |
| `first_breach_date` | string |
| `last_breach_date` | string |
| `data_types` | array<string> |
| `timeline` | array<object> |
| `timeline[].year` | number |
| `timeline[].breaches` | array<object> |
| `timeline[].breaches[].id` | string |
| `timeline[].breaches[].name` | string |
| `timeline[].breaches[].title` | string |
| `timeline[].breaches[].domain` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/breached-account-stats.md


---

# Breached Accounts Domain Stats

URL: https://docs.deepinfo.com/reference/cti/breached-accounts-domain-stats/

GET /cti/email-breaches/accounts/stats/domain: Breached account counts per domain.

`GET https://api.deepinfo.com/v1/cti/email-breaches/accounts/stats/domain`

Breached account counts per domain.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `domain` | string |
| `affected_account_count` | integer |
| `breach_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].domain` | string |
| `[].affected_account_count` | number |
| `[].breach_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/breached-accounts-domain-stats.md


---

# Email Breach Stats

URL: https://docs.deepinfo.com/reference/cti/email-breach-stats/

GET /cti/email-breaches/breaches/stats: Breach statistics.

`GET https://api.deepinfo.com/v1/cti/email-breaches/breaches/stats`

Breach statistics.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type | Description |
|---|---|---|
| `breach_count` | integer |  |
| `breached_account_count` | integer |  |
| `last_breach_date` | string | date-time |
| `data_type_stats` | array of object |  |
| `timeline` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `breach_count` | number |
| `breached_account_count` | number |
| `last_breach_date` | string |
| `data_type_stats` | array<object> |
| `data_type_stats[].affected_account_count` | number |
| `data_type_stats[].type` | string |
| `timeline` | array<object> |
| `timeline[].year` | number |
| `timeline[].breach_count` | number |
| `timeline[].breached_account_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/email-breach-stats.md


---

# Breached Account Update

URL: https://docs.deepinfo.com/reference/cti/breached-account-update/

PUT /cti/email-breaches/accounts/{account_id}: Updates a breached account's profile with the fields in the request body.

`PUT https://api.deepinfo.com/v1/cti/email-breaches/accounts/{account_id}`

Updates a breached account's profile with the fields in the request body.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `account_id` | Required |  | `00000000000000000000000ec9430001` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `vip` | boolean | Required |  |
| `first_name` | string | Optional | max length `100` |
| `last_name` | string | Optional | max length `100` |
| `title` | string | Optional | max length `100` |
| `linkedin_url` | string | Optional | min length `1`; max length `2083` |

```json
{
  "vip": false,
  "first_name": null,
  "last_name": null,
  "title": null,
  "linkedin_url": null
}
```

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `email` | string |
| `vip` | boolean |
| `first_name` | string |
| `last_name` | string |
| `title` | string |
| `linkedin_url` | string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `email` | string |
| `vip` | boolean |
| `first_name` | null |
| `last_name` | null |
| `title` | null |
| `linkedin_url` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/breached-account-update.md


---

# Compromised Employee Account Search

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-account-search/

POST /cti/compromised-employee-accounts/search: Searches employee accounts found in leaked credentials.

`POST https://api.deepinfo.com/v1/cti/compromised-employee-accounts/search`

Searches employee accounts found in leaked credentials.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `security_profile.exposure.first_exposure_date` | When the employee's earliest leaked credential was added, shown as FIRST SEEN in the security profile (UTC date-time). |
| `security_profile.exposure.last_exposure_date` | When the employee's most recent leaked credential was added, shown as LAST EXPOSURE in the list and LAST SEEN in the security profile (UTC date-time). The list is sorted by it, newest first. |
| `security_profile.exposure.exposure_span_days` | The number of days between the first and the last exposure date (EXPOSURE SPAN); `0` when all of the employee's credentials were added on the same day. |
| `security_profile.password_behavior.unique_password_count` | The number of different passwords among the employee's leaked credentials, shown as UNIQUE PASSWORDS and in the PASSWORDS column. |
| `security_profile.password_behavior.avg_password_length` | The average length, in characters, of the passwords in the employee's leaked credentials (AVG LENGTH). |
| `security_profile.password_behavior.avg_strength_score` | The average password strength score of the employee's leaked credentials, on the 0 to 100 scale of `password_analysis.strength.score`. The platform shows it divided by 10, as AVG STRENGTH SCORE out of 10. |
| `security_profile.password_behavior.min_strength_score` | The lowest password strength score among the employee's leaked credentials, from 0 to 100 (the first number of MIN / MAX SCORE). |
| `security_profile.password_behavior.max_strength_score` | The highest password strength score among the employee's leaked credentials, from 0 to 100 (the second number of MIN / MAX SCORE). |
| `security_profile.password_behavior.strength_distribution.very_weak` | The number of the employee's leaked credentials whose password is rated `Very Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.weak` | The number of the employee's leaked credentials whose password is rated `Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.medium` | The number of the employee's leaked credentials whose password is rated `Medium`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.strong` | The number of the employee's leaked credentials whose password is rated `Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.very_strong` | The number of the employee's leaked credentials whose password is rated `Very Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.weak_password_percentage` | The share of the employee's leaked credentials whose password is rated `Very Weak` or `Weak`, as a percentage from 0 to 100 (WEAK PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_count` | The number of the employee's passwords that appear in more than one leaked credential (REUSED PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_percentage` | The share of the employee's different passwords that appear in more than one leaked credential, as a percentage from 0 to 100 (REUSE RATE and the REUSE column). |
| `security_profile.composition.common_password_count` | The number of the employee's leaked credentials whose password is a known common password (`password_analysis.dictionary_match.is_common_password`), shown as COMMON PASSWORDS. |
| `security_profile.composition.dictionary_word_count` | The number of the employee's leaked credentials whose password is a dictionary word (`password_analysis.dictionary_match.is_dictionary_word`), shown as DICTIONARY WORDS. |
| `security_profile.composition.keyboard_pattern_count` | The number of the employee's leaked credentials whose password contains a keyboard pattern (`password_analysis.patterns.has_keyboard_pattern`), shown as KEYBOARD PATTERNS. |
| `security_profile.composition.date_pattern_count` | The number of the employee's leaked credentials whose password contains a date pattern (`password_analysis.patterns.has_date_pattern`), shown as DATE PATTERNS. |
| `security_profile.composition.avg_character_classes` | The average number of character types (uppercase letters, lowercase letters, digits, special characters) per password across the employee's leaked credentials, from 1 to 4 (AVG CHAR CLASSES). |
| `security_profile.composition.all_four_classes_percentage` | The share of the employee's leaked credentials whose password uses all four character types, as a percentage from 0 to 100 (ALL CHAR CLASSES). |
| `security_profile.composition.structure_variety_count` | The number of different password structures among the employee's leaked credentials (STRUCTURE VARIETY). |
| `security_profile.temporal.days_since_last_exposure` | The number of days since the employee's last exposure (`security_profile.exposure.last_exposure_date`), shown as DAYS SINCE LAST. |
| `security_profile.temporal.exposure_velocity` | How often new leaked credentials of the account appear, in credentials per month (VELOCITY, shown as cred/mo). |
| `state_stats.total` | The number of the employee's leaked credentials, in any state (Total Credentials in the STATE filter group). |
| `state_stats.active_count` | The number of the employee's credentials in an active state, `newly_detected` or `unresolved` (Active Credential Count). |
| `state_stats.inactive_count` | The number of the employee's credentials in an inactive state, such as ignored, risk accepted or marked as resolved (Inactive Credential Count). |
| `state_stats.unresolved_count` | The number of the employee's credentials that are unresolved (Unresolved Credential Count). |
| `state_stats.resolved_count` | The number of the employee's credentials that are resolved (Resolved Credential Count). |
| `state_stats.risk_accepted_count` | The number of the employee's credentials in the `risk_accepted` state (Risk Accepted Credential Count). |
| `state_stats.ignored_count` | The number of the employee's credentials in the `ignored` state (Ignored Credential Count). |
| `state_stats.false_positive_count` | The number of the employee's credentials in the `marked_as_false_positive` state (False Positive Credential Count). |
| `risk_score` | The employee account's numeric risk score, which goes with its `risk_level`; a higher score means a higher risk. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `email` | The employee's e-mail address that was found in leaked credential data. It identifies the account and cannot be edited. |
| `domain` | The domain of the employee's e-mail address, one of your organization's domains; the list has one tab per domain. |
| `first_name` | The employee's first name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `last_name` | The employee's last name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `title` | The employee's job title (CURRENT TITLE when you edit it), when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `linkedin_url` | The address of the employee's LinkedIn profile, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `department` | The employee's department, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `security_profile.composition.dominant_structure` | The most common password structure among the employee's leaked credentials, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character. It shows the passwords' shape while they are masked, so treat it as sensitive. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_executive` | Whether the employee is marked as an executive; executives show a VIP icon. You set it with EDIT DETAILS or the Compromised Employee Account Update endpoint. |
| `security_profile.temporal.exposure_accelerating` | Whether new exposures of the account are becoming more frequent; the TREND figure shows `true` as ACCELERATING and `false` as STABLE. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `computed_state` | The employee account's computed state (State in the STATE filter group). It takes the same values as a credential's `state`, such as `newly_detected` or `unresolved`. |
| `risk_level` | The employee's priority level: `low`, `medium`, `high` or `critical`. The platform describes it as a composite priority based on credential, role and recency. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The employee account's unique ID, a 24-character hex string. Exposed credentials refer to it as `account.id`. |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The employee account's unique ID, a 24-character hex string. Exposed credentials refer to it as `account.id`. |
| `email` | The employee's e-mail address that was found in leaked credential data. It identifies the account and cannot be edited. |
| `domain` | The domain of the employee's e-mail address, one of your organization's domains; the list has one tab per domain. |
| `is_executive` | Whether the employee is marked as an executive; executives show a VIP icon. You set it with EDIT DETAILS or the Compromised Employee Account Update endpoint. |
| `first_name` | The employee's first name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `last_name` | The employee's last name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `title` | The employee's job title (CURRENT TITLE when you edit it), when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `linkedin_url` | The address of the employee's LinkedIn profile, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `department` | The employee's department, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `security_profile.exposure.first_exposure_date` | When the employee's earliest leaked credential was added, shown as FIRST SEEN in the security profile (UTC date-time). |
| `security_profile.exposure.last_exposure_date` | When the employee's most recent leaked credential was added, shown as LAST EXPOSURE in the list and LAST SEEN in the security profile (UTC date-time). The list is sorted by it, newest first. |
| `security_profile.exposure.exposure_span_days` | The number of days between the first and the last exposure date (EXPOSURE SPAN); `0` when all of the employee's credentials were added on the same day. |
| `security_profile.password_behavior.unique_password_count` | The number of different passwords among the employee's leaked credentials, shown as UNIQUE PASSWORDS and in the PASSWORDS column. |
| `security_profile.password_behavior.avg_password_length` | The average length, in characters, of the passwords in the employee's leaked credentials (AVG LENGTH). |
| `security_profile.password_behavior.avg_strength_score` | The average password strength score of the employee's leaked credentials, on the 0 to 100 scale of `password_analysis.strength.score`. The platform shows it divided by 10, as AVG STRENGTH SCORE out of 10. |
| `security_profile.password_behavior.min_strength_score` | The lowest password strength score among the employee's leaked credentials, from 0 to 100 (the first number of MIN / MAX SCORE). |
| `security_profile.password_behavior.max_strength_score` | The highest password strength score among the employee's leaked credentials, from 0 to 100 (the second number of MIN / MAX SCORE). |
| `security_profile.password_behavior.strength_distribution.very_weak` | The number of the employee's leaked credentials whose password is rated `Very Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.weak` | The number of the employee's leaked credentials whose password is rated `Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.medium` | The number of the employee's leaked credentials whose password is rated `Medium`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.strong` | The number of the employee's leaked credentials whose password is rated `Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.very_strong` | The number of the employee's leaked credentials whose password is rated `Very Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.weak_password_percentage` | The share of the employee's leaked credentials whose password is rated `Very Weak` or `Weak`, as a percentage from 0 to 100 (WEAK PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_count` | The number of the employee's passwords that appear in more than one leaked credential (REUSED PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_percentage` | The share of the employee's different passwords that appear in more than one leaked credential, as a percentage from 0 to 100 (REUSE RATE and the REUSE column). |
| `security_profile.composition.common_password_count` | The number of the employee's leaked credentials whose password is a known common password (`password_analysis.dictionary_match.is_common_password`), shown as COMMON PASSWORDS. |
| `security_profile.composition.dictionary_word_count` | The number of the employee's leaked credentials whose password is a dictionary word (`password_analysis.dictionary_match.is_dictionary_word`), shown as DICTIONARY WORDS. |
| `security_profile.composition.keyboard_pattern_count` | The number of the employee's leaked credentials whose password contains a keyboard pattern (`password_analysis.patterns.has_keyboard_pattern`), shown as KEYBOARD PATTERNS. |
| `security_profile.composition.date_pattern_count` | The number of the employee's leaked credentials whose password contains a date pattern (`password_analysis.patterns.has_date_pattern`), shown as DATE PATTERNS. |
| `security_profile.composition.avg_character_classes` | The average number of character types (uppercase letters, lowercase letters, digits, special characters) per password across the employee's leaked credentials, from 1 to 4 (AVG CHAR CLASSES). |
| `security_profile.composition.all_four_classes_percentage` | The share of the employee's leaked credentials whose password uses all four character types, as a percentage from 0 to 100 (ALL CHAR CLASSES). |
| `security_profile.composition.dominant_structure` | The most common password structure among the employee's leaked credentials, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character. It shows the passwords' shape while they are masked, so treat it as sensitive. |
| `security_profile.composition.structure_variety_count` | The number of different password structures among the employee's leaked credentials (STRUCTURE VARIETY). |
| `security_profile.temporal.days_since_last_exposure` | The number of days since the employee's last exposure (`security_profile.exposure.last_exposure_date`), shown as DAYS SINCE LAST. |
| `security_profile.temporal.exposure_accelerating` | Whether new exposures of the account are becoming more frequent; the TREND figure shows `true` as ACCELERATING and `false` as STABLE. |
| `security_profile.temporal.exposure_velocity` | How often new leaked credentials of the account appear, in credentials per month (VELOCITY, shown as cred/mo). |
| `computed_state` | The employee account's computed state (State in the STATE filter group). It takes the same values as a credential's `state`, such as `newly_detected` or `unresolved`. |
| `state_stats.total` | The number of the employee's leaked credentials, in any state (Total Credentials in the STATE filter group). |
| `state_stats.active_count` | The number of the employee's credentials in an active state, `newly_detected` or `unresolved` (Active Credential Count). |
| `state_stats.inactive_count` | The number of the employee's credentials in an inactive state, such as ignored, risk accepted or marked as resolved (Inactive Credential Count). |
| `state_stats.unresolved_count` | The number of the employee's credentials that are unresolved (Unresolved Credential Count). |
| `state_stats.resolved_count` | The number of the employee's credentials that are resolved (Resolved Credential Count). |
| `state_stats.risk_accepted_count` | The number of the employee's credentials in the `risk_accepted` state (Risk Accepted Credential Count). |
| `state_stats.ignored_count` | The number of the employee's credentials in the `ignored` state (Ignored Credential Count). |
| `state_stats.false_positive_count` | The number of the employee's credentials in the `marked_as_false_positive` state (False Positive Credential Count). |
| `risk_score` | The employee account's numeric risk score, which goes with its `risk_level`; a higher score means a higher risk. |
| `risk_level` | The employee's priority level: `low`, `medium`, `high` or `critical`. The platform describes it as a composite priority based on credential, role and recency. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].email` | string |  |
| `results[].domain` | string |  |
| `results[].is_executive` | boolean |  |
| `results[].first_name` | string |  |
| `results[].last_name` | string |  |
| `results[].title` | string |  |
| `results[].linkedin_url` | string |  |
| `results[].department` | string |  |
| `results[].security_profile` | object |  |
| `results[].computed_state` | string | One of `newly_detected`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `results[].state_stats` | object |  |
| `results[].risk_score` | integer |  |
| `results[].risk_level` | string | One of `low`, `medium`, `high`, `critical` |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].email` | string |
| `results[].domain` | string |
| `results[].is_executive` | boolean |
| `results[].first_name` | null |
| `results[].last_name` | null |
| `results[].title` | null |
| `results[].linkedin_url` | null |
| `results[].department` | null |
| `results[].security_profile` | object |
| `results[].security_profile.exposure` | object |
| `results[].security_profile.exposure.first_exposure_date` | string |
| `results[].security_profile.exposure.last_exposure_date` | string |
| `results[].security_profile.exposure.exposure_span_days` | number |
| `results[].security_profile.password_behavior` | object |
| `results[].security_profile.password_behavior.unique_password_count` | number |
| `results[].security_profile.password_behavior.avg_password_length` | number |
| `results[].security_profile.password_behavior.avg_strength_score` | number |
| `results[].security_profile.password_behavior.min_strength_score` | number |
| `results[].security_profile.password_behavior.max_strength_score` | number |
| `results[].security_profile.password_behavior.strength_distribution` | object |
| `results[].security_profile.password_behavior.strength_distribution.very_weak` | number |
| `results[].security_profile.password_behavior.strength_distribution.weak` | number |
| `results[].security_profile.password_behavior.strength_distribution.medium` | number |
| `results[].security_profile.password_behavior.strength_distribution.strong` | number |
| `results[].security_profile.password_behavior.strength_distribution.very_strong` | number |
| `results[].security_profile.password_behavior.weak_password_percentage` | number |
| `results[].security_profile.reuse_analysis` | object |
| `results[].security_profile.reuse_analysis.password_reuse_count` | number |
| `results[].security_profile.reuse_analysis.password_reuse_percentage` | number |
| `results[].security_profile.composition` | object |
| `results[].security_profile.composition.common_password_count` | number |
| `results[].security_profile.composition.dictionary_word_count` | number |
| `results[].security_profile.composition.keyboard_pattern_count` | number |
| `results[].security_profile.composition.date_pattern_count` | number |
| `results[].security_profile.composition.avg_character_classes` | number |
| `results[].security_profile.composition.all_four_classes_percentage` | number |
| `results[].security_profile.composition.dominant_structure` | string |
| `results[].security_profile.composition.structure_variety_count` | number |
| `results[].security_profile.temporal` | object |
| `results[].security_profile.temporal.credential_timeline` | array<object> |
| `results[].security_profile.temporal.credential_timeline[].year` | number |
| `results[].security_profile.temporal.credential_timeline[].month` | number |
| `results[].security_profile.temporal.credential_timeline[].count` | number |
| `results[].security_profile.temporal.exposure_velocity` | number |
| `results[].security_profile.temporal.exposure_accelerating` | boolean |
| `results[].security_profile.temporal.days_since_last_exposure` | number |
| `results[].computed_state` | string |
| `results[].state_stats` | object |
| `results[].state_stats.total` | number |
| `results[].state_stats.active_count` | number |
| `results[].state_stats.inactive_count` | number |
| `results[].state_stats.unresolved_count` | number |
| `results[].state_stats.resolved_count` | number |
| `results[].state_stats.risk_accepted_count` | number |
| `results[].state_stats.ignored_count` | number |
| `results[].state_stats.false_positive_count` | number |
| `results[].risk_score` | number |
| `results[].risk_level` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-account-search.md


---

# Compromised Employee Account Export

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-account-export/

POST /cti/compromised-employee-accounts/search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/cti/compromised-employee-accounts/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `security_profile.exposure.first_exposure_date` | When the employee's earliest leaked credential was added, shown as FIRST SEEN in the security profile (UTC date-time). |
| `security_profile.exposure.last_exposure_date` | When the employee's most recent leaked credential was added, shown as LAST EXPOSURE in the list and LAST SEEN in the security profile (UTC date-time). The list is sorted by it, newest first. |
| `security_profile.exposure.exposure_span_days` | The number of days between the first and the last exposure date (EXPOSURE SPAN); `0` when all of the employee's credentials were added on the same day. |
| `security_profile.password_behavior.unique_password_count` | The number of different passwords among the employee's leaked credentials, shown as UNIQUE PASSWORDS and in the PASSWORDS column. |
| `security_profile.password_behavior.avg_password_length` | The average length, in characters, of the passwords in the employee's leaked credentials (AVG LENGTH). |
| `security_profile.password_behavior.avg_strength_score` | The average password strength score of the employee's leaked credentials, on the 0 to 100 scale of `password_analysis.strength.score`. The platform shows it divided by 10, as AVG STRENGTH SCORE out of 10. |
| `security_profile.password_behavior.min_strength_score` | The lowest password strength score among the employee's leaked credentials, from 0 to 100 (the first number of MIN / MAX SCORE). |
| `security_profile.password_behavior.max_strength_score` | The highest password strength score among the employee's leaked credentials, from 0 to 100 (the second number of MIN / MAX SCORE). |
| `security_profile.password_behavior.strength_distribution.very_weak` | The number of the employee's leaked credentials whose password is rated `Very Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.weak` | The number of the employee's leaked credentials whose password is rated `Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.medium` | The number of the employee's leaked credentials whose password is rated `Medium`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.strong` | The number of the employee's leaked credentials whose password is rated `Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.very_strong` | The number of the employee's leaked credentials whose password is rated `Very Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.weak_password_percentage` | The share of the employee's leaked credentials whose password is rated `Very Weak` or `Weak`, as a percentage from 0 to 100 (WEAK PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_count` | The number of the employee's passwords that appear in more than one leaked credential (REUSED PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_percentage` | The share of the employee's different passwords that appear in more than one leaked credential, as a percentage from 0 to 100 (REUSE RATE and the REUSE column). |
| `security_profile.composition.common_password_count` | The number of the employee's leaked credentials whose password is a known common password (`password_analysis.dictionary_match.is_common_password`), shown as COMMON PASSWORDS. |
| `security_profile.composition.dictionary_word_count` | The number of the employee's leaked credentials whose password is a dictionary word (`password_analysis.dictionary_match.is_dictionary_word`), shown as DICTIONARY WORDS. |
| `security_profile.composition.keyboard_pattern_count` | The number of the employee's leaked credentials whose password contains a keyboard pattern (`password_analysis.patterns.has_keyboard_pattern`), shown as KEYBOARD PATTERNS. |
| `security_profile.composition.date_pattern_count` | The number of the employee's leaked credentials whose password contains a date pattern (`password_analysis.patterns.has_date_pattern`), shown as DATE PATTERNS. |
| `security_profile.composition.avg_character_classes` | The average number of character types (uppercase letters, lowercase letters, digits, special characters) per password across the employee's leaked credentials, from 1 to 4 (AVG CHAR CLASSES). |
| `security_profile.composition.all_four_classes_percentage` | The share of the employee's leaked credentials whose password uses all four character types, as a percentage from 0 to 100 (ALL CHAR CLASSES). |
| `security_profile.composition.structure_variety_count` | The number of different password structures among the employee's leaked credentials (STRUCTURE VARIETY). |
| `security_profile.temporal.days_since_last_exposure` | The number of days since the employee's last exposure (`security_profile.exposure.last_exposure_date`), shown as DAYS SINCE LAST. |
| `security_profile.temporal.exposure_velocity` | How often new leaked credentials of the account appear, in credentials per month (VELOCITY, shown as cred/mo). |
| `state_stats.total` | The number of the employee's leaked credentials, in any state (Total Credentials in the STATE filter group). |
| `state_stats.active_count` | The number of the employee's credentials in an active state, `newly_detected` or `unresolved` (Active Credential Count). |
| `state_stats.inactive_count` | The number of the employee's credentials in an inactive state, such as ignored, risk accepted or marked as resolved (Inactive Credential Count). |
| `state_stats.unresolved_count` | The number of the employee's credentials that are unresolved (Unresolved Credential Count). |
| `state_stats.resolved_count` | The number of the employee's credentials that are resolved (Resolved Credential Count). |
| `state_stats.risk_accepted_count` | The number of the employee's credentials in the `risk_accepted` state (Risk Accepted Credential Count). |
| `state_stats.ignored_count` | The number of the employee's credentials in the `ignored` state (Ignored Credential Count). |
| `state_stats.false_positive_count` | The number of the employee's credentials in the `marked_as_false_positive` state (False Positive Credential Count). |
| `risk_score` | The employee account's numeric risk score, which goes with its `risk_level`; a higher score means a higher risk. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `email` | The employee's e-mail address that was found in leaked credential data. It identifies the account and cannot be edited. |
| `domain` | The domain of the employee's e-mail address, one of your organization's domains; the list has one tab per domain. |
| `first_name` | The employee's first name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `last_name` | The employee's last name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `title` | The employee's job title (CURRENT TITLE when you edit it), when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `linkedin_url` | The address of the employee's LinkedIn profile, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `department` | The employee's department, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `security_profile.composition.dominant_structure` | The most common password structure among the employee's leaked credentials, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character. It shows the passwords' shape while they are masked, so treat it as sensitive. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_executive` | Whether the employee is marked as an executive; executives show a VIP icon. You set it with EDIT DETAILS or the Compromised Employee Account Update endpoint. |
| `security_profile.temporal.exposure_accelerating` | Whether new exposures of the account are becoming more frequent; the TREND figure shows `true` as ACCELERATING and `false` as STABLE. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `computed_state` | The employee account's computed state (State in the STATE filter group). It takes the same values as a credential's `state`, such as `newly_detected` or `unresolved`. |
| `risk_level` | The employee's priority level: `low`, `medium`, `high` or `critical`. The platform describes it as a composite priority based on credential, role and recency. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The employee account's unique ID, a 24-character hex string. Exposed credentials refer to it as `account.id`. |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The employee account's unique ID, a 24-character hex string. Exposed credentials refer to it as `account.id`. |
| `email` | The employee's e-mail address that was found in leaked credential data. It identifies the account and cannot be edited. |
| `domain` | The domain of the employee's e-mail address, one of your organization's domains; the list has one tab per domain. |
| `is_executive` | Whether the employee is marked as an executive; executives show a VIP icon. You set it with EDIT DETAILS or the Compromised Employee Account Update endpoint. |
| `first_name` | The employee's first name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `last_name` | The employee's last name, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `title` | The employee's job title (CURRENT TITLE when you edit it), when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `linkedin_url` | The address of the employee's LinkedIn profile, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `department` | The employee's department, when known. You can add or correct it with EDIT DETAILS in the platform or the Compromised Employee Account Update endpoint. |
| `security_profile.exposure.first_exposure_date` | When the employee's earliest leaked credential was added, shown as FIRST SEEN in the security profile (UTC date-time). |
| `security_profile.exposure.last_exposure_date` | When the employee's most recent leaked credential was added, shown as LAST EXPOSURE in the list and LAST SEEN in the security profile (UTC date-time). The list is sorted by it, newest first. |
| `security_profile.exposure.exposure_span_days` | The number of days between the first and the last exposure date (EXPOSURE SPAN); `0` when all of the employee's credentials were added on the same day. |
| `security_profile.password_behavior.unique_password_count` | The number of different passwords among the employee's leaked credentials, shown as UNIQUE PASSWORDS and in the PASSWORDS column. |
| `security_profile.password_behavior.avg_password_length` | The average length, in characters, of the passwords in the employee's leaked credentials (AVG LENGTH). |
| `security_profile.password_behavior.avg_strength_score` | The average password strength score of the employee's leaked credentials, on the 0 to 100 scale of `password_analysis.strength.score`. The platform shows it divided by 10, as AVG STRENGTH SCORE out of 10. |
| `security_profile.password_behavior.min_strength_score` | The lowest password strength score among the employee's leaked credentials, from 0 to 100 (the first number of MIN / MAX SCORE). |
| `security_profile.password_behavior.max_strength_score` | The highest password strength score among the employee's leaked credentials, from 0 to 100 (the second number of MIN / MAX SCORE). |
| `security_profile.password_behavior.strength_distribution.very_weak` | The number of the employee's leaked credentials whose password is rated `Very Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.weak` | The number of the employee's leaked credentials whose password is rated `Weak`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.medium` | The number of the employee's leaked credentials whose password is rated `Medium`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.strong` | The number of the employee's leaked credentials whose password is rated `Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.strength_distribution.very_strong` | The number of the employee's leaked credentials whose password is rated `Very Strong`. Credentials are counted, so a reused password counts once for each credential. |
| `security_profile.password_behavior.weak_password_percentage` | The share of the employee's leaked credentials whose password is rated `Very Weak` or `Weak`, as a percentage from 0 to 100 (WEAK PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_count` | The number of the employee's passwords that appear in more than one leaked credential (REUSED PASSWORDS). |
| `security_profile.reuse_analysis.password_reuse_percentage` | The share of the employee's different passwords that appear in more than one leaked credential, as a percentage from 0 to 100 (REUSE RATE and the REUSE column). |
| `security_profile.composition.common_password_count` | The number of the employee's leaked credentials whose password is a known common password (`password_analysis.dictionary_match.is_common_password`), shown as COMMON PASSWORDS. |
| `security_profile.composition.dictionary_word_count` | The number of the employee's leaked credentials whose password is a dictionary word (`password_analysis.dictionary_match.is_dictionary_word`), shown as DICTIONARY WORDS. |
| `security_profile.composition.keyboard_pattern_count` | The number of the employee's leaked credentials whose password contains a keyboard pattern (`password_analysis.patterns.has_keyboard_pattern`), shown as KEYBOARD PATTERNS. |
| `security_profile.composition.date_pattern_count` | The number of the employee's leaked credentials whose password contains a date pattern (`password_analysis.patterns.has_date_pattern`), shown as DATE PATTERNS. |
| `security_profile.composition.avg_character_classes` | The average number of character types (uppercase letters, lowercase letters, digits, special characters) per password across the employee's leaked credentials, from 1 to 4 (AVG CHAR CLASSES). |
| `security_profile.composition.all_four_classes_percentage` | The share of the employee's leaked credentials whose password uses all four character types, as a percentage from 0 to 100 (ALL CHAR CLASSES). |
| `security_profile.composition.dominant_structure` | The most common password structure among the employee's leaked credentials, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character. It shows the passwords' shape while they are masked, so treat it as sensitive. |
| `security_profile.composition.structure_variety_count` | The number of different password structures among the employee's leaked credentials (STRUCTURE VARIETY). |
| `security_profile.temporal.days_since_last_exposure` | The number of days since the employee's last exposure (`security_profile.exposure.last_exposure_date`), shown as DAYS SINCE LAST. |
| `security_profile.temporal.exposure_accelerating` | Whether new exposures of the account are becoming more frequent; the TREND figure shows `true` as ACCELERATING and `false` as STABLE. |
| `security_profile.temporal.exposure_velocity` | How often new leaked credentials of the account appear, in credentials per month (VELOCITY, shown as cred/mo). |
| `computed_state` | The employee account's computed state (State in the STATE filter group). It takes the same values as a credential's `state`, such as `newly_detected` or `unresolved`. |
| `state_stats.total` | The number of the employee's leaked credentials, in any state (Total Credentials in the STATE filter group). |
| `state_stats.active_count` | The number of the employee's credentials in an active state, `newly_detected` or `unresolved` (Active Credential Count). |
| `state_stats.inactive_count` | The number of the employee's credentials in an inactive state, such as ignored, risk accepted or marked as resolved (Inactive Credential Count). |
| `state_stats.unresolved_count` | The number of the employee's credentials that are unresolved (Unresolved Credential Count). |
| `state_stats.resolved_count` | The number of the employee's credentials that are resolved (Resolved Credential Count). |
| `state_stats.risk_accepted_count` | The number of the employee's credentials in the `risk_accepted` state (Risk Accepted Credential Count). |
| `state_stats.ignored_count` | The number of the employee's credentials in the `ignored` state (Ignored Credential Count). |
| `state_stats.false_positive_count` | The number of the employee's credentials in the `marked_as_false_positive` state (False Positive Credential Count). |
| `risk_score` | The employee account's numeric risk score, which goes with its `risk_level`; a higher score means a higher risk. |
| `risk_level` | The employee's priority level: `low`, `medium`, `high` or `critical`. The platform describes it as a composite priority based on credential, role and recency. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-account-export.md


---

# Compromised Employee Account Detail

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-account-detail/

GET /cti/compromised-employee-accounts/{account_id}: Returns one compromised employee account.

`GET https://api.deepinfo.com/v1/cti/compromised-employee-accounts/{account_id}`

Returns one compromised employee account.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `account_id` | Required |  | `000000000000000ec9430001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `email` | string |  |
| `domain` | string |  |
| `is_executive` | boolean |  |
| `first_name` | string |  |
| `last_name` | string |  |
| `title` | string |  |
| `linkedin_url` | string |  |
| `department` | string |  |
| `security_profile` | object |  |
| `computed_state` | string | One of `newly_detected`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `state_stats` | object |  |
| `risk_score` | integer |  |
| `risk_level` | string | One of `low`, `medium`, `high`, `critical` |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `email` | string |
| `domain` | string |
| `is_executive` | boolean |
| `first_name` | null |
| `last_name` | null |
| `title` | null |
| `linkedin_url` | null |
| `department` | null |
| `security_profile` | object |
| `security_profile.exposure` | object |
| `security_profile.exposure.first_exposure_date` | string |
| `security_profile.exposure.last_exposure_date` | string |
| `security_profile.exposure.exposure_span_days` | number |
| `security_profile.password_behavior` | object |
| `security_profile.password_behavior.unique_password_count` | number |
| `security_profile.password_behavior.avg_password_length` | number |
| `security_profile.password_behavior.avg_strength_score` | number |
| `security_profile.password_behavior.min_strength_score` | number |
| `security_profile.password_behavior.max_strength_score` | number |
| `security_profile.password_behavior.strength_distribution` | object |
| `security_profile.password_behavior.strength_distribution.very_weak` | number |
| `security_profile.password_behavior.strength_distribution.weak` | number |
| `security_profile.password_behavior.strength_distribution.medium` | number |
| `security_profile.password_behavior.strength_distribution.strong` | number |
| `security_profile.password_behavior.strength_distribution.very_strong` | number |
| `security_profile.password_behavior.weak_password_percentage` | number |
| `security_profile.reuse_analysis` | object |
| `security_profile.reuse_analysis.password_reuse_count` | number |
| `security_profile.reuse_analysis.password_reuse_percentage` | number |
| `security_profile.composition` | object |
| `security_profile.composition.common_password_count` | number |
| `security_profile.composition.dictionary_word_count` | number |
| `security_profile.composition.keyboard_pattern_count` | number |
| `security_profile.composition.date_pattern_count` | number |
| `security_profile.composition.avg_character_classes` | number |
| `security_profile.composition.all_four_classes_percentage` | number |
| `security_profile.composition.dominant_structure` | string |
| `security_profile.composition.structure_variety_count` | number |
| `security_profile.temporal` | object |
| `security_profile.temporal.credential_timeline` | array<object> |
| `security_profile.temporal.credential_timeline[].year` | number |
| `security_profile.temporal.credential_timeline[].month` | number |
| `security_profile.temporal.credential_timeline[].count` | number |
| `security_profile.temporal.exposure_velocity` | number |
| `security_profile.temporal.exposure_accelerating` | boolean |
| `security_profile.temporal.days_since_last_exposure` | number |
| `computed_state` | string |
| `state_stats` | object |
| `state_stats.total` | number |
| `state_stats.active_count` | number |
| `state_stats.inactive_count` | number |
| `state_stats.unresolved_count` | number |
| `state_stats.resolved_count` | number |
| `state_stats.risk_accepted_count` | number |
| `state_stats.ignored_count` | number |
| `state_stats.false_positive_count` | number |
| `risk_score` | number |
| `risk_level` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-account-detail.md


---

# Compromised Employee Account Risk Distribution Stats

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-account-risk-distribution-stats/

GET /cti/compromised-employee-accounts/stats/risk-distribution: Distribution of compromised employee accounts by risk.

`GET https://api.deepinfo.com/v1/cti/compromised-employee-accounts/stats/risk-distribution`

Distribution of compromised employee accounts by risk.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `critical` | integer |
| `high` | integer |
| `medium` | integer |
| `low` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `critical` | number |
| `high` | number |
| `medium` | number |
| `low` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-account-risk-distribution-stats.md


---

# Compromised Employee Accounts Domain Stats

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-accounts-domain-stats/

GET /cti/compromised-employee-accounts/stats/domain: Compromised employee account counts per domain.

`GET https://api.deepinfo.com/v1/cti/compromised-employee-accounts/stats/domain`

Compromised employee account counts per domain.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `domain` | string |
| `affected_account_count` | integer |
| `credential_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].domain` | string |
| `[].affected_account_count` | number |
| `[].credential_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-accounts-domain-stats.md


---

# Compromised Employee Account Update

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-account-update/

PUT /cti/compromised-employee-accounts/{account_id}: Updates an account's profile with the fields in the request body.

`PUT https://api.deepinfo.com/v1/cti/compromised-employee-accounts/{account_id}`

Updates an account's profile with the fields in the request body.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `account_id` | Required |  | `000000000000000ec9430001` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `is_executive` | boolean | Required |  |
| `first_name` | string | Optional | max length `100` |
| `last_name` | string | Optional | max length `100` |
| `title` | string | Optional | max length `100` |
| `linkedin_url` | string | Optional | min length `1`; max length `2083` |
| `department` | string | Optional | max length `100` |

```json
{
  "is_executive": false,
  "first_name": null,
  "last_name": null,
  "title": null,
  "linkedin_url": null,
  "department": null
}
```

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `email` | string |
| `is_executive` | boolean |
| `first_name` | string |
| `last_name` | string |
| `title` | string |
| `linkedin_url` | string |
| `department` | string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `email` | string |
| `is_executive` | boolean |
| `first_name` | null |
| `last_name` | null |
| `title` | null |
| `linkedin_url` | null |
| `department` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-account-update.md


---

# Compromised Employee Credential Search

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-search/

POST /cti/compromised-employee-credentials/search: Searches leaked employee credentials and their state.

`POST https://api.deepinfo.com/v1/cti/compromised-employee-credentials/search`

Searches leaked employee credentials and their state.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].url` | string |  |
| `results[].state` | string | One of `newly_detected`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `results[].account` | object |  |
| `results[].added_at` | string | date-time |
| `results[].password` | string |  |
| `results[].password_analysis` | object |  |
| `results[].target` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].url` | string |
| `results[].state` | string |
| `results[].account` | object |
| `results[].account.id` | string |
| `results[].account.email` | string |
| `results[].account.domain` | string |
| `results[].account.is_executive` | boolean |
| `results[].account.first_name` | null |
| `results[].account.last_name` | null |
| `results[].account.title` | null |
| `results[].account.linkedin_url` | null |
| `results[].account.department` | null |
| `results[].added_at` | string |
| `results[].password` | string |
| `results[].password_analysis` | object |
| `results[].password_analysis.strength` | object |
| `results[].password_analysis.strength.level` | number |
| `results[].password_analysis.strength.score` | number |
| `results[].password_analysis.strength.label` | string |
| `results[].password_analysis.strength.entropy_bits` | number |
| `results[].password_analysis.composition` | object |
| `results[].password_analysis.composition.length` | number |
| `results[].password_analysis.composition.structure` | string |
| `results[].password_analysis.composition.character_classes_used` | number |
| `results[].password_analysis.composition.contains_uppercase` | boolean |
| `results[].password_analysis.composition.contains_lowercase` | boolean |
| `results[].password_analysis.composition.contains_number` | boolean |
| `results[].password_analysis.composition.contains_special` | boolean |
| `results[].password_analysis.composition.starts_with_uppercase` | boolean |
| `results[].password_analysis.composition.ends_with_numbers` | boolean |
| `results[].password_analysis.composition.ends_with_special` | boolean |
| `results[].password_analysis.patterns` | object |
| `results[].password_analysis.patterns.has_keyboard_pattern` | boolean |
| `results[].password_analysis.patterns.has_date_pattern` | boolean |
| `results[].password_analysis.patterns.has_leet_speak` | boolean |
| `results[].password_analysis.patterns.has_sequential_chars` | boolean |
| `results[].password_analysis.patterns.has_repeated_chars` | boolean |
| `results[].password_analysis.dictionary_match` | object |
| `results[].password_analysis.dictionary_match.is_common_password` | boolean |
| `results[].password_analysis.dictionary_match.common_password_rank` | null |
| `results[].password_analysis.dictionary_match.is_dictionary_word` | boolean |
| `results[].password_analysis.dictionary_match.dictionary_word_found` | null |
| `results[].target` | object |
| `results[].target.url` | string |
| `results[].target.url_raw` | string |
| `results[].target.fqdn` | string |
| `results[].target.domain` | string |
| `results[].target.service` | string |
| `results[].target.platform` | string |
| `results[].target.main_category` | string \| null |
| `results[].target.sub_category` | string \| null |
| `results[].target.risk_tier` | string \| null |
| `results[].target.is_corporate` | boolean |
| `results[].target.requires_mfa_by_default` | boolean \| null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-search.md


---

# Compromised Employee Credential Export

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-export/

POST /cti/compromised-employee-credentials/search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/cti/compromised-employee-credentials/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-export.md


---

# Compromised Employee Credential Accept Risk

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-accept-risk/

POST /cti/compromised-employee-credentials/search:accept-risk: Accepts the risk of the compromised employee credentials that match filters (risk_accepted).

`POST https://api.deepinfo.com/v1/cti/compromised-employee-credentials/search:accept-risk`

Accepts the risk of the compromised employee credentials that match `filters` (`risk_accepted`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-accept-risk.md


---

# Compromised Employee Credential Ignore

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-ignore/

POST /cti/compromised-employee-credentials/search:ignore: Ignores the compromised employee credentials that match filters (ignored).

`POST https://api.deepinfo.com/v1/cti/compromised-employee-credentials/search:ignore`

Ignores the compromised employee credentials that match `filters` (`ignored`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-ignore.md


---

# Compromised Employee Credential Mark False Positive

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-mark-false-positive/

Marks the compromised employee credentials that match filters as false positive (marked_as_false_positive).

`POST https://api.deepinfo.com/v1/cti/compromised-employee-credentials/search:mark-false-positive`

Marks the compromised employee credentials that match `filters` as false positive (`marked_as_false_positive`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-mark-false-positive.md


---

# Compromised Employee Credential Mark Resolved

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-mark-resolved/

POST /cti/compromised-employee-credentials/search:mark-resolved: Marks the compromised employee credentials that match filters as resolved (marked_as_resolved).

`POST https://api.deepinfo.com/v1/cti/compromised-employee-credentials/search:mark-resolved`

Marks the compromised employee credentials that match `filters` as resolved (`marked_as_resolved`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-mark-resolved.md


---

# Compromised Employee Credential Revert

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-revert/

POST /cti/compromised-employee-credentials/search:revert: Reverts the compromised employee credentials that match filters to their previous, active state.

`POST https://api.deepinfo.com/v1/cti/compromised-employee-credentials/search:revert`

Reverts the compromised employee credentials that match `filters` to their previous, active state. Only states set by a user can be reverted.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The exposed credential's unique ID, a 24-character hex string. |
| `url` | The address of the site or app the leaked login was used on; the SEARCH box of EXPOSED CREDENTIALS matches it. In the samples it is the same as `target.url`. |
| `account.id` | The ID of the employee account the credential belongs to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the credential belongs to (ACCOUNT column). |
| `account.domain` | The domain of the employee's e-mail address, one of your organization's domains. |
| `account.is_executive` | Whether the employee the credential belongs to is marked as an executive. |
| `account.first_name` | The first name of the employee the credential belongs to, when known. |
| `account.last_name` | The last name of the employee the credential belongs to, when known. |
| `account.title` | The job title of the employee the credential belongs to, when known. |
| `account.linkedin_url` | The address of the LinkedIn profile of the employee the credential belongs to, when known. |
| `account.department` | The department of the employee the credential belongs to, when known. |
| `added_at` | When the credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The leaked password in plain text. The platform masks it on screen, but API responses include it, so protect them. |
| `password_analysis.strength.level` | The password's strength level from 0 to 4: `0` Very Weak, `1` Weak, `2` Medium, `3` Strong, `4` Very Strong, matching `password_analysis.strength.label`. |
| `password_analysis.strength.score` | The password's strength score from 0 to 100; a higher score means a stronger password (STRENGTH). |
| `password_analysis.strength.label` | The password's strength rating: `Very Weak`, `Weak`, `Medium`, `Strong` or `Very Strong`, shown with a bar in the STRENGTH column. |
| `password_analysis.strength.entropy_bits` | An estimate of how hard the password is to guess, in bits of entropy (ENTROPY); a higher value means harder to guess. |
| `password_analysis.composition.length` | The number of characters in the password (LENGTH). |
| `password_analysis.composition.structure` | The shape of the password, one letter per character: `U` uppercase, `l` lowercase, `n` digit, `s` special character (STRUCTURE). It shows the password's shape while the password is masked, so treat it as sensitive. |
| `password_analysis.composition.character_classes_used` | How many of the four character types (uppercase letters, lowercase letters, digits, special characters) the password uses, from 1 to 4 (CHARACTER CLASSES). |
| `password_analysis.composition.contains_uppercase` | Whether the password contains an uppercase letter (A–Z). |
| `password_analysis.composition.contains_lowercase` | Whether the password contains a lowercase letter (a–z). |
| `password_analysis.composition.contains_number` | Whether the password contains a digit (0–9). |
| `password_analysis.composition.contains_special` | Whether the password contains a special character, such as `!`, `@` or `#`. |
| `password_analysis.composition.starts_with_uppercase` | Whether the password starts with an uppercase letter (START WITH UPPERCASE). |
| `password_analysis.composition.ends_with_numbers` | Whether the password ends with a digit (END WITH NUMBERS). |
| `password_analysis.composition.ends_with_special` | Whether the password ends with a special character (END WITH SPECIAL CHARACTER). |
| `password_analysis.patterns.has_keyboard_pattern` | Whether the password contains a keyboard pattern (KEYBOARD PATTERN). |
| `password_analysis.patterns.has_date_pattern` | Whether the password contains a date pattern (DATE PATTERN). |
| `password_analysis.patterns.has_leet_speak` | Whether the password uses leet speak, letters written as look-alike digits or symbols (LEET SPEAK). |
| `password_analysis.patterns.has_sequential_chars` | Whether the password contains sequential characters (SEQUENTIAL CHARACTER). |
| `password_analysis.patterns.has_repeated_chars` | Whether the password contains repeated characters (REPEATED CHARACTER). |
| `password_analysis.dictionary_match.is_common_password` | Whether the password is a known common password (COMMON PASSWORD). |
| `password_analysis.dictionary_match.common_password_rank` | The password's rank in the list of common passwords, where a lower number means a more common password; set only when `is_common_password` is `true`. |
| `password_analysis.dictionary_match.is_dictionary_word` | Whether the whole password, ignoring letter case, is a dictionary word. |
| `password_analysis.dictionary_match.dictionary_word_found` | The dictionary word found inside the password (DICT WORD), also when the password holds more than that word; empty when none is found. It reveals part of the password. |
| `target.url` | The address of the site or app the credential belongs to (Target URL). For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL, shown as URL RAW on the credential's TARGET tab; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example` (FQDN). For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example` (DOMAIN). |
| `target.service` | The name of the site or service the credential belongs to (SERVICE), shown first in the SOURCE/SERVICE column of the list. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown as the platform tag next to the host. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail` (MAIN CATEGORY). Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider` (SUB CATEGORY). Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW` (RISK TIER). Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service (CORPORATE); such credentials show a corporate-building icon in the list. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default, shown as MFA BY DEFAULT: ENFORCED or NOT ENFORCED. Empty for a service without a category. |
| `state` | The credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-revert.md


---

# Compromised Employee Credential Exposure Timeline

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-exposure-timeline/

GET /cti/compromised-employee-credentials/stats/exposure-timeline: Time series of newly exposed employee credentials.

`GET https://api.deepinfo.com/v1/cti/compromised-employee-credentials/stats/exposure-timeline`

Time series of newly exposed employee credentials.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `count` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-exposure-timeline.md


---

# Compromised Employee Credential Stats

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-stats/

GET /cti/compromised-employee-credentials/stats: Compromised employee credential statistics.

`GET https://api.deepinfo.com/v1/cti/compromised-employee-credentials/stats`

Compromised employee credential statistics.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type | Description |
|---|---|---|
| `credential_count` | integer |  |
| `credential_account_count` | integer |  |
| `first_exposure_date` | string | date-time |
| `timeline` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `credential_count` | number |
| `credential_account_count` | number |
| `first_exposure_date` | string |
| `timeline` | array<object> |
| `timeline[].year` | number |
| `timeline[].credential_count` | number |
| `timeline[].credential_account_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-stats.md


---

# Compromised Employee Credential Status Stats

URL: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-status-stats/

GET /cti/compromised-employee-credentials/stats/status: Compromised employee credential counts per state.

`GET https://api.deepinfo.com/v1/cti/compromised-employee-credentials/stats/status`

Compromised employee credential counts per state.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `active` | integer |
| `inactive` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `active` | number |
| `inactive` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-employee-credential-status-stats.md


---

# Compromised Client Credential Search

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-search/

POST /cti/compromised-client-credentials/search: Searches leaked credentials of your customers and their state.

`POST https://api.deepinfo.com/v1/cti/compromised-client-credentials/search`

Searches leaked credentials of your customers and their state.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].url` | string |  |
| `results[].username` | string |  |
| `results[].username_type` | string | One of `email`, `username` |
| `results[].state` | string | One of `newly_detected`, `unresolved`, `marked_as_resolved`, `risk_accepted`, `ignored`, `marked_as_false_positive`, `not_applicable`, `verified_resolved` |
| `results[].added_at` | string | date-time |
| `results[].password` | string |  |
| `results[].target` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].url` | string |
| `results[].username` | string |
| `results[].username_type` | null |
| `results[].state` | string |
| `results[].added_at` | string |
| `results[].password` | string |
| `results[].target` | object |
| `results[].target.url` | string |
| `results[].target.url_raw` | string |
| `results[].target.fqdn` | string |
| `results[].target.domain` | string |
| `results[].target.service` | string |
| `results[].target.platform` | string |
| `results[].target.main_category` | null |
| `results[].target.sub_category` | null |
| `results[].target.risk_tier` | null |
| `results[].target.is_corporate` | boolean |
| `results[].target.requires_mfa_by_default` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-search.md


---

# Compromised Client Credential Export

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-export/

POST /cti/compromised-client-credentials/search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/cti/compromised-client-credentials/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-export.md


---

# Compromised Client Credential Accept Risk

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-accept-risk/

POST /cti/compromised-client-credentials/search:accept-risk: Accepts the risk of the compromised client credentials that match filters (risk_accepted).

`POST https://api.deepinfo.com/v1/cti/compromised-client-credentials/search:accept-risk`

Accepts the risk of the compromised client credentials that match `filters` (`risk_accepted`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-accept-risk.md


---

# Compromised Client Credential Ignore

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-ignore/

POST /cti/compromised-client-credentials/search:ignore: Ignores the compromised client credentials that match filters (ignored).

`POST https://api.deepinfo.com/v1/cti/compromised-client-credentials/search:ignore`

Ignores the compromised client credentials that match `filters` (`ignored`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-ignore.md


---

# Compromised Client Credential Mark False Positive

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-mark-false-positive/

Marks the compromised client credentials that match filters as false positive (marked_as_false_positive).

`POST https://api.deepinfo.com/v1/cti/compromised-client-credentials/search:mark-false-positive`

Marks the compromised client credentials that match `filters` as false positive (`marked_as_false_positive`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-mark-false-positive.md


---

# Compromised Client Credential Mark Resolved

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-mark-resolved/

POST /cti/compromised-client-credentials/search:mark-resolved: Marks the compromised client credentials that match filters as resolved (marked_as_resolved).

`POST https://api.deepinfo.com/v1/cti/compromised-client-credentials/search:mark-resolved`

Marks the compromised client credentials that match `filters` as resolved (`marked_as_resolved`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-mark-resolved.md


---

# Compromised Client Credential Revert

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-revert/

POST /cti/compromised-client-credentials/search:revert: Reverts the compromised client credentials that match filters to their previous, active state.

`POST https://api.deepinfo.com/v1/cti/compromised-client-credentials/search:revert`

Reverts the compromised client credentials that match `filters` to their previous, active state. Only states set by a user can be reverted.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "id",
        "type": "eq",
        "value": "000000000000000e37e30001"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |

Operators: `eq`, `in`

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `id` | The client credential's unique ID, a 24-character hex string. |
| `url` | The address of the login page or app of your service where the customer's credential was used; in the samples it is the same as `target.url`. |
| `username` | The customer's username or e-mail address from the leaked login (USERNAME). |
| `username_type` | Whether `username` is an e-mail address (`email`) or a user name (`username`); it can be empty. |
| `added_at` | When the client credential was added to Deepinfo's data, shown as ADDED DATE (UTC date-time). |
| `password` | The customer's leaked password in plain text. The platform's list does not show it, but API responses include it, so protect them. |
| `target.url` | The address of the site or app the credential belongs to. For an Android app (`target.platform` `ANDROID`) it is an `android://` app address instead of a web address. |
| `target.url_raw` | The raw form of the target URL; in the samples it is always the same as `target.url`. |
| `target.fqdn` | The host name of the target, such as `login.acme.example`. For an Android app it is the app's package name in reverse order. |
| `target.domain` | The registered domain of the target, such as `acme.example` for `login.acme.example`. |
| `target.service` | The name of your site or service the client credential belongs to. |
| `target.platform` | Where the credential was used: `WEB` for a website or `ANDROID` for an Android app (values seen), shown with the login address in the TARGET column. |
| `target.main_category` | The category of the target service, such as `Social Media`, `Identity & Access` or `E-Commerce & Retail`. Empty for a service without a category. |
| `target.sub_category` | A narrower category of the target service within `target.main_category`, such as `Email Provider` or `SSO / Identity Provider`. Empty for a service without a category. |
| `target.risk_tier` | The risk tier of the target service: `CRITICAL`, `HIGH`, `MEDIUM` or `LOW`. Empty for a service without a category. |
| `target.is_corporate` | Whether the target is a corporate service. |
| `target.requires_mfa_by_default` | Whether the target service enforces multi-factor authentication by default. Empty for a service without a category. |
| `state` | The client credential's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-revert.md


---

# Compromised Client Credential Stats

URL: https://docs.deepinfo.com/reference/cti/compromised-client-credential-stats/

GET /cti/compromised-client-credentials/stats: Compromised client credential statistics.

`GET https://api.deepinfo.com/v1/cti/compromised-client-credentials/stats`

Compromised client credential statistics.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type | Description |
|---|---|---|
| `credential_count` | integer |  |
| `first_exposure_date` | string | date-time |
| `timeline` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `credential_count` | number |
| `first_exposure_date` | string |
| `timeline` | array<object> |
| `timeline[].year` | number |
| `timeline[].credential_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-client-credential-stats.md


---

# Compromised Payment Credential Search

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-search/

POST /cti/compromised-payment-credentials/search: Searches leaked payment cards and their state.

`POST https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search`

Searches leaked payment cards and their state.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "pan_last_four",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `pan` | The full card number (primary account number) found in the leak. Treat it as sensitive. |
| `pan_masked` | The card number in masked form, with part of the digits hidden. |
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `dedup_key` | A de-duplication key for the card record. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `card_type` | The card type: `credit`, `debit` or `prepaid`. |
| `card_level` | The card's product level: `classic`, `gold`, `world`, `platinum`, `business`, `signature`, `standard` or `enhanced`. |
| `issuer_name` | The name of the card's issuer. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `leak_name` | The names of the leaks the card was found in, as a list. |
| `source_url` | The address of the source where the card was found. |
| `harvest_url` | The address the card record was harvested (collected) from, recorded separately from `source_url`. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `expiry_year` | The card's expiry year; it can be empty. |
| `expiry_month` | The card's expiry month, as a number; it can be empty. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `luhn_valid` | Whether the card number passes the Luhn check, the check-digit test that valid card numbers pass. |
| `has_cvv` | Whether the leaked record includes the card's security code (CVV). |
| `is_validated_live` | Whether the card has been validated as live. |

Operators: not measured

| Field | Description |
|---|---|
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `network` | Network names recorded for the card record, as a list of strings. |

### Sortable Fields

| Field | Description |
|---|---|
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `expiry_year` | The card's expiry year; it can be empty. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].pan` | string |  |
| `results[].pan_masked` | string |  |
| `results[].pan_last_four` | string |  |
| `results[].bin` | string |  |
| `results[].dedup_key` | string |  |
| `results[].luhn_valid` | boolean |  |
| `results[].expiry_year` | integer |  |
| `results[].expiry_month` | integer |  |
| `results[].expiry_raw` | string |  |
| `results[].is_expired` | boolean |  |
| `results[].has_cvv` | boolean |  |
| `results[].card_brand` | string |  |
| `results[].card_type` | string |  |
| `results[].card_level` | string |  |
| `results[].issuer_name` | string |  |
| `results[].issuer_country` | string |  |
| `results[].check_status` | string |  |
| `results[].is_validated_live` | boolean |  |
| `results[].confidence` | string |  |
| `results[].source_format` | string |  |
| `results[].network` | array of string |  |
| `results[].leak_name` | array of string |  |
| `results[].source_url` | string |  |
| `results[].first_seen` | string | date-time |
| `results[].last_seen` | string | date-time |
| `results[].times_seen` | integer |  |
| `results[].hackishness` | number |  |
| `results[].harvest_url` | string |  |
| `results[].co_listed_card_count` | integer |  |
| `results[].other_context` | object |  |
| `results[].state` | string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-search.md


---

# Compromised Payment Credential Export

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-export/

POST /cti/compromised-payment-credentials/search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "pan_last_four",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `pan` | The full card number (primary account number) found in the leak. Treat it as sensitive. |
| `pan_masked` | The card number in masked form, with part of the digits hidden. |
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `dedup_key` | A de-duplication key for the card record. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `card_type` | The card type: `credit`, `debit` or `prepaid`. |
| `card_level` | The card's product level: `classic`, `gold`, `world`, `platinum`, `business`, `signature`, `standard` or `enhanced`. |
| `issuer_name` | The name of the card's issuer. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `leak_name` | The names of the leaks the card was found in, as a list. |
| `source_url` | The address of the source where the card was found. |
| `harvest_url` | The address the card record was harvested (collected) from, recorded separately from `source_url`. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `expiry_year` | The card's expiry year; it can be empty. |
| `expiry_month` | The card's expiry month, as a number; it can be empty. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `luhn_valid` | Whether the card number passes the Luhn check, the check-digit test that valid card numbers pass. |
| `has_cvv` | Whether the leaked record includes the card's security code (CVV). |
| `is_validated_live` | Whether the card has been validated as live. |

Operators: not measured

| Field | Description |
|---|---|
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `network` | Network names recorded for the card record, as a list of strings. |

### Sortable Fields

| Field | Description |
|---|---|
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `expiry_year` | The card's expiry year; it can be empty. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-export.md


---

# Compromised Payment Credential Detail

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-detail/

GET /cti/compromised-payment-credentials/{credential_id}: Returns one compromised payment credential.

`GET https://api.deepinfo.com/v1/cti/compromised-payment-credentials/{credential_id}`

Returns one compromised payment credential.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `credential_id` | Required |  | `<credential_id>` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `pan` | string |  |
| `pan_masked` | string |  |
| `pan_last_four` | string |  |
| `bin` | string |  |
| `dedup_key` | string |  |
| `luhn_valid` | boolean |  |
| `expiry_year` | integer |  |
| `expiry_month` | integer |  |
| `expiry_raw` | string |  |
| `is_expired` | boolean |  |
| `has_cvv` | boolean |  |
| `card_brand` | string |  |
| `card_type` | string |  |
| `card_level` | string |  |
| `issuer_name` | string |  |
| `issuer_country` | string |  |
| `check_status` | string |  |
| `is_validated_live` | boolean |  |
| `confidence` | string |  |
| `source_format` | string |  |
| `network` | array of string |  |
| `leak_name` | array of string |  |
| `source_url` | string |  |
| `first_seen` | string | date-time |
| `last_seen` | string | date-time |
| `times_seen` | integer |  |
| `hackishness` | number |  |
| `harvest_url` | string |  |
| `co_listed_card_count` | integer |  |
| `other_context` | object |  |
| `state` | string |  |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-detail.md


---

# Compromised Payment Credential Accept Risk

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-accept-risk/

POST /cti/compromised-payment-credentials/search:accept-risk: Accepts the risk of the compromised payment credentials that match filters (risk_accepted).

`POST https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:accept-risk`

Accepts the risk of the compromised payment credentials that match `filters` (`risk_accepted`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "newly_detected"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "pan_last_four",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `pan` | The full card number (primary account number) found in the leak. Treat it as sensitive. |
| `pan_masked` | The card number in masked form, with part of the digits hidden. |
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `dedup_key` | A de-duplication key for the card record. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `card_type` | The card type: `credit`, `debit` or `prepaid`. |
| `card_level` | The card's product level: `classic`, `gold`, `world`, `platinum`, `business`, `signature`, `standard` or `enhanced`. |
| `issuer_name` | The name of the card's issuer. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `leak_name` | The names of the leaks the card was found in, as a list. |
| `source_url` | The address of the source where the card was found. |
| `harvest_url` | The address the card record was harvested (collected) from, recorded separately from `source_url`. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `expiry_year` | The card's expiry year; it can be empty. |
| `expiry_month` | The card's expiry month, as a number; it can be empty. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `luhn_valid` | Whether the card number passes the Luhn check, the check-digit test that valid card numbers pass. |
| `has_cvv` | Whether the leaked record includes the card's security code (CVV). |
| `is_validated_live` | Whether the card has been validated as live. |

Operators: not measured

| Field | Description |
|---|---|
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `network` | Network names recorded for the card record, as a list of strings. |

### Sortable Fields

| Field | Description |
|---|---|
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `expiry_year` | The card's expiry year; it can be empty. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-accept-risk.md


---

# Compromised Payment Credential Ignore

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-ignore/

POST /cti/compromised-payment-credentials/search:ignore: Ignores the compromised payment credentials that match filters (ignored).

`POST https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:ignore`

Ignores the compromised payment credentials that match `filters` (`ignored`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "newly_detected"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "pan_last_four",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `pan` | The full card number (primary account number) found in the leak. Treat it as sensitive. |
| `pan_masked` | The card number in masked form, with part of the digits hidden. |
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `dedup_key` | A de-duplication key for the card record. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `card_type` | The card type: `credit`, `debit` or `prepaid`. |
| `card_level` | The card's product level: `classic`, `gold`, `world`, `platinum`, `business`, `signature`, `standard` or `enhanced`. |
| `issuer_name` | The name of the card's issuer. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `leak_name` | The names of the leaks the card was found in, as a list. |
| `source_url` | The address of the source where the card was found. |
| `harvest_url` | The address the card record was harvested (collected) from, recorded separately from `source_url`. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `expiry_year` | The card's expiry year; it can be empty. |
| `expiry_month` | The card's expiry month, as a number; it can be empty. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `luhn_valid` | Whether the card number passes the Luhn check, the check-digit test that valid card numbers pass. |
| `has_cvv` | Whether the leaked record includes the card's security code (CVV). |
| `is_validated_live` | Whether the card has been validated as live. |

Operators: not measured

| Field | Description |
|---|---|
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `network` | Network names recorded for the card record, as a list of strings. |

### Sortable Fields

| Field | Description |
|---|---|
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `expiry_year` | The card's expiry year; it can be empty. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-ignore.md


---

# Compromised Payment Credential Mark False Positive

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-mark-false-positive/

Marks the compromised payment credentials that match filters as false positive (marked_as_false_positive).

`POST https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:mark-false-positive`

Marks the compromised payment credentials that match `filters` as false positive (`marked_as_false_positive`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "newly_detected"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "pan_last_four",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `pan` | The full card number (primary account number) found in the leak. Treat it as sensitive. |
| `pan_masked` | The card number in masked form, with part of the digits hidden. |
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `dedup_key` | A de-duplication key for the card record. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `card_type` | The card type: `credit`, `debit` or `prepaid`. |
| `card_level` | The card's product level: `classic`, `gold`, `world`, `platinum`, `business`, `signature`, `standard` or `enhanced`. |
| `issuer_name` | The name of the card's issuer. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `leak_name` | The names of the leaks the card was found in, as a list. |
| `source_url` | The address of the source where the card was found. |
| `harvest_url` | The address the card record was harvested (collected) from, recorded separately from `source_url`. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `expiry_year` | The card's expiry year; it can be empty. |
| `expiry_month` | The card's expiry month, as a number; it can be empty. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `luhn_valid` | Whether the card number passes the Luhn check, the check-digit test that valid card numbers pass. |
| `has_cvv` | Whether the leaked record includes the card's security code (CVV). |
| `is_validated_live` | Whether the card has been validated as live. |

Operators: not measured

| Field | Description |
|---|---|
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `network` | Network names recorded for the card record, as a list of strings. |

### Sortable Fields

| Field | Description |
|---|---|
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `expiry_year` | The card's expiry year; it can be empty. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-mark-false-positive.md


---

# Compromised Payment Credential Mark Resolved

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-mark-resolved/

POST /cti/compromised-payment-credentials/search:mark-resolved: Marks the compromised payment credentials that match filters as resolved (marked_as_resolved).

`POST https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:mark-resolved`

Marks the compromised payment credentials that match `filters` as resolved (`marked_as_resolved`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "newly_detected"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "pan_last_four",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `pan` | The full card number (primary account number) found in the leak. Treat it as sensitive. |
| `pan_masked` | The card number in masked form, with part of the digits hidden. |
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `dedup_key` | A de-duplication key for the card record. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `card_type` | The card type: `credit`, `debit` or `prepaid`. |
| `card_level` | The card's product level: `classic`, `gold`, `world`, `platinum`, `business`, `signature`, `standard` or `enhanced`. |
| `issuer_name` | The name of the card's issuer. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `leak_name` | The names of the leaks the card was found in, as a list. |
| `source_url` | The address of the source where the card was found. |
| `harvest_url` | The address the card record was harvested (collected) from, recorded separately from `source_url`. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `expiry_year` | The card's expiry year; it can be empty. |
| `expiry_month` | The card's expiry month, as a number; it can be empty. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `luhn_valid` | Whether the card number passes the Luhn check, the check-digit test that valid card numbers pass. |
| `has_cvv` | Whether the leaked record includes the card's security code (CVV). |
| `is_validated_live` | Whether the card has been validated as live. |

Operators: not measured

| Field | Description |
|---|---|
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `network` | Network names recorded for the card record, as a list of strings. |

### Sortable Fields

| Field | Description |
|---|---|
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `expiry_year` | The card's expiry year; it can be empty. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-mark-resolved.md


---

# Compromised Payment Credential Revert

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-revert/

POST /cti/compromised-payment-credentials/search:revert: Reverts the compromised payment credentials that match filters to their previous, active state.

`POST https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:revert`

Reverts the compromised payment credentials that match `filters` to their previous, active state. Only states set by a user can be reverted.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "newly_detected"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "pan_last_four",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `pan` | The full card number (primary account number) found in the leak. Treat it as sensitive. |
| `pan_masked` | The card number in masked form, with part of the digits hidden. |
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `dedup_key` | A de-duplication key for the card record. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `card_type` | The card type: `credit`, `debit` or `prepaid`. |
| `card_level` | The card's product level: `classic`, `gold`, `world`, `platinum`, `business`, `signature`, `standard` or `enhanced`. |
| `issuer_name` | The name of the card's issuer. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `leak_name` | The names of the leaks the card was found in, as a list. |
| `source_url` | The address of the source where the card was found. |
| `harvest_url` | The address the card record was harvested (collected) from, recorded separately from `source_url`. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `expiry_year` | The card's expiry year; it can be empty. |
| `expiry_month` | The card's expiry month, as a number; it can be empty. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `luhn_valid` | Whether the card number passes the Luhn check, the check-digit test that valid card numbers pass. |
| `has_cvv` | Whether the leaked record includes the card's security code (CVV). |
| `is_validated_live` | Whether the card has been validated as live. |

Operators: not measured

| Field | Description |
|---|---|
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `network` | Network names recorded for the card record, as a list of strings. |

### Sortable Fields

| Field | Description |
|---|---|
| `pan_last_four` | The last four digits of the card number. |
| `bin` | The card's bank identification number (BIN), the leading digits of the card number that identify the issuer. |
| `expiry_year` | The card's expiry year; it can be empty. |
| `card_brand` | The card brand: `visa`, `mastercard`, `amex`, `discover` or `unionpay`. |
| `issuer_country` | The country of the card's issuer. |
| `check_status` | The result of checking the card: `approved`, `declined` or `unknown`, which is the default. |
| `confidence` | The platform's confidence level for the record: `high`, `medium` or `low` (CONFIDENCE). |
| `source_format` | The kind of source the card was found in: `structured_dump`, `checker_bot`, `stealer_log`, `bare_ccn` or `other`. |
| `first_seen` | When the card was first seen (UTC date-time). |
| `last_seen` | When the card was last seen, shown as LAST SEEN (UTC date-time). |
| `times_seen` | How many times the card was seen (TIMES SEEN). |
| `hackishness` | The record's hackishness score (HACKISHNESS), the same kind of score as on dark web search results. |
| `co_listed_card_count` | The number of cards listed together with this card in its source. |
| `state` | The card record's state: `newly_detected` or `unresolved` while active; once inactive, `not_applicable` or `verified_resolved` (set by the platform) or `ignored`, `risk_accepted`, `marked_as_resolved` or `marked_as_false_positive` (set by you). |

## Response Fields

| Field | Type |
|---|---|
| `count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-revert.md


---

# Compromised Payment Credential Stats

URL: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-stats/

GET /cti/compromised-payment-credentials/stats: Compromised payment credential statistics.

`GET https://api.deepinfo.com/v1/cti/compromised-payment-credentials/stats`

Compromised payment credential statistics.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type | Description |
|---|---|---|
| `credential_count` | integer |  |
| `first_exposure_date` | string | date-time |
| `timeline` | array of object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `credential_count` | number |
| `first_exposure_date` | null |
| `timeline` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-payment-credential-stats.md


---

# Compromised Device Search

URL: https://docs.deepinfo.com/reference/cti/compromised-device-search/

POST /cti/compromised-devices: Searches compromised (infostealer-infected) devices linked to your employees.

`POST https://api.deepinfo.com/v1/cti/compromised-devices`

Searches compromised (infostealer-infected) devices linked to your employees.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "compromised_device.hardware_id",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "compromised_device.hardware_id",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `compromised_device.hardware_id` | The hardware ID the infostealer recorded for the infected device, which identifies one machine across logs. |
| `compromised_device.user_info.username` | The operating-system user name on the infected device, as the stealer log recorded it. |
| `compromised_device.user_info.machine_name` | The computer name of the infected device; the platform shows it as MACHINE. |
| `compromised_device.user_info.country` | The country the infected device was in when the log was made, as the stealer recorded it. |
| `compromised_device.user_info.location` | The location the stealer log gives for the device, such as a city or region. |
| `compromised_device.user_info.zip_code` | The postal code the stealer log gives for the device's location. |
| `compromised_device.user_info.language` | The system language of the infected device; the platform shows it as LANGUAGE. |
| `compromised_device.user_info.time_zone` | The time zone set on the infected device; the platform shows it as TIMEZONE. |
| `compromised_device.user_info.operating_system` | The operating system of the infected device, such as a Windows version; the platform shows it as OS. |
| `compromised_device.user_info.screen_resolution` | The screen resolution of the infected device, as the stealer recorded it. |
| `compromised_device.user_info.ip_address` | The IP address the infected device had when the data was stolen; the platform shows it as IP. |
| `compromised_device.user_info.keyboard_layouts` | The keyboard layouts installed on the infected device, a list of language codes. |
| `compromised_device.system_info.ram` | The amount of memory (RAM) of the infected device, as text. |
| `compromised_device.system_info.cpu` | The processor (CPU) model of the infected device. |
| `compromised_device.system_info.gpu` | The graphics cards (GPU) of the infected device, a list. |
| `compromised_device.system_info.installed_antivirus` | The antivirus products found on the infected device, a list; the platform shows it as AV. |
| `compromised_device.installed_softwares.name` | The name of a program installed on the infected device. |
| `compromised_device.installed_softwares.version` | The version of a program installed on the infected device. |
| `compromised_device.installed_softwares.category` | The category of a program installed on the infected device. |
| `compromised_device.installed_browsers.name` | The name of a web browser installed on the infected device. |
| `compromised_device.installed_browsers.version` | The version of a web browser installed on the infected device. |
| `account.id` | The ID of the employee account the device is linked to, the `id` returned by Compromised Employee Account Search. |
| `account.email` | The e-mail address of the employee account the device is linked to. |
| `leaked_data.stealer_docs` | The names of the files the infostealer took from the device, a list. |
| `leaked_data.passwords.url` | The address of the login page a stolen password was saved for. |
| `leaked_data.passwords.fqdn` | The full host name of the login page a stolen password was saved for, such as `login.acme.example`. |
| `leaked_data.passwords.domain` | The registered domain of the login page a stolen password was saved for, such as `acme.example`. |
| `leaked_data.passwords.username` | The user name or e-mail address saved with a stolen password. Responses mask personal values. |
| `leaked_data.passwords.password` | The stolen password itself. Responses show it masked. |
| `leaked_data.passwords.leak_source_type` | Where the stolen password came from, such as the kind of stealer log. |
| `leaked_data.passwords.source_application` | The application the password was stolen from, such as a web browser. |
| `leaked_data.tokens.raw_value` | The stolen token itself, such as a session or API token. Responses show it masked. |
| `leaked_data.tokens.token_type` | The kind of stolen token, such as a session token or an API key. |
| `leaked_data.tokens.possible_issuer` | The service that probably issued the stolen token; the platform shows it as ISSUER. |
| `leaked_data.tokens.associated_user` | The user the stolen token belongs to; the platform shows it as USER. |
| `leaked_data.tokens.website` | The website the stolen token is used on. |
| `leaked_data.tokens.category` | The category of the stolen token's service. |
| `leaked_data.tokens.risk_reason` | Why the stolen token got its risk level, in words. |
| `leaked_data.tokens.source_application` | The application the token was stolen from, such as a web browser. |
| `leaked_data.auto_fills.field_name` | The name of a form field whose saved (autofill) value was stolen, such as `email` or `phone`. |
| `leaked_data.auto_fills.field_value` | The stolen autofill value. Responses mask personal values. |
| `leaked_data.auto_fills.data_type` | The kind of data in a stolen autofill value, such as an e-mail address or a phone number. |
| `leaked_data.auto_fills.source_application` | The application the autofill value was stolen from, such as a web browser. |
| `leaked_data.auto_fills.source_name` | The name of the browser profile or source the autofill value was read from. |
| `leaked_data.cookies.domain` | A domain the infected device had cookies for, such as `acme.example`. |
| `leaked_data.cookies.subdomains` | The subdomains of that domain the device had cookies for, a list. |
| `leaked_data.sensitive_cookies.domain` | The domain a stolen sensitive cookie (one that can open a session) belongs to. |
| `leaked_data.sensitive_cookies.name` | The name of a stolen sensitive cookie. |
| `leaked_data.sensitive_cookies.value` | The value of a stolen sensitive cookie. Responses show it masked. |
| `leaked_data.sensitive_cookies.path` | The path a stolen sensitive cookie applies to, such as `/`. |
| `leaked_data.sensitive_cookies.cookie_type` | The kind of stolen cookie, such as a session or authentication cookie. |
| `leaked_data.sensitive_cookies.risk_reason` | Why the stolen cookie got its risk level, in words. |
| `leaked_data.sensitive_cookies.source_application` | The application the cookie was stolen from, such as a web browser. |
| `leaked_data.documents.name` | The file name of a document the infostealer took from the device. |
| `leaked_data.documents.creator` | The author recorded in a stolen document's properties. Responses mask personal values. |
| `leaked_data.documents.last_modified_by` | The last editor recorded in a stolen document's properties. Responses mask personal values. |
| `leaked_data.documents.content` | The text of a stolen document. Responses do not show it. |
| `leaked_data.documents.language` | The language of a stolen document's text. |
| `leaked_data.documents.sensitive_data_score` | A score of how much sensitive data a stolen document holds. |
| `leaked_data.documents.sensitive_data_type` | The kinds of sensitive data found in a stolen document, a list. |
| `compromise_summary.corporate_email_address` | Your organization's e-mail addresses found on the device, a list. |
| `compromise_summary.other_email_addresses` | The other e-mail addresses found on the device, a list. |
| `compromise_summary.same_password_rate` | How often the same password is reused among the device's stolen passwords, as text. |
| `compromise_summary.accessed_internal_resources` | Internal resources of your organization the device had stolen access to, such as internal login pages, a list. |
| `compromise_summary.corporate_risk` | A short assessment of the risk to your organization; the platform shows it as CORPORATE RISK. |
| `compromise_summary.financial_risk` | A short assessment of the financial risk; the platform shows it as FINANCIAL RISK. |
| `compromise_summary.identity_theft_risk` | A short assessment of the identity theft risk; the platform shows it as IDENTITY THEFT. |
| `compromise_summary.corporate_espionage` | A short assessment of the corporate espionage risk. |
| `compromise_summary.ransomware_threat` | A short assessment of the ransomware threat; the platform shows it as RANSOMWARE THREAT. |
| `compromise_summary.phishing_risk` | A short assessment of the phishing risk; the platform shows it as PHISHING RISK. |
| `compromise_summary.session_hijacking_risk` | A short assessment of the session hijacking risk, from the stolen cookies and tokens; the platform shows it as SESSION HIJACKING. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `compromised_device.log_date` | When the infostealer log of this device was created, that is, when the data was stolen. |
| `leaked_data.sensitive_cookies.expiration_timestamp` | When the stolen cookie expires. A cookie that has not expired can still open a session. |
| `leaked_data.documents.created_date` | When a stolen document was created, from its properties. |
| `leaked_data.documents.modified_date` | When a stolen document was last changed, from its properties. |
| `compromise_summary.password_count` | The number of passwords stolen from the device; the platform shows it as PASSWORDS. |
| `compromise_summary.token_count` | The number of tokens stolen from the device; the platform shows it as TOKEN. |
| `compromise_summary.autofill_count` | The number of autofill values stolen from the device; the platform shows it as AUTOFILL. |
| `compromise_summary.cookie_count` | The number of cookies stolen from the device. |
| `compromise_summary.sensitive_cookie_count` | The number of sensitive cookies (ones that can open a session) stolen from the device; the platform shows it as COOKIE. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `leaked_data.passwords.is_corporate` | `true` when the stolen password is for one of your organization's own services. |
| `leaked_data.sensitive_cookies.secure` | `true` when the stolen cookie is sent over HTTPS only. |
| `leaked_data.sensitive_cookies.http_only` | `true` when the stolen cookie is hidden from page scripts (HttpOnly). |
| `leaked_data.sensitive_cookies.include_subdomains` | `true` when the stolen cookie also applies to the domain's subdomains. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `leaked_data.tokens.risk_level` | How risky the stolen token is: `low`, `medium`, `high` or `critical`. |
| `leaked_data.sensitive_cookies.risk_level` | How risky the stolen cookie is: `low`, `medium`, `high` or `critical`. |
| `compromise_summary.risk_level` | The device's overall risk level: `low`, `medium`, `high` or `critical`. |

### Sortable Fields

| Field | Description |
|---|---|
| `compromised_device.hardware_id` | The hardware ID the infostealer recorded for the infected device, which identifies one machine across logs. |
| `compromised_device.log_date` | When the infostealer log of this device was created, that is, when the data was stolen. |
| `compromised_device.user_info.username` | The operating-system user name on the infected device, as the stealer log recorded it. |
| `compromised_device.user_info.machine_name` | The computer name of the infected device; the platform shows it as MACHINE. |
| `compromised_device.user_info.country` | The country the infected device was in when the log was made, as the stealer recorded it. |
| `compromised_device.user_info.language` | The system language of the infected device; the platform shows it as LANGUAGE. |
| `compromised_device.user_info.operating_system` | The operating system of the infected device, such as a Windows version; the platform shows it as OS. |
| `compromised_device.user_info.screen_resolution` | The screen resolution of the infected device, as the stealer recorded it. |
| `compromised_device.user_info.ip_address` | The IP address the infected device had when the data was stolen; the platform shows it as IP. |
| `compromise_summary.password_count` | The number of passwords stolen from the device; the platform shows it as PASSWORDS. |
| `compromise_summary.token_count` | The number of tokens stolen from the device; the platform shows it as TOKEN. |
| `compromise_summary.autofill_count` | The number of autofill values stolen from the device; the platform shows it as AUTOFILL. |
| `compromise_summary.cookie_count` | The number of cookies stolen from the device. |
| `compromise_summary.sensitive_cookie_count` | The number of sensitive cookies (ones that can open a session) stolen from the device; the platform shows it as COOKIE. |
| `compromise_summary.same_password_rate` | How often the same password is reused among the device's stolen passwords, as text. |
| `compromise_summary.risk_level` | The device's overall risk level: `low`, `medium`, `high` or `critical`. |
| `compromise_summary.corporate_risk` | A short assessment of the risk to your organization; the platform shows it as CORPORATE RISK. |
| `compromise_summary.financial_risk` | A short assessment of the financial risk; the platform shows it as FINANCIAL RISK. |
| `compromise_summary.identity_theft_risk` | A short assessment of the identity theft risk; the platform shows it as IDENTITY THEFT. |
| `compromise_summary.corporate_espionage` | A short assessment of the corporate espionage risk. |
| `compromise_summary.ransomware_threat` | A short assessment of the ransomware threat; the platform shows it as RANSOMWARE THREAT. |
| `compromise_summary.phishing_risk` | A short assessment of the phishing risk; the platform shows it as PHISHING RISK. |
| `compromise_summary.session_hijacking_risk` | A short assessment of the session hijacking risk, from the stolen cookies and tokens; the platform shows it as SESSION HIJACKING. |

## Response Fields

| Field | Type |
|---|---|
| `page` | integer |
| `page_size` | integer |
| `result_count` | integer |
| `results` | array of object |
| `results[].id` | string |
| `results[].account` | object |
| `results[].compromised_device` | object |
| `results[].leaked_data` | object |
| `results[].compromise_summary` | object |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-device-search.md


---

# Compromised Device Detail

URL: https://docs.deepinfo.com/reference/cti/compromised-device-detail/

GET /cti/compromised-devices/{compromised_employee_device_id}: Returns one compromised device.

`GET https://api.deepinfo.com/v1/cti/compromised-devices/{compromised_employee_device_id}`

Returns one compromised device.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `compromised_employee_device_id` | Required |  | `<compromised_employee_device_id>` |

## Response Fields

| Field | Type |
|---|---|
| `id` | string |
| `account` | object |
| `compromised_device` | object |
| `leaked_data` | object |
| `compromise_summary` | object |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/compromised-device-detail.md


---

# Threat Actor Search

URL: https://docs.deepinfo.com/reference/cti/threat-actor-search/

POST /cti/threat-actors/search: Searches threat actors.

`POST https://api.deepinfo.com/v1/cti/threat-actors/search`

Searches threat actors.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "name",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "name",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `name` | The threat actor's main name; other names are in `aliases`. |
| `aliases` | Other names the threat actor is known by. |
| `actor_size` | The threat actor's size, as text. |
| `actor_types` | The threat actor's types, as a list of strings. |
| `actor_sophistication` | The threat actor's level of sophistication, as text. |
| `actor_specializations` | The threat actor's specializations, as a list of strings. |
| `description` | A text description of the threat actor. |
| `law_enforcement` | Law enforcement information recorded for the threat actor, as text. |
| `contact_info.email` | E-mail addresses listed in the threat actor's contact information. |
| `contact_info.telegram_username` | Telegram usernames listed in the threat actor's contact information. |
| `contact_info.telegram_channel` | Telegram channels listed in the threat actor's contact information. |
| `contact_info.discord_username` | Discord usernames listed in the threat actor's contact information. |
| `contact_info.jabber` | Jabber (XMPP) addresses listed in the threat actor's contact information. |
| `contact_info.tox` | Tox IDs listed in the threat actor's contact information. |
| `contact_info.skype` | Skype names listed in the threat actor's contact information. |
| `contact_info.icq` | ICQ contacts listed in the threat actor's contact information. |
| `contact_info.cdn` | CDN entries listed in the threat actor's contact information. |
| `contact_info.ip_ranges` | IP address ranges listed in the threat actor's contact information. |
| `social_media.twitter` | The threat actor's Twitter (X) accounts. |
| `social_media.vimeo` | The threat actor's Vimeo accounts. |
| `websites` | Websites linked to the threat actor. |
| `payment_info.bitcoin` | Bitcoin addresses in the threat actor's payment information. |
| `payment_info.ethereum` | Ethereum addresses in the threat actor's payment information. |
| `origin_countries` | The threat actor's countries of origin; the Most Actor Hosting Countries statistic counts actors per origin country. |
| `leak_names` | Names of leaks linked to the threat actor. |
| `forum_names` | Names of the forums the threat actor is active on. |
| `market_names` | Names of the markets the threat actor is active on. |
| `forum_market_usernames` | The usernames the threat actor uses on forums and markets. |
| `targeted_regions` | The regions the threat actor has targeted. |
| `targeted_countries` | The countries the threat actor has targeted; the Most Targeted Countries statistic counts them. |
| `targeted_industries` | The industries the threat actor has targeted; the Most Targeted Industries statistic counts them. |
| `targeted_organizations` | The organizations the threat actor has targeted; the Most Targeted Organizations statistic counts them. |
| `cves_used` | CVE IDs of the vulnerabilities the threat actor has used; the Most Used CVEs statistic counts them. |
| `tools_used` | The tools the threat actor has used; the Most Used Tools statistic counts them. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `date_updated` | When the threat actor's profile was last updated (UTC date-time). |
| `date_first_seen` | When the threat actor was first seen (UTC date-time). |
| `date_last_seen` | When the threat actor was last seen active (UTC date-time). |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_active` | Whether the threat actor is considered active. |

### Sortable Fields

| Field | Description |
|---|---|
| `name` | The threat actor's main name; other names are in `aliases`. |
| `date_updated` | When the threat actor's profile was last updated (UTC date-time). |
| `date_first_seen` | When the threat actor was first seen (UTC date-time). |
| `date_last_seen` | When the threat actor was last seen active (UTC date-time). |
| `is_active` | Whether the threat actor is considered active. |
| `actor_size` | The threat actor's size, as text. |
| `actor_sophistication` | The threat actor's level of sophistication, as text. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].name` | string |  |
| `results[].aliases` | array of string |  |
| `results[].date_updated` | string | date-time |
| `results[].date_first_seen` | string | date-time |
| `results[].date_last_seen` | string | date-time |
| `results[].is_active` | boolean |  |
| `results[].actor_size` | string |  |
| `results[].actor_types` | array of string |  |
| `results[].actor_sophistication` | string |  |
| `results[].actor_specializations` | array of string |  |
| `results[].description` | string |  |
| `results[].law_enforcement` | string |  |
| `results[].contact_info` | object |  |
| `results[].social_media` | object |  |
| `results[].websites` | array of string |  |
| `results[].payment_info` | object |  |
| `results[].origin_countries` | array of string |  |
| `results[].leak_names` | array of string |  |
| `results[].forum_names` | array of string |  |
| `results[].market_names` | array of string |  |
| `results[].forum_market_usernames` | array of string |  |
| `results[].targeted_regions` | array of string |  |
| `results[].targeted_countries` | array of string |  |
| `results[].targeted_industries` | array of string |  |
| `results[].targeted_organizations` | array of string |  |
| `results[].cves_used` | array of string |  |
| `results[].tools_used` | array of string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/threat-actor-search.md


---

# Threat Actor Detail

URL: https://docs.deepinfo.com/reference/cti/threat-actor-detail/

GET /cti/threat-actors/{threat_actor_id}: Returns one threat actor profile.

`GET https://api.deepinfo.com/v1/cti/threat-actors/{threat_actor_id}`

Returns one threat actor profile.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `threat_actor_id` | Required |  | `<threat_actor_id>` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `aliases` | array of string |  |
| `date_updated` | string | date-time |
| `date_first_seen` | string | date-time |
| `date_last_seen` | string | date-time |
| `is_active` | boolean |  |
| `actor_size` | string |  |
| `actor_types` | array of string |  |
| `actor_sophistication` | string |  |
| `actor_specializations` | array of string |  |
| `description` | string |  |
| `law_enforcement` | string |  |
| `contact_info` | object |  |
| `social_media` | object |  |
| `websites` | array of string |  |
| `payment_info` | object |  |
| `origin_countries` | array of string |  |
| `leak_names` | array of string |  |
| `forum_names` | array of string |  |
| `market_names` | array of string |  |
| `forum_market_usernames` | array of string |  |
| `targeted_regions` | array of string |  |
| `targeted_countries` | array of string |  |
| `targeted_industries` | array of string |  |
| `targeted_organizations` | array of string |  |
| `cves_used` | array of string |  |
| `tools_used` | array of string |  |

> No live example: the DEMO account has no data for this endpoint yet, or it returned an error during testing. The response shape is described above.

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/threat-actor-detail.md


---

# Most Actor Hosting Countries by Threat Actors

URL: https://docs.deepinfo.com/reference/cti/most-actor-hosting-countries-by-threat-actors/

GET /cti/threat-actors/stats/most-actor-hosting-countries: Countries hosting the most threat actors.

`GET https://api.deepinfo.com/v1/cti/threat-actors/stats/most-actor-hosting-countries`

Countries hosting the most threat actors.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `size` | Optional | Min `1`, max `100`. | `25` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `count` | integer |
| `origin_country` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/most-actor-hosting-countries-by-threat-actors.md


---

# Most Targeted Countries by Threat Actors

URL: https://docs.deepinfo.com/reference/cti/most-targeted-countries-by-threat-actors/

GET /cti/threat-actors/stats/most-targeted-countries: Countries most targeted by threat actors (size: number of rows).

`GET https://api.deepinfo.com/v1/cti/threat-actors/stats/most-targeted-countries`

Countries most targeted by threat actors (`size`: number of rows).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `size` | Optional | Min `1`, max `100`. | `25` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `count` | integer |
| `target_country` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/most-targeted-countries-by-threat-actors.md


---

# Most Targeted Industries by Threat Actors

URL: https://docs.deepinfo.com/reference/cti/most-targeted-industries-by-threat-actors/

GET /cti/threat-actors/stats/most-targeted-industries: Industries most targeted by threat actors.

`GET https://api.deepinfo.com/v1/cti/threat-actors/stats/most-targeted-industries`

Industries most targeted by threat actors.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `size` | Optional | Min `1`, max `100`. | `25` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `count` | integer |
| `target_industry` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/most-targeted-industries-by-threat-actors.md


---

# Most Targeted Organizations by Threat Actors

URL: https://docs.deepinfo.com/reference/cti/most-targeted-organizations-by-threat-actors/

GET /cti/threat-actors/stats/most-targeted-organizations: Organizations most targeted by threat actors.

`GET https://api.deepinfo.com/v1/cti/threat-actors/stats/most-targeted-organizations`

Organizations most targeted by threat actors.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `size` | Optional | Min `1`, max `100`. | `25` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `count` | integer |
| `target_organization` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/most-targeted-organizations-by-threat-actors.md


---

# Most Used CVEs by Threat Actors

URL: https://docs.deepinfo.com/reference/cti/most-used-cves-by-threat-actors/

GET /cti/threat-actors/stats/most-used-cves: CVEs most used by threat actors.

`GET https://api.deepinfo.com/v1/cti/threat-actors/stats/most-used-cves`

CVEs most used by threat actors.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `size` | Optional | Min `1`, max `100`. | `25` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `count` | integer |
| `cve` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/most-used-cves-by-threat-actors.md


---

# Most Used Tools by Threat Actors

URL: https://docs.deepinfo.com/reference/cti/most-used-tools-by-threat-actors/

GET /cti/threat-actors/stats/most-used-tools: Tools most used by threat actors.

`GET https://api.deepinfo.com/v1/cti/threat-actors/stats/most-used-tools`

Tools most used by threat actors.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `size` | Optional | Min `1`, max `100`. | `25` |

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `count` | integer |
| `tool` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/most-used-tools-by-threat-actors.md


---

# Security News Search

URL: https://docs.deepinfo.com/reference/cti/security-news-search/

POST /cti/news/search: Searches curated cybersecurity news.

`POST https://api.deepinfo.com/v1/cti/news/search`

Searches curated cybersecurity news.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "title",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "title",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `title` | The article's headline; the platform's news search box matches words in it. |
| `source` | The publisher of the article, such as `Bleeping Computer`, `The Hacker News` or `Security Affairs`; a few records hold the article's address instead. |
| `tags` | Topic tags of the article, in lower case with hyphens, such as `zero-day`, `active-exploitation` or `cisa`; they are the tag chips on the article cards. |
| `country` | Countries the article names as targets (TARGET COUNTRY), as English country names such as `Germany` rather than codes. |
| `industry` | Industries the article names as targets (TARGET INDUSTRY), as sector names such as `Education` or `Financial and Insurance Activities`. |
| `organization` | Organizations the article names as targets (TARGET ORGANIZATION). |
| `cve_vendor` | Vendor names linked to the CVEs in the article (VENDOR), in lower case with underscores, such as `microsoft` or `fortinet`. |
| `cve_product` | Product names linked to the CVEs in the article (PRODUCT), usually in lower case with underscores, such as `chrome` or `linux_kernel`. |
| `cve_id` | CVE IDs mentioned in the article, such as `CVE-2025-59718` (CVE in the article's side panel). |
| `threat_actor` | Threat actors the article names (THREAT ACTOR), such as `ShinyHunters`. |
| `related_issue_types` | Issue types the article is linked to, as a list of strings; empty on every article in the samples. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `featured` | Boolean flag for featured articles; `false` on every article in the samples. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `publish_date` | When the article was published (UTC date-time); the news menu groups articles by it under TODAY and LAST 7 DAYS. |

### Sortable Fields

| Field | Description |
|---|---|
| `title` | The article's headline; the platform's news search box matches words in it. |
| `source` | The publisher of the article, such as `Bleeping Computer`, `The Hacker News` or `Security Affairs`; a few records hold the article's address instead. |
| `publish_date` | When the article was published (UTC date-time); the news menu groups articles by it under TODAY and LAST 7 DAYS. |
| `tags` | Topic tags of the article, in lower case with hyphens, such as `zero-day`, `active-exploitation` or `cisa`; they are the tag chips on the article cards. |
| `country` | Countries the article names as targets (TARGET COUNTRY), as English country names such as `Germany` rather than codes. |
| `industry` | Industries the article names as targets (TARGET INDUSTRY), as sector names such as `Education` or `Financial and Insurance Activities`. |
| `organization` | Organizations the article names as targets (TARGET ORGANIZATION). |
| `cve_vendor` | Vendor names linked to the CVEs in the article (VENDOR), in lower case with underscores, such as `microsoft` or `fortinet`. |
| `cve_product` | Product names linked to the CVEs in the article (PRODUCT), usually in lower case with underscores, such as `chrome` or `linux_kernel`. |
| `cve_id` | CVE IDs mentioned in the article, such as `CVE-2025-59718` (CVE in the article's side panel). |
| `featured` | Boolean flag for featured articles; `false` on every article in the samples. |
| `threat_actor` | Threat actors the article names (THREAT ACTOR), such as `ShinyHunters`. |
| `related_issue_types` | Issue types the article is linked to, as a list of strings; empty on every article in the samples. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].title` | string |  |
| `results[].image` | string |  |
| `results[].source` | string |  |
| `results[].source_url` | string |  |
| `results[].publish_date` | string | date-time |
| `results[].tags` | array of string |  |
| `results[].country` | array of string |  |
| `results[].industry` | array of string |  |
| `results[].organization` | array of string |  |
| `results[].cve_vendor` | array of string |  |
| `results[].cve_product` | array of string |  |
| `results[].cve_id` | array of string |  |
| `results[].featured` | boolean |  |
| `results[].threat_actor` | array of string |  |
| `results[].related_issue_types` | array of string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].title` | string |
| `results[].image` | string |
| `results[].source` | string |
| `results[].source_url` | string |
| `results[].publish_date` | string |
| `results[].tags` | array<string> |
| `results[].country` | array |
| `results[].industry` | array<string> |
| `results[].organization` | array |
| `results[].cve_vendor` | array<string> |
| `results[].cve_product` | array<string> |
| `results[].cve_id` | array<string> |
| `results[].featured` | boolean |
| `results[].threat_actor` | array<string> |
| `results[].related_issue_types` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/security-news-search.md


---

# Security News Detail

URL: https://docs.deepinfo.com/reference/cti/security-news-detail/

GET /cti/news/{id}: Returns one news item.

`GET https://api.deepinfo.com/v1/cti/news/{id}`

Returns one news item.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `id` | Required |  | `000000000000000ecf240001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `title` | string |  |
| `content` | string |  |
| `image` | string |  |
| `source` | string |  |
| `source_url` | string |  |
| `publish_date` | string | date-time |
| `tags` | array of string |  |
| `country` | array of string |  |
| `industry` | array of string |  |
| `organization` | array of string |  |
| `cve_vendor` | array of string |  |
| `cve_product` | array of string |  |
| `cve_id` | array of string |  |
| `featured` | boolean |  |
| `threat_actor` | array of string |  |
| `related_issue_types` | array of string |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `title` | string |
| `content` | string |
| `image` | string |
| `source` | string |
| `source_url` | string |
| `publish_date` | string |
| `tags` | array<string> |
| `country` | array |
| `industry` | array |
| `organization` | array |
| `cve_vendor` | array<string> |
| `cve_product` | array<string> |
| `cve_id` | array<string> |
| `featured` | boolean |
| `threat_actor` | array |
| `related_issue_types` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/cti/security-news-detail.md


---

# Brand Risk Protection (BRP)

URL: https://docs.deepinfo.com/reference/brp/

Brand Risk Protection: domains that imitate your brand. Suspicious domains are candidates for review; approved ones become fraudulent domains and are…

Domains that imitate your brand. **Suspicious domains** are candidates for review; approved ones become **fraudulent domains** and are monitored.

## Settings

Brand Risk Protection settings.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Fraudulent Settings Detail](/reference/brp/fraudulent-settings-detail/) | `/brp/fraudulent-settings` |
| PUT | [Fraudulent Settings Update](/reference/brp/fraudulent-settings-update/) | `/brp/fraudulent-settings` |

## Fraudulent Domains

Monitored fraudulent domains, their scans, history and risk score.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Fraudulent Domain Search](/reference/brp/fraudulent-domain-search/) | `/brp/fraudulent-domains/search` |
| POST | [Fraudulent Domain Export](/reference/brp/fraudulent-domain-export/) | `/brp/fraudulent-domains/search:export` |
| GET | [Fraudulent Domain Detail](/reference/brp/fraudulent-domain-detail/) | `/brp/fraudulent-domains/{fraudulent_id}` |
| POST | [Fraudulent Domain Delete](/reference/brp/fraudulent-domain-delete/) | `/brp/fraudulent-domains/search:delete` |
| POST | [Fraudulent Domain Instant Scan](/reference/brp/fraudulent-domain-instant-scan/) | `/brp/fraudulent-domains/{fraudulent_id}/instant-scan` |
| GET | [Fraudulent Domain DNS History](/reference/brp/fraudulent-domain-dns-history/) | `/brp/fraudulent-domains/{fraudulent_id}/dns-history` |
| GET | [Fraudulent Domain Latest Scan](/reference/brp/fraudulent-domain-latest-scan/) | `/brp/fraudulent-domains/{fraudulent_id}/latest-scan` |
| GET | [Fraudulent Domain Port Scan History](/reference/brp/fraudulent-domain-port-scan-history/) | `/brp/fraudulent-domains/{fraudulent_id}/port-scan-history` |
| GET | [Fraudulent Domain SSL History](/reference/brp/fraudulent-domain-ssl-history/) | `/brp/fraudulent-domains/{fraudulent_id}/ssl-history` |
| GET | [Fraudulent Domain Webdata History](/reference/brp/fraudulent-domain-webdata-history/) | `/brp/fraudulent-domains/{fraudulent_id}/webdata-history` |
| GET | [Fraudulent Domain Whois History](/reference/brp/fraudulent-domain-whois-history/) | `/brp/fraudulent-domains/{fraudulent_id}/whois-history` |
| POST | [Fraudulent Domain Instant Snapshot](/reference/brp/fraudulent-domain-instant-snapshot/) | `/brp/fraudulent-domains/{fraudulent_id}/instant-snapshot` |
| GET | [Fraudulent Domain Latest Snapshot](/reference/brp/fraudulent-domain-latest-snapshot/) | `/brp/fraudulent-domains/{fraudulent_id}/latest-snapshot` |
| GET | [Fraudulent Domain Risk Score Timeline](/reference/brp/fraudulent-domain-risk-score-timeline/) | `/brp/fraudulent-domains/{fraudulent_id}/risk-score-timeline` |
| GET | [Fraudulent Domain Type Stats](/reference/brp/fraudulent-domain-type-stats/) | `/brp/fraudulent-domains/stats/type` |

## Suspicious Domains

Candidates found by your fraudulent rules. Each is `in_review`, `approved` or `ignored`.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Suspicious Domain Search](/reference/brp/suspicious-domain-search/) | `/brp/suspicious-domains/search` |
| POST | [Suspicious Domain Export](/reference/brp/suspicious-domain-export/) | `/brp/suspicious-domains/search:export` |
| GET | [Suspicious Domain Detail](/reference/brp/suspicious-domain-detail/) | `/brp/suspicious-domains/{detected_fraudulent_id}` |
| POST | [Suspicious Domain Approve](/reference/brp/suspicious-domain-approve/) | `/brp/suspicious-domains/search:approve` |
| POST | [Suspicious Domain Ignore](/reference/brp/suspicious-domain-ignore/) | `/brp/suspicious-domains/search:ignore` |
| POST | [Suspicious Domain Revert](/reference/brp/suspicious-domain-revert/) | `/brp/suspicious-domains/search:revert` |
| GET | [Suspicious Domain State Stats](/reference/brp/suspicious-domain-state-stats/) | `/brp/suspicious-domains/stats/state` |

## Fraudulent Rules

Rules (keywords, match types) that detect domains imitating your brand.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Fraudulent Rule Search](/reference/brp/fraudulent-rule-search/) | `/brp/fraudulent-rules/search` |
| GET | [Fraudulent Rule List](/reference/brp/fraudulent-rule-list/) | `/brp/fraudulent-rules` |
| GET | [Fraudulent Rule Detail](/reference/brp/fraudulent-rule-detail/) | `/brp/fraudulent-rules/{rule_id}` |
| POST | [Fraudulent Rule Create](/reference/brp/fraudulent-rule-create/) | `/brp/fraudulent-rules` |
| PUT | [Fraudulent Rule Update](/reference/brp/fraudulent-rule-update/) | `/brp/fraudulent-rules/{rule_id}` |
| DELETE | [Fraudulent Rule Delete](/reference/brp/fraudulent-rule-delete/) | `/brp/fraudulent-rules/{rule_id}` |


---

# Fraudulent Settings Detail

URL: https://docs.deepinfo.com/reference/brp/fraudulent-settings-detail/

GET /brp/fraudulent-settings: Returns the Brand Risk Protection settings: ignored_domains are never reported.

`GET https://api.deepinfo.com/v1/brp/fraudulent-settings`

Returns the Brand Risk Protection settings: `ignored_domains` are never reported.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `ignored_domains` | array of string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `ignored_domains` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-settings-detail.md


---

# Fraudulent Settings Update

URL: https://docs.deepinfo.com/reference/brp/fraudulent-settings-update/

PUT /brp/fraudulent-settings: Replaces the Brand Risk Protection settings. Send the full ignored_domains list.

`PUT https://api.deepinfo.com/v1/brp/fraudulent-settings`

Replaces the Brand Risk Protection settings. Send the **full** `ignored_domains` list.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required |
|---|---|---|
| `ignored_domains` | array | Required |

```json
{
  "ignored_domains": []
}
```

## Response Fields

| Field | Type |
|---|---|
| `ignored_domains` | array of string |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `ignored_domains` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-settings-update.md


---

# Fraudulent Domain Search

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-search/

POST /brp/fraudulent-domains/search: Searches your monitored fraudulent domains by name, type, risk score and indicators.

`POST https://api.deepinfo.com/v1/brp/fraudulent-domains/search`

Searches your monitored fraudulent domains by name, type, risk score and indicators.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].fraudulent` | string |  |
| `results[].fraudulent_unicode` | string |  |
| `results[].fraudulent_type` | string | One of `domain`, `subdomain` |
| `results[].tags` | array of string |  |
| `results[].detection_history` | array of object |  |
| `results[].first_detection_date` | string | date-time |
| `results[].monitoring_indicator` | object |  |
| `results[].risk_score` | integer |  |
| `results[].screenshot` | string |  |
| `results[].thumbnail` | string |  |
| `results[].added_date` | string | date-time |
| `results[].is_login_page` | boolean |  |
| `results[].seems_inactive` | boolean |  |
| `results[].seems_inactive_first_seen` | string | date-time |
| `results[].seems_inactive_last_seen` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].fraudulent` | string |
| `results[].fraudulent_unicode` | string |
| `results[].fraudulent_type` | string |
| `results[].tags` | array<string> |
| `results[].detection_history` | array<object> |
| `results[].detection_history[].id` | string |
| `results[].detection_history[].rule` | string |
| `results[].detection_history[].detection_date` | string |
| `results[].detection_history[].enabled` | boolean |
| `results[].detection_history[].deleted` | boolean |
| `results[].first_detection_date` | string |
| `results[].monitoring_indicator` | object |
| `results[].monitoring_indicator.dns` | boolean |
| `results[].monitoring_indicator.dns_mx` | boolean |
| `results[].monitoring_indicator.ssl` | boolean |
| `results[].monitoring_indicator.http` | boolean |
| `results[].risk_score` | number |
| `results[].screenshot` | null |
| `results[].thumbnail` | null |
| `results[].added_date` | string |
| `results[].is_login_page` | boolean |
| `results[].seems_inactive` | boolean |
| `results[].seems_inactive_first_seen` | null |
| `results[].seems_inactive_last_seen` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-search.md


---

# Fraudulent Domain Export

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-export/

POST /brp/fraudulent-domains/search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/brp/fraudulent-domains/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-export.md


---

# Fraudulent Domain Detail

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-detail/

GET /brp/fraudulent-domains/{fraudulent_id}: Returns one fraudulent domain with its latest data and risk score.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}`

Returns one fraudulent domain with its latest data and risk score.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `fraudulent` | string |  |
| `fraudulent_unicode` | string |  |
| `fraudulent_type` | string | One of `domain`, `subdomain` |
| `detection_history` | array of object |  |
| `first_detection_date` | string | date-time |
| `added_date` | string | date-time |
| `monitoring_indicator` | object |  |
| `risk_score` | integer |  |
| `screenshot` | string |  |
| `thumbnail` | string |  |
| `is_login_page` | boolean |  |
| `seems_inactive` | boolean |  |
| `seems_inactive_first_seen` | string | date-time |
| `seems_inactive_last_seen` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `fraudulent` | string |
| `fraudulent_unicode` | string |
| `fraudulent_type` | string |
| `detection_history` | array<object> |
| `detection_history[].id` | string |
| `detection_history[].rule` | string |
| `detection_history[].detection_date` | string |
| `detection_history[].enabled` | boolean |
| `detection_history[].deleted` | boolean |
| `first_detection_date` | string |
| `added_date` | string |
| `monitoring_indicator` | object |
| `monitoring_indicator.dns` | boolean |
| `monitoring_indicator.dns_mx` | boolean |
| `monitoring_indicator.ssl` | boolean |
| `monitoring_indicator.http` | boolean |
| `risk_score` | number |
| `screenshot` | null |
| `thumbnail` | null |
| `is_login_page` | boolean |
| `seems_inactive` | boolean |
| `seems_inactive_first_seen` | null |
| `seems_inactive_last_seen` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-detail.md


---

# Fraudulent Domain Delete

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-delete/

POST /brp/fraudulent-domains/search:delete: Stops monitoring every fraudulent domain matching filters.

`POST https://api.deepinfo.com/v1/brp/fraudulent-domains/search:delete`

Stops monitoring every fraudulent domain matching `filters`.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The fraudulent domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `added_date` | When the domain was added to the fraudulent list (UTC date-time), that is when it was marked as fraudulent, by you or by a rule with Auto Approval. |
| `is_login_page` | `true` when the domain's site has a login page; the FRAUDULENT DOMAINS list shows a Login Page icon next to its name. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |
| `seems_inactive_first_seen` | When the domain was first found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |
| `seems_inactive_last_seen` | When the domain was most recently found to seem inactive (UTC date-time). In the samples it was empty on every domain, including those with `seems_inactive` true. |

## Response Fields

| Field | Type |
|---|---|
| `deleted_fraudulent_count` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `deleted_fraudulent_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-delete.md


---

# Fraudulent Domain Instant Scan

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-instant-scan/

POST /brp/fraudulent-domains/{fraudulent_id}/instant-scan: Starts an on-demand scan of a fraudulent domain.

`POST https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/instant-scan`

Starts an on-demand scan of a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-instant-scan.md


---

# Fraudulent Domain DNS History

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-dns-history/

GET /brp/fraudulent-domains/{fraudulent_id}/dns-history: Returns the DNS history recorded for a fraudulent domain.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/dns-history`

Returns the DNS history recorded for a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].result` | object |  |
| `results[].status` | boolean |  |
| `results[].check_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].result` | object |
| `results[].result.fqdn` | string |
| `results[].result.requested_types` | array<string> |
| `results[].result.responses` | array<object> |
| `results[].result.responses[].type` | string |
| `results[].result.responses[].conn_status` | string |
| `results[].result.responses[].rcode` | string |
| `results[].result.responses[].raw` | null |
| `results[].result.responses[].values` | null |
| `results[].result.responses[].server` | string |
| `results[].result.servers` | array<string> |
| `results[].result.check_date` | string |
| `results[].status` | boolean |
| `results[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-dns-history.md


---

# Fraudulent Domain Latest Scan

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-latest-scan/

GET /brp/fraudulent-domains/{fraudulent_id}/latest-scan: Returns the latest scan of a fraudulent domain.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/latest-scan`

Returns the latest scan of a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `scope` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `requested_scopes` | array of string |  |
| `monitored_scopes` | array of string |  |
| `results` | array of object |  |
| `check_date` | string | date-time |
| `results[].result` | object |  |
| `results[].status` | boolean |  |
| `results[].scope` | string | One of `whois`, `dns`, `ssl`, `port_scan`, `webdata`, `ipwhois`, `http`, `ipdns` |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `requested_scopes` | array<string> |
| `monitored_scopes` | array<string> |
| `results` | array<object> |
| `results[].result` | object |
| `results[].result.domain_name` | string |
| `results[].result.raw` | string |
| `results[].result.parsed` | object |
| `results[].result.parsed.uid` | string |
| `results[].result.parsed.create_date` | string |
| `results[].result.parsed.update_date` | string |
| `results[].result.parsed.expiry_date` | string |
| `results[].result.parsed.registrar` | string |
| `results[].result.parsed.registrant` | object |
| `results[].result.parsed.registrant.name` | null |
| `results[].result.parsed.registrant.organization` | null |
| `results[].result.parsed.registrant.street` | null |
| `results[].result.parsed.registrant.city` | null |
| `results[].result.parsed.registrant.state` | null |
| `results[].result.parsed.registrant.postal_code` | null |
| `results[].result.parsed.registrant.country` | null |
| `results[].result.parsed.registrant.phone` | null |
| `results[].result.parsed.registrant.email` | null |
| `results[].result.parsed.name_servers` | array<string> |
| `results[].result.parsed.domain_status` | array<string> |
| `results[].result.parsed.whois_server` | null |
| `results[].result.check_date` | string |
| `results[].result.parse_code` | null |
| `results[].result.fqdn` | string |
| `results[].result.requested_types` | array<string> |
| `results[].result.responses` | array<object> |
| `results[].result.responses[].type` | string |
| `results[].result.responses[].conn_status` | string |
| `results[].result.responses[].rcode` | string |
| `results[].result.responses[].raw` | null |
| `results[].result.responses[].values` | null |
| `results[].result.responses[].server` | string |
| `results[].result.servers` | array<string> |
| `results[].status` | boolean |
| `results[].scope` | string |
| `check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-latest-scan.md


---

# Fraudulent Domain Port Scan History

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-port-scan-history/

GET /brp/fraudulent-domains/{fraudulent_id}/port-scan-history: Returns the port scan history recorded for a fraudulent domain.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/port-scan-history`

Returns the port scan history recorded for a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].result` | object |  |
| `results[].status` | boolean |  |
| `results[].check_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].result` | null |
| `results[].status` | null |
| `results[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-port-scan-history.md


---

# Fraudulent Domain SSL History

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-ssl-history/

GET /brp/fraudulent-domains/{fraudulent_id}/ssl-history: Returns the SSL certificate history recorded for a fraudulent domain.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/ssl-history`

Returns the SSL certificate history recorded for a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].result` | object |  |
| `results[].status` | boolean |  |
| `results[].check_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].result` | null |
| `results[].status` | null |
| `results[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-ssl-history.md


---

# Fraudulent Domain Webdata History

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-webdata-history/

Returns the web data (page content, technologies, headers) history recorded for a fraudulent domain.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/webdata-history`

Returns the web data (page content, technologies, headers) history recorded for a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].result` | object |  |
| `results[].status` | boolean |  |
| `results[].check_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].result` | null |
| `results[].status` | null |
| `results[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-webdata-history.md


---

# Fraudulent Domain Whois History

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-whois-history/

GET /brp/fraudulent-domains/{fraudulent_id}/whois-history: Returns the WHOIS history recorded for a fraudulent domain.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/whois-history`

Returns the WHOIS history recorded for a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].result` | object |  |
| `results[].status` | boolean |  |
| `results[].check_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].result` | object |
| `results[].result.domain_name` | string |
| `results[].result.raw` | string |
| `results[].result.parsed` | object |
| `results[].result.parsed.uid` | string |
| `results[].result.parsed.create_date` | string |
| `results[].result.parsed.update_date` | string |
| `results[].result.parsed.expiry_date` | string |
| `results[].result.parsed.registrar` | string |
| `results[].result.parsed.registrant` | object |
| `results[].result.parsed.registrant.name` | null |
| `results[].result.parsed.registrant.organization` | null |
| `results[].result.parsed.registrant.street` | null |
| `results[].result.parsed.registrant.city` | null |
| `results[].result.parsed.registrant.state` | null |
| `results[].result.parsed.registrant.postal_code` | null |
| `results[].result.parsed.registrant.country` | null |
| `results[].result.parsed.registrant.phone` | null |
| `results[].result.parsed.registrant.email` | null |
| `results[].result.parsed.name_servers` | array<string> |
| `results[].result.parsed.domain_status` | array<string> |
| `results[].result.parsed.whois_server` | null |
| `results[].result.check_date` | string |
| `results[].result.parse_code` | null |
| `results[].status` | boolean |
| `results[].check_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-whois-history.md


---

# Fraudulent Domain Instant Snapshot

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-instant-snapshot/

POST /brp/fraudulent-domains/{fraudulent_id}/instant-snapshot: Recalculates the fraudulent domain snapshot now.

`POST https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/instant-snapshot`

Recalculates the fraudulent domain snapshot now.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Response Fields

| Field | Type |
|---|---|
| `triggered` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `triggered` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-instant-snapshot.md


---

# Fraudulent Domain Latest Snapshot

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-latest-snapshot/

GET /brp/fraudulent-domains/{fraudulent_id}/latest-snapshot: Latest summary of a fraudulent domain.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/latest-snapshot`

Latest summary of a fraudulent domain.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `stats` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `snapshot` | object |  |
| `date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `snapshot` | object |
| `snapshot.risk_score` | number |
| `date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-latest-snapshot.md


---

# Fraudulent Domain Risk Score Timeline

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-risk-score-timeline/

GET /brp/fraudulent-domains/{fraudulent_id}/risk-score-timeline: Time series of a fraudulent domain's risk score.

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/{fraudulent_id}/risk-score-timeline`

Time series of a fraudulent domain's risk score.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `fraudulent_id` | Required |  | `000000000000000ee94f0001` |

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `interval` | Optional | One of: `daily`, `weekly`, `monthly`. | `weekly` |

## Response Fields

An array of objects:

| Field | Type | Description |
|---|---|---|
| `date` | string | date |
| `score` | integer |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].date` | string |
| `[].score` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-risk-score-timeline.md


---

# Fraudulent Domain Type Stats

URL: https://docs.deepinfo.com/reference/brp/fraudulent-domain-type-stats/

GET /brp/fraudulent-domains/stats/type: Counts fraudulent domains per type (domain, subdomain).

`GET https://api.deepinfo.com/v1/brp/fraudulent-domains/stats/type`

Counts fraudulent domains per type (`domain`, `subdomain`).

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `domain` | integer |
| `subdomain` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `domain` | number |
| `subdomain` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-domain-type-stats.md


---

# Suspicious Domain Search

URL: https://docs.deepinfo.com/reference/brp/suspicious-domain-search/

POST /brp/suspicious-domains/search: Searches suspicious domains (candidates found by your fraudulent rules) and their state.

`POST https://api.deepinfo.com/v1/brp/suspicious-domains/search`

Searches suspicious domains (candidates found by your fraudulent rules) and their state.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `state` | The review state: `in_review` (on the SUSPICIOUS DOMAINS list, waiting for your decision), `approved` (marked as fraudulent and moved to the fraudulent list) or `ignored` (dismissed, on Ignored Domains); the API also lists `initial`, which was not seen in the data. Without a `state` filter the search is not limited to one state: it returned both `in_review` and `approved` domains. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].fraudulent` | string |  |
| `results[].fraudulent_unicode` | string |  |
| `results[].fraudulent_type` | string | One of `domain`, `subdomain` |
| `results[].state` | string | One of `initial`, `in_review`, `approved`, `ignored` |
| `results[].tags` | array of string |  |
| `results[].detection_history` | array of object |  |
| `results[].first_detection_date` | string | date-time |
| `results[].monitoring_indicator` | object |  |
| `results[].risk_score` | integer |  |
| `results[].seems_inactive` | boolean |  |
| `results[].approve_date` | string | date-time |
| `results[].ignore_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].fraudulent` | string |
| `results[].fraudulent_unicode` | string |
| `results[].fraudulent_type` | string |
| `results[].state` | string |
| `results[].tags` | array |
| `results[].detection_history` | array<object> |
| `results[].detection_history[].id` | string |
| `results[].detection_history[].rule` | string |
| `results[].detection_history[].detection_date` | string |
| `results[].detection_history[].enabled` | boolean |
| `results[].detection_history[].deleted` | boolean |
| `results[].first_detection_date` | string |
| `results[].monitoring_indicator` | object |
| `results[].monitoring_indicator.dns` | boolean |
| `results[].monitoring_indicator.dns_mx` | boolean |
| `results[].monitoring_indicator.ssl` | null |
| `results[].monitoring_indicator.http` | boolean |
| `results[].risk_score` | number |
| `results[].seems_inactive` | boolean |
| `results[].approve_date` | null |
| `results[].ignore_date` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/suspicious-domain-search.md


---

# Suspicious Domain Export

URL: https://docs.deepinfo.com/reference/brp/suspicious-domain-export/

POST /brp/suspicious-domains/search:export: Exports every record matching filters (no pagination).

`POST https://api.deepinfo.com/v1/brp/suspicious-domains/search:export`

Exports every record matching `filters` (no pagination). `format=csv` returns CSV text; `format=json` returns a JSON array. Large exports can time out: narrow them with filters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `format` | Optional | One of: `json`, `csv`. | `csv` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "state",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `state` | The review state: `in_review` (on the SUSPICIOUS DOMAINS list, waiting for your decision), `approved` (marked as fraudulent and moved to the fraudulent list) or `ignored` (dismissed, on Ignored Domains); the API also lists `initial`, which was not seen in the data. Without a `state` filter the search is not limited to one state: it returned both `in_review` and `approved` domains. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].fraudulent` | string |  |
| `results[].fraudulent_unicode` | string |  |
| `results[].fraudulent_type` | string | One of `domain`, `subdomain` |
| `results[].state` | string | One of `initial`, `in_review`, `approved`, `ignored` |
| `results[].tags` | array of string |  |
| `results[].detection_history` | array of object |  |
| `results[].first_detection_date` | string | date-time |
| `results[].monitoring_indicator` | object |  |
| `results[].risk_score` | integer |  |
| `results[].seems_inactive` | boolean |  |
| `results[].approve_date` | string | date-time |
| `results[].ignore_date` | string | date-time |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/suspicious-domain-export.md


---

# Suspicious Domain Detail

URL: https://docs.deepinfo.com/reference/brp/suspicious-domain-detail/

GET /brp/suspicious-domains/{detected_fraudulent_id}: Returns one suspicious domain with the rule that detected it.

`GET https://api.deepinfo.com/v1/brp/suspicious-domains/{detected_fraudulent_id}`

Returns one suspicious domain with the rule that detected it.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `detected_fraudulent_id` | Required |  | `00000000000000000000000e25cc0001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `fraudulent` | string |  |
| `fraudulent_unicode` | string |  |
| `fraudulent_type` | string | One of `domain`, `subdomain` |
| `state` | string | One of `in_review`, `approved`, `ignored` |
| `detection_history` | array of object |  |
| `first_detection_date` | string | date-time |
| `monitoring_indicator` | object |  |
| `risk_score` | integer |  |
| `monitoring` | object |  |
| `approve_date` | string | date-time |
| `ignore_date` | string | date-time |
| `seems_inactive` | boolean |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `fraudulent` | string |
| `fraudulent_unicode` | string |
| `fraudulent_type` | string |
| `state` | string |
| `detection_history` | array<object> |
| `detection_history[].id` | string |
| `detection_history[].rule` | string |
| `detection_history[].detection_date` | string |
| `detection_history[].enabled` | boolean |
| `detection_history[].deleted` | boolean |
| `first_detection_date` | string |
| `monitoring_indicator` | object |
| `monitoring_indicator.dns` | boolean |
| `monitoring_indicator.dns_mx` | boolean |
| `monitoring_indicator.ssl` | null |
| `monitoring_indicator.http` | boolean |
| `risk_score` | number |
| `monitoring` | object |
| `monitoring.whois` | object |
| `monitoring.whois.domain_name` | string |
| `monitoring.whois.raw` | string |
| `monitoring.whois.parsed` | object |
| `monitoring.whois.parsed.uid` | string |
| `monitoring.whois.parsed.create_date` | string |
| `monitoring.whois.parsed.update_date` | string |
| `monitoring.whois.parsed.expiry_date` | string |
| `monitoring.whois.parsed.registrar` | string |
| `monitoring.whois.parsed.registrant` | object |
| `monitoring.whois.parsed.registrant.name` | string |
| `monitoring.whois.parsed.registrant.organization` | string |
| `monitoring.whois.parsed.registrant.street` | string |
| `monitoring.whois.parsed.registrant.city` | string |
| `monitoring.whois.parsed.registrant.state` | null |
| `monitoring.whois.parsed.registrant.postal_code` | string |
| `monitoring.whois.parsed.registrant.country` | string |
| `monitoring.whois.parsed.registrant.phone` | null |
| `monitoring.whois.parsed.registrant.email` | null |
| `monitoring.whois.parsed.name_servers` | array<string> |
| `monitoring.whois.parsed.domain_status` | array<string> |
| `monitoring.whois.parsed.whois_server` | string |
| `monitoring.whois.check_date` | string |
| `monitoring.whois.parse_code` | null |
| `monitoring.dns` | object |
| `monitoring.dns.fqdn` | string |
| `monitoring.dns.requested_types` | array<string> |
| `monitoring.dns.responses` | array<object> |
| `monitoring.dns.responses[].type` | string |
| `monitoring.dns.responses[].conn_status` | string |
| `monitoring.dns.responses[].rcode` | string |
| `monitoring.dns.responses[].raw` | string \| null |
| `monitoring.dns.responses[].values` | array<string> \| null |
| `monitoring.dns.responses[].server` | string |
| `monitoring.dns.servers` | array<string> |
| `monitoring.dns.check_date` | string |
| `monitoring.ssl` | null |
| `monitoring.http` | object |
| `monitoring.http.requested_url` | string |
| `monitoring.http.version` | number |
| `monitoring.http.check_date` | string |
| `monitoring.http.connection_status` | string |
| `monitoring.http.requested_domain` | string |
| `monitoring.http.final_url` | string |
| `monitoring.http.final_domain` | string |
| `monitoring.http.http` | object |
| `monitoring.http.http.redirection_history` | array<object> |
| `monitoring.http.http.redirection_history[].url` | string |
| `monitoring.http.http.redirection_history[].status_code` | number |
| `monitoring.http.http.headers` | array<object> |
| `monitoring.http.http.headers[].name` | string |
| `monitoring.http.http.headers[].value` | string |
| `monitoring.http.http.cookies` | array |
| `monitoring.http.html` | object |
| `monitoring.http.html.source_hash_code` | string |
| `monitoring.http.final_status_code` | number |
| `approve_date` | null |
| `ignore_date` | null |
| `seems_inactive` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/suspicious-domain-detail.md


---

# Suspicious Domain Approve

URL: https://docs.deepinfo.com/reference/brp/suspicious-domain-approve/

POST /brp/suspicious-domains/search:approve: Approves the suspicious domains that match filters (approved).

`POST https://api.deepinfo.com/v1/brp/suspicious-domains/search:approve`

Approves the suspicious domains that match `filters` (`approved`). Approved domains become **fraudulent domains** and are monitored.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `state` | The review state: `in_review` (on the SUSPICIOUS DOMAINS list, waiting for your decision), `approved` (marked as fraudulent and moved to the fraudulent list) or `ignored` (dismissed, on Ignored Domains); the API also lists `initial`, which was not seen in the data. Without a `state` filter the search is not limited to one state: it returned both `in_review` and `approved` domains. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `detected_fraudulent_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/suspicious-domain-approve.md


---

# Suspicious Domain Ignore

URL: https://docs.deepinfo.com/reference/brp/suspicious-domain-ignore/

POST /brp/suspicious-domains/search:ignore: Ignores the suspicious domains that match filters (ignored).

`POST https://api.deepinfo.com/v1/brp/suspicious-domains/search:ignore`

Ignores the suspicious domains that match `filters` (`ignored`).

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `state` | The review state: `in_review` (on the SUSPICIOUS DOMAINS list, waiting for your decision), `approved` (marked as fraudulent and moved to the fraudulent list) or `ignored` (dismissed, on Ignored Domains); the API also lists `initial`, which was not seen in the data. Without a `state` filter the search is not limited to one state: it returned both `in_review` and `approved` domains. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `detected_fraudulent_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/suspicious-domain-ignore.md


---

# Suspicious Domain Revert

URL: https://docs.deepinfo.com/reference/brp/suspicious-domain-revert/

POST /brp/suspicious-domains/search:revert: Reverts the suspicious domains that match filters to their previous, active state.

`POST https://api.deepinfo.com/v1/brp/suspicious-domains/search:revert`

Reverts the suspicious domains that match `filters` to their previous, active state. Only states set by a user can be reverted.

The action applies to **every record matching `filters`**. Always send a filter (for example by `id`); an empty filter matches all records.

> State changes are applied **asynchronously**: the new state is visible a few seconds after the response. The response body only reports how many records matched.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "acme.example"
      }
    ]
  }
}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "fraudulent",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "fraudulent",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with every filter of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `fraudulent_type` | Whether the name is a `domain` or a `subdomain` (Domain and Subdomain in the TYPE filter); each detection rule looks at one or the other. |
| `monitoring_indicator.dns` | DNS indicator: `true` when the domain's DNS lookup at its last check returned records (such as A, NS or SOA; an address record is not required); `false` when the name did not exist (NXDOMAIN); null when there is no DNS result. The INDICATORS filter's DNS option finds the domains where it is `true`. |
| `monitoring_indicator.dns_mx` | DNS MX indicator: `true` when the domain had an MX (mail exchanger) record at its last check; `false` when it had none; null when there is no DNS result. The INDICATORS filter's DNS MX option finds the domains where it is `true`. |
| `monitoring_indicator.ssl` | SSL indicator: `true` when a TLS connection to the domain on port 443 succeeded and returned a certificate at its last check; `false` when it failed (for example refused or not resolved); null when there is no result for that check. The INDICATORS filter's SSL option finds the domains where it is `true`. |
| `monitoring_indicator.http` | HTTP indicator: `true` when the domain answered an HTTP request at its last check, after following redirects (in the samples a final 525 error status also counted); `false` when it did not (for example because the name did not resolve); null when there is no result for that check. The INDICATORS filter's HTTP option finds the domains where it is `true`. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `tags` | Tags on the domain, as a list of strings; in the samples they are always the tags of the detection rules that found it (the rule's TAGS setting). The TAGS filter matches them. |
| `detection_history.id` | The ID of a detection rule that found the domain, a 24-character hexadecimal string; it is the rule's `id` in Fraudulent Rule Search. Filter on it to list the domains one rule detected. |

### Sortable Fields

| Field | Description |
|---|---|
| `fraudulent` | The suspicious domain or subdomain name in ASCII form, with internationalized names in punycode (starting with `xn--`); `fraudulent_unicode` in the response holds the Unicode form. The DOMAIN filter and the SEARCH box match on it. |
| `state` | The review state: `in_review` (on the SUSPICIOUS DOMAINS list, waiting for your decision), `approved` (marked as fraudulent and moved to the fraudulent list) or `ignored` (dismissed, on Ignored Domains); the API also lists `initial`, which was not seen in the data. Without a `state` filter the search is not limited to one state: it returned both `in_review` and `approved` domains. |
| `detection_history` | The detection rules that found the domain, one entry per rule with the rule's `id`, its name (`rule`), the `detection_date` and the `enabled` and `deleted` flags; the lists show it as RULES. It can be sorted on but not filtered: filter on `detection_history.id` instead. |
| `first_detection_date` | When a detection rule first found the domain (UTC date-time), shown as DETECTION DATE; in the samples it always equals the earliest `detection_date` in `detection_history`. |
| `monitoring_indicator` | The four indicator flags `dns`, `dns_mx`, `ssl` and `http` as one object (null when there is no check result); the lists show them as the INDICATORS icons. It can be sorted on but not filtered: filter on `monitoring_indicator.dns`, `monitoring_indicator.dns_mx`, `monitoring_indicator.ssl` or `monitoring_indicator.http` instead. |
| `risk_score` | The domain's risk score, an integer from 0 to 100 (can be null). The platform labels 1 to 20 INFORMATION, over 20 up to 40 LOW, over 40 up to 60 MEDIUM, over 60 up to 80 HIGH and over 80 CRITICAL; 0 has no label. |
| `ignore_date` | When the domain was ignored (UTC date-time), shown as IGNORED DATE; empty if it was never ignored. A domain restored from Ignored Domains keeps this date, so a filter on it can also match domains that are back in review. |
| `approve_date` | When the domain was marked as fraudulent (UTC date-time), shown as APPROVE DATE; empty on domains that are still waiting for review. |
| `seems_inactive` | `true` when the domain seems inactive; in the samples, inactive domains had no DNS records and no parsed WHOIS data at their last check. The lists show a SEEMS INACTIVE banner on it. |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `detected_fraudulent_count` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/suspicious-domain-revert.md


---

# Suspicious Domain State Stats

URL: https://docs.deepinfo.com/reference/brp/suspicious-domain-state-stats/

GET /brp/suspicious-domains/stats/state: Counts suspicious domains per state.

`GET https://api.deepinfo.com/v1/brp/suspicious-domains/stats/state`

Counts suspicious domains per state.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

| Field | Type |
|---|---|
| `in_review` | integer |
| `ignored` | integer |
| `approved` | integer |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `in_review` | number |
| `ignored` | number |
| `approved` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/suspicious-domain-state-stats.md


---

# Fraudulent Rule Search

URL: https://docs.deepinfo.com/reference/brp/fraudulent-rule-search/

POST /brp/fraudulent-rules/search: Searches your fraudulent rules.

`POST https://api.deepinfo.com/v1/brp/fraudulent-rules/search`

Searches your fraudulent rules.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | object | Optional | One `{field, order}` object |

```json
{}
```

## Filtering

This search takes `filters` as an object with one key per field, not as a `must` list. Each field takes the operators of its filter type as keys, and fields combine with AND. `sort` is one `{field, order}` object, not a list. Example body:

```json
{
  "filters": {
    "name": {
      "equals": [
        "<value>"
      ]
    }
  },
  "sort": {
    "field": "name",
    "order": "desc"
  }
}
```

Operators by field:

| Field | Operators |
|---|---|
| `name` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `filters.match_type` | `equals`, `not_equals`; each takes a list of values |
| `detected_fraudulent_count` | `gt`, `gte`, `lt`, `lte` |
| `tags` | `equals`, `not_equals`, `contains`, `not_contains`, `startswith`, `endswith`; each takes a list of values |
| `enabled` | a plain boolean value |
| `create_date` | `gt`, `gte`, `lt`, `lte` |
| `last_update_date` | `gt`, `gte`, `lt`, `lte` |

### Searchable Fields

| Field | Description |
|---|---|
| `name` | The fraudulent domain rule's name, as you gave it. |
| `filters.match_type` | How the rule matches domain names to its keyword: `exact`, `contains`, `fuzzy`, `fuzzy_contains` or a `confusable_*` variant (look-alike characters). It sits in a nested `filters` object: `{"filters": {"filters": {"match_type": {"equals": ["contains"]}}}}`. |
| `detected_fraudulent_count` | How many fraudulent domains the rule has detected. |
| `tags` | The tags on the rule. |
| `enabled` | `true` for rules that are switched on, `false` for rules that are switched off. |
| `create_date` | When the rule was created (ISO 8601 date-time). |
| `last_update_date` | When the rule was last changed (ISO 8601 date-time). |

### Sortable Fields

| Field | Description |
|---|---|
| `name` | The fraudulent domain rule's name, as you gave it. |
| `filters_match_type` | The rule's match type (`filters.match_type` in the response), for sorting. |
| `detected_fraudulent_count` | How many fraudulent domains the rule has detected. |
| `tags` | The tags on the rule. |
| `enabled` | `true` for rules that are switched on, `false` for rules that are switched off. |
| `create_date` | When the rule was created (ISO 8601 date-time). |
| `last_update_date` | When the rule was last changed (ISO 8601 date-time). |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].name` | string |  |
| `results[].filters` | object |  |
| `results[].detected_fraudulent_count` | integer |  |
| `results[].tags` | array of string |  |
| `results[].enabled` | boolean |  |
| `results[].create_date` | string | date-time |
| `results[].last_update_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].name` | string |
| `results[].filters` | object |
| `results[].filters.match_type` | string |
| `results[].detected_fraudulent_count` | number |
| `results[].tags` | array |
| `results[].enabled` | boolean |
| `results[].create_date` | string |
| `results[].last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-rule-search.md


---

# Fraudulent Rule List

URL: https://docs.deepinfo.com/reference/brp/fraudulent-rule-list/

GET /brp/fraudulent-rules: Lists your fraudulent rules.

`GET https://api.deepinfo.com/v1/brp/fraudulent-rules`

Lists your fraudulent rules.

## Authentication

Send your API key in the `apikey` request header.

## Response Fields

An array of objects:

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `enabled` | boolean |
| `deleted` | boolean |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract. The response body is an array; `[]` marks its elements.

| Field | Type |
|---|---|
| `[].id` | string |
| `[].name` | string |
| `[].enabled` | boolean |
| `[].deleted` | boolean |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-rule-list.md


---

# Fraudulent Rule Detail

URL: https://docs.deepinfo.com/reference/brp/fraudulent-rule-detail/

GET /brp/fraudulent-rules/{rule_id}: Returns one fraudulent rule.

`GET https://api.deepinfo.com/v1/brp/fraudulent-rules/{rule_id}`

Returns one fraudulent rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `filters` | object |  |
| `tags` | array of string |  |
| `include_past` | boolean |  |
| `auto_approval` | boolean |  |
| `enabled` | boolean |  |
| `create_date` | string | date-time |
| `last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `filters` | object |
| `filters.fqdn_type` | string |
| `filters.keyword` | string |
| `filters.match_type` | string |
| `filters.helper_keywords` | array |
| `filters.discard_keywords` | array |
| `filters.included_extensions` | array |
| `filters.excluded_extensions` | array |
| `tags` | array |
| `include_past` | boolean |
| `auto_approval` | boolean |
| `enabled` | boolean |
| `create_date` | string |
| `last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-rule-detail.md


---

# Fraudulent Rule Create

URL: https://docs.deepinfo.com/reference/brp/fraudulent-rule-create/

POST /brp/fraudulent-rules: Creates a fraudulent rule: a keyword with match_type and helper keywords.

`POST https://api.deepinfo.com/v1/brp/fraudulent-rules`

Creates a fraudulent rule: a `keyword` with `match_type` and helper keywords. `include_past` also scans already registered domains; `auto_approval` makes matches fraudulent domains directly.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `255` |
| `filters` | object | Required | The filters of the rule; see the example request body |
| `tags` | array | Optional | max items `10` |
| `include_past` | boolean | Required |  |
| `auto_approval` | boolean | Required |  |
| `enabled` | boolean | Required |  |

```json
{
  "name": "Brand name",
  "filters": {
    "fqdn_type": "domain",
    "keyword": "acme",
    "match_type": "exact",
    "helper_keywords": [],
    "discard_keywords": [],
    "included_extensions": [],
    "excluded_extensions": []
  },
  "tags": [],
  "include_past": true,
  "auto_approval": false,
  "enabled": true
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `filters` | object |  |
| `tags` | array of string |  |
| `include_past` | boolean |  |
| `auto_approval` | boolean |  |
| `enabled` | boolean |  |
| `create_date` | string | date-time |
| `last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `filters` | object |
| `filters.fqdn_type` | string |
| `filters.keyword` | string |
| `filters.match_type` | string |
| `filters.helper_keywords` | array |
| `filters.discard_keywords` | array |
| `filters.included_extensions` | array |
| `filters.excluded_extensions` | array |
| `tags` | array |
| `include_past` | boolean |
| `auto_approval` | boolean |
| `enabled` | boolean |
| `create_date` | string |
| `last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-rule-create.md


---

# Fraudulent Rule Update

URL: https://docs.deepinfo.com/reference/brp/fraudulent-rule-update/

PUT /brp/fraudulent-rules/{rule_id}: Updates a fraudulent rule (send all fields).

`PUT https://api.deepinfo.com/v1/brp/fraudulent-rules/{rule_id}`

Updates a fraudulent rule (send all fields).

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `255` |
| `filters` | object | Required | The filters of the rule; see the example request body |
| `tags` | array | Optional | max items `10` |
| `auto_approval` | boolean | Required |  |
| `enabled` | boolean | Required |  |

```json
{
  "name": "Brand name",
  "filters": {
    "fqdn_type": "domain",
    "keyword": "acme",
    "match_type": "exact",
    "helper_keywords": [],
    "discard_keywords": [],
    "included_extensions": [],
    "excluded_extensions": []
  },
  "tags": [],
  "auto_approval": false,
  "enabled": true
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `filters` | object |  |
| `tags` | array of string |  |
| `include_past` | boolean |  |
| `auto_approval` | boolean |  |
| `enabled` | boolean |  |
| `create_date` | string | date-time |
| `last_update_date` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `filters` | object |
| `filters.fqdn_type` | string |
| `filters.keyword` | string |
| `filters.match_type` | string |
| `filters.helper_keywords` | array |
| `filters.discard_keywords` | array |
| `filters.included_extensions` | array |
| `filters.excluded_extensions` | array |
| `tags` | array |
| `include_past` | boolean |
| `auto_approval` | boolean |
| `enabled` | boolean |
| `create_date` | string |
| `last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-rule-update.md


---

# Fraudulent Rule Delete

URL: https://docs.deepinfo.com/reference/brp/fraudulent-rule-delete/

DELETE /brp/fraudulent-rules/{rule_id}: Deletes a fraudulent rule.

`DELETE https://api.deepinfo.com/v1/brp/fraudulent-rules/{rule_id}`

Deletes a fraudulent rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/brp/fraudulent-rule-delete.md


---

# Platform

URL: https://docs.deepinfo.com/reference/platform/

Notifications and reports.

Notifications and reports.

## Notifications

Rules that send email notifications when an event of their `scope` happens, and the log of emails sent.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Notification Email List](/reference/platform/notification-email-list/) | `/platform/notification-emails` |
| GET | [Notification Rule List](/reference/platform/notification-rule-list/) | `/platform/notification-rules` |
| GET | [Notification Rule Detail](/reference/platform/notification-rule-detail/) | `/platform/notification-rules/{rule_id}` |
| POST | [Notification Rule Create](/reference/platform/notification-rule-create/) | `/platform/notification-rules` |
| PUT | [Notification Rule Update](/reference/platform/notification-rule-update/) | `/platform/notification-rules/{rule_id}` |
| DELETE | [Notification Rule Delete](/reference/platform/notification-rule-delete/) | `/platform/notification-rules/{rule_id}` |

## Reports

Generate, download and manage PDF reports.

| Method | Endpoint | Path |
|---|---|---|
| POST | [Report Search](/reference/platform/report-search/) | `/platform/reports/search` |
| GET | [Report Detail](/reference/platform/report-detail/) | `/platform/reports/{report_id}` |
| POST | [Report Create](/reference/platform/report-create/) | `/platform/reports` |
| GET | [Report Download](/reference/platform/report-download/) | `/platform/reports/{report_id}/download` |
| DELETE | [Report Delete](/reference/platform/report-delete/) | `/platform/reports/{report_id}` |

## Scheduled Reports

Rules that generate and email reports on a schedule.

| Method | Endpoint | Path |
|---|---|---|
| GET | [Scheduled Report Rule List](/reference/platform/scheduled-report-rule-list/) | `/platform/scheduled-reports/rules` |
| GET | [Scheduled Report Rule Detail](/reference/platform/scheduled-report-rule-detail/) | `/platform/scheduled-reports/rules/{rule_id}` |
| POST | [Scheduled Report Rule Create](/reference/platform/scheduled-report-rule-create/) | `/platform/scheduled-reports/rules` |
| DELETE | [Scheduled Report Rule Delete](/reference/platform/scheduled-report-rule-delete/) | `/platform/scheduled-reports/rules/{rule_id}` |


---

# Notification Email List

URL: https://docs.deepinfo.com/reference/platform/notification-email-list/

GET /platform/notification-emails: Lists notification emails that were sent, with the rule that triggered them.

`GET https://api.deepinfo.com/v1/platform/notification-emails`

Lists notification emails that were sent, with the rule that triggered them.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `rule__id` | Optional |  |  |
| `rule__name__icontains` | Optional |  |  |
| `rule__scope` | Optional | One of: `new_issue_detected`, `reappeared_issue_detected`, `asset_security_score_decreased`, `asset_security_score_changed`, `asset_ssl_changed`, `asset_whois_changed`, `asset_dns_changed`, `domain_security_score_decreased`, `domain_security_score_changed`, `new_asset_discovered`, `new_asset_added`, `new_vulnerability_detected`, `reappeared_vulnerability_detected`, `new_email_breach_detected`, `new_suspicious_domain_detected`, `new_fraudulent_domain_detected`, `new_open_port_detected`, `new_employee_credential_detected`, `new_client_credential_detected`, `new_payment_credential_detected`, `new_cybersecurity_news_added`. |  |
| `rule__frequency` | Optional | One of: `instant`, `hourly`, `daily`, `weekly`, `monthly`. |  |
| `sent_at__gte` | Optional |  |  |
| `sent_at__lte` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].rule` | object |  |
| `results[].sent_at` | string | date-time |
| `results[].recipients` | array of object |  |
| `results[].context` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].rule` | object |
| `results[].rule.id` | string |
| `results[].rule.name` | string |
| `results[].rule.scope` | string |
| `results[].rule.frequency` | string |
| `results[].sent_at` | string |
| `results[].recipients` | array<object> |
| `results[].recipients[].email` | string |
| `results[].recipients[].full_name` | string |
| `results[].context` | object |
| `results[].context.event_date` | string |
| `results[].context.event_date_humanized` | string |
| `results[].context.id` | string |
| `results[].context.asset` | object |
| `results[].context.asset.id` | string |
| `results[].context.asset.name` | string |
| `results[].context.asset.name_unicode` | string |
| `results[].context.asset.tags` | array |
| `results[].context.severity` | string |
| `results[].context.last_seen_date` | string |
| `results[].context.last_seen_date_humanized` | string |
| `results[].context.type` | object |
| `results[].context.type.id` | string |
| `results[].context.type.name` | string |
| `results[].context.type.description` | string |
| `results[].context.type.category` | object |
| `results[].context.type.category.id` | string |
| `results[].context.type.category.name` | string |
| `results[].context.first_seen_date` | string |
| `results[].context.first_seen_date_humanized` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/notification-email-list.md


---

# Notification Rule List

URL: https://docs.deepinfo.com/reference/platform/notification-rule-list/

GET /platform/notification-rules: Lists notification rules. Filter and sort with the optional query parameters.

`GET https://api.deepinfo.com/v1/platform/notification-rules`

Lists notification rules. Filter and sort with the optional query parameters.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `name__contains` | Optional |  |  |
| `name__not_contains` | Optional |  |  |
| `scope__in` | Optional |  |  |
| `scope__nin` | Optional |  |  |
| `frequency__in` | Optional |  |  |
| `frequency__nin` | Optional |  |  |
| `members__in` | Optional |  |  |
| `members__nin` | Optional |  |  |
| `enabled` | Optional |  |  |
| `added_date__lte` | Optional |  |  |
| `added_date__gte` | Optional |  |  |
| `last_update_date__lte` | Optional |  |  |
| `last_update_date__gte` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].name` | string |  |
| `results[].scope` | string | One of `new_issue_detected`, `reappeared_issue_detected`, `asset_security_score_decreased`, `asset_security_score_changed`, `asset_ssl_changed`, `asset_whois_changed`, `asset_dns_changed`, `domain_security_score_decreased`, `domain_security_score_changed`, `new_asset_discovered`, `new_asset_added`, `new_vulnerability_detected`, `reappeared_vulnerability_detected`, `new_email_breach_detected`, `new_suspicious_domain_detected`, `new_fraudulent_domain_detected`, `new_open_port_detected`, `new_employee_credential_detected`, `new_client_credential_detected`, `new_payment_credential_detected`, `new_cybersecurity_news_added` |
| `results[].frequency` | string | One of `instant`, `hourly`, `daily`, `weekly`, `monthly` |
| `results[].delivery_hour` | integer |  |
| `results[].delivery_day_of_week` | integer |  |
| `results[].members` | array of object |  |
| `results[].enabled` | boolean |  |
| `results[].added_date` | string | date-time |
| `results[].last_update_date` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].name` | string |
| `results[].scope` | string |
| `results[].frequency` | string |
| `results[].delivery_hour` | null |
| `results[].delivery_day_of_week` | null |
| `results[].members` | array<object> |
| `results[].members[].team_member_uuid` | string |
| `results[].members[].email` | string |
| `results[].enabled` | boolean |
| `results[].added_date` | string |
| `results[].last_update_date` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/notification-rule-list.md


---

# Notification Rule Detail

URL: https://docs.deepinfo.com/reference/platform/notification-rule-detail/

GET /platform/notification-rules/{rule_id}: Returns one notification rule.

`GET https://api.deepinfo.com/v1/platform/notification-rules/{rule_id}`

Returns one notification rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `scope` | string | One of `new_issue_detected`, `reappeared_issue_detected`, `asset_security_score_decreased`, `asset_security_score_changed`, `asset_ssl_changed`, `asset_whois_changed`, `asset_dns_changed`, `domain_security_score_decreased`, `domain_security_score_changed`, `new_asset_discovered`, `new_asset_added`, `new_vulnerability_detected`, `reappeared_vulnerability_detected`, `new_email_breach_detected`, `new_suspicious_domain_detected`, `new_fraudulent_domain_detected`, `new_open_port_detected`, `new_employee_credential_detected`, `new_client_credential_detected`, `new_payment_credential_detected`, `new_cybersecurity_news_added` |
| `frequency` | string | One of `instant`, `hourly`, `daily`, `weekly`, `monthly` |
| `delivery_hour` | integer |  |
| `delivery_day_of_week` | integer |  |
| `members` | array of object |  |
| `enabled` | boolean |  |
| `added_date` | string | date-time |
| `last_update_date` | string | date-time |
| `strategy` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `scope` | string |
| `frequency` | string |
| `delivery_hour` | null |
| `delivery_day_of_week` | null |
| `members` | array<object> |
| `members[].team_member_uuid` | string |
| `members[].email` | string |
| `enabled` | boolean |
| `added_date` | string |
| `last_update_date` | string |
| `strategy` | object |
| `strategy.from` | number |
| `strategy.to` | number |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/notification-rule-detail.md


---

# Notification Rule Create

URL: https://docs.deepinfo.com/reference/platform/notification-rule-create/

POST /platform/notification-rules: Creates a notification rule: the event scope (e.g. new_issue_detected), an optional strategy (conditions such as asset…

`POST https://api.deepinfo.com/v1/platform/notification-rules`

Creates a notification rule: the event `scope` (e.g. `new_issue_detected`), an optional `strategy` (conditions such as asset, severity, tags), `frequency` (`instant`, `hourly`, `daily`, `weekly`, `monthly`), `delivery_hour` / `delivery_day_of_week` and the team `members` (user ids) to email.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `255` |
| `scope` | string | Required | One of `new_issue_detected`, `reappeared_issue_detected`, `asset_security_score_decreased`, `asset_security_score_changed`, `asset_ssl_changed`, `asset_whois_changed`, `asset_dns_changed`, `domain_security_score_decreased`, `domain_security_score_changed`, `new_asset_discovered`, `new_asset_added`, `new_vulnerability_detected`, `reappeared_vulnerability_detected`, `new_email_breach_detected`, `new_suspicious_domain_detected`, `new_fraudulent_domain_detected`, `new_open_port_detected`, `new_employee_credential_detected`, `new_client_credential_detected`, `new_payment_credential_detected`, `new_cybersecurity_news_added` |
| `strategy` | object | Optional |  |
| `frequency` | string | Optional | One of `instant`, `hourly`, `daily`, `weekly`, `monthly` |
| `delivery_hour` | integer | Optional | min `0.0`; max `23.0` |
| `delivery_day_of_week` | integer | Optional | min `0.0`; max `6.0` |
| `members` | array | Required | min items `1` |
| `enabled` | boolean | Optional |  |

```json
{
  "name": "Critical issues",
  "scope": "new_asset_added",
  "frequency": "daily",
  "delivery_hour": 8,
  "members": [
    "00000000-0000-4000-8000-00006bb60001"
  ],
  "enabled": true
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `scope` | string | One of `new_issue_detected`, `reappeared_issue_detected`, `asset_security_score_decreased`, `asset_security_score_changed`, `asset_ssl_changed`, `asset_whois_changed`, `asset_dns_changed`, `domain_security_score_decreased`, `domain_security_score_changed`, `new_asset_discovered`, `new_asset_added`, `new_vulnerability_detected`, `reappeared_vulnerability_detected`, `new_email_breach_detected`, `new_suspicious_domain_detected`, `new_fraudulent_domain_detected`, `new_open_port_detected`, `new_employee_credential_detected`, `new_client_credential_detected`, `new_payment_credential_detected`, `new_cybersecurity_news_added` |
| `frequency` | string | One of `instant`, `hourly`, `daily`, `weekly`, `monthly` |
| `delivery_hour` | integer |  |
| `delivery_day_of_week` | integer |  |
| `members` | array of object |  |
| `enabled` | boolean |  |
| `added_date` | string | date-time |
| `last_update_date` | string | date-time |
| `strategy` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `scope` | string |
| `frequency` | string |
| `delivery_hour` | number |
| `delivery_day_of_week` | null |
| `members` | array<object> |
| `members[].team_member_uuid` | string |
| `members[].email` | string |
| `enabled` | boolean |
| `added_date` | string |
| `last_update_date` | string |
| `strategy` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/notification-rule-create.md


---

# Notification Rule Update

URL: https://docs.deepinfo.com/reference/platform/notification-rule-update/

PUT /platform/notification-rules/{rule_id}: Updates a notification rule's name, delivery time, members and enabled. scope and strategy cannot be changed.

`PUT https://api.deepinfo.com/v1/platform/notification-rules/{rule_id}`

Updates a notification rule's `name`, delivery time, `members` and `enabled`. `scope` and `strategy` cannot be changed.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `255` |
| `delivery_hour` | integer | Optional | min `0.0`; max `23.0` |
| `delivery_day_of_week` | integer | Optional | min `0.0`; max `6.0` |
| `members` | array | Required | min items `1` |
| `enabled` | boolean | Required |  |

```json
{
  "name": "Critical issues",
  "delivery_hour": 8,
  "members": [
    "00000000-0000-4000-8000-00006bb60001"
  ],
  "enabled": true
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `scope` | string | One of `new_issue_detected`, `reappeared_issue_detected`, `asset_security_score_decreased`, `asset_security_score_changed`, `asset_ssl_changed`, `asset_whois_changed`, `asset_dns_changed`, `domain_security_score_decreased`, `domain_security_score_changed`, `new_asset_discovered`, `new_asset_added`, `new_vulnerability_detected`, `reappeared_vulnerability_detected`, `new_email_breach_detected`, `new_suspicious_domain_detected`, `new_fraudulent_domain_detected`, `new_open_port_detected`, `new_employee_credential_detected`, `new_client_credential_detected`, `new_payment_credential_detected`, `new_cybersecurity_news_added` |
| `frequency` | string | One of `instant`, `hourly`, `daily`, `weekly`, `monthly` |
| `delivery_hour` | integer |  |
| `delivery_day_of_week` | integer |  |
| `members` | array of object |  |
| `enabled` | boolean |  |
| `added_date` | string | date-time |
| `last_update_date` | string | date-time |
| `strategy` | object |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `scope` | string |
| `frequency` | string |
| `delivery_hour` | number |
| `delivery_day_of_week` | null |
| `members` | array<object> |
| `members[].team_member_uuid` | string |
| `members[].email` | string |
| `enabled` | boolean |
| `added_date` | string |
| `last_update_date` | string |
| `strategy` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/notification-rule-update.md


---

# Notification Rule Delete

URL: https://docs.deepinfo.com/reference/platform/notification-rule-delete/

DELETE /platform/notification-rules/{rule_id}: Deletes a notification rule.

`DELETE https://api.deepinfo.com/v1/platform/notification-rules/{rule_id}`

Deletes a notification rule.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/notification-rule-delete.md


---

# Report Search

URL: https://docs.deepinfo.com/reference/platform/report-search/

POST /platform/reports/search: Searches reports.

`POST https://api.deepinfo.com/v1/platform/reports/search`

Searches reports. **Different filter format:** `filters.type` is required, other filters use operators like `{"name": {"contains": "…"}}`.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Required | See [Filtering](#ref-filtering) below |
| `sort` | object | Optional | One `{field, order}` object |

```json
{
  "filters": {
    "type": "easm_executive_summary"
  }
}
```

## Filtering

This search takes `filters` as an object with one key per field, not as a `must` list. Each field takes the operators of its filter type as keys, and fields combine with AND. `sort` is one `{field, order}` object, not a list. Example body:

```json
{
  "filters": {
    "name": {
      "equals": "<value>"
    }
  },
  "sort": {
    "field": "name",
    "order": "desc"
  }
}
```

Operators by field:

| Field | Operators |
|---|---|
| `name` | `equals`, `not_equals`, `contains` |
| `type` | a plain value: `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `type_context` | `equals`, `not_equals` |
| `description` | `contains` |
| `creation_date` | `gt`, `gte`, `lt`, `lte` |
| `creation_method` | a plain value: `instant`, `scheduled` |
| `rule_id` | a plain string value |

### Searchable Fields

| Field | Description |
|---|---|
| `name` | The report's name, such as `executive-summary-2025-06-01-08:00`. |
| `type` | **Required.** The report type to search, such as `easm_executive_summary`, `easm_asset_detail` or `cti_email_breach_summary`. One search covers one type. |
| `type_context` | The options the report was made with (for example, which asset an asset detail report covers), an object compared as a whole. |
| `description` | The report's description. |
| `creation_date` | When the report was created (ISO 8601 date-time). |
| `creation_method` | How the report was made: `instant` (on demand) or `scheduled` (by a scheduled report rule). |
| `rule_id` | The ID of the scheduled report rule that made the report; `null` in the response for instant reports. |

### Sortable Fields

| Field | Description |
|---|---|
| `name` | The report's name, such as `executive-summary-2025-06-01-08:00`. |
| `description` | The report's description. |
| `creation_date` | When the report was created (ISO 8601 date-time). |
| `creation_method` | How the report was made: `instant` (on demand) or `scheduled` (by a scheduled report rule). |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].name` | string |  |
| `results[].description` | string |  |
| `results[].creation_date` | string | date-time |
| `results[].creation_method` | string | One of `instant`, `scheduled` |
| `results[].rule_id` | string |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].name` | string |
| `results[].description` | string \| null |
| `results[].creation_date` | string |
| `results[].creation_method` | string |
| `results[].rule_id` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/report-search.md


---

# Report Detail

URL: https://docs.deepinfo.com/reference/platform/report-detail/

GET /platform/reports/{report_id}: Returns one report and its generation status.

`GET https://api.deepinfo.com/v1/platform/reports/{report_id}`

Returns one report and its generation status.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `report_id` | Required |  | `000000000000000eab510001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `type` | string | One of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `type_context` | object |  |
| `description` | string |  |
| `creation_date` | string | date-time |
| `context` | object |  |
| `creation_method` | string | One of `instant`, `scheduled` |
| `rule_id` | string |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `type` | string |
| `type_context` | object |
| `description` | null |
| `creation_date` | string |
| `context` | object |
| `context.asset_type_stats_timeline` | array<object> |
| `context.asset_type_stats_timeline[].date` | string |
| `context.asset_type_stats_timeline[].types` | array<object> |
| `context.asset_type_stats_timeline[].types[].name` | string |
| `context.asset_type_stats_timeline[].types[].count` | number |
| `context.assets_with_most_websites` | array<object> |
| `context.assets_with_most_websites[].id` | string |
| `context.assets_with_most_websites[].asset` | string |
| `context.assets_with_most_websites[].asset_type` | string |
| `context.assets_with_most_websites[].added_date` | string |
| `context.assets_with_most_websites[].tags` | array |
| `context.assets_with_most_websites[].creation_method` | string |
| `context.assets_with_most_websites[].favicon` | string \| null |
| `context.assets_with_most_websites[].fqdn` | object |
| `context.assets_with_most_websites[].fqdn.unicode` | string |
| `context.assets_with_most_websites[].fqdn.punycode` | string |
| `context.assets_with_most_websites[].fqdn.is_idn` | boolean |
| `context.assets_with_most_websites[].fqdn.domain` | object |
| `context.assets_with_most_websites[].fqdn.domain.unicode` | string |
| `context.assets_with_most_websites[].fqdn.domain.punycode` | string |
| `context.assets_with_most_websites[].fqdn.domain.is_idn` | boolean |
| `context.assets_with_most_websites[].website_count` | number |
| `context.assets_with_most_websites[].is_parked` | boolean |
| `context.assets_with_most_websites[].issue_count` | object |
| `context.assets_with_most_websites[].issue_count.total` | number |
| `context.assets_with_most_websites[].issue_count.active` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity` | object |
| `context.assets_with_most_websites[].issue_count.active_by_severity.critical` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.high` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.medium` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.low` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.information` | number |
| `context.assets_with_most_websites[].technology_count` | object |
| `context.assets_with_most_websites[].technology_count.total` | number |
| `context.assets_with_most_websites[].technology_count.by_category` | array<object> |
| `context.assets_with_most_websites[].technology_count.by_category[].name` | string |
| `context.assets_with_most_websites[].technology_count.by_category[].count` | number |
| `context.assets_with_most_websites[].security_score` | number |
| `context.domains_with_most_subdomains` | array<object> |
| `context.domains_with_most_subdomains[].id` | string |
| `context.domains_with_most_subdomains[].asset` | string |
| `context.domains_with_most_subdomains[].asset_type` | string |
| `context.domains_with_most_subdomains[].added_date` | string |
| `context.domains_with_most_subdomains[].tags` | array |
| `context.domains_with_most_subdomains[].creation_method` | string |
| `context.domains_with_most_subdomains[].favicon` | null |
| `context.domains_with_most_subdomains[].fqdn` | object |
| `context.domains_with_most_subdomains[].fqdn.unicode` | string |
| `context.domains_with_most_subdomains[].fqdn.punycode` | string |
| `context.domains_with_most_subdomains[].fqdn.is_idn` | boolean |
| `context.domains_with_most_subdomains[].fqdn.domain` | object |
| `context.domains_with_most_subdomains[].fqdn.domain.unicode` | string |
| `context.domains_with_most_subdomains[].fqdn.domain.punycode` | string |
| `context.domains_with_most_subdomains[].fqdn.domain.is_idn` | boolean |
| `context.domains_with_most_subdomains[].subdomain_count` | number |
| `context.domains_with_most_subdomains[].is_parked` | boolean |
| `context.domains_with_most_subdomains[].issue_count` | object |
| `context.domains_with_most_subdomains[].issue_count.total` | number |
| `context.domains_with_most_subdomains[].issue_count.active` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity` | object |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.critical` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.high` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.medium` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.low` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.information` | number |
| `context.domains_with_most_subdomains[].technology_count` | object |
| `context.domains_with_most_subdomains[].technology_count.total` | number |
| `context.domains_with_most_subdomains[].technology_count.by_category` | array<object> |
| `context.domains_with_most_subdomains[].technology_count.by_category[].name` | string |
| `context.domains_with_most_subdomains[].technology_count.by_category[].count` | number |
| `context.domains_with_most_subdomains[].security_score` | number |
| `context.issue_severity_stats_timeline` | array<object> |
| `context.issue_severity_stats_timeline[].date` | string |
| `context.issue_severity_stats_timeline[].severities` | array<object> |
| `context.issue_severity_stats_timeline[].severities[].name` | string |
| `context.issue_severity_stats_timeline[].severities[].count` | number |
| `context.latest_snapshot` | object |
| `context.latest_snapshot.id` | string |
| `context.latest_snapshot.snapshot` | object |
| `context.latest_snapshot.snapshot.asset_type_stats` | array<object> |
| `context.latest_snapshot.snapshot.asset_type_stats[].name` | string |
| `context.latest_snapshot.snapshot.asset_type_stats[].count` | number |
| `context.latest_snapshot.snapshot.total_issue_count` | number |
| `context.latest_snapshot.snapshot.active_issue_count` | number |
| `context.latest_snapshot.snapshot.issue_severity_stats` | array<object> |
| `context.latest_snapshot.snapshot.issue_severity_stats[].name` | string |
| `context.latest_snapshot.snapshot.issue_severity_stats[].count` | number |
| `context.latest_snapshot.snapshot.technology_count` | number |
| `context.latest_snapshot.snapshot.technology_category_stats` | array<object> |
| `context.latest_snapshot.snapshot.technology_category_stats[].name` | string |
| `context.latest_snapshot.snapshot.technology_category_stats[].count` | number |
| `context.latest_snapshot.snapshot.open_port_count` | number |
| `context.latest_snapshot.snapshot.vulnerability_count` | number |
| `context.latest_snapshot.snapshot.vulnerability_severity_stats` | array<object> |
| `context.latest_snapshot.snapshot.vulnerability_severity_stats[].name` | string |
| `context.latest_snapshot.snapshot.vulnerability_severity_stats[].count` | number |
| `context.latest_snapshot.snapshot.security_score` | number |
| `context.latest_snapshot.date` | string |
| `context.most_critical_issues` | array<object> |
| `context.most_critical_issues[].severity` | string |
| `context.most_critical_issues[].type` | object |
| `context.most_critical_issues[].type.id` | string |
| `context.most_critical_issues[].type.name` | string |
| `context.most_critical_issues[].type.category` | object |
| `context.most_critical_issues[].type.category.id` | string |
| `context.most_critical_issues[].type.category.name` | string |
| `context.most_critical_issues[].type.severity` | string |
| `context.most_critical_issues[].affected_asset_count` | number |
| `context.most_critical_vulnerabilities` | array<object> |
| `context.most_critical_vulnerabilities[].id` | string |
| `context.most_critical_vulnerabilities[].cve` | object |
| `context.most_critical_vulnerabilities[].cve.id` | string |
| `context.most_critical_vulnerabilities[].cve.published` | string |
| `context.most_critical_vulnerabilities[].cve.last_modified` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe` | array<object> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].id` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].owasptop10_2021` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].name` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].description` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].capec_id` | array<number> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].scope` | array<string> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].impact` | array<string> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].detection_method` | array |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score.epss` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score.percentile` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score.date` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.cisa_kev` | null |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_version` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.base_score` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.base_severity` | string |
| `context.most_critical_vulnerabilities[].affected_asset_count` | object |
| `context.most_critical_vulnerabilities[].affected_asset_count.total` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.domain` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.subdomain` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.ip` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.website` | number |
| `context.most_critical_vulnerabilities[].affected_domain_asset_count` | number |
| `context.most_critical_vulnerabilities[].affected_asset_tags` | array |
| `context.most_critical_vulnerabilities[].first_seen_date` | string |
| `context.most_critical_vulnerabilities[].last_seen_date` | string |
| `context.most_critical_vulnerabilities[].last_check_date` | string |
| `context.most_critical_vulnerabilities[].state` | string |
| `context.most_critical_vulnerabilities[].is_certain` | boolean |
| `context.most_critical_vulnerabilities[].is_potential` | boolean |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count` | object |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.total` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.domain` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.subdomain` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.ip` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.website` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count` | object |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.total` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.domain` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.subdomain` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.ip` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.website` | number |
| `context.most_identified_technologies` | array<object> |
| `context.most_identified_technologies[].id` | string |
| `context.most_identified_technologies[].technology` | string |
| `context.most_identified_technologies[].favicon` | string |
| `context.most_identified_technologies[].categories` | array<string> |
| `context.most_identified_technologies[].affected_asset_count` | number |
| `context.most_identified_technologies[].versions` | array<object> |
| `context.most_identified_technologies[].versions[].version` | string |
| `context.most_identified_technologies[].versions[].has_vulnerability` | boolean |
| `context.most_identified_technologies[].latest_version` | string |
| `context.most_identified_technologies[].vulnerability_stats` | object |
| `context.most_identified_technologies[].vulnerability_stats.total` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity` | object |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.critical` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.high` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.medium` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.low` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.none` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.unknown` | number |
| `context.security_score_timeline` | array<object> |
| `context.security_score_timeline[].date` | string |
| `context.security_score_timeline[].score` | number |
| `context.technology_count_timeline` | array<object> |
| `context.technology_count_timeline[].date` | string |
| `context.technology_count_timeline[].count` | number |
| `context.vulnerability_severity_stats_timeline` | array<object> |
| `context.vulnerability_severity_stats_timeline[].date` | string |
| `context.vulnerability_severity_stats_timeline[].severities` | array<object> |
| `context.vulnerability_severity_stats_timeline[].severities[].name` | string |
| `context.vulnerability_severity_stats_timeline[].severities[].count` | number |
| `creation_method` | string |
| `rule_id` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/report-detail.md


---

# Report Create

URL: https://docs.deepinfo.com/reference/platform/report-create/

POST /platform/reports: Generates a report.

`POST https://api.deepinfo.com/v1/platform/reports`

Generates a report. `type` is one of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary`. Generation takes a while; poll [Report Detail](/reference/platform/report-detail/), then [Report Download](/reference/platform/report-download/).

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `100` |
| `type` | string | Required | One of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `type_context` | object | Optional |  |
| `description` | string | Optional | min length `1`; max length `350` |

```json
{
  "name": "Executive summary",
  "type": "easm_executive_summary",
  "description": "A PDF report of your attack surface."
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `type` | string | One of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `type_context` | object |  |
| `description` | string |  |
| `creation_date` | string | date-time |
| `context` | object |  |
| `creation_method` | string | One of `instant`, `scheduled` |
| `rule_id` | string |  |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `type` | string |
| `type_context` | object |
| `description` | string |
| `creation_date` | string |
| `context` | object |
| `context.asset_type_stats_timeline` | array<object> |
| `context.asset_type_stats_timeline[].date` | string |
| `context.asset_type_stats_timeline[].types` | array<object> |
| `context.asset_type_stats_timeline[].types[].name` | string |
| `context.asset_type_stats_timeline[].types[].count` | number |
| `context.assets_with_most_websites` | array<object> |
| `context.assets_with_most_websites[].id` | string |
| `context.assets_with_most_websites[].asset` | string |
| `context.assets_with_most_websites[].asset_type` | string |
| `context.assets_with_most_websites[].added_date` | string |
| `context.assets_with_most_websites[].tags` | array |
| `context.assets_with_most_websites[].creation_method` | string |
| `context.assets_with_most_websites[].favicon` | string \| null |
| `context.assets_with_most_websites[].fqdn` | object |
| `context.assets_with_most_websites[].fqdn.unicode` | string |
| `context.assets_with_most_websites[].fqdn.punycode` | string |
| `context.assets_with_most_websites[].fqdn.is_idn` | boolean |
| `context.assets_with_most_websites[].fqdn.domain` | object |
| `context.assets_with_most_websites[].fqdn.domain.unicode` | string |
| `context.assets_with_most_websites[].fqdn.domain.punycode` | string |
| `context.assets_with_most_websites[].fqdn.domain.is_idn` | boolean |
| `context.assets_with_most_websites[].website_count` | number |
| `context.assets_with_most_websites[].is_parked` | boolean |
| `context.assets_with_most_websites[].issue_count` | object |
| `context.assets_with_most_websites[].issue_count.total` | number |
| `context.assets_with_most_websites[].issue_count.active` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity` | object |
| `context.assets_with_most_websites[].issue_count.active_by_severity.critical` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.high` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.medium` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.low` | number |
| `context.assets_with_most_websites[].issue_count.active_by_severity.information` | number |
| `context.assets_with_most_websites[].technology_count` | object |
| `context.assets_with_most_websites[].technology_count.total` | number |
| `context.assets_with_most_websites[].technology_count.by_category` | array<object> |
| `context.assets_with_most_websites[].technology_count.by_category[].name` | string |
| `context.assets_with_most_websites[].technology_count.by_category[].count` | number |
| `context.assets_with_most_websites[].security_score` | number |
| `context.domains_with_most_subdomains` | array<object> |
| `context.domains_with_most_subdomains[].id` | string |
| `context.domains_with_most_subdomains[].asset` | string |
| `context.domains_with_most_subdomains[].asset_type` | string |
| `context.domains_with_most_subdomains[].added_date` | string |
| `context.domains_with_most_subdomains[].tags` | array |
| `context.domains_with_most_subdomains[].creation_method` | string |
| `context.domains_with_most_subdomains[].favicon` | null |
| `context.domains_with_most_subdomains[].fqdn` | object |
| `context.domains_with_most_subdomains[].fqdn.unicode` | string |
| `context.domains_with_most_subdomains[].fqdn.punycode` | string |
| `context.domains_with_most_subdomains[].fqdn.is_idn` | boolean |
| `context.domains_with_most_subdomains[].fqdn.domain` | object |
| `context.domains_with_most_subdomains[].fqdn.domain.unicode` | string |
| `context.domains_with_most_subdomains[].fqdn.domain.punycode` | string |
| `context.domains_with_most_subdomains[].fqdn.domain.is_idn` | boolean |
| `context.domains_with_most_subdomains[].subdomain_count` | number |
| `context.domains_with_most_subdomains[].is_parked` | boolean |
| `context.domains_with_most_subdomains[].issue_count` | object |
| `context.domains_with_most_subdomains[].issue_count.total` | number |
| `context.domains_with_most_subdomains[].issue_count.active` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity` | object |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.critical` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.high` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.medium` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.low` | number |
| `context.domains_with_most_subdomains[].issue_count.active_by_severity.information` | number |
| `context.domains_with_most_subdomains[].technology_count` | object |
| `context.domains_with_most_subdomains[].technology_count.total` | number |
| `context.domains_with_most_subdomains[].technology_count.by_category` | array<object> |
| `context.domains_with_most_subdomains[].technology_count.by_category[].name` | string |
| `context.domains_with_most_subdomains[].technology_count.by_category[].count` | number |
| `context.domains_with_most_subdomains[].security_score` | number |
| `context.issue_severity_stats_timeline` | array<object> |
| `context.issue_severity_stats_timeline[].date` | string |
| `context.issue_severity_stats_timeline[].severities` | array<object> |
| `context.issue_severity_stats_timeline[].severities[].name` | string |
| `context.issue_severity_stats_timeline[].severities[].count` | number |
| `context.latest_snapshot` | object |
| `context.latest_snapshot.id` | string |
| `context.latest_snapshot.snapshot` | object |
| `context.latest_snapshot.snapshot.asset_type_stats` | array<object> |
| `context.latest_snapshot.snapshot.asset_type_stats[].name` | string |
| `context.latest_snapshot.snapshot.asset_type_stats[].count` | number |
| `context.latest_snapshot.snapshot.total_issue_count` | number |
| `context.latest_snapshot.snapshot.active_issue_count` | number |
| `context.latest_snapshot.snapshot.issue_severity_stats` | array<object> |
| `context.latest_snapshot.snapshot.issue_severity_stats[].name` | string |
| `context.latest_snapshot.snapshot.issue_severity_stats[].count` | number |
| `context.latest_snapshot.snapshot.technology_count` | number |
| `context.latest_snapshot.snapshot.technology_category_stats` | array<object> |
| `context.latest_snapshot.snapshot.technology_category_stats[].name` | string |
| `context.latest_snapshot.snapshot.technology_category_stats[].count` | number |
| `context.latest_snapshot.snapshot.open_port_count` | number |
| `context.latest_snapshot.snapshot.vulnerability_count` | number |
| `context.latest_snapshot.snapshot.vulnerability_severity_stats` | array<object> |
| `context.latest_snapshot.snapshot.vulnerability_severity_stats[].name` | string |
| `context.latest_snapshot.snapshot.vulnerability_severity_stats[].count` | number |
| `context.latest_snapshot.snapshot.security_score` | number |
| `context.latest_snapshot.date` | string |
| `context.most_critical_issues` | array<object> |
| `context.most_critical_issues[].severity` | string |
| `context.most_critical_issues[].type` | object |
| `context.most_critical_issues[].type.id` | string |
| `context.most_critical_issues[].type.name` | string |
| `context.most_critical_issues[].type.category` | object |
| `context.most_critical_issues[].type.category.id` | string |
| `context.most_critical_issues[].type.category.name` | string |
| `context.most_critical_issues[].type.severity` | string |
| `context.most_critical_issues[].affected_asset_count` | number |
| `context.most_critical_vulnerabilities` | array<object> |
| `context.most_critical_vulnerabilities[].id` | string |
| `context.most_critical_vulnerabilities[].cve` | object |
| `context.most_critical_vulnerabilities[].cve.id` | string |
| `context.most_critical_vulnerabilities[].cve.published` | string |
| `context.most_critical_vulnerabilities[].cve.last_modified` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe` | array<object> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].id` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].owasptop10_2021` | null |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].name` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].description` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].capec_id` | array<number> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].scope` | array<string> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].impact` | array<string> |
| `context.most_critical_vulnerabilities[].cve.enrichment.cwe[].detection_method` | array<string> |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score.epss` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score.percentile` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.epss_score.date` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.cisa_kev` | null |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_version` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data` | object |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_confidentiality` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_integrity` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.vulnerable_system_availability` | string |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.base_score` | number |
| `context.most_critical_vulnerabilities[].cve.enrichment.vdeep_metric.cvss_data.base_severity` | string |
| `context.most_critical_vulnerabilities[].affected_asset_count` | object |
| `context.most_critical_vulnerabilities[].affected_asset_count.total` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.domain` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.subdomain` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.ip` | number |
| `context.most_critical_vulnerabilities[].affected_asset_count.website` | number |
| `context.most_critical_vulnerabilities[].affected_domain_asset_count` | number |
| `context.most_critical_vulnerabilities[].affected_asset_tags` | array |
| `context.most_critical_vulnerabilities[].first_seen_date` | string |
| `context.most_critical_vulnerabilities[].last_seen_date` | string |
| `context.most_critical_vulnerabilities[].last_check_date` | string |
| `context.most_critical_vulnerabilities[].state` | string |
| `context.most_critical_vulnerabilities[].is_certain` | boolean |
| `context.most_critical_vulnerabilities[].is_potential` | boolean |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count` | object |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.total` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.domain` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.subdomain` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.ip` | number |
| `context.most_critical_vulnerabilities[].certainly_affected_asset_count.website` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count` | object |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.total` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.domain` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.subdomain` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.ip` | number |
| `context.most_critical_vulnerabilities[].potentially_affected_asset_count.website` | number |
| `context.most_identified_technologies` | array<object> |
| `context.most_identified_technologies[].id` | string |
| `context.most_identified_technologies[].technology` | string |
| `context.most_identified_technologies[].favicon` | string |
| `context.most_identified_technologies[].categories` | array<string> |
| `context.most_identified_technologies[].affected_asset_count` | number |
| `context.most_identified_technologies[].versions` | array<object> |
| `context.most_identified_technologies[].versions[].version` | string |
| `context.most_identified_technologies[].versions[].has_vulnerability` | boolean |
| `context.most_identified_technologies[].latest_version` | string |
| `context.most_identified_technologies[].vulnerability_stats` | object |
| `context.most_identified_technologies[].vulnerability_stats.total` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity` | object |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.critical` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.high` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.medium` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.low` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.none` | number |
| `context.most_identified_technologies[].vulnerability_stats.by_severity.unknown` | number |
| `context.security_score_timeline` | array<object> |
| `context.security_score_timeline[].date` | string |
| `context.security_score_timeline[].score` | number |
| `context.technology_count_timeline` | array<object> |
| `context.technology_count_timeline[].date` | string |
| `context.technology_count_timeline[].count` | number |
| `context.vulnerability_severity_stats_timeline` | array<object> |
| `context.vulnerability_severity_stats_timeline[].date` | string |
| `context.vulnerability_severity_stats_timeline[].severities` | array<object> |
| `context.vulnerability_severity_stats_timeline[].severities[].name` | string |
| `context.vulnerability_severity_stats_timeline[].severities[].count` | number |
| `creation_method` | string |
| `rule_id` | null |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/report-create.md


---

# Report Download

URL: https://docs.deepinfo.com/reference/platform/report-download/

GET /platform/reports/{report_id}/download: Returns a pre-signed download_url for the report PDF.

`GET https://api.deepinfo.com/v1/platform/reports/{report_id}/download`

Returns a pre-signed `download_url` for the report PDF.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `report_id` | Required |  | `000000000000000eab510001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `download_url` | string | uri |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `download_url` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/report-download.md


---

# Report Delete

URL: https://docs.deepinfo.com/reference/platform/report-delete/

DELETE /platform/reports/{report_id}: Deletes a report.

`DELETE https://api.deepinfo.com/v1/platform/reports/{report_id}`

Deletes a report.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `report_id` | Required |  | `000000000000000eab510001` |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/report-delete.md


---

# Scheduled Report Rule List

URL: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-list/

GET /platform/scheduled-reports/rules: Lists scheduled report rules.

`GET https://api.deepinfo.com/v1/platform/scheduled-reports/rules`

Lists scheduled report rules.

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `ordering` | Optional |  |  |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |
| `name__icontains` | Optional |  |  |
| `type__in` | Optional |  |  |
| `type__nin` | Optional |  |  |
| `frequency__in` | Optional |  |  |
| `frequency__nin` | Optional |  |  |
| `members__in` | Optional |  |  |
| `members__nin` | Optional |  |  |
| `last_sent_date__lte` | Optional |  |  |
| `last_sent_date__gte` | Optional |  |  |
| `next_send_date__lte` | Optional |  |  |
| `next_send_date__gte` | Optional |  |  |
| `created_at__lte` | Optional |  |  |
| `created_at__gte` | Optional |  |  |
| `updated_at__lte` | Optional |  |  |
| `updated_at__gte` | Optional |  |  |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].name` | string |  |
| `results[].type` | string | One of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `results[].type_context` | object |  |
| `results[].frequency` | string | One of `daily`, `weekly`, `monthly` |
| `results[].members` | array of string |  |
| `results[].last_sent_date` | string | date-time |
| `results[].next_send_date` | string | date-time |
| `results[].created_at` | string | date-time |
| `results[].updated_at` | string | date-time |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-list.md


---

# Scheduled Report Rule Detail

URL: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-detail/

GET /platform/scheduled-reports/rules/{rule_id}: Returns one scheduled report rule with last and next send dates.

`GET https://api.deepinfo.com/v1/platform/scheduled-reports/rules/{rule_id}`

Returns one scheduled report rule with last and next send dates.

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `type` | string | One of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `type_context` | object |  |
| `frequency` | string | One of `daily`, `weekly`, `monthly` |
| `members` | array of string |  |
| `last_sent_date` | string | date-time |
| `next_send_date` | string | date-time |
| `created_at` | string | date-time |
| `updated_at` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `type` | string |
| `type_context` | null |
| `frequency` | string |
| `members` | array<string> |
| `last_sent_date` | null |
| `next_send_date` | string |
| `created_at` | string |
| `updated_at` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-detail.md


---

# Scheduled Report Rule Create

URL: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-create/

POST /platform/scheduled-reports/rules: Creates a scheduled report: type, frequency (daily, weekly, monthly) and the team members (user ids) who receive it.

`POST https://api.deepinfo.com/v1/platform/scheduled-reports/rules`

Creates a scheduled report: `type`, `frequency` (`daily`, `weekly`, `monthly`) and the team `members` (user ids) who receive it.

## Authentication

Send your API key in the `apikey` request header.

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | Required | min length `1`; max length `255` |
| `type` | string | Required | One of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `type_context` | object | Optional |  |
| `frequency` | string | Required | One of `daily`, `weekly`, `monthly` |
| `members` | array | Optional |  |

```json
{
  "name": "Weekly executive summary",
  "type": "easm_executive_summary",
  "frequency": "monthly",
  "members": [
    "00000000-0000-4000-8000-00006bb60001"
  ]
}
```

## Response Fields

| Field | Type | Description |
|---|---|---|
| `id` | string |  |
| `name` | string |  |
| `type` | string | One of `easm_executive_summary`, `easm_weekly_progress`, `easm_asset_detail`, `easm_vulnerability_detail`, `easm_vulnerability_overview`, `easm_issue_overview`, `easm_issue_detail`, `cti_email_breach_summary` |
| `type_context` | object |  |
| `frequency` | string | One of `daily`, `weekly`, `monthly` |
| `members` | array of string |  |
| `last_sent_date` | string | date-time |
| `next_send_date` | string | date-time |
| `created_at` | string | date-time |
| `updated_at` | string | date-time |

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `id` | string |
| `name` | string |
| `type` | string |
| `type_context` | null |
| `frequency` | string |
| `members` | array<string> |
| `last_sent_date` | null |
| `next_send_date` | string |
| `created_at` | string |
| `updated_at` | string |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-create.md


---

# Scheduled Report Rule Delete

URL: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-delete/

DELETE /platform/scheduled-reports/rules/{rule_id}: Deletes a scheduled report rule. (There is no update; delete and create again.)

`DELETE https://api.deepinfo.com/v1/platform/scheduled-reports/rules/{rule_id}`

Deletes a scheduled report rule. (There is no update; delete and create again.)

## Authentication

Send your API key in the `apikey` request header.

## Path Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `rule_id` | Required |  | `000000000000000e8e040001` |

## Examples

Request and response examples: https://docs.deepinfo.com/reference/platform/scheduled-report-rule-delete.md


---

# Platform Guide

URL: https://docs.deepinfo.com/guide/

How to use the Deepinfo Platform, the web application for External Attack Surface Management, Cyber Threat Intelligence, Brand Risk Protection and Deep Search & Insights, from your first sign-in to reports and notifications.

This guide explains the Deepinfo Platform, the web application your security team works in: what
each screen shows, how to read it and what you can do there. If you want to call Deepinfo from your own
code, see [Getting started](/getting-started/) and the [API reference](/reference/).

> [!NOTE]
> **Demo account?** The links in this guide follow the environment chosen in the **Environment** switch
> at the top of the [API Reference](/reference/) sidebar: Production unless you pick **Demo** there, and
> **Go to Platform** in the header names the environment when it is Demo. See
> [Environments & Base URL](/getting-started/environments-and-base-url/).

## Start Here

New to the platform? Read [Getting started with the platform](/guide/basics/) first: signing in,
two-factor authentication, finding your way around the sidebar, and the list, filter and export controls
that every module shares.

## Sections

| Section | What it covers |
|---|---|
| [Getting started with the platform](/guide/basics/) | From your first sign-in to your first useful screen. |
| [Account and workspace](/guide/settings/) | Your own account, your organization's API keys, API usage and API logs and, for admins, the organization's name, logo, members and two-factor requirement. |
| [Global dashboard](/guide/global-dashboard/) | The landing page: your External Attack Surface Management (EASM) security score, summary cards for EASM, Cyber Threat Intelligence (CTI) and Brand Risk Protection (BRP), trends, and links into each module. |
| [EASM](/guide/easm/) | Your internet-facing assets, discovery of related assets, and the issues, vulnerabilities and technologies found on them. |
| [CTI](/guide/cti/) | Employee, customer and payment card credentials found in leaked data, what you did about each one, cyber security news and dark web search. |
| [BRP](/guide/brp/) | Domain names that imitate your brand: confirm them as fraudulent or ignore them, and follow the confirmed ones. |
| [Deep Search & Insights (DSI)](/guide/dsi/) | Deepinfo's internet-wide data in the platform: domain and vulnerability statistics, domain and CVE search, real-time lookups and data feeds. |
| [Reports](/guide/reports/) | PDF reports and CSV or JSON exports per module, and scheduled reports sent by e-mail. |
| [Notification Center](/guide/notifications/) | Rules that e-mail the members you choose when something happens. |
| [Glossary](/guide/glossary/) | The terms and UI labels used in the platform and in this guide. |

Which modules and screens you see depends on your organization's package. See
[Packages and roles](/guide/basics/packages-and-roles/).

## Get Help

Write to [support@deepinfo.com](mailto:support@deepinfo.com). If your question is about an API request,
include the `deepinfo-request-id` value from the response headers.


---

# Getting Started With the Platform

URL: https://docs.deepinfo.com/guide/basics/

Start using the Deepinfo Platform by signing in, securing your account, finding your way around and learning the list controls every module shares.

The Deepinfo Platform at [platform.deepinfo.com](https://platform.deepinfo.com) is the web application
your security team works in. This section takes you from your first sign-in to your first useful screen:
signing in, securing your account, finding your way around, and the list controls that every module
shares.

## Before You Start

You need a Deepinfo Platform account. The platform has no sign-up form: you set up your account from a
link in an e-mail, either an invitation from an admin in your organization or an e-mail asking you to
activate your Deepinfo account. See
[Set up your account from an e-mail link](/guide/basics/set-up-your-account/). No package or role is
needed to sign in.

## Where to Find It

Open [platform.deepinfo.com](https://platform.deepinfo.com) and sign in. Unless you opened a link to a
specific page, you land on the Global Dashboard:
**Sidebar:** **GLOBAL DASHBOARD** · https://platform.deepinfo.com/app/global-dashboard

## What the Platform Covers

The sidebar on the left lists the platform's areas. Each module has a coloured group heading.
Which modules you can open depends on your organization's package (see
[What you can access](/guide/basics/packages-and-roles/)).

| Area | Sidebar | What you do there |
|---|---|---|
| [Global Dashboard](/guide/global-dashboard/) | **GLOBAL DASHBOARD** | See your organization's security score and headline figures for External Attack Surface Management (EASM), Cyber Threat Intelligence (CTI) and Brand Risk Protection (BRP), with links into each module |
| [External Attack Surface Management](/guide/easm/) | **EXTERNAL ATTACK SURFACE MANAGEMENT** | Monitor your assets (domains, subdomains, IP addresses and websites), review newly discovered assets, and work through issues, vulnerabilities and technologies |
| [Cyber Threat Intelligence](/guide/cti/) | **CYBER THREAT INTELLIGENCE** | Review compromised employee data and exposed credentials, and compromised client and payment credentials; read cybersecurity news; search the dark web |
| [Brand Risk Protection](/guide/brp/) | **BRAND RISK PROTECTION** | Review lookalike domains that your detection rules find, and mark them as fraudulent or ignore them |
| [Deep Search & Insights](/guide/dsi/) | **DEEP SEARCH & INSIGHTS** | Domain and vulnerability intelligence, domain and vulnerability search, instant lookups and data feeds. The breadcrumb calls this area **DSI** |
| [Reports](/guide/reports/) | **REPORTS** | Generate and schedule PDF reports, and export data as CSV or JSON |
| [Notification Center](/guide/notifications/) | **NOTIFICATION CENTER** | Set up notification rules that e-mail your team when an event happens, for example a newly discovered asset or a new fraudulent domain |
| [Settings](/guide/settings/) | **SETTINGS** | Manage your account and, if you are an admin, your organization, its members and its security settings; manage API keys, usage and logs |

Some screens use the word *portfolio*. It means your monitored assets, the same thing as your EASM
inventory.

## Pages in This Section

Read them in this order:

1. [Sign in and sign out](/guide/basics/sign-in/)
2. [Reset a forgotten password](/guide/basics/reset-password/)
3. [Set up your account from an e-mail link](/guide/basics/set-up-your-account/)
4. [Use two-factor authentication](/guide/basics/two-factor-authentication/)
5. [Find your way around](/guide/basics/navigation/): the sidebar, the breadcrumb, in-page tabs and the
   menus at the top right
6. [What you can access](/guide/basics/packages-and-roles/): packages and roles
7. [Search, filter and export lists](/guide/basics/lists-filters-and-exports/)

Your own profile, your password and your organization's settings are covered in
[Account and workspace](/guide/settings/).

## Good to Know

- **Get help.** In the platform, open the profile menu at the top right and select **SUPPORT**. It opens
  an e-mail to [support@deepinfo.com](mailto:support@deepinfo.com). **DOCUMENTATION** in the same menu
  opens this documentation site.
- **Terms.** The [Glossary](/guide/glossary/) explains the terms and labels used across the platform.
- **Working with the API instead?** This guide covers the web application. For programmatic access, start
  with [Getting started](/getting-started/) and the [API reference](/reference/).


---

# Sign In and Sign Out

URL: https://docs.deepinfo.com/guide/basics/sign-in/

Sign in to the Deepinfo Platform with your e-mail address and password, and sign out when you are done.

You sign in with the e-mail address and password of your Deepinfo account. If two-factor authentication
is on for your account, you also enter a code from your authenticator app.

## Before You Start

- You need a Deepinfo Platform account. If you have an invitation or activation e-mail but no password
  yet, see [Set up your account from an e-mail link](/guide/basics/set-up-your-account/).
- Signing in needs no particular package or role.

## Where to Find It

The sign-in page is at https://platform.deepinfo.com/login. Opening
[platform.deepinfo.com](https://platform.deepinfo.com) takes you there too.

![The sign-in page, with the rotating carousel panel on the left and the sign-in form with EMAIL, PASSWORD and SIGN IN on the right.](/img/guide/basics/sign-in-01.png)

## Sign In

1. Open https://platform.deepinfo.com/login (demo accounts: https://platform.deepinfodemo.com/login).
2. Enter your e-mail address in **EMAIL** and your password in **PASSWORD**. The icon at the end of the
   password field shows or hides what you typed.
3. Select **SIGN IN**.
4. If two-factor authentication is on for your account, enter the 6-digit code from your authenticator
   app. If your organization requires two-factor authentication and you have not set it up yet, the
   platform asks you to set it up first. See
   [Use two-factor authentication](/guide/basics/two-factor-authentication/).

Where you land:

- If you opened a link to a platform page before you signed in, you go straight to that page.
- Otherwise you land on the Global Dashboard. Its breadcrumb reads **DEEPINFO / GLOBAL DASHBOARD**.

If a field is empty or the e-mail address is not valid, a message appears under the field. Errors from
the sign-in itself, such as a wrong password, also appear below the fields.

## Sign Out

1. At the top right of any page, select your organization's logo (or its initials) and the chevron next
   to it. The profile menu opens.
2. Select **SIGN OUT**.

You return to the sign-in page.

![The profile menu open, with SIGN OUT at the bottom.](/img/guide/basics/navigation-06.png)

## How Long You Stay Signed In

While the platform is open, it renews your session in the background about every 30 minutes. If it
cannot renew it, it signs you out without a warning and shows the sign-in page. When you sign in again,
you return to the page you were on.

## Good to Know

- **No sign-up form.** The platform has no self-service registration. **Request Demo** below the sign-in
  form opens the demo request page on [deepinfo.com](https://www.deepinfo.com/request-demo) in a new tab.
- **Shared devices.** The sign-in page recommends a private or incognito window when the device is not
  yours.
- **Links to platform pages work when you are signed out.** The sign-in page keeps the address you
  opened and takes you there after you sign in, so you can share and bookmark platform links.
- **"There is an issue with your account."** If sign-in stops with this message, your e-mail address and
  password were accepted, but the account's subscription does not allow sign-in at the moment. Contact
  [support@deepinfo.com](mailto:support@deepinfo.com), as the message says.
- **Forgot your password?** Use the link on the sign-in page. See
  [Reset a forgotten password](/guide/basics/reset-password/).


---

# Reset a Forgotten Password

URL: https://docs.deepinfo.com/guide/basics/reset-password/

Request a password-reset link by e-mail and set a new password that meets the password rules.

If you forgot your password, request a reset link. The platform e-mails it to you, and you set a new
password from that link.

## Before You Start

You need the e-mail address of your Deepinfo account and access to its inbox. No package or role is
needed.

## Where to Find It

Select **Forgot your password?** on the sign-in page, or open https://platform.deepinfo.com/reset-password
(demo accounts: https://platform.deepinfodemo.com/reset-password).

## Request a Reset Link

1. On the sign-in page, select **Forgot your password?**. The **Reset Password** page opens.
2. In **EMAIL**, enter the e-mail address you use on the platform.
3. Select **SEND RESET LINK**.

The page confirms that a password recovery link was sent, and shows the address you entered. Select
**BACK TO SIGN IN** to return to the sign-in page.

![The Reset Password page with the EMAIL field and the SEND RESET LINK button.](/img/guide/basics/reset-password-01.png)

## Set a New Password

1. Open the link in the e-mail. The **Change Password** page opens.
2. Enter your new password in **NEW PASSWORD**. The rules below the field turn green as you meet them.
3. When all five rules are green, select **CHANGE PASSWORD**.
4. When **Password Changed** appears, select **BACK TO SIGN IN** and sign in with your new password.

![The Change Password page opened from a reset link, with a new password typed in and some of the password rules turned green.](/img/guide/basics/reset-password-03.png)

## Password Rules

The button that saves a password stays disabled until the password meets all five rules:

- **Use at least 12 characters**
- **1 Uppercase letter**
- **1 Lowercase letter**
- **1 Number**
- **1 Symbol**

Only these characters count as a symbol: `! @ # $ % ^ & * ( ) , . ? " : { } | < >`

Other characters, such as `-`, `_`, `+`, `=`, `/` and `~`, do not count as a symbol.

The same rules apply wherever you set a password: on this page, when you accept an invitation or activate
an account, and when you change your password in Settings.

## Good to Know

- **The link expires after 2 hours.** If it has expired, request a new one.
- **You know your current password?** You can change it while signed in instead. See
  [Change your password](/guide/settings/change-password/).


---

# Set Up Your Account From an E-mail Link

URL: https://docs.deepinfo.com/guide/basics/set-up-your-account/

Accept an invitation to your organization, or activate a Deepinfo account, and set your first password.

The platform has no sign-up form. You set up your account from a link in an e-mail: an invitation from
an admin in your organization, or an e-mail asking you to activate your Deepinfo account. Either way, you
choose your own password on the page the link opens, then sign in.

## Before You Start

You need the invitation e-mail or the activation e-mail. No package or role is needed.

## Where to Find It

Both pages open only from the link in the e-mail. They have no menu entry.

## Accept an Invitation

1. Open the link in the invitation e-mail. The **Create Your Account** page opens.
2. Enter your name in **FIRST NAME** (required) and **LAST NAME**.
3. Enter a password in **PASSWORD**. The rules below the field turn green as you meet them. See
   [Password rules](/guide/basics/reset-password/#password-rules).
4. Select **CREATE ACCOUNT**. The button is enabled once you have entered a first name and the password
   meets every rule.
5. When **Account Created** appears, select **GO TO SIGN IN**, and sign in with the address the
   invitation was sent to and your new password.

The page does not show or ask for your e-mail address: the link in the invitation identifies it.

![The Create Your Account page with the FIRST NAME, LAST NAME and PASSWORD fields, the password rules and the CREATE ACCOUNT button.](/img/guide/basics/set-up-your-account-01.png)

## Activate an Account

1. Open the link in the activation e-mail. The **Deepinfo Account** page opens.
2. Enter a password in **NEW PASSWORD** that meets every
   [password rule](/guide/basics/reset-password/#password-rules).
3. Select **SET PASSWORD**.
4. When **Account created** appears, select **BACK TO SIGN IN** and sign in.

![The Deepinfo Account page with the NEW PASSWORD field, the password rules and the SET PASSWORD button.](/img/guide/basics/set-up-your-account-03.png)

## Good to Know

- **Your role.** An invitation does not set a role. Once you have joined, an admin in your organization
  can make you an Admin or a Member. See [What you can access](/guide/basics/packages-and-roles/).
- **The invitation link no longer works?** Ask an admin in your organization to resend the invitation.
  See [Manage members and invitations](/guide/settings/members/#resend-an-invitation).
- **Next steps.** Turn on [two-factor authentication](/guide/basics/two-factor-authentication/), then
  check your name and time zone in [your profile](/guide/settings/account-details/).


---

# Use Two-Factor Authentication

URL: https://docs.deepinfo.com/guide/basics/two-factor-authentication/

Turn two-factor authentication on or off for your account, and sign in with an authenticator code or a recovery code.

Two-factor authentication (2FA) adds a second step to signing in: after your password, you enter a
6-digit code from an authenticator app on your phone. Any authenticator app that supports TOTP works, for
example Google Authenticator. The app shows a new code every 30 seconds.

## Before You Start

- Install an authenticator app that supports TOTP on your phone.
- Any role can turn on 2FA for their own account. Admins can also require it for everyone in the
  organization: see [Require two-factor authentication](/guide/settings/require-two-factor-authentication/).

## Where to Find It

**Sidebar:** **SETTINGS** › **USER SETTINGS** › **Security** ·
https://platform.deepinfo.com/app/settings/user-security

The settings are in the **Two Factor Authentication** card, below **Change Password**.

Next to the card title, the status reads **Enabled** (green dot) or **Disabled** (red dot).

## Turn On Two-Factor Authentication

1. Go to **SETTINGS** › **USER SETTINGS** › **Security**.
2. In the **Two Factor Authentication** card, select **ENABLE TWO FACTOR AUTHENTICATION**.
3. Scan the QR code with your authenticator app. If you cannot scan it, select **COPY SECRET KEY** and
   add the key to the app by hand.
4. Enter the 6-digit code that the app shows. The code is sent as soon as all six digits are in. You can
   also select **VERIFY**.
5. The recovery codes appear. Select **DOWNLOAD CODE AND CLOSE**. This saves the codes to a text file named
   `recovery-code-<your e-mail address>.txt`, one code per line, and closes the window.
6. Keep the file somewhere safe, away from your phone.

The status now reads **Enabled**.

> [!IMPORTANT]
> Save your recovery codes when they appear. The platform has no screen to show them again or to create new
> ones later. Each code works only once.

## Sign In With a Code

1. Sign in with your e-mail address and password.
2. On **Two-Factor Authentication Verification**, enter the 6-digit code from your authenticator app. You
   can type or paste it. It is sent as soon as all six digits are in, or select **VERIFY**.

You then continue to the page you were opening, which is the Global Dashboard unless you followed a link
to another page.

## Sign In With a Recovery Code

Use a recovery code when you do not have your phone.

1. Sign in with your e-mail address and password.
2. On **Two-Factor Authentication Verification**, select **Use a Recovery Code**. The input changes to
   eight boxes.
3. Enter one of your recovery codes.

That code is now used up. To go back to the app code, select **Use Token**. If you have neither your phone
nor a recovery code, contact [support@deepinfo.com](mailto:support@deepinfo.com).

## Turn Off Two-Factor Authentication

1. Go to **SETTINGS** › **USER SETTINGS** › **Security**.
2. In the **Two Factor Authentication** card, select **DISABLE TWO FACTOR AUTHENTICATION**.
3. Confirm with **DISABLE**.

If your organization requires 2FA, you cannot turn it off. The platform shows "Two Factor Authentication
is required in your organization." and 2FA stays on.

## When Your Organization Requires 2FA

When an admin requires 2FA and you have not set it up, the platform stops you after you sign in, or on
your next page load, with a **Two-Factor Authentication** page. It explains that your organization
requires 2FA.

1. Select **ENABLE TWO FACTOR AUTHENTICATION**. The **Verify Your Identity** window opens.
2. Scan the QR code with your authenticator app, or select **COPY SECRET KEY** and add the key by hand.
3. Enter the 6-digit code from the app and select **VERIFY**.
4. Save your recovery codes with **DOWNLOAD CODE AND CLOSE**.

You then continue to the page you were opening, or to the Global Dashboard. Until you finish, the only
other option on the page is **Sign Out**.

## Good to Know

- **A new QR code every time.** Each time you turn 2FA on, the platform creates a new secret, so you scan a
  new QR code. You can then remove the old Deepinfo entry from your authenticator app.
- **Shared screens.** The QR code, the secret key and the recovery codes let someone else pass your second
  step. Do not show them on a shared screen or in a screenshot.


---

# Find Your Way Around

URL: https://docs.deepinfo.com/guide/basics/navigation/

Learn the frame of every platform page, from the sidebar and its module groups to the breadcrumb, in-page tabs and the +, Cybersecurity News and profile menus.

Every platform page has the same frame: the **sidebar** on the left, and a header row at the top with the
**breadcrumb** on the left and three menus on the right. Many pages also split their content into
**in-page tabs** under the page title.

## Before You Start

No package or role is needed. The sidebar shows the same modules to every user, including modules that
your organization's package does not include; those open to a lock screen. The profile menu has one more
item for admins. See [What you can access](/guide/basics/packages-and-roles/).

## Where to Find It

On every page after you sign in, for example the Global Dashboard:
**Sidebar:** **GLOBAL DASHBOARD** · https://platform.deepinfo.com/app/global-dashboard

## The Sidebar

The sidebar lists everything you can open, from top to bottom:

1. The Deepinfo logo and **GLOBAL DASHBOARD**. Both open the Global Dashboard.
2. The module groups, each under a coloured heading. The headings are labels, not links.
3. **REPORTS**, **NOTIFICATION CENTER** and **SETTINGS**.

| Group heading | Colour | Items |
|---|---|---|
| **EXTERNAL ATTACK SURFACE MANAGEMENT** | Blue | **EASM DASHBOARD** · **ASSETS** (**INVENTORY**, **DISCOVERY**) · **ISSUES** · **TECHNOLOGIES** · **VULNERABILITIES** |
| **CYBER THREAT INTELLIGENCE** | Red | **CTI DASHBOARD** · **COMPROMISED EMPLOYEE DATA** · **COMPROMISED CLIENT CREDENTIALS** · **COMPROMISED PAYMENT CREDENTIALS** · **CYBER SECURITY NEWS** · **DARK WEB SEARCH** |
| **BRAND RISK PROTECTION** | Orange | **FRAUDULENT DOMAINS** |
| **DEEP SEARCH & INSIGHTS** | Green | **DOMAIN INTELLIGENCE** · **DOMAIN SEARCH** · **VULNERABILITY INTELLIGENCE** · **VULNERABILITY SEARCH** · **INSTANT LOOKUP** · **FEEDS** |
| No heading | None | **REPORTS** (**REPORTS**, **SCHEDULED REPORTS**) · **NOTIFICATION CENTER** · **SETTINGS** |

**ASSETS** and **REPORTS** have a chevron. Select one to show the items in brackets below it.

The guide has a section for each area: the [Global Dashboard](/guide/global-dashboard/),
[External Attack Surface Management (EASM)](/guide/easm/), [Cyber Threat Intelligence (CTI)](/guide/cti/),
[Brand Risk Protection (BRP)](/guide/brp/), [Deep Search & Insights (DSI)](/guide/dsi/),
[Reports](/guide/reports/), [Notification Center](/guide/notifications/) and [Settings](/guide/settings/).

![The expanded sidebar with the coloured module group headings and ASSETS opened to show INVENTORY and DISCOVERY.](/img/guide/basics/navigation-01.png)

### Collapse the Sidebar

The button to the left of the breadcrumb collapses the sidebar into a narrow column of icons
(**Collapse sidebar**), and opens it again (**Expand sidebar**).

When the sidebar is collapsed, the groups keep their short names **EASM**, **CTI**, **BRP** and **DSI**.
Hover over an icon to see the item's name, for example **ASSETS**.

![The collapsed sidebar showing only icons and the short group names, with the tooltip of one icon visible.](/img/guide/basics/navigation-02.png)

## The Breadcrumb

The breadcrumb at the top left shows where you are. It starts with the short name of the area, for
example:

- **DEEPINFO / GLOBAL DASHBOARD**
- **EASM / ISSUES / ISSUE LIST**
- **DSI / DOMAIN SEARCH**
- **SETTINGS / USER SETTINGS / ACCOUNT DETAILS**

Some parts of the breadcrumb are links. For example, **ISSUES** in **EASM / ISSUES / ISSUE LIST** opens
the **OVERVIEW** tab of Issues.

## In-Page Tabs

Many pages have tabs under the page title. Each tab has its own address, so you can bookmark or share
it. Selecting the item in the sidebar opens the list tab; **OVERVIEW** holds the summary cards.

| Sidebar item | In-page tabs |
|---|---|
| **INVENTORY** | **OVERVIEW** · **ASSETS LIST** · **INSIGHTS** |
| **DISCOVERY** | **OVERVIEW** · **DISCOVERED ASSETS** · **SETTINGS** |
| **ISSUES** | **OVERVIEW** · **ISSUE LIST** · **INSIGHTS** |
| **TECHNOLOGIES** | **OVERVIEW** · **TECHNOLOGIES LIST** · **INSIGHTS** |
| **VULNERABILITIES** | **OVERVIEW** · **VULNERABILITIES LIST** · **INSIGHTS** |
| **COMPROMISED EMPLOYEE DATA** | **OVERVIEW** · **COMPROMISED EMPLOYEES** · **EXPOSED CREDENTIALS** |
| **FRAUDULENT DOMAINS** | **OVERVIEW** · **FRAUDULENT DOMAINS** · **SETTINGS** |

![The Issues page header with the breadcrumb and the OVERVIEW, ISSUE LIST and INSIGHTS tabs.](/img/guide/basics/navigation-03.png)

### How This Guide Gives Directions

Each page in this guide says where to find a screen in one line: **Sidebar:** is the path in the
sidebar, and **Tab:** is the in-page tab, followed by the page's address. For example:

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ISSUES** · **Tab:** **ISSUE LIST** ·
https://platform.deepinfo.com/app/easm/issues

## The + Menu

The blue **+** button at the top right is a shortcut for adding things.

| Group | Item | Opens |
|---|---|---|
| **ASSETS** | **ADD ASSETS / MANUALLY** | The EASM page where you type assets in. See [Add assets](/guide/easm/add-assets/) |
| **ASSETS** | **ADD ASSETS / UPLOAD FILE** | The EASM page where you upload a file of assets. See [Add assets](/guide/easm/add-assets/) |
| **ORGANIZATION** | **ADD NEW MEMBER** | **SETTINGS** › **ORGANIZATION SETTINGS** › **Members**, where admins invite people. Members who are not admins land on **Account Details** instead |

![The + menu open, with its ASSETS and ORGANIZATION items.](/img/guide/basics/navigation-04.png)

## The Cybersecurity News Menu

The newspaper icon next to **+** opens **Cybersecurity News**, a short list of recent articles under the
tab **All**, which shows how many there are:

- **TODAY**: articles published within about the last day.
- **LAST 7 DAYS**: up to five articles from the past week.

Each entry shows the title and how long ago it was published, such as **12 HOURS AGO**. Select one to open
the article. **Go to Cybersecurity News** at the bottom opens the full news list, the same page as
**CYBER SECURITY NEWS** in the sidebar. See [Cyber security news](/guide/cti/cybersecurity-news/).

![The Cybersecurity News menu open, with articles under TODAY and LAST 7 DAYS and the Go to Cybersecurity News link.](/img/guide/basics/navigation-05.png)

## The Profile Menu

The button at the far right shows your **organization's** logo, or its initials when it has no logo,
with a chevron. It is not your own photo. It opens this menu:

| Item | What it does |
|---|---|
| **USER SETTINGS** | Opens your **Account Details** in Settings |
| **COMPANY SETTINGS** | Opens the organization's **Settings** page. Admins only |
| **DOCUMENTATION** | Opens this documentation site in a new tab |
| **SUPPORT** | Opens an e-mail to [support@deepinfo.com](mailto:support@deepinfo.com) |
| **SIGN OUT** | Signs you out and returns to the sign-in page |

The items sit under the headings **ACCOUNT** (**USER SETTINGS** and **COMPANY SETTINGS**) and
**ORGANIZATION** (the rest).

![The profile menu of an admin, with USER SETTINGS, COMPANY SETTINGS, DOCUMENTATION, SUPPORT and SIGN OUT.](/img/guide/basics/navigation-06.png)

## Good to Know

- **No global search.** Search inside each list instead. See
  [Search, filter and export lists](/guide/basics/lists-filters-and-exports/).
- **One organization per account.** Your account belongs to exactly one organization, so there is no
  organization switcher.
- **No language setting.** The platform is in English.
- **Page links are shareable.** Platform addresses work as bookmarks and in messages to colleagues. A
  signed-out colleague is asked to sign in first and then lands on the page.
- **Some links open a new browser tab,** for example the figure cards on the Global Dashboard and
  **OPEN IN NEW TAB** in a record's side panel.
- **Narrow windows.** On a small screen, collapse the sidebar to give the page more room.
- **Page not found.** A platform address that does not exist shows **PAGE NOT FOUND** in the breadcrumb
  and a message that the page could not be found. **GO BACK TO DASHBOARD** there opens the EASM
  dashboard. To reach the Global Dashboard, select **GLOBAL DASHBOARD** in the sidebar.

## Do This With the API

- The articles in the Cybersecurity News menu: [Security News Search](/reference/cti/security-news-search/).


---

# What You Can Access

URL: https://docs.deepinfo.com/guide/basics/packages-and-roles/

Learn how your organization's package decides which screens you can open, and what the Admin and Member roles can do.

Two things decide what you see in the platform: your organization's **package**, which includes modules
and features, and your **role**, which is either Admin or Member.

## Before You Start

This applies to every user. To find out which package your organization has, ask an admin in your
organization or [support@deepinfo.com](mailto:support@deepinfo.com).

## Where to Find It

Package locks appear on the module pages themselves. Roles are managed on the **Members** page (admins
only): **Sidebar:** **SETTINGS** › **ORGANIZATION SETTINGS** › **Members** ·
https://platform.deepinfo.com/app/settings/org-members

## Packages

Your organization's package is what it has bought from Deepinfo. It decides which modules and features
open. The sidebar shows every module either way: a module outside the package opens to a lock screen
instead of its content.

### Lock Screens

A locked screen takes one of three forms:

- **Full-page lock.** The page is replaced by a message that the module
  **IS NOT INCLUDED IN YOUR PACKAGE** (for example **DARK WEB SEARCH IS NOT INCLUDED IN YOUR PACKAGE**),
  the line "Please talk to us to upgrade your package." and a **TALK TO US** button.
- **In-page lock.** The page stays visible but faded and cannot be clicked. Over it are the line
  "This module is not included in your package." and a **TALK WITH AN EXPERT** button.
- **Faded content.** The content is shown faded and cannot be clicked, without a message.

**TALK TO US** and **TALK WITH AN EXPERT** both open an e-mail to
[support@deepinfo.com](mailto:support@deepinfo.com).

Locked [Deep Search & Insights (DSI)](/guide/dsi/) search screens show sample data behind the lock. It is demo data, not your
organization's data.

On the **FEEDS** page, a feed outside your package says **This feed is not included in your package**,
and you can download only its sample data.

### What the Package Includes

| Area | What the package includes |
|---|---|
| External Attack Surface Management (EASM) | Every EASM screen |
| Cyber Threat Intelligence (CTI) | The CTI screens. Without CTI in the package, the CTI dashboard shows a lock screen |
| Dark Web Search | The page opens with either CTI or Dark Web Search in the package. Running a search needs Dark Web Search |
| Brand Risk Protection (BRP) | Every BRP screen |
| DSI | Each feature on its own: Domain Search, domain details, Vulnerability Search, vulnerability details, each type of instant lookup, the Feeds page and each feed |
| Reports and Notifications | Both at once: the same package item includes the two |

### Other Things That Change What You See

- **An access error.** If a screen asks for data outside your package, a message appears at the bottom
  right: "There was a problem with your access permissions. Please get in touch with us."
- **An empty EASM inventory.** This is not a package lock: if your organization has no assets yet, every
  EASM page takes you to the page for adding assets first. See [Add assets](/guide/easm/add-assets/).

## Roles

The roles are **ADMIN** and **MEMBER**. There are no other roles and no custom permissions.

| What | Admin | Member |
|---|---|---|
| Your own settings: **Account Details**, **Security**, **Session**, **Notifications** | Yes | Yes |
| **API Keys**, **API Usage**, **API Logs** | Yes | Yes |
| The organization's **Settings** (name and logo), **Members** and **Security** (require 2FA) | Yes | No |
| **COMPANY SETTINGS** in the profile menu | Yes | No |
| Module screens: EASM, CTI, BRP, DSI, Reports, Notifications | Yes | Yes |

- Members do not see the admin-only items in the Settings sidebar. If a member opens one of those pages
  by its address, the platform shows **Account Details** instead.
- Both roles can use the module screens. When a member creates a notification rule or schedules a
  report, the member can choose only themselves as a recipient.
- On **API Keys**, the **TEAM MEMBER** column shows which member each key belongs to. Admins see the keys
  of every member. See [Create and manage API keys](/guide/settings/api-keys/).
- An admin changes a person's role on the **Members** tab with **SET AS ADMIN** or **SET AS MEMBER**. See
  [Manage members and invitations](/guide/settings/members/).

## Good to Know

- **Upgrades go through Deepinfo.** Use **TALK TO US** or **TALK WITH AN EXPERT** on a lock screen, or
  write to [support@deepinfo.com](mailto:support@deepinfo.com).
- **API keys have the same limits.** An API call to an endpoint outside your package returns
  **403 Forbidden**. See [Errors](/getting-started/errors/#403-endpoint-not-in-plan).

## Do This With the API

- [Authentication](/getting-started/authentication/): what a 401 and a 403 mean for an API key.
- [Errors](/getting-started/errors/): the full error responses.


---

# Search, Filter and Export Lists

URL: https://docs.deepinfo.com/guide/basics/lists-filters-and-exports/

Use the list controls that every module shares, from search, filters, views and columns to bulk selection, record drawers, exports and history comparison.

Most module screens are lists: assets, discovered assets, issues, vulnerabilities, technologies,
compromised employees and exposed credentials, suspicious and fraudulent domains, and Deep Search & Insights (DSI) search results.
They share the same controls, described once here.

## Before You Start

You need the module's package. Some lists do not offer every control; each module page says which ones
it has.

## Where to Find It

On any list screen, for example the asset inventory:
**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY** · **Tab:** **ASSETS LIST** ·
https://platform.deepinfo.com/app/easm/assets

## Read a List Screen

From top to bottom, a list screen usually has:

1. **In-page tabs** under the page title, for example **OVERVIEW**, **ASSETS LIST** and **INSIGHTS**. The
   list is one of these tabs.
2. **The filter bar:** the **SEARCH** box, one filter chip per category or field, and at the right two
   icons that switch between quick view and list view. When the chips do not fit, **SHOW ALL FILTERS**
   shows the rest and **HIDE FILTERS** folds them again.
3. **The result line:** the number of results, for example **\<n\> ASSETS FOUND**, and buttons such as
   **EXPORT** and **VIEW SETTINGS**. Some lists add options here, such as **SHOW INACTIVES**.
4. **List tabs,** on some lists, for example one tab per asset type with its count.
5. **The list** itself, with "Displaying Results" and the page numbers below it.

![The asset inventory list with the SEARCH box, the filter chips, the result line with its buttons and the asset-type tabs.](/img/guide/basics/lists-filters-and-exports-01.png)

## Search a List

1. Type in the **SEARCH** box.
2. Press **Enter**.

The search is added as a filter on the list's main field. In the inventory, for example, it becomes the
condition **Asset** · **Must** · **Contains Any** · your text.

On **DARK WEB SEARCH**, **Enter** only adds your text as a condition. Select **SEARCH** to run the search.

## Filter a List

1. Select a filter chip. If the one you need is not shown, select **SHOW ALL FILTERS** first.
   - On some lists a chip is a **category**. The inventory, for example, has **ASSET META**, **WHOIS**,
     **DNS**, **SSL**, **HTTP**, **WEBDATA**, **IP WHOIS** and **OTHER**. Under **Select field**, choose the
     field to filter on.
   - On other lists a chip is a single **field**, for example **ISSUE**, **SEVERITY** or **STATE** in the
     issue list.
2. Set the rule:
   - **Must**: results must match this condition.
   - **Must Not**: results must not match this condition.
   - **Should**: results must match at least one of your **Should** conditions.
3. Choose an operator and enter the **Value**. The operators depend on the field:
   - text fields offer operators such as **Equal**, **Wildcard**, **Fuzzy**, **Contains Any**,
     **Start With** and **Exists**;
   - number fields use **Between**, with a **MINIMUM** and a **MAXIMUM**;
   - date fields use **AFTER** and **BEFORE**;
   - some fields have one fixed operator, for example **Equal**.
4. To add another condition in the same chip, select **Add New**. **Clear All** removes the chip's
   conditions.
5. Select **APPLY**, or **CANCEL** to close without changes.

The chip then shows how many conditions it holds, for example **ASSET META 1**.

Some search pages work a little differently: **DOMAIN SEARCH** and **VULNERABILITY SEARCH** in DSI,
**DARK WEB SEARCH** and **CYBER SECURITY NEWS**. On these pages the filters sit in a panel, and you run
the search with **SEARCH**. Your conditions are listed under **FILTERS APPLIED**, and **CLEAR FILTERS**
removes them all. On the DSI search pages and **DARK WEB SEARCH**, the panel has the tabs **FILTERS**
and **SAVED SEARCH**.

![A filter chip open, with one Must condition on a field.](/img/guide/basics/lists-filters-and-exports-02.png)
![The Domain Search page with one condition listed under FILTERS APPLIED.](/img/guide/basics/lists-filters-and-exports-03.png)

## Switch Between Quick View and List View

The two icons at the right of the filter bar switch the layout. The eye icon is quick view.

- **List view** shows a table, usually 25 results per page.
- **Quick view** shows a list on the left and the selected record's details on the right, with
  **OPEN IN NEW TAB** to open the record's full page. On many lists, **LOAD MORE** at the end of the left
  list loads more records. The inventory's left list has its own **SEARCH** box and a sort icon.

Some controls, such as **VIEW SETTINGS**, are hidden in quick view.

![The asset inventory in quick view, with the record list and the selected record's details, above the same list in list view.](/img/guide/basics/lists-filters-and-exports-04.png)

## Change Columns, Sorting and Page Size

In list view, select **VIEW SETTINGS** to open **View Options**. Depending on the list, it has:

- **Sort By**: shows **Default** until you choose. Select it, choose the field and the direction in the
  two **Select** boxes, and select **APPLY**. **CLEAR** removes the sort.
- **Result Per Page**: 25, 50, 75 or 100.
- **SHOWN**: one switch per column. Turn a switch off to hide the column. Drag columns to change their
  order. A column whose switch cannot be changed is always shown.
- **Reset to Default View**: restores the default columns.
- Extra options on some lists, for example **Show Only Tagged Assets** in the inventory.

To sort by a column, select the arrows in its header. The first click sorts in descending order, the
second in ascending order, and the third returns to the default order. Not every column can be sorted.

Column changes are not saved: when you reload the page, the default columns come back. Your search and
filters are cleared on reload too, and on some lists when you switch list tabs.

![VIEW SETTINGS open on the inventory, showing View Options with Sort By, Result Per Page and the SHOWN column switches.](/img/guide/basics/lists-filters-and-exports-05.png)

## Open a Record

Select a row to open its **drawer**, a panel on the right with the record's details.

- The drawer's sections are a column of icons along its side. Hover over an icon to see its name, for
  example **OVERVIEW** or **ISSUES**.
- **OPEN IN NEW TAB** at the top of the drawer opens the record's full page in a new browser tab.
- Actions for the record sit in the drawer's **…** or **⋮** menu, or in buttons at the bottom of the
  drawer, such as **IGNORE** and **ADD TO MY ASSETS** for a discovered asset.

![A record drawer with its column of section icons, a section tooltip and OPEN IN NEW TAB at the top.](/img/guide/basics/lists-filters-and-exports-06.png)

## Select Several Records

1. Tick the checkboxes of the rows you want. A bar appears above the list with **\<n\> selected** and the
   actions, for example **SCAN NOW** and **DELETE** in the inventory, or **CHANGE ALL STATUS** in the
   issue list.
2. To widen the selection, open the menu of the checkbox in the table header:
   - **SELECT THIS PAGE** selects every row on the page;
   - **SELECT ALL RESULTS**, on the lists that offer it, selects every result;
   - **CLEAR SELECTION** starts again.

   **SELECT THIS PAGE** and **SELECT ALL RESULTS** show how many rows they select.
3. Choose the action in the bar.

> [!WARNING]
> **SELECT ALL RESULTS** selects every result, on every page, not only the rows you can see. The action
> you choose next applies to all of them. Use it only on lists whose page in this guide describes it, and
> check your filters first. Everywhere else, tick the rows or use **SELECT THIS PAGE**.

![The header checkbox menu with SELECT THIS PAGE, SELECT ALL RESULTS and CLEAR SELECTION.](/img/guide/basics/lists-filters-and-exports-07.png)

## Export a List

1. Filter the list if you want only part of it.
2. Select **EXPORT**. The **DOWNLOAD** window opens: "Choose the records, format, and level of detail for
   your export."
3. Choose what you want:
   - **RECORDS**: **ALL** for every record in the list, without your filters, or **FILTERED** for the
     records that match your filters. **FILTERED** is offered when filters are applied.
   - **FILE FORMAT**: **CSV** or **JSON**. **JSON** is selected at first.
   - **EXPORT SCOPE**: **DEFAULT**, **BASIC** or **EXTENDED**, on the lists that offer it.
4. Select **DOWNLOAD**. On Cyber Threat Intelligence (CTI) lists the button is **EXPORT**.

Not every list offers every choice. Vulnerability Search, for example, asks only for the **FILE FORMAT**.
On a few lists, **EXPORT** is shown but cannot be used.

## Compare Historical Records

On an asset's full page, the **ASSET INFO** tab has buttons such as **SHOW HISTORICAL WHOIS RECORDS** and
**SHOW HISTORICAL DNS RECORDS**. For open ports, the history button is an icon. Each opens a date
picker with **YEAR**, **MONTH** and **DAY**.

- To see one snapshot, choose its date and select **CONFIRM**.
- To compare, tick **Compare Dates (Up to 3 Records)**, choose up to three dates and select
  **COMPARE**.

![The historical records date picker with Compare Dates ticked and the YEAR, MONTH and DAY tabs.](/img/guide/basics/lists-filters-and-exports-09.png)

## Work With Page Tabs

Domain Search, Vulnerability Search, Instant Lookup and Dark Web Search work in page tabs, like a
browser. Each search or lookup can have its own tab.

Right-click a tab for **Duplicate**, **New Tab to The Right**, **Close Tab**, **Close Other Tabs** and
**Close Tabs to the Right**. The same menu lists **Add Tab to Saved Search**, which is not available.
The tab list menu has a **Search tabs** box.

Your tabs are kept in this browser, for your user, so they are still there after a reload. They do not
appear in another browser or on another computer. Because a tab keeps its content, check the target in
a lookup tab before you run it again.

![The right-click menu of a Domain Search page tab.](/img/guide/basics/lists-filters-and-exports-10.png)

## Good to Know

- **No saved searches.** **SAVE THIS SEARCH**, the **SAVED SEARCH** tab and **Add Tab to Saved Search**
  appear on some pages, but you cannot save a search with them.
- **Changes take a few seconds.** After an action such as a state change or a removal, the list refreshes
  after about 6 seconds.
- **Same model as the API.** The **Must**, **Must Not** and **Should** rules work like the `must`,
  `must_not` and `should` parts of an API search request.

## Do This With the API

- [Search & filters](/getting-started/search-and-filters/): the filter model, the operators and bulk
  actions.
- [Pagination](/getting-started/pagination/): paging through results.
- Exports work the same way through the API, for example [Asset Export](/reference/easm/asset-export/).


---

# Account and Workspace

URL: https://docs.deepinfo.com/guide/settings/

Find your way around Settings, where you manage your own account, admins manage the organization, and everyone reaches API keys, usage and logs.

Settings holds your own account settings and your organization's settings, including its API keys, API
usage and API logs. Some pages are for admins only.

## Before You Start

No package is needed, and every user can open Settings. Admins also see **Settings**, **Members** and **Security** under
**ORGANIZATION SETTINGS**; members do not. See
[What you can access](/guide/basics/packages-and-roles/).

## Where to Find It

**Sidebar:** **SETTINGS** · https://platform.deepinfo.com/app/settings

It opens **Account Details**. You can also get there from the menus at the top right:

- the profile menu: **USER SETTINGS** opens **Account Details**, and **COMPANY SETTINGS** (admins only)
  opens the organization's **Settings** page;
- the **+** menu: **ADD NEW MEMBER** opens **Members** (admins only; members land on
  **Account Details**).

## Read the Screen

From top to bottom:

1. The breadcrumb, **SETTINGS / \<GROUP\> / \<PAGE\>**, for example
   **SETTINGS / USER SETTINGS / ACCOUNT DETAILS**.
2. A header card with your organization's logo (or its initials) and its name.
3. The Settings sidebar on the left, with the groups **USER SETTINGS** and **ORGANIZATION SETTINGS**, and
   the selected page on the right.

In this guide, **Sidebar:** **SETTINGS** › **USER SETTINGS** › **Account Details** means: select
**SETTINGS** in the main sidebar, then **Account Details** under **USER SETTINGS** in the Settings
sidebar.

![Settings as an admin, with the header card and the full Settings sidebar next to Account Details.](/img/guide/settings/index-01.png)

### USER SETTINGS

These pages are about you, and every user has them.

| Settings sidebar item | What you do there | Guide page |
|---|---|---|
| **Account Details** | Change your photo, name and time zone | [Update your profile](/guide/settings/account-details/) |
| **Security** | Change your password; turn two-factor authentication on or off | [Change your password](/guide/settings/change-password/), [Use two-factor authentication](/guide/basics/two-factor-authentication/) |
| **Session** | See your sign-in history | [Review your sign-in history](/guide/settings/sessions/) |
| **Notifications** | Choose which Deepinfo e-mails you receive | [Choose which Deepinfo e-mails you receive](/guide/settings/email-preferences/) |

### ORGANIZATION SETTINGS

These pages are about your organization.

| Settings sidebar item | Who sees it | What you do there | Guide page |
|---|---|---|---|
| **Settings** | Admins | Change the organization's name and logo | [Change your organization's name and logo](/guide/settings/organization/) |
| **Members** | Admins | Invite people, change roles, deactivate or delete members | [Manage members and invitations](/guide/settings/members/) |
| **Security** | Admins | Require two-factor authentication for everyone | [Require two-factor authentication](/guide/settings/require-two-factor-authentication/) |
| **API Keys** | Everyone | Create, rename, delete and choose the default API key; see who each key belongs to | [Create and manage API keys](/guide/settings/api-keys/) |
| **API Usage** | Everyone | Check quota, usage and what remains | [Check API usage and quota](/guide/settings/api-usage/) |
| **API Logs** | Everyone | Review and filter the log of calls to the Deepinfo API | [Review API logs](/guide/settings/api-logs/) |

## Good to Know

- **Admin-only pages.** Members do not see **Settings**, **Members** and **Security** under
  **ORGANIZATION SETTINGS**. If a member opens one of them by its address, **Account Details** opens
  instead.
- **Security in both groups.** **Security** under **USER SETTINGS** is for your own password and 2FA.
  **Security** under **ORGANIZATION SETTINGS** requires 2FA for everyone; its breadcrumb reads
  **ORGANIZATION SECURITY**.
- **Names in the breadcrumb.** The breadcrumb can differ slightly from the Settings sidebar: **Session**
  shows as **SESSIONS**. This guide uses the Settings sidebar names.
- **No new browser tab.** The Settings sidebar items are not links, so you cannot open them in a new
  browser tab. Use the page addresses in this guide instead.
- **Wide tables.** Some Settings tables are wider than a laptop screen. Scroll the table sideways to reach
  the last columns, for example **ACTIVE** on **Members**.
- **Two kinds of notifications.** **Notifications** in Settings controls Deepinfo's own e-mails to you.
  Security alerts come from [notification rules](/guide/notifications/), under **NOTIFICATION CENTER** in
  the sidebar.
- **Times.** Dates and times in Settings tables are shown in your browser's local time.


---

# Update Your Profile

URL: https://docs.deepinfo.com/guide/settings/account-details/

Change your photo, your name and your time zone; your e-mail address is fixed.

**Account Details** holds your photo, your name and your time zone. Your e-mail address is shown but
cannot be changed here.

## Before You Start

No package is needed, and any role can use this page. It is about your own account only.

## Where to Find It

**Sidebar:** **SETTINGS** › **USER SETTINGS** › **Account Details** ·
https://platform.deepinfo.com/app/settings/user-detail

**USER SETTINGS** in the profile menu opens it too.

## Read the Screen

The page has three cards:

1. **Avatar**: your photo, or your initials when you have no photo.
2. **Personal Information**: **FIRST NAME**, **LAST NAME** and **EMAIL ADDRESS**. The e-mail address
   cannot be edited.
3. **Preferences**: **TIMEZONE**. It shows "Select" until you choose a time zone.

**Personal Information** and **Preferences** each have their own **UPDATE** button. It stays disabled
until you change something in that card.

![The Account Details page with the Avatar, Personal Information and Preferences sections.](/img/guide/settings/account-details-01.png)

## Add or Change Your Photo

1. In **Avatar**, select **ADD PHOTO**, or **CHANGE PHOTO** if you already have one.
2. Choose an image file of 5 MB or less.
3. Select **UPLOAD PHOTO**. To cancel instead, select the **×** on the preview.

The platform confirms with "Your avatar has been updated." To remove your photo, select **REMOVE PHOTO**.

## Change Your Name

1. In **Personal Information**, edit **FIRST NAME** and **LAST NAME**.
2. Select **UPDATE**.

Your new name is used across the platform.

## Set Your Time Zone

1. In **Preferences**, open **TIMEZONE**. Each entry shows the offset and the time zone name, for example
   **(GMT+0000) Africa/Abidjan**.
2. Choose your time zone.
3. Select **UPDATE**. The platform confirms with "Your preferences information has been updated."

## Good to Know

- **Changing your e-mail address.** You cannot change it yourself. Contact
  [support@deepinfo.com](mailto:support@deepinfo.com).
- **Photo files.** Only image files are accepted, up to 5 MB.
- **Times on screen.** Tables show dates and times in your browser's local time. The **TIMEZONE**
  setting does not change what the web app shows.
- **No language setting.** The text of the **Preferences** card mentions a preferred language, but the
  only preference you can set is the time zone. The platform is in English.
- **Your photo and the profile menu.** The button at the top right shows your organization's logo or
  initials, not your photo. See [Change your organization's name and logo](/guide/settings/organization/).


---

# Change Your Password

URL: https://docs.deepinfo.com/guide/settings/change-password/

Change your password from Settings while you are signed in.

Change your password from Settings when you know your current one. If you forgot it, reset it from the
sign-in page instead.

## Before You Start

- No package is needed, and any role can change their own password.
- You need your current password. If you do not know it, see
  [Reset a forgotten password](/guide/basics/reset-password/).

## Where to Find It

**Sidebar:** **SETTINGS** › **USER SETTINGS** › **Security** ·
https://platform.deepinfo.com/app/settings/user-security

The **Change Password** card is at the top of the page.

![The Change Password card with a new password typed in and some of the password rules turned green.](/img/guide/settings/change-password-01.png)

## Change Your Password

1. Go to **SETTINGS** › **USER SETTINGS** › **Security**.
2. In **Change Password**, enter your **CURRENT PASSWORD**.
3. Enter your **NEW PASSWORD**. The rules below the field turn green as you meet them.
4. Select **CHANGE PASSWORD**. The button stays disabled until the form is complete and every rule is
   met.

The platform confirms with "Your password has been updated." and clears the form.

## Password Rules

Your new password must meet five rules, shown below the field: **Use at least 12 characters**,
**1 Uppercase letter**, **1 Lowercase letter**, **1 Number** and **1 Symbol**. Only some characters count
as a symbol: see the full list under [Password rules](/guide/basics/reset-password/#password-rules).

If the new password is not strong enough, the page shows "Password is too weak."

## Good to Know

- **Two-factor authentication** is on the same page, in the **Two Factor Authentication** card. See
  [Use two-factor authentication](/guide/basics/two-factor-authentication/).


---

# Review Your Sign-In History

URL: https://docs.deepinfo.com/guide/settings/sessions/

Read your own session list, with the date, IP address, browser, operating system and type of each entry.

**Session** lists your own sign-in history. Use it to check where and from which browser your account was
used.

## Before You Start

No package is needed, and any role can open this page. You see only your own entries.

## Where to Find It

**Sidebar:** **SETTINGS** › **USER SETTINGS** › **Session** ·
https://platform.deepinfo.com/app/settings/user-session

The breadcrumb on this page reads **SESSIONS**.

## Read the Screen

The count at the top, **\<n\> SESSIONS**, shows how many entries there are, with **VIEW SETTINGS** next to
it. The table has these columns:

| Column | What it shows |
|---|---|
| **DATE** | The date and time of the entry, in your browser's local time |
| **IP ADDRESS** | The IP address the entry came from |
| **BROWSER** | The browser |
| **OS** | The operating system |
| **TYPE** | The type of entry: **Login** for each sign-in, and **Signed up** for the entry from when your account was created |

A **Country** column is available but hidden by default.

The newest entry is at the top, and the table shows 10 entries per page at first. Below the table,
"Displaying Results" and the page numbers take you through older entries.

![The session table with its DATE, IP ADDRESS, BROWSER, OS and TYPE columns and the page numbers below it.](/img/guide/settings/sessions-01.png)

## Show More Columns or Rows

1. Select **VIEW SETTINGS**. **View Options** opens.
2. Under **Result Per Page**, choose 25, 50, 75 or 100.
3. Under **SHOWN**, turn on the switch next to **Country** to show that column, or turn off a column you
   do not need.
4. To go back to the default layout, select **Reset to Default View**.

![View Options open on the session table, with Result Per Page and the SHOWN column switches.](/img/guide/settings/sessions-02.png)

## Good to Know

- **Read-only.** You cannot sign out other sessions from this page, and the table cannot be filtered or
  sorted.
- **An entry you do not recognize?** [Change your password](/guide/settings/change-password/) and turn on
  [two-factor authentication](/guide/basics/two-factor-authentication/).
- **For the whole organization.** Admins can see every member's activity on the **Members Activity** tab.
  See [Manage members and invitations](/guide/settings/members/#review-member-activity).


---

# Choose Which Deepinfo E-mails You Receive

URL: https://docs.deepinfo.com/guide/settings/email-preferences/

Turn Deepinfo's own e-mails to you on or off; these preferences do not control security alerts.

**Notifications** in Settings holds your e-mail preferences: which e-mails you receive from Deepinfo
itself, such as announcements and newsletters. Security alerts about your assets are not set here.

## Before You Start

No package is needed, and any role can use this page. Your preferences apply to you only.

## Where to Find It

**Sidebar:** **SETTINGS** › **USER SETTINGS** › **Notifications** ·
https://platform.deepinfo.com/app/settings/user-notifications

## Read the Screen

The page is titled **Notify me when...** and has four switches.

![The Notifications page with one switch per type of Deepinfo e-mail and the UPDATE button.](/img/guide/settings/email-preferences-01.png)

| Switch | E-mails it covers |
|---|---|
| **Company Announcements** | Company updates from Deepinfo |
| **Monthly Newsletter** | Deepinfo's monthly newsletter |
| **Product Feature Updates** | Product updates |
| **Education Training** | Product education and training |

## Change Your E-mail Preferences

1. Go to **SETTINGS** › **USER SETTINGS** › **Notifications**.
2. Turn each switch on or off.
3. Select **UPDATE**. The button stays disabled until you change a switch.

The platform confirms that your notifications have been updated.

## Good to Know

- **E-mail preferences are not notification rules.** To get e-mails when something happens on your
  attack surface, such as a new fraudulent domain, set up notification rules under
  **NOTIFICATION CENTER** in the sidebar. See [Notifications](/guide/notifications/).


---

# Change Your Organization's Name and Logo

URL: https://docs.deepinfo.com/guide/settings/organization/

Admins can change the organization's name and upload or remove its logo.

The organization's **Settings** page holds its name and logo. Both appear in several places in the
platform, listed below.

## Before You Start

- You must be an **admin**. Members do not see this page; if they open it, **Account Details** opens
  instead. No package is needed.
- For the logo, have an image file of 5 MB or less.

## Where to Find It

**Sidebar:** **SETTINGS** › **ORGANIZATION SETTINGS** › **Settings** ·
https://platform.deepinfo.com/app/settings/org-settings

**COMPANY SETTINGS** in the profile menu opens it too.

## Read the Screen

The page is headed **Organization Details** and has two cards: **Organization Logo** and
**Organization Name**. The logo card shows the organization's initials until a logo is uploaded.

![The organization Settings page with the Organization Logo and Organization Name sections.](/img/guide/settings/organization-01.png)

## Change the Organization Name

1. In **Organization Name**, edit **ORGANIZATION NAME**.
2. Select **UPDATE**. The button stays disabled until you change the name.

The platform confirms with "Your organization has been updated."

## Add or Change the Logo

1. In **Organization Logo**, select **ADD PHOTO**, or **CHANGE PHOTO** if there is a logo already.
2. Choose an image file of 5 MB or less.
3. Select **UPLOAD PHOTO**. To cancel instead, select the **×** on the preview.

The platform confirms with "Your Organization logo has been updated." To remove the logo, select
**REMOVE PHOTO**.

## Where the Name and Logo Appear

- The header card at the top of Settings shows the logo and the name.
- The profile-menu button at the top right of every page shows the logo, or the organization's initials
  when there is no logo.
- The Global Dashboard and the Cyber Threat Intelligence (CTI) dashboard show the logo at the top. Without a logo, an empty space is
  shown there.

## Good to Know

- **One organization per account.** Every user belongs to exactly one organization, and there is no way
  to switch between organizations.
- **Two-factor authentication for everyone** is set on a separate page. See
  [Require two-factor authentication](/guide/settings/require-two-factor-authentication/).


---

# Manage Members and Invitations

URL: https://docs.deepinfo.com/guide/settings/members/

Admins can invite people, change roles, deactivate or delete members, resend or revoke invitations, and review member activity.

**Members** is where admins manage who has access to the organization: the people in it, the invitations
sent, and everyone's sign-in history.

## Before You Start

You must be an **admin**. Members do not see this page; if they open it, **Account Details** opens
instead. No package is needed.

## Where to Find It

**Sidebar:** **SETTINGS** › **ORGANIZATION SETTINGS** › **Members** ·
https://platform.deepinfo.com/app/settings/org-members

**+** › **ADD NEW MEMBER** opens it too.

## Read the Screen

The page has three tabs: **Members**, **Invited Members** and **Members Activity**. Switching tabs does
not change the page address.

### Members

The count at the top, **\<n\> MEMBERS**, shows the number of members, with **INVITE NEW MEMBER** next to it.

| Column | What it shows |
|---|---|
| **MEMBER NAME** | First and last name |
| **EMAIL** | The member's e-mail address |
| **LAST LOGIN** | Date and time of the last sign-in |
| **ROLE** | **ADMIN** or **MEMBER**, with a chevron. Select it to change the role |
| **ACTIVE** | A switch that deactivates or reactivates the member, with **YES** while the member is active |
| Trash icon | Deletes the member |

Your own row has no trash icon, and its role cannot be changed.

![The Members tab with the role dropdown of a member open, showing SET AS ADMIN and SET AS MEMBER.](/img/guide/settings/members-01.png)

### Invited Members

The count at the top shows the number of invitations, with **INVITE NEW MEMBER** next to it.

| Column | What it shows |
|---|---|
| **MEMBER NAME** | The e-mail address the invitation went to |
| **INVITED BY** | The admin who sent it |
| **INVITED AT** | When it was sent |
| **STATUS** | **SENT** and **RESENT** in green, **REVOKED** in red |

A resend icon appears on invitations with the status **SENT**. A trash icon revokes an invitation that is
not revoked yet.

![The Invited Members tab listing an invitation with who sent it, when, and its status.](/img/guide/settings/members-02.png)

### Members Activity

The sign-in history of everyone in the organization. See [Review member activity](#review-member-activity).

## Invite People

1. On the **Members** or **Invited Members** tab, select **INVITE NEW MEMBER**. The
   **Invite New Members** window opens: "You can send invitations to more than one mail address at the
   same time."
2. In **TO:**, enter the e-mail addresses to invite, one per line. Blank lines and duplicates are removed.
3. Select **INVITE**. The button is enabled once you have entered an address.

The platform confirms each invitation with "\<e-mail address\> has been invited." and switches to
**Invited Members**. Each person receives an e-mail with a link to create their account; see
[Set up your account from an e-mail link](/guide/basics/set-up-your-account/).

If an address is not valid, the window shows "Please enter a valid email address per line."

After inviting several addresses at once, check **Invited Members** to make sure every address is listed.

![The Invite New Members window with e-mail addresses in the TO box.](/img/guide/settings/members-03.png)

## Change a Member's Role

1. On the **Members** tab, select the member's **ADMIN** or **MEMBER** role button.
2. Choose **SET AS ADMIN** or **SET AS MEMBER**.
3. Confirm with **OK**.

## Deactivate or Reactivate a Member

1. On the **Members** tab, select the member's **ACTIVE** switch.
2. Confirm with **UPDATE**.

## Delete a Member

1. On the **Members** tab, select the trash icon in the member's row.
2. In **Delete Member**, select **DELETE**.

The platform confirms that the member has been removed.

## Resend an Invitation

1. On the **Invited Members** tab, find an invitation with the status **SENT**.
2. Select its resend icon (**Resend Email**).
3. In **Resend Invitation**, select **RESEND**.

## Revoke an Invitation

1. On the **Invited Members** tab, select the trash icon in the invitation's row.
2. In **Revoke Invitation**, select **REVOKE**.

The status changes to **REVOKED**.

## Review Member Activity

Open the **Members Activity** tab. It is the organization-wide version of your own
[Session](/guide/settings/sessions/) page: one row per entry, for every member. The count
at the top reads **\<n\> MEMBER ACTIVITIES**.

| Column | What it shows |
|---|---|
| **USER** | The member's name, with the e-mail address below |
| **IP ADDRESS** | The IP address the entry came from |
| **BROWSER** | The browser |
| **OS** | The operating system |
| **TIMESTAMP** | When it happened |
| **TYPE** | The type of entry, for example **Login** for a sign-in |

The table shows 10 entries per page. It has no **VIEW SETTINGS** and no filters.

![The Members Activity tab listing the sign-in entries of everyone in the organization.](/img/guide/settings/members-05.png)

## Good to Know

- **Your own row is locked.** You cannot change your own role, deactivate yourself or delete yourself.
  Ask another admin.
- **No role when inviting.** You cannot choose a role in the invitation. Change it on the **Members** tab
  after the person has created their account.
- **No search or export.** The **Members** and **Members Activity** tabs cannot be searched, filtered or
  exported.
- **Wide table.** On a laptop screen you may need to scroll the **Members** table sideways to reach
  **ACTIVE** and the trash icon.
- **Personal data.** These tabs show names, e-mail addresses, IP addresses and sign-in times. Keep
  screenshots of them inside your organization.


---

# Require Two-Factor Authentication

URL: https://docs.deepinfo.com/guide/settings/require-two-factor-authentication/

As an admin, require two-factor authentication for everyone in your organization, and see what people experience once it is required.

An admin can require two-factor authentication (2FA) for everyone in the organization. Once it is
required, everyone without 2FA must set it up before they can continue to use the platform.

## Before You Start

- You must be an **admin**. Members do not see this page; if they open it, **Account Details** opens
  instead. No package is needed.
- You need 2FA on your own account. If it is not on yet, the platform sets it up with you as the first
  step, so have an authenticator app ready. See
  [Use two-factor authentication](/guide/basics/two-factor-authentication/).

## Where to Find It

**Sidebar:** **SETTINGS** › **ORGANIZATION SETTINGS** › **Security** ·
https://platform.deepinfo.com/app/settings/org-security

The breadcrumb on this page reads **ORGANIZATION SECURITY**. The **Two Factor Authentication** card
shows **Enabled** (green) when 2FA is required, or **Disabled** (red) when it is not.

![The organization Security page with Two Factor Authentication shown as Disabled.](/img/guide/settings/require-two-factor-authentication-01.png)

## Require 2FA for Everyone

1. Go to **SETTINGS** › **ORGANIZATION SETTINGS** › **Security**.
2. Select **ENABLE TWO FACTOR AUTHENTICATION**.
3. If your own account already has 2FA, confirm with **ENABLE**.

   If it does not, the 2FA set-up window opens first. Scan the QR code, enter the 6-digit code, select
   **VERIFY**, and save your recovery codes with **DOWNLOAD CODE AND CLOSE**. The requirement is switched
   on when you finish.

The card now shows **Enabled**, and the platform confirms with "Two Factor Authentication has been
enabled."

## Stop Requiring 2FA

1. Go to **SETTINGS** › **ORGANIZATION SETTINGS** › **Security**.
2. Select **DISABLE TWO FACTOR AUTHENTICATION**.
3. Confirm with **DISABLE**.

This changes only the organization setting. Everyone who has 2FA on their own account keeps it until
they turn it off in **SETTINGS** › **USER SETTINGS** › **Security**.

## What Everyone Else Sees

This applies to admins and members alike.

- **People without 2FA** are stopped on their next sign-in or page load. A **Two-Factor Authentication**
  page tells them that the organization requires it, and they must set it up before they continue. The
  steps are in [Use two-factor authentication](/guide/basics/two-factor-authentication/#when-your-organization-requires-2fa).
- **People with 2FA** see no change, except that they cannot turn their own 2FA off. If they try, the
  platform shows "Two Factor Authentication is required in your organization."

## Good to Know

- **Tell your team first.** Everyone without 2FA needs an authenticator app on their phone the next time
  they use the platform.
- **Lost phone.** Someone who has lost both the phone and the recovery codes cannot pass the second
  step. They should contact [support@deepinfo.com](mailto:support@deepinfo.com).


---

# Create and Manage API Keys

URL: https://docs.deepinfo.com/guide/settings/api-keys/

Generate, rename, delete and choose the default API key, see which member each key belongs to, and understand why the default key matters.

API keys authenticate calls to the Deepinfo API (`https://api.deepinfo.com`). You create and manage them
on the **API Keys** page. A badge marks the **default key**: the platform also uses the default key for
its own calls to the API.

## Before You Start

No package is needed to open this page, and any role can use it: **API Keys** is not limited to admins.

## Where to Find It

**Sidebar:** **SETTINGS** › **ORGANIZATION SETTINGS** › **API Keys** ·
https://platform.deepinfo.com/app/settings/org-api-keys

## Read the Screen

The count of keys, **\<n\> API KEYS**, is at the top, with **GENERATE NEW KEY** and **VIEW SETTINGS** next
to it. The table has these columns:

| Column | What it shows |
|---|---|
| **NAME** | The key's name. A badge marks the default key (tooltip **Default API Key**) |
| **KEY** | The key itself, in full, with a **Copy** button |
| **TEAM MEMBER** | The e-mail address of the member the key belongs to |
| **CREATED DATE** | The date and time the key was created |
| **⋯** | The actions menu: **Edit**, **Set as Default** and **Delete** |

Keys belong to members. As an admin, you see the keys of every member in the organization.

![The API Keys table with the actions menu of one key open, showing Edit, Set as Default and Delete.](/img/guide/settings/api-keys-01.png)

## Generate a Key

1. Select **GENERATE NEW KEY**. The **Generate a New API Key** window opens.
2. Enter a **Name**, or leave it empty to get a random 9-character name.
3. Select **GENERATE**.
4. The new key appears in the **API KEY** field. Select **COPY AND CLOSE** to copy it to your clipboard
   and close the window.

Store the key in a secret store or an environment variable, not in code.

## Rename a Key

1. In the key's row, open **⋯** and select **Edit**.
2. Change the **Name**. A name is required.
3. Select **UPDATE**.

## Set the Default Key

1. In the key's row, open **⋯** and select **Set as Default**.
2. Confirm with **SET DEFAULT**.

The badge moves to that key.

## Delete a Key

1. In the key's row, open **⋯** and select **Delete**.
2. In **Delete API Key**, select **DELETE**.

A deleted key can no longer be used to call the API. You cannot delete the default key: make another
key the default first.

## Replace an Exposed Key

If a key may have leaked, replace it:

1. Generate a new key.
2. Switch your integration to the new key.
3. If the exposed key is the default, set the new key as default.
4. Delete the exposed key.

There is no rotate or regenerate action: replacing a key always means generating a new one and deleting
the old one.

## Why the Default Key Matters

The platform uses the default key when it calls the Deepinfo API for you, for example when you run a
Deep Search & Insights (DSI) search or an instant lookup. These calls appear in [API Logs](/guide/settings/api-logs/) under the
default key, next to the calls from your own integrations. Searches and lookups made this way can use
quota on [API Usage](/guide/settings/api-usage/).

## Good to Know

- **The keys are shown in full.** The **KEY** column shows each key in plain text, and so does the **KEY**
  column in **API Logs**. Treat screenshots of these pages as secret.
- **The default key cannot be deleted.** In its **⋯** menu, **Set as Default** and **Delete** are
  unavailable.

## Do This With the API

- [Authentication](/getting-started/authentication/): send the key in the `apikey` header of every
  request.
- [Rate limits](/getting-started/rate-limits/): how many requests a key can make, and the quota.
- [Errors](/getting-started/errors/): what a missing or invalid key (401) and an endpoint outside your
  package (403) return.


---

# Check API Usage and Quota

URL: https://docs.deepinfo.com/guide/settings/api-usage/

Read the quota, the usage and what remains for each group of API endpoints in your package.

Some API endpoints count against a quota in your organization's package. **API Usage** shows each quota,
how much of it has been used and how much remains.

## Before You Start

No package is needed to open this page, and any role can use it: **API Usage** is not limited to
admins.

## Where to Find It

**Sidebar:** **SETTINGS** › **ORGANIZATION SETTINGS** › **API Usage** ·
https://platform.deepinfo.com/app/settings/org-api-usage

## Read the Screen

The page is a list with one row per quota, and no other controls. Each row shows:

| Part | What it shows |
|---|---|
| Name | The API or APIs that share this quota. When several share one quota, their names are separated by commas |
| **QUOTA:** | The size of the quota in your package |
| **USED:** | How much of it has been used |
| **REMAINING:** | How much is left |
| Bar | A segmented bar. The filled segments show the share that **remains** |
| Percentage | The share that **remains**, with the percent sign in front of the number |

Some rows cover a whole module, for example **EASM Customer All API**. Others cover a single API, for
example **Whois Lookup API** or **Domain Search**.

A full bar means the quota is untouched. As the quota is used, the bar empties.

When there is nothing to show, the page reads "No API Usage Found."

![The API Usage page with several quota rows, each with its quota, used and remaining figures, a segmented bar and a percentage.](/img/guide/settings/api-usage-01.png)

## Good to Know

- **The bar and the percentage show what is left, not what is used.**
- **No period or reset date.** The page does not show whether a quota is monthly, yearly or a total, or
  when it resets. Ask [support@deepinfo.com](mailto:support@deepinfo.com) if you need to
  know.
- **The order of the rows can change** when you reload the page. Look for a row by its name.
- **Platform searches can count too.** The platform calls the Deepinfo API with the
  [default API key](/guide/settings/api-keys/#why-the-default-key-matters) when you run searches and
  lookups, for example in Deep Search & Insights (DSI), so those can use quota.
- **No filters or export.** The page has no date range, filter or export.

## Do This With the API

- [Rate limits](/getting-started/rate-limits/#quota): how the quota works for API calls, and what happens
  when you go over the rate limit.


---

# Review API Logs

URL: https://docs.deepinfo.com/guide/settings/api-logs/

Read and filter the log of API calls, with the endpoint, date, IP address, key, method, status and parameters of each call.

**API Logs** lists the calls made to the Deepinfo API with your API keys. Use it to see what was called,
with which key, and whether it worked.

## Before You Start

No package is needed to open this page, and any role can use it: **API Logs** is not limited to
admins.

## Where to Find It

**Sidebar:** **SETTINGS** › **ORGANIZATION SETTINGS** › **API Logs** ·
https://platform.deepinfo.com/app/settings/org-api-logs

## Read the Screen

The count of log entries, **\<n\> API LOGS**, is at the top, with **VIEW SETTINGS** next to it. The table
has these columns:

| Column | What it shows |
|---|---|
| **API** | A short name taken from the endpoint's path, for example `assets`. The full path is in the row's details |
| **DATE** | Date and time of the call |
| **IP** | The IP address the call came from |
| **KEY** | The API key that made the call, in full |
| **METHOD** | The HTTP method, for example **GET** or **POST** |
| **STATUS** | The HTTP status code, for example **200**. Codes of 4xx and 5xx are shown in red |

The log shows 25 entries per page.

![The API Logs table with its API, DATE, IP, KEY, METHOD and STATUS columns.](/img/guide/settings/api-logs-01.png)

## See the Details of a Call

1. Select a row. It expands below.
2. Read the details:
   - **API VERSION**: the API version, for example `v1`.
   - **URL**: the full path that was called.
   - **PARAMS**: the query parameters, as JSON.

![One API log row expanded to show API VERSION, URL and PARAMS.](/img/guide/settings/api-logs-02.png)

## Filter the Log

The filters are inside **VIEW SETTINGS**:

1. Select **VIEW SETTINGS**. **View Options** opens.
2. Select **Filter By**. It reads **Default** while no filter is set. The **FILTER** panel opens.
3. In the **Select** boxes, choose the field to filter on, **Endpoint**, **Time Range** or
   **Http Status**, and set its condition.
4. To add another condition, select **NEW FILTER**. **CLEAR ALL** removes them all.
5. Select **APPLY**.

![The Filter By panel in View Options with one Http Status condition.](/img/guide/settings/api-logs-03.png)

## Show or Hide Columns

In **VIEW SETTINGS** › **View Options**, the **SHOWN** list has a switch for each column. The **API**
column is always shown. **Reset to Default View** restores the default columns.

## Read the Status Codes

A red status means the call failed. The most common ones:

| Status | Meaning |
|---|---|
| 401 | The API key was missing or not valid |
| 403 | The endpoint is not included in your package |
| 429 | The key went over its rate limit |

[Errors](/getting-started/errors/) lists every status code the API returns, with example responses.

## Good to Know

- **Platform activity appears too.** The platform calls the Deepinfo API with the
  [default API key](/guide/settings/api-keys/#why-the-default-key-matters) while you use it, so those
  calls are listed here next to the calls from your own integrations.
- **Sensitive content.** The log shows API keys in full, IP addresses and the parameters of each call,
  which can include the domains and e-mail addresses you looked up. Treat screenshots of this page as
  secret.

## Do This With the API

- [Errors](/getting-started/errors/): every error format and status code.
- [Rate limits](/getting-started/rate-limits/): the rate-limit headers and what a 429 means.


---

# Global Dashboard

URL: https://docs.deepinfo.com/guide/global-dashboard/

The platform's landing page shows summary cards for External Attack Surface Management (EASM), Cyber Threat Intelligence (CTI) and Brand Risk Protection (BRP), with your EASM security score, 30-day trends and top lists, and links into each module.

The Global Dashboard puts the headline numbers of External Attack Surface Management (EASM), Cyber Threat Intelligence (CTI) and Brand Risk Protection (BRP) on one page. Start here to see what
changed, then follow a card into the module where you can act on it.

## Before You Start

- **Package:** the page itself is not locked by package. Each section shows the figures of its own module.
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **GLOBAL DASHBOARD** · https://platform.deepinfo.com/app/global-dashboard

The Deepinfo logo at the top of the sidebar also opens this page. After you sign in, the platform opens the
Global Dashboard by default. If you signed in from a link to another page, it opens that page instead.

## Read the Screen

![The full Global Dashboard with the sidebar, numbered 1 to 6: the logo tab, the security score radar, the module cards and the EASM, CTI and BRP sections.](/img/guide/global-dashboard/index-01.png)

The header breadcrumb reads **DEEPINFO / GLOBAL DASHBOARD**.

1. **Organization logo.** A tab at the top of the page shows your organization's logo. It stays empty until
   an admin uploads a logo.
2. **Security score radar.** The centre of the radar shows your organization's EASM security grade (A to F) and
   its score. See [How security scores work](/guide/easm/security-score/).
3. **Module cards around the radar.** Each card opens its module in the same tab:
   - **EASM** (left of the radar): the grade and score, and the **ASSETS**, **ISSUES**, **TECHNOLOGIES** and
     **VULNERABILITIES** counts. Opens the [EASM dashboard](/guide/easm/dashboard/).
   - **CTI** (right): the **COMPROMISED EMPLOYEES**, **CREDENTIALS**, **COMPROMISED CLIENTS** and
     **COMPROMISED PAYMENTS** counts. Opens the [CTI dashboard](/guide/cti/dashboard/).
   - **BRP** (right): the **FRAUDULENT DOMAIN** and **SUSPICIOUS DOMAIN** counts. Opens
     **FRAUDULENT DOMAINS** (see [Brand Risk Protection](/guide/brp/)).

   The CTI and BRP cards show counts only. The only score on this page is the EASM security score.
4. **EASM section**, with the **GO TO EASM DASHBOARD** button.
5. **CTI section**, with the **GO TO CTI DASHBOARD** button. See
   [Cyber Threat Intelligence (CTI)](/guide/cti/).
6. **BRP section.** It has no button of its own; use its cards.

![Close-up of the security score radar with the grade and the score, and the EASM, CTI and BRP cards around it.](/img/guide/global-dashboard/index-02.png)

### EASM Section

![The EASM section of the Global Dashboard, with one sparkline and its LAST 30 DAYS change pill outlined.](/img/guide/global-dashboard/index-03.png)

| Card | What it shows | Opens |
|---|---|---|
| **TOTAL ASSETS** | Number of assets, with a 30-day trend | [Inventory](/guide/easm/asset-inventory/) |
| **TOTAL ISSUES** | Number of issues, with a 30-day trend | [Issue List](/guide/easm/issues/) |
| **TOTAL TECHNOLOGIES** | Number of detected technologies, with a 30-day trend | [Technologies](/guide/easm/technologies/) |
| **TOTAL VULNERABILITIES** | Number of vulnerabilities, with a 30-day trend | [Vulnerability List](/guide/easm/vulnerabilities/) |
| **ASSET TYPES** | Pie chart of **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES** | None |
| **ISSUE SEVERITY** | One bar per severity, from **CRITICAL** at the top to **INFORMATION** | None |
| **TOP TECHNOLOGY CATEGORIES** | The technology categories with the highest counts | None |
| **MOST CRITICAL VULNERABILITIES** | Three CVEs, each with its score and severity. A red **EXP.** badge marks a CVE in the CISA KEV catalogue | That CVE's page |

The **TOTAL** cards show the current total, a line of the last 30 daily values and a change pill
labelled **LAST 30 DAYS**. The pill shows how much the value changed over those 30 days: the latest daily value
minus the value 30 days earlier, for example `+12`, `-3` or `0`. After a sharp drop, the decrease can be larger
than the current total.

### CTI Section

![The CTI section of the Global Dashboard, with the employee e-mail addresses and credential domains blurred.](/img/guide/global-dashboard/index-04.png)

| Card | What it shows | Opens |
|---|---|---|
| **EXPOSED CREDENTIALS** | Number of exposed employee credentials | **COMPROMISED EMPLOYEE DATA**, **EXPOSED CREDENTIALS** tab ([Review exposed credentials](/guide/cti/credential-exposures/)) |
| **COMPROMISED EMPLOYEE DATA** | Number of compromised employee accounts | **COMPROMISED EMPLOYEE DATA**, **COMPROMISED EMPLOYEES** tab ([Investigate compromised employees](/guide/cti/compromised-employees/)) |
| **COMPROMISED CLIENT CREDENTIALS** | Number of compromised client credentials | [**COMPROMISED CLIENT CREDENTIALS**](/guide/cti/compromised-client-credentials/) |
| **COMPROMISED PAYMENT CREDENTIALS** | Number of compromised payment credentials; `-` when there are none | [**COMPROMISED PAYMENT CREDENTIALS**](/guide/cti/compromised-payment-credentials/) |
| **COMPROMISED EMPLOYEES RISK DISTRIBUTION** | Compromised employees per risk level: **LOW**, **MEDIUM**, **HIGH** and **CRITICAL** | None |
| **RECENTLY EXPOSED EMPLOYEES** | The e-mail addresses of the five most recently exposed employees | None |
| **TOP CREDENTIAL DOMAINS** | Domain names, each with its count | None |
| **EXPOSED CREDENTIALS STATUS STATS** | Pie chart of **ACTIVE** and **INACTIVE** exposed credentials | None |

**RECENTLY EXPOSED EMPLOYEES** shows real e-mail addresses of people in your organization. Keep that in mind
when you share your screen.

### BRP Section

![The BRP section of the Global Dashboard with the FRAUDULENT DOMAINS and SUSPICIOUS DOMAINS cards.](/img/guide/global-dashboard/index-05.png)

| Card | What it shows | Opens |
|---|---|---|
| **FRAUDULENT DOMAINS** | Lookalike domains marked as fraudulent | **FRAUDULENT DOMAINS** ([Track fraudulent domains](/guide/brp/fraudulent-domains/)) |
| **SUSPICIOUS DOMAINS** | Lookalike domains your rules found that are waiting for review | **FRAUDULENT DOMAINS** ([Review suspicious domains](/guide/brp/review-suspicious-domains/)) |

## States, Colours and Scores

**Security grade.** The radar and the EASM card use these grades. What each grade means is explained in
[How security scores work](/guide/easm/security-score/#grades).

| Score | Grade | Colour |
|---|---|---|
| 800 and above | A | green |
| 700 and above | B | light green |
| 600 and above | C | yellow |
| 500 and above | D | orange |
| 400 and above | E | red |
| 300 and above | F | dark red |
| below 300 or no score | `-` | grey |

**Change pills on the TOTAL cards.**

| Card | Increase | Decrease | No change |
|---|---|---|---|
| **TOTAL ASSETS**, **TOTAL TECHNOLOGIES** | blue | blue | grey |
| **TOTAL ISSUES**, **TOTAL VULNERABILITIES** | red | green | grey |

## Good to Know

- The page has no filters, date range or export. Trends always cover the last 30 days.
- The section cards, and the rows of **MOST CRITICAL VULNERABILITIES**, open in a new browser tab. The cards
  around the radar and the **GO TO** buttons open in the same tab.
- A top list with nothing in it shows `-`. A trend with no data, or with no change at all, shows as a flat
  grey line.

## Do This With the API

- Security score over time: [Security Score Timeline](/reference/easm/security-score-timeline/)
- Asset counts per type: [Asset Type Stats](/reference/easm/asset-type-stats/)
- Issue counts per severity: [Issue Severity Stats](/reference/easm/issue-severity-stats/)
- Vulnerability counts per severity: [Vulnerability Severity Stats](/reference/easm/vulnerability-severity-stats/)
- Exposed employee credentials: [Compromised Employee Credential Search](/reference/cti/compromised-employee-credential-search/)
- Compromised employee accounts: [Compromised Employee Account Search](/reference/cti/compromised-employee-account-search/)
- Compromised client credentials: [Compromised Client Credential Search](/reference/cti/compromised-client-credential-search/)
- Compromised payment credentials: [Compromised Payment Credential Search](/reference/cti/compromised-payment-credential-search/)
- Compromised employees per risk level: [Compromised Employee Account Risk Distribution Stats](/reference/cti/compromised-employee-account-risk-distribution-stats/)
- Compromised employee accounts per domain: [Compromised Employee Accounts Domain Stats](/reference/cti/compromised-employee-accounts-domain-stats/)
- Fraudulent and suspicious domain counts: [Suspicious Domain State Stats](/reference/brp/suspicious-domain-state-stats/)


---

# External Attack Surface Management (EASM)

URL: https://docs.deepinfo.com/guide/easm/

External Attack Surface Management (EASM) keeps an inventory of your internet-facing assets, suggests related assets through discovery, and reports the issues, vulnerabilities and technologies found on them.

EASM keeps an inventory of your internet-facing assets and reports what it finds on them: issues,
vulnerabilities (CVEs) and the technologies they run. Discovery finds candidate assets related to yours, and a
security score grades your organization, each asset and each issue type from A to F.

## Before You Start

- **Package:** EASM. Without it, EASM pages are replaced by a notice that the package is not included, with a
  **TALK TO US** button that opens an e-mail to support@deepinfo.com.
- **Role:** Admin or Member.
- **Data:** at least one asset. While your inventory is empty, every EASM page sends you to
  [Add assets](/guide/easm/add-assets/).

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **EASM DASHBOARD** · [https://platform.deepinfo.com/app/easm/dashboard](https://platform.deepinfo.com/app/easm/dashboard)

EASM is the blue **EXTERNAL ATTACK SURFACE MANAGEMENT** group in the sidebar (**EASM** when the sidebar is
collapsed). Most items open a page with in-page tabs under the title:

| Sidebar item | In-page tabs | Guide page |
|---|---|---|
| **EASM DASHBOARD** | None | [EASM dashboard](/guide/easm/dashboard/) |
| **ASSETS** › **INVENTORY** | **OVERVIEW** · **ASSETS LIST** · **INSIGHTS** | [Browse your asset inventory](/guide/easm/asset-inventory/), [Asset insights](/guide/easm/asset-insights/) |
| **ASSETS** › **DISCOVERY** | **OVERVIEW** · **DISCOVERED ASSETS** · **SETTINGS** | [Review discovered assets](/guide/easm/discovery/), [Tune smart discovery](/guide/easm/discovery-settings/) |
| **ISSUES** | **OVERVIEW** · **ISSUE LIST** · **INSIGHTS** | [Triage issues](/guide/easm/issues/), [Issue insights](/guide/easm/issue-insights/) |
| **TECHNOLOGIES** | **OVERVIEW** · **TECHNOLOGIES LIST** · **INSIGHTS** | [Review detected technologies](/guide/easm/technologies/), [Technology insights](/guide/easm/technology-insights/) |
| **VULNERABILITIES** | **OVERVIEW** · **VULNERABILITIES LIST** · **INSIGHTS** | [Prioritize vulnerabilities](/guide/easm/vulnerabilities/), [Vulnerability insights](/guide/easm/vulnerability-insights/) |

**ASSETS** expands in place when you select it. The **OVERVIEW** tabs hold the summary cards of each area;
the list tabs hold the records. The header breadcrumb starts with **EASM**, for example
**EASM / ISSUES / ISSUE LIST**.

The **+** button in the header also has **ADD ASSETS / MANUALLY** and **ADD ASSETS / UPLOAD FILE**.

![The EXTERNAL ATTACK SURFACE MANAGEMENT group in the sidebar with ASSETS expanded, next to the Inventory page with its in-page tabs.](/img/guide/easm/index-01.png)

## Concepts

### Assets

An asset is one item EASM monitors. It is one of these types:

| Type | Tab label | Example |
|---|---|---|
| Domain | **DOMAINS** | `acme.example` |
| Subdomain | **SUBDOMAINS** | `www.acme.example` |
| IP address | **IP ADDRESSES** | `192.0.2.10` |
| Website | **WEBSITES** | `www.acme.example:8443` |

A website's name includes its port (`host:port`). All your assets together form your **inventory**. Some
messages and dialogs say "portfolio"; it means the same thing, your own monitored assets.

Asset names can carry badges: **MAIN ASSET**, **SEEMS INACTIVE**, and icons for a login page, an
internationalized name (**IDN**), a parked domain or a redirect. You can also tag assets.
[Browse your asset inventory](/guide/easm/asset-inventory/) explains each one.

### Discovery

Discovery rules look for assets related to the ones you already have. Each candidate starts in review. You
approve it into your inventory or ignore it. See [Review discovered assets](/guide/easm/discovery/).

### Issues and Issue Types

An **issue type** is a kind of finding, for example an expired SSL certificate. An **issue** is one issue type
found on one asset. The **ISSUE LIST** shows issue types by default, with the number of affected assets, and
can switch to one row per issue. Issue types belong to **categories** and have one of these severities:
**CRITICAL**, **HIGH**, **MEDIUM**, **LOW** and **INFORMATION**.

### Vulnerabilities

A vulnerability is a CVE that affects at least one of your assets. The **VULNERABILITIES LIST** shows one row
per CVE. States are kept per asset: each CVE on each asset has its own state, and you change it there.

### States

Every issue, and every vulnerability on an asset, has a state. The platform sets **NEWLY DETECTED**,
**UNRESOLVED**, **REAPPEARED**, **NOT APPLICABLE** and **VERIFIED RESOLVED**. You can set **IGNORED**,
**RISK ACCEPTED**, **MARKED AS RESOLVED** and **MARKED AS FALSE POSITIVE**, and revert them. See
[Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).

### Technologies

EASM detects the software, frameworks and services your assets run, with their versions and known CVEs.
They are listed under **TECHNOLOGIES**; see [Review detected technologies](/guide/easm/technologies/).

### Security Score

Your organization, each asset and each issue type get a score and an A to F grade. See
[How security scores work](/guide/easm/security-score/).

## Pages in This Section

Start here:

1. [EASM dashboard](/guide/easm/dashboard/): the one-page summary.
2. [How security scores work](/guide/easm/security-score/): grades, bands and asset weight.
3. [Add assets](/guide/easm/add-assets/): type them or upload a file.
4. [Browse your asset inventory](/guide/easm/asset-inventory/): the **ASSETS LIST** and its **OVERVIEW** tab.
5. [Investigate an asset](/guide/easm/asset-details/): the asset drawer and detail page.
6. [Review discovered assets](/guide/easm/discovery/): approve or ignore candidates.
7. [Triage issues](/guide/easm/issues/): the **ISSUE LIST** and its **OVERVIEW** tab.
8. [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).
9. [Prioritize vulnerabilities](/guide/easm/vulnerabilities/): the **VULNERABILITIES LIST** and its
   **OVERVIEW** tab.

Then, as you need them:

- Assets: [Tag, weight and configure assets](/guide/easm/asset-settings/),
  [Remove and restore assets](/guide/easm/remove-and-restore-assets/),
  [Asset insights](/guide/easm/asset-insights/).
- Discovery: [Tune smart discovery](/guide/easm/discovery-settings/),
  [Create custom discovery rules](/guide/easm/custom-discovery-rules/).
- Issues: [Issue type details](/guide/easm/issue-types/), [Issue insights](/guide/easm/issue-insights/).
- Vulnerabilities: [Vulnerability details](/guide/easm/vulnerability-details/),
  [Vulnerability insights](/guide/easm/vulnerability-insights/).
- Technologies: [Review detected technologies](/guide/easm/technologies/),
  [Technology details](/guide/easm/technology-details/),
  [Technology insights](/guide/easm/technology-insights/).

## Do This With the API

- Your assets and their risk signals: [Asset Search](/reference/easm/asset-search/)


---

# EASM Dashboard

URL: https://docs.deepinfo.com/guide/easm/dashboard/

Read the one-page summary of your attack surface, from the security score dial and totals with trends to the top assets, issues, technologies and vulnerabilities.

The External Attack Surface Management (EASM) dashboard summarizes your attack surface on one page. Use it to spot what needs attention, then
open the full list from the section it belongs to.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.
- **Data:** at least one asset. With an empty inventory, the platform opens [Add assets](/guide/easm/add-assets/)
  instead.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **EASM DASHBOARD** · [https://platform.deepinfo.com/app/easm/dashboard](https://platform.deepinfo.com/app/easm/dashboard)

From the [Global dashboard](/guide/global-dashboard/), the **EASM** card and **GO TO EASM DASHBOARD** open it
too. The page title reads **External Attack Surface Management Dashboard**.

## Read the Screen

![The top of the EASM dashboard with the security score dial and the four total cards with their change chips.](/img/guide/easm/dashboard-01.png)

The page has a summary at the top and four sections below it, in this order.

1. **Score dial and totals.** The dial shows your organization's security grade and score. Next to it are
   four cards: **TOTAL ASSETS**, **TOTAL ISSUES** (active issues only), **TOTAL TECHNOLOGIES** and
   **TOTAL VULNERABILITIES**. Each shows the total, a change chip, a trend line and **LAST 30 DAYS**. Select a
   card to jump to its section.
2. **ASSETS**, with the **GO TO ASSETS PAGE** button.
3. **ISSUES**, with the **GO TO ISSUES PAGE** button.
4. **TECHNOLOGIES**, with the **GO TO TECHNOLOGIES PAGE** button.
5. **VULNERABILITIES**, with the **GO TO VULNERABILITIES PAGE** button.

The change chip shows how much the value changed over the last 30 days, for example `+12`, `-3` or `0`. After a
sharp drop, the decrease can be larger than the current total.

Rows in the top lists open the matching detail page in a new browser tab. In the asset tables, the link icon
next to a name opens the live site in a new tab. The **GO TO …** buttons open their page in the same tab.

### ASSETS

![The ASSETS section of the EASM dashboard with its summary cards and the recently added and most risky asset tables.](/img/guide/easm/dashboard-02.png)

| Card | What it shows |
|---|---|
| **TOTAL ASSETS** | Number of assets |
| **ASSET TYPES** | **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES**, with the count of each |
| **TOP ASNs** | Your subdomains grouped by network (ASN) |
| **TOP REGISTRARS** | Your domains grouped by WHOIS registrar |
| **RECENTLY ADDED ASSETS** | The newest assets: **ASSET NAME** and **ADDED DATE** |
| **MOST RISKY ASSETS** | The assets with the lowest security score: **ASSET NAME** and **SECURITY RATING** |

**GO TO ASSETS PAGE** opens [Inventory](/guide/easm/asset-inventory/). A row opens that asset's detail page,
described in [Investigate an asset](/guide/easm/asset-details/).

### ISSUES

![The ISSUES section of the EASM dashboard with severity, category and status cards and the top issue tables.](/img/guide/easm/dashboard-03.png)

| Card | What it shows |
|---|---|
| **TOTAL ISSUES** | Number of issues |
| **SEVERITY** | Issues per severity, from **CRITICAL** to **INFORMATION** |
| **CATEGORY** | Issues per category |
| **STATUS** | **ACTIVE** and **INACTIVE** issues |
| **MOST CRITICAL ISSUES** | Issue types ranked by severity and then by the number of affected assets: **ISSUE** and **ASSET COUNT** |
| **MOST SEEN ISSUES** | The issue types that affect the most assets: **ISSUE** and **ASSET COUNT** |

**GO TO ISSUES PAGE** opens the [Issue List](/guide/easm/issues/). A row opens that
[issue type's page](/guide/easm/issue-types/).

### TECHNOLOGIES

![The TECHNOLOGIES section of the EASM dashboard with category and vulnerability cards and the top technology tables.](/img/guide/easm/dashboard-04.png)

| Card | What it shows |
|---|---|
| **TOTAL TECHNOLOGIES** | Number of detected technologies |
| **CATEGORY** | The largest technology categories |
| **VULNERABILITY STATS** | The technologies' vulnerabilities per severity |
| **MOST USED TECHNOLOGIES** | **TECHNOLOGY** and the number of **ASSETS** that run it |
| **MOST VULNERABLE TECHNOLOGIES** | **TECHNOLOGY** and its number of **VULNERABILITIES** |

**GO TO TECHNOLOGIES PAGE** opens the [technology list](/guide/easm/technologies/). A row opens that
technology's page.

### VULNERABILITIES

![The VULNERABILITIES section of the EASM dashboard with severity and exploitability cards and the top CVE tables.](/img/guide/easm/dashboard-05.png)

| Card | What it shows |
|---|---|
| **TOTAL VULNERABILITIES** | Number of vulnerabilities |
| **SEVERITY** | Vulnerabilities per severity |
| **AVERAGE EXPLOITABILITY SCORE** | A percentage, coloured by band (see below) |
| **KNOWN EXPLOITABLE VULNERABILITIES** | In red: the number of assets affected by known-exploitable vulnerabilities |
| **MOST CRITICAL VULNERABILITIES** | CVEs ranked by CVSS base score: **CVE ID** and **SCORE/SEVERITY**, with the CWE and, for a CVE in the CISA KEV catalogue, an **EXPLOITABLE** tag |
| **MOST SEEN VULNERABILITIES** | CVEs that affect the most assets: **CVE ID** and **ASSETS** |

**GO TO VULNERABILITIES PAGE** opens the [Vulnerability List](/guide/easm/vulnerabilities/). A row opens that
[CVE's page](/guide/easm/vulnerability-details/).

## States, Colours and Scores

The dial uses the A to F grades explained in [How security scores work](/guide/easm/security-score/).

**AVERAGE EXPLOITABILITY SCORE** is coloured by band:

| Value | Colour |
|---|---|
| 1–25% | light yellow |
| 25–50% | dark yellow |
| 50–75% | orange |
| 75–99% | red |
| 99–100% | dark red |

## Good to Know

- The dashboard has no filters, date range or export. All charts use daily data.
- The **TOTAL ISSUES** card at the top counts active issues only. Inactive issues, including the ones you
  ignored, accepted as a risk, or marked as resolved or as a false positive, are not in it.
- **KNOWN EXPLOITABLE VULNERABILITIES** counts affected assets, not CVEs.
- The **OVERVIEW** tabs of Inventory, Issues, Technologies and Vulnerabilities show similar summary cards for
  their own area.

## Do This With the API

- Security score over time: [Security Score Timeline](/reference/easm/security-score-timeline/)
- Asset counts per type over time: [Asset Type Stats Timeline](/reference/easm/asset-type-stats-timeline/)
- Issue types with affected-asset counts: [Issue Type Stats](/reference/easm/issue-type-stats/)
- Technology categories: [Technology Category Stats](/reference/easm/technology-category-stats/)
- Known-exploitable vulnerabilities: [Vulnerability Known Exploitable Stats](/reference/easm/vulnerability-known-exploitable-stats/)
- Average exploitability: [Vulnerability Exploitability Score Stats](/reference/easm/vulnerability-exploitability-score-stats/)


---

# How Security Scores Work

URL: https://docs.deepinfo.com/guide/easm/security-score/

What the A to F security grades mean, how asset weight feeds your organization's score, and where you see organization, asset, domain and issue-type scores.

External Attack Surface Management (EASM) gives a security score and an A to F grade to your organization, to each asset and to each issue type. A
higher score is better. This page explains the grades, how asset weight affects your organization's score, and
where each score appears.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.

## Where You See Scores

A score appears as a grade letter with the number next to it.

| Score | Where |
|---|---|
| Your organization | The radar on the [Global dashboard](/guide/global-dashboard/) and the dial on the [EASM dashboard](/guide/easm/dashboard/) |
| One asset | The **SECURITY RATING** column on the **ASSETS LIST** tab of Inventory, the **INSIGHTS** block in the asset drawer, and the **SCORE** widget on the asset's **OVERVIEW** tab (see [Investigate an asset](/guide/easm/asset-details/)) |
| One domain with its subdomains | The **SCORE** widget of a domain, with **Include the impact of subdomains** turned on |
| One issue type | **SCORE** on the issue type page (see [Issue type details](/guide/easm/issue-types/)) |

The **SCORE** widgets on the asset and issue type pages include a **TIMELINE** chart. Choose **DAILY**,
**WEEKLY** or **MONTHLY** in its drop-down to change the interval.

Inventory also has an **INCLUDE SUBDOMAIN SCORES** checkbox above the list. It is not shown on the
**SUBDOMAINS** and **IP ADDRESSES** tabs.

## Grades

| Score | Grade | Colour |
|---|---|---|
| 800 and above | A | green |
| 700 and above | B | light green |
| 600 and above | C | yellow |
| 500 and above | D | orange |
| 400 and above | E | red |
| 300 and above | F | dark red |
| below 300 or no score | `-` (no grade) | grey |

Asset and issue-type scores use the same bands. An inactive asset has no score and shows `-`.

## A Grade Is Not the Whole Story

A grade sums up an asset, but it does not list what is wrong. An asset with a good grade can still have
active high or critical issues. Before you move on from an asset, check its **ISSUES** column in Inventory,
or the **ISSUES** block in its drawer, for red and orange severities.

![An Inventory row with a good security rating next to an ISSUES cell whose tooltip shows a high-severity issue.](/img/guide/easm/security-score-01.png)

## Asset Weight

Asset weight tells EASM how important an asset is to your organization. A higher weight marks a more critical
asset, and the weight affects your organization's overall security score.

- **SYSTEM WEIGHT** is calculated automatically from hundreds of criteria. It is not limited to 100, so you
  may see higher values.
- **USER WEIGHT** is a value from 1 to 100 that you enter to override it.

The weight shown on an asset is the user weight if one is set, otherwise the system weight. You find it as
**ASSET WEIGHT** in the asset drawer and on the asset's **OVERVIEW** tab, and as the **ASSET WEIGHT** column
in Inventory.

### Change an Asset's Weight

1. Open the asset's **…** menu: in the Inventory row, in the asset drawer header or on the asset detail page.
2. Under **ASSET SETTINGS**, select **SET ASSET WEIGHT**. The popup shows the **SYSTEM WEIGHT** with its
   **LAST UPDATE:** date, and your **USER WEIGHT** if you have set one.
3. In **NEW WEIGHT**, enter a value from 1 to 100. To remove your override and go back to the system weight,
   leave the field empty.
4. Select **SAVE**. A message confirms that the asset weight has been updated. To close without a change,
   select **CANCEL**.

![The SET ASSET WEIGHT dialog with the system weight, its last update and the NEW WEIGHT field.](/img/guide/easm/asset-settings-03.png)

## Domain-Level Score

For a domain that has subdomains, the **SCORE** widget on its **OVERVIEW** tab has the switch
**Include the impact of subdomains**. Next to it, the widget says how many subdomains the domain has and how
many extra issues, technologies and open ports they bring. Turn the switch on to show the domain-level score,
which includes that impact.

![The SCORE widget of a domain with the Include the impact of subdomains switch, the grade and the TIMELINE drop-down.](/img/guide/easm/security-score-03.png)

## Issue-Type Scores

Each issue type also has a score and a grade. The issue type page shows it under **SCORE**, with its
**TIMELINE**.

## Good to Know

> [!NOTE]
> Other scores in the platform use different scales. Do not compare them with the security score:
> the Brand Risk Protection (BRP) risk score runs from 0 to 100, a CVSS score from 0 to 10, and EPSS and the average exploitability
> score are percentages.

## Do This With the API

- Organization score over time: [Security Score Timeline](/reference/easm/security-score-timeline/)
- One asset's score over time: [Asset Security Score Timeline](/reference/easm/asset-security-score-timeline/)
- A domain with its subdomains: [Domain Security Score Timeline](/reference/easm/domain-security-score-timeline/)
- One issue type's score over time: [Issue Type Security Score Timeline](/reference/easm/issue-type-security-score-timeline/)
- Change asset weights: [Asset Set Weight](/reference/easm/asset-set-weight/)


---

# Add Assets

URL: https://docs.deepinfo.com/guide/easm/add-assets/

Add domains, subdomains, IP addresses and websites to your inventory by typing them or uploading a file, then read the result.

Add the assets you want External Attack Surface Management (EASM) to monitor. You can type or paste them, or upload a file and let the platform
pick out the domains and IP addresses in it.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.
- If your inventory is empty, every EASM page opens the method chooser until you add your first asset.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY** · **Tab:** **ASSETS LIST** · [https://platform.deepinfo.com/app/easm/assets/add](https://platform.deepinfo.com/app/easm/assets/add)

On the **ASSETS LIST** tab, select **ADD NEW ASSET**. The **+** button in the header goes straight to a method:
**ADD ASSETS / MANUALLY**
([https://platform.deepinfo.com/app/easm/assets/add-manual](https://platform.deepinfo.com/app/easm/assets/add-manual))
or **ADD ASSETS / UPLOAD FILE**
([https://platform.deepinfo.com/app/easm/assets/add-upload](https://platform.deepinfo.com/app/easm/assets/add-upload)).

![The add-assets method chooser with the Add Your Assets Manually and Upload Your Assets List cards, under the ADD NEW ASSETS breadcrumb.](/img/guide/easm/add-assets-01.png)

The method chooser keeps the page title **Inventory**; the breadcrumb reads **EASM / ASSETS / ADD NEW ASSETS**.
It has two cards:

- **Add Your Assets Manually**, with the button **ADD YOUR ASSETS**.
- **Upload Your Assets List**, with the button **UPLOAD YOUR FILE**.

## Type or Paste Assets

1. Open **ADD ASSETS / MANUALLY** from the **+** button, or select **ADD YOUR ASSETS** on the method chooser.
   The form is headed **ADD NEW ASSET / MANUALLY**.
2. In **YOUR ASSETS**, enter your domains, subdomains, IP addresses or websites. Put each one on its own line,
   or separate them with commas:

   ```text
   acme.example
   www.acme.example
   192.0.2.10
   ```

   Extra spaces and duplicates are removed for you.
3. Select **ADD**.
4. The **Congratulations** popup opens (see [Read the result](#read-the-result)). If the request itself fails,
   the error appears on the form instead.

![The ADD NEW ASSET / MANUALLY form with two domain names and an IP address, one per line, in the YOUR ASSETS field and the ADD button.](/img/guide/easm/add-assets-02.png)

## Upload a File

1. Open **ADD ASSETS / UPLOAD FILE** from the **+** button, or select **UPLOAD YOUR FILE** on the method
   chooser. The form is headed **ADD NEW ASSET / UPLOAD**.
2. Drop one file on the **UPLOAD YOUR FILE** area, or browse for it. The file picker accepts `.txt`, `.csv`,
   `.json`, `.docx` and `.xlsx` files, and the upload area asks for files of 1 MB at most.
3. Select **UPLOAD**. The platform then lists the assets it found, with the line **N Assets Identified** and
   the file name.
4. Review the table. Each row shows the **Asset Name** and its **Asset Type** (Domain or IP Address). To leave
   an asset out, select the trash icon on its row.
5. Select **ADD ALL ASSETS**. To start over with another file, select **CANCEL**.
6. The **Congratulations** popup opens (see [Read the result](#read-the-result)).

## Read the Result

The **Congratulations** popup tells you what happened to every entry. It can show these groups:

| Group | Meaning |
|---|---|
| **Added** | New assets now in your inventory, counted per type |
| **Already existed** | Assets that were already in your inventory. They were not added again |
| **Couldn't be added** | Entries that could not be added because of errors, such as invalid values |

Select **GO TO ASSETS PAGE** to open [Inventory](/guide/easm/asset-inventory/). The popup says "portfolio":
it means your inventory.

## Good to Know

- Entries already in your inventory are skipped, so you can safely paste a list that overlaps with it.
- In an uploaded file, the review table labels each asset as a Domain or an IP Address.

## Do This With the API

- Add assets: [Asset Create](/reference/easm/asset-create/)


---

# Browse Your Asset Inventory

URL: https://docs.deepinfo.com/guide/easm/asset-inventory/

Use Inventory to see every monitored asset with its risk signals, and to filter, sort, tag, export, rescan and remove assets.

Inventory lists every asset External Attack Surface Management (EASM) monitors, with the signals you need to decide where to look first: security
rating, active issues, vulnerabilities, open ports, certificate and domain expiry, HTTP status and your tags.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.
- **Data:** at least one asset. See [Add assets](/guide/easm/add-assets/).

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY** · **Tab:** **ASSETS LIST** · [https://platform.deepinfo.com/app/easm/assets](https://platform.deepinfo.com/app/easm/assets)

The [EASM dashboard](/guide/easm/dashboard/)'s **GO TO ASSETS PAGE** opens it too. Inventory has three
in-page tabs:

| Tab | What it holds | Deep link |
|---|---|---|
| **OVERVIEW** | Summary cards for your inventory (see [The OVERVIEW tab](#the-overview-tab)) | [/app/easm/assets/overview](https://platform.deepinfo.com/app/easm/assets/overview) |
| **ASSETS LIST** | The list of assets, described on this page | [/app/easm/assets](https://platform.deepinfo.com/app/easm/assets) |
| **INSIGHTS** | How your assets are spread across registrars, DNS, hosting, certificates and HTTP status; see [Asset insights](/guide/easm/asset-insights/) | [/app/easm/assets/insights](https://platform.deepinfo.com/app/easm/assets/insights) |

## Read the Screen

![The top of the ASSETS LIST tab on ALL ASSETS with the title, in-page tabs, filter bar, result row, type tabs and list, numbered 1 to 6.](/img/guide/easm/asset-inventory-01.png)

The header breadcrumb reads **EASM / ASSETS / INVENTORY**.

1. **Title and menu.** The title **Inventory** has a **⋮** menu with **DELETED ASSETS**, the list of assets
   you removed.
2. **In-page tabs:** **OVERVIEW**, **ASSETS LIST** and **INSIGHTS**.
3. **Filter bar:** the **SEARCH** box, one drop-down chip per filter category (**ASSET META**, **WHOIS**,
   **DNS**, **SSL**, **HTTP**, **WEBDATA**, **IP WHOIS**, **OTHER**) and two icons that switch between quick
   view and list view. On a narrow screen, some chips fold behind **SHOW ALL FILTERS**.
4. **Result row:** the number of assets found (**N ASSETS FOUND**), the **INCLUDE SUBDOMAIN SCORES** checkbox,
   **ADD NEW ASSET**, **EXPORT** and **VIEW SETTINGS**.
5. **Type tabs** with counts: **ALL ASSETS**, **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES**.
6. **The list**, 25 rows per page by default. Select a row to open the asset drawer (see
   [Investigate an asset](/guide/easm/asset-details/)).

### Columns

Each tab shows the columns that fit its asset type.

| Column | What it shows | Tabs |
|---|---|---|
| **DOMAIN NAME**, **SUBDOMAIN**, **IP ADDRESS**, **WEBSITE NAME** | The asset, with its badges and a screenshot thumbnail (or **NO SCREENSHOT**) | one per tab |
| **SECURITY RATING** | The asset's security grade and score (see [How security scores work](/guide/easm/security-score/)) | all |
| **ASSET WEIGHT** | How important the asset is, as a number and a bar (see [asset weight](/guide/easm/security-score/#asset-weight)) | all |
| **ISSUES** | Active issues as coloured severity dots; hover for the count per severity | all |
| **SUBDOMAINS** | Number of subdomains | **ALL ASSETS**, **DOMAINS** |
| **TECHNOLOGIES** | Icons of the technology categories found | all |
| **OPEN PORTS** | Number of open ports | all |
| **VULNERABILITIES** | Vulnerabilities, in total and per severity | all |
| **IP ADDRESSES** | Up to two addresses; hover for the rest | all except **IP ADDRESSES** |
| **LAST CHECK DATE** | When the asset was last checked | all |
| **DOMAIN EXPIRE ON** | WHOIS expiry date and status chip | **ALL ASSETS**, **DOMAINS**, **WEBSITES** |
| **SSL CERTIFICATE** | Certificate expiry date and status chip | all |
| **HTTP STATUS** | The status code, coloured by class | all |
| **TAGS** | The tags you gave the asset | **ALL ASSETS**, **DOMAINS**, **SUBDOMAINS** |
| **…** | The asset's actions menu | all |

The **ALL ASSETS** tab lists every type and uses the column set of the **DOMAINS** tab. For subdomains and
websites, **SUBDOMAINS** and **DOMAIN EXPIRE ON** show `-` there.

### Badges on Asset Names

| Badge or icon | Meaning |
|---|---|
| **MAIN ASSET** (star) | The asset is set as your main asset. A subdomain can be a main asset too |
| **SEEMS INACTIVE** | No active DNS records or WHOIS information were found for the asset |
| Login page icon | The asset has a login page |
| **IDN** | The name is internationalized; the tooltip shows its punycode form |
| **P** (parked) | The domain is parked; the tooltip shows where it redirects |
| Redirect icon | The asset redirects to another name, shown in the tooltip |

Hover over the screenshot thumbnail for two seconds to see a larger preview. Parked assets are shown in grey,
but their risk columns keep full colour.

## Find Assets

1. To search by name, type in **SEARCH** and press Enter. This adds the condition
   **Asset · Must · Contains Any** with your text.
2. For anything else, open a category chip, for example **ASSET META**. Under **Select field**, pick a field.
   **ASSET META** has fields such as **Asset**, **Asset Type**, **Tags**, **Creation Method**, **Added Date**,
   **Is Main Asset** and **Seems Inactive**; **OTHER** has fields such as **Security Score** and
   **Open Port Count**.
3. Set the condition:
   - the rule: **Must** (include), **Must Not** (exclude) or **Should** (prefer);
   - the operator. Text fields offer **Equal**, **Wildcard**, **Fuzzy**, **Contains Any**, **Start With** and
     **Exists**. Number fields use **Between**, with a **MINIMUM** and a **MAXIMUM**;
   - the **Value**.
4. To add another condition in the same category, select **Add New**. **Clear All** removes the conditions
   in the popover.
5. Select **APPLY**, or **CANCEL** to close without a change.

A chip with active conditions shows their number, for example **ASSET META 1**. Filters and the search are
cleared when you reload the page.

The same rules work in the API; see [Search & filters](/getting-started/search-and-filters/).

![The ASSET META filter chip open with one Must condition and a count badge on the chip.](/img/guide/easm/asset-inventory-02.png)

## Change the View

- **Quick view** shows a list of assets on the left, with its own **SEARCH** box and a sort icon, and the
  selected asset's full detail on the right, with **OPEN IN NEW TAB**, **SCAN NOW** and **CREATE A REPORT**.
- **VIEW SETTINGS** opens **View Options**:
  - **Sort By** (**Default** until you choose): pick a field and a direction in the two **Select** boxes, then
    **APPLY**. **CLEAR** removes your choice.
  - **Result Per Page**: 25, 50, 75 or 100.
  - **Show Only Tagged Assets**.
  - **Reset to Default View**.
  - **SHOWN**: a switch per column to show or hide it.

The selected type tab is part of the page address, so you can bookmark or share it.

## Tag Assets

Tags let you group assets your own way, for example by owner or environment.

1. Open the asset's **…** menu and, under **ASSET SETTINGS**, select **ADD NEW TAG**. You can also select
   **ADD TAG** in the **TAGS** block of the asset drawer or of the asset's **OVERVIEW** tab.
2. In **ADD NEW TAG**, type a tag name of 3 to 100 characters in **Add New**.
3. For a domain, tick **Apply to current subdomains of this domain** to tag its current subdomains too.
4. Press Enter to add the tag.

To rename a tag, remove it from an asset or delete it everywhere, see
[Tag, weight and configure assets](/guide/easm/asset-settings/).

Tags appear in the **TAGS** column. To list only tagged assets, tick **Show Only Tagged Assets** in
**View Options**; to filter by a tag, use **ASSET META** › **Tags**.

![The ADD NEW TAG dialog with the Add New field and the Apply to current subdomains of this domain option.](/img/guide/easm/asset-settings-02.png)

## Export the List

1. Select **EXPORT**. The **DOWNLOAD** dialog opens.
2. Under **RECORDS**, choose **ALL** to export without your filters, or **FILTERED** for the assets that match
   your filters. **FILTERED** is offered when filters are applied.
3. Under **FILE FORMAT**, choose **CSV** or **JSON**. **JSON** is selected by default.
4. Under **EXPORT SCOPE**, choose **DEFAULT**, **BASIC** or **EXTENDED**. The dialog does not describe what
   each scope contains.
5. Select **DOWNLOAD**, or **CANCEL** to close without a file.

![The DOWNLOAD dialog with the RECORDS, FILE FORMAT and EXPORT SCOPE options.](/img/guide/easm/asset-inventory-04.png)

## Rescan Assets

1. Tick the assets you want to rescan. The checkbox menu has **SELECT THIS PAGE** and **CLEAR SELECTION**;
   selection works on the current page only.
2. Select **SCAN NOW** in the selection bar. The scans start right away, without a confirmation.
3. A progress bar shows while the scans start. The list refreshes when they are under way.

To rescan one asset, select **SCAN NOW** in its **…** menu.

## Remove Assets

1. Tick the assets, then select **DELETE** in the selection bar. For one asset, open its **…** menu and
   select **REMOVE THIS ASSET** (**REMOVE FROM INVENTORY** for an inactive asset).
2. The **Remove** confirmation names what you are about to remove. Select **REMOVE**, or **CANCEL** to keep
   the assets.
3. After a few seconds a message confirms the removal and the list refreshes.

Removed assets move to **Deleted Assets** (the **⋮** menu next to the **Inventory** title). From there you
can add them back with **RE-ADD AS ASSET**. A removed asset can also be found again by discovery and show up
for review in [Discovery](/guide/easm/discovery/). See [Remove and restore assets](/guide/easm/remove-and-restore-assets/).

## The OVERVIEW Tab

![The Inventory OVERVIEW tab with its summary cards and the recently added and most risky asset tables.](/img/guide/easm/asset-inventory-05.png)

The **OVERVIEW** tab (breadcrumb **EASM / ASSETS / OVERVIEW**) summarizes your inventory:

| Card | What it shows |
|---|---|
| **TOTAL ASSETS** | Number of assets, with a change chip and **LAST 30 DAYS** |
| **ASSET TYPES** | Assets per type |
| **LAST 3 ASSETS** | The three most recently added assets. Each link opens the asset in a new tab |
| **TOP ASNs** | Your subdomains grouped by network (ASN) |
| **TOP REGISTRARS** | Your domains grouped by WHOIS registrar |
| **RECENTLY ADDED ASSETS** | **ASSET NAME** and **ADDED DATE** |
| **MOST RISKY ASSETS** | The assets with the lowest security score: **DOMAIN NAME** and **SECURITY RATING** |

## States, Colours and Scores

**SSL CERTIFICATE** and **DOMAIN EXPIRE ON** chips:

| Chip | Meaning |
|---|---|
| **ACTIVE** | Expires more than a month from now |
| **EXPIRES SOON** | Expires within the next month |
| **EXPIRED** | The date is in the past; the date also turns red |
| **INVALID CERTIFICATE** | The SSL certificate has no valid expiry date |

A domain expiry without a valid date shows `-`.

**HTTP STATUS** is green for 2xx codes, orange for 3xx and red for 4xx and 5xx. The status description, for
example **OK**, appears next to the code.

## When a Tab Is Empty

A tab with no assets says there is no asset of that type in your portfolio ("portfolio" means your
inventory), with a button to add some, for example **ADD IP ADDRESSES**. If discovery has found subdomains
that are waiting for review, the **SUBDOMAINS** tab says so and offers **GO TO DISCOVERY**. See
[Review discovered assets](/guide/easm/discovery/).

## Good to Know

- The **…** menu on each row has the same actions as the asset drawer and detail page: **SCAN NOW** and
  **CREATE REPORT**; under **ASSET SETTINGS**, **SET AS MAIN ASSET** (or **REVERT TO NORMAL ASSET**),
  **SET ASSET WEIGHT**, **SET DISCOVERY SETTINGS** and **ADD NEW TAG**; under **OTHER ACTIONS**,
  **REMOVE THIS ASSET**.
- **CREATE REPORT** creates a new report as soon as it opens. See
  [Generate and download a PDF report](/guide/reports/generate-a-report/).
- Saved searches are not available.
- For the list controls every module shares, see
  [Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

## Do This With the API

- Search your assets: [Asset Search](/reference/easm/asset-search/)
- Export them as CSV or JSON: [Asset Export](/reference/easm/asset-export/)
- Count them per type: [Asset Type Stats](/reference/easm/asset-type-stats/)
- Tag assets: [Asset Set Tag](/reference/easm/asset-set-tag/)
- Rescan an asset: [Asset Instant Scan](/reference/easm/asset-instant-scan/)
- Remove assets: [Asset Delete](/reference/easm/asset-delete/)


---

# Investigate an Asset

URL: https://docs.deepinfo.com/guide/easm/asset-details/

Open an asset's drawer or detail page to see its score, issues, related assets, technologies, open ports, vulnerabilities, and its WHOIS, DNS, SSL and website records with their history.

Everything External Attack Surface Management (EASM) knows about one asset is in two places: the **drawer** that opens from a list, and the full
**detail page**. Use the drawer for a quick look and the detail page to dig in, compare history or rescan.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.
- **Data:** the asset must be in your inventory.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY** · **Tab:** **ASSETS LIST** · [https://platform.deepinfo.com/app/easm/assets](https://platform.deepinfo.com/app/easm/assets)

- **Drawer:** select a row in [Inventory](/guide/easm/asset-inventory/). The same drawer also opens from the
  rows of the **SUBDOMAINS** and **WEBSITES** tabs on an asset's detail page.
- **Detail page:** select **OPEN IN NEW TAB** at the top of the drawer, or an asset under **LAST 3 ASSETS** on
  the Inventory **OVERVIEW** tab. The address is
  `https://platform.deepinfo.com/app/easm/assets/<asset ID>`. The open tab is part of the address, so a link
  can point straight at, for example, **OPEN PORTS**.

## Read the Drawer

![The asset drawer on its OVERVIEW tab, with OPEN IN NEW TAB, the actions menu and the icon tabs down the side.](/img/guide/easm/asset-details-01.png)

The top of the drawer shows **OPEN IN NEW TAB**, the asset name with its badges, a link icon that opens the
live site, and the **…** actions menu. The drawer's tabs are icons down the side; hover over an icon to see
its name.

| Tab | What it shows |
|---|---|
| **OVERVIEW** | **LAST CHECK DATE**; **IP ADDRESSES**, **HTTP STATUS**, **DOMAIN EXPIRE** (domains) and **SSL CERTIFICATE**; **ASSET WEIGHT**; **TAGS** with **ADD TAG**; **INSIGHTS**, the grade and score with counters for issues, subdomains, technologies, open ports and vulnerabilities; active **ISSUES** per severity |
| **ISSUES** | The asset's active issues, with **EXPORT**. Each card shows the severity, state, name and category. Select one to open it in a new tab |
| **SUBDOMAINS** | Only for domains: the domain's subdomains with their IP addresses and HTTP status, with **EXPORT** |
| **WEBSITES** | Websites on this host, with **EXPORT** (not shown for website assets) |
| **TECHNOLOGIES** | Detected technologies with their version and latest version, with **EXPORT** |
| **OPEN PORTS** | Open ports with **SERVICE NAME**, **PRODUCT NAME**, **STATE** and **PROTOCOL**; **START PORT SCAN** and a history button |
| **VULNERABILITIES** | The asset's active vulnerabilities, with **EXPORT** |
| **ASSET INFO** | The asset's **WHOIS**, **DNS**, **SSL** and **WEBSITE INFO** records |
| **SCREENSHOT** | The latest screenshot of the site, if there is one |

Select a counter under **INSIGHTS** to jump to its tab. An empty tab says **No Result Found.**

## Read the Detail Page

![The header of an asset's detail page with the breadcrumb, SCAN NOW, CREATE A REPORT, the actions menu and the tabs.](/img/guide/easm/asset-details-02.png)

The header breadcrumb reads **EASM / ASSETS / INVENTORY /** and the asset name. The page has no back button
of its own. It shows the asset name with its badges, **LAST CHECK DATE**, and the buttons **SCAN NOW**,
**CREATE A REPORT** and **…**. Below them are the tabs:

| Tab | What it shows |
|---|---|
| **OVERVIEW** | **INFO** (IP addresses, domain expiry, SSL certificate, HTTP status), **ASSET WEIGHT**, **INSIGHTS** counters, **TAGS** with **ADD TAG**, **SCORE** with its **TIMELINE**, and **FINDINGS** (issues per severity) |
| **ISSUES** | The asset's issues: **ISSUE**, **STATE**, **CATEGORY**, **ACTIVE DAYS**, **FIRST SEEN**, **LAST SEEN** |
| **SUBDOMAINS** | Subdomains of a domain, with their rating, weight, issues, ports and certificate |
| **WEBSITES** | Websites on this host, with their rating, weight, issues, ports and certificate |
| **TECHNOLOGIES** | **TECHNOLOGY**, **CATEGORY**, **VERSION**, **LATEST VERSION**, **VULNERABILITIES** |
| **OPEN PORTS** | **PORT NUMBER**, **SERVICE**, **PRODUCT**, **STATE**, **PROTOCOL**, with port-state filters |
| **VULNERABILITIES** | The asset's active CVEs: **CVE ID**, **SCORE/SEVERITY**, **CLASSIFICATION**, **EPSS**, **FIRST SEEN DATE**, **LAST SEEN DATE** |
| **ASSET INFO** | **WHOIS**, **DNS**, **SSL** and **WEBSITE INFO**, each with its history |
| **SCREENSHOT** | The latest screenshot, if there is one |

Which tabs appear depends on the asset type: a subdomain has no **SUBDOMAINS** tab, and a website has neither
**SUBDOMAINS** nor **WEBSITES**. Selecting a row in **SUBDOMAINS**, **WEBSITES** or **TECHNOLOGIES** opens that
item's drawer.

## Rescan an Asset

1. On the detail page, select **SCAN NOW**.
2. The button stays disabled for five minutes. Hover over it to see when the scan was triggered and whether it
   is still running.
3. While the scan is queued or running, the page reloads itself after 30 seconds.

**SCAN NOW** is also in the **…** menu, here, in the drawer and in Inventory. It starts the scan right away,
without a confirmation.

## Scan the Open Ports

1. Open the **OPEN PORTS** tab, on the detail page or in the drawer.
2. Select **START PORT SCAN**. The results appear as the scan runs.

On the detail page, use the filters **ALL**, **OPEN**, **OPEN FILTERED**, **CLOSED**, **CLOSED FILTERED**,
**FILTERED** and **UNFILTERED** to choose which ports to list. The list starts on **OPEN**. Select a port to see
its **SERVICE**, **PRODUCT**, **STATE** and **PROTOCOL**.

## Look at Earlier Records

EASM keeps snapshots of an asset's records. To see what changed:

1. On the detail page, open **ASSET INFO** (or **OPEN PORTS** for ports). In **ASSET INFO**, the links
   **WHOIS**, **DNS**, **SSL** and **INFO** on the left jump to each panel.
2. Select **SHOW HISTORICAL WHOIS RECORDS**, **SHOW HISTORICAL DNS RECORDS**,
   **SHOW HISTORICAL SSL RECORDS** or **SHOW HISTORICAL WEBSITE INFO RECORDS**. For ports, select the history
   button on the **OPEN PORTS** tab.
3. The date picker opens with **YEAR**, **MONTH** and **DAY**. To view one snapshot, pick its date and select
   **CONFIRM**.
4. To compare, tick **Compare Dates (Up to 3 Records)**, pick up to three dates and select **COMPARE**. The
   records open in a compare view.

![The DNS panel of ASSET INFO with the historical records date picker open.](/img/guide/easm/asset-details-03a.png)

![The compare view of ASSET INFO showing the DNS records of three dates side by side.](/img/guide/easm/asset-details-03b.png)

Which panels appear depends on the asset type:

- A subdomain has no **WHOIS** panel.
- A website asset has no WHOIS or DNS history: its **WHOIS** panel says that no WHOIS record was found.
- An IP address has no **DNS** panel, and its **WHOIS** history is its IP WHOIS history.

Comparing dates works on the detail page; use it rather than the drawer.

## Work With the Asset's Issues

On the detail page, the **ISSUES** tab lists active issues. To include inactive issues, tick
**SHOW INACTIVES**. Use **ALL**, **CRITICAL**, **HIGH**, **MEDIUM**, **LOW** and **INFORMATION** to filter by
severity. **EXPORT** and **VIEW SETTINGS** work as in other lists.

- Select an issue to open its drawer. A banner says you are viewing this issue only for this asset;
  **View for All Assets** opens the issue type across all your assets. The drawer's icon tabs are
  **ISSUE INFO** (category, active days, first and last seen, **DESCRIPTION** with external references,
  **REMEDY**) and **PROOF**, plus **VULNERABILITIES** for technology issues.
- **OPEN IN NEW TAB** opens the issue on its own page inside the asset. Its breadcrumb names the asset type,
  for example **EASM / ASSETS / DOMAINS /** asset **/ ISSUES /** issue. The page has the tabs **ISSUE INFO**,
  **PROOF** and **VULNERABILITIES**, and a **CHANGE STATE** action.
- Tick issues and select **CHANGE ALL STATUS** to change their state together.

See [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/) and
[Triage issues](/guide/easm/issues/).

## Inactive Assets

Some assets are marked as inactive, for example a domain with no active DNS records or WHOIS information:

- In lists, the name shows **SEEMS INACTIVE**.
- The detail page turns grey and shows a banner, for example **THIS DOMAIN IS CURRENTLY INACTIVE**, with
  **REMOVE FROM INVENTORY**.
- In the drawer, **ASSET WEIGHT** shows 0 and the score shows `-`.

If the asset is no longer relevant, select **REMOVE FROM INVENTORY** and confirm with **REMOVE**. You return
to Inventory.

## Good to Know

- **CREATE A REPORT** (and **CREATE REPORT** in the **…** menu) creates a new asset report as soon as the
  page opens, with an automatic name. See [Generate and download a PDF report](/guide/reports/generate-a-report/).
- The **…** menu also holds, under **ASSET SETTINGS**, **SET AS MAIN ASSET** (or **REVERT TO NORMAL ASSET**),
  **SET ASSET WEIGHT**, **SET DISCOVERY SETTINGS** and **ADD NEW TAG**, and under **OTHER ACTIONS**,
  **REMOVE THIS ASSET**. See [Tag, weight and configure assets](/guide/easm/asset-settings/) and
  [Remove and restore assets](/guide/easm/remove-and-restore-assets/). For how weight affects the score, see
  [How security scores work](/guide/easm/security-score/#asset-weight).
- You cannot export an asset's open ports, or its technologies from the detail page.
- If the detail page cannot load the asset, it returns you to Inventory.

## Do This With the API

- Get one asset: [Asset Detail](/reference/easm/asset-detail/)
- Rescan it: [Asset Instant Scan](/reference/easm/asset-instant-scan/) and
  [Asset Instant Scan Status](/reference/easm/asset-instant-scan-status/)
- Open ports: [Asset Open Port List](/reference/easm/asset-open-port-list/) and
  [Asset Instant Open Port Scan](/reference/easm/asset-instant-open-port-scan/)
- History: [WHOIS](/reference/easm/asset-whois-history-list/),
  [DNS](/reference/easm/asset-dns-history-list/),
  [SSL](/reference/easm/asset-ssl-history-list/),
  [website data](/reference/easm/asset-webdata-history-list/),
  [port scans](/reference/easm/asset-port-scan-history-list/) and
  [IP WHOIS](/reference/easm/asset-ip-whois-history-list/)


---

# Tag, Weight and Configure Assets

URL: https://docs.deepinfo.com/guide/easm/asset-settings/

Tag your assets, set how much an asset weighs in your security score, mark a main asset, and choose whether discovery starts from an asset.

Every asset has a few settings of its own: its tags, its weight, whether it is a main asset, and whether
discovery uses it to look for related assets. You change them from the asset's **…** menu.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.
- **Data:** at least one asset in your inventory.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY** · **Tab:** **ASSETS LIST** · [https://platform.deepinfo.com/app/easm/assets](https://platform.deepinfo.com/app/easm/assets)

Open the **…** menu at the end of an asset's row. The same menu is at the top of the asset drawer and on the
asset's own page (see [Investigate an asset](/guide/easm/asset-details/)).

## Read the Menu

![The actions menu of an asset row, open on the ASSETS LIST, with its ASSET SETTINGS and OTHER ACTIONS sections.](/img/guide/easm/asset-settings-01.png)

| Section | Item | What it does |
|---|---|---|
| | **SCAN NOW** | Starts a rescan of the asset at once, with no confirmation. See [Investigate an asset](/guide/easm/asset-details/) |
| | **CREATE REPORT** | Opens a report for this asset in a new tab. Opening it creates a new report. See [Generate and download a PDF report](/guide/reports/generate-a-report/) |
| **ASSET SETTINGS** | **SET AS MAIN ASSET** (or **REVERT TO NORMAL ASSET**) | Makes the asset a main asset, or turns it back into a normal one |
| | **SET ASSET WEIGHT** | Sets how important the asset is |
| | **SET DISCOVERY SETTINGS** | Turns discovery on or off for this asset |
| | **ADD NEW TAG** | Adds a tag to the asset |
| **OTHER ACTIONS** | **REMOVE THIS ASSET** (or **REMOVE FROM INVENTORY** for an inactive asset) | Removes the asset. See [Remove and restore assets](/guide/easm/remove-and-restore-assets/) |

## Tag Assets

Tags are your own labels, for example a business unit or an environment. Use them to find and filter assets.

1. Open the asset's **…** menu and select **ADD NEW TAG**. You can also select **ADD TAG** in the **TAGS** block,
   on the drawer's overview or on the asset page's **OVERVIEW** tab.
2. The **ADD NEW TAG** dialog opens. Type the tag in **Add New**. A tag has 3 to 100 characters.
3. To give the same tag to the subdomains the domain has now, tick **Apply to current subdomains of this domain**.
4. Press Enter to add the tag.

![The ADD NEW TAG dialog with the Add New field and the Apply to current subdomains of this domain option.](/img/guide/easm/asset-settings-02.png)

Once your assets have tags:

- Inventory shows them in the **TAGS** column (the **WEBSITES** tab has no **TAGS** column).
- To filter by tag, open **ASSET META** in the filter bar and pick **Tags**.
- To list only tagged assets, open **VIEW SETTINGS** and tick **Show Only Tagged Assets**.

### Rename, Remove or Delete a Tag

Select a tag in the **TAGS** block to open its menu:

- **Edit** renames the tag. A tag is shared, so the new name applies to every asset that has it. Confirm with
  **UPDATE**.
- **Remove** takes the tag off this asset only.
- **Delete** deletes the tag from every asset. Confirm with **DELETE**.

> [!WARNING]
> **Delete** removes the tag from all your assets, not just this one. To take a tag off one asset, use **Remove**.

## Set an Asset's Weight

The asset weight says how important an asset is to your organization: a higher weight marks a more critical
asset. The platform calculates a **SYSTEM WEIGHT** for every asset, and you can override it with your own
weight. The weight directly affects your organization's overall security score.

1. Open the asset's **…** menu and select **SET ASSET WEIGHT**.
2. The dialog shows the **SYSTEM WEIGHT** and when it was last updated (**LAST UPDATE:**). If you set a weight
   before, it also shows your **USER WEIGHT**.
3. Enter a number from 1 to 100 in **NEW WEIGHT**.
4. Select **SAVE**.

To go back to the system weight, clear **NEW WEIGHT** and select **SAVE**.

![The SET ASSET WEIGHT dialog with the system weight, its last update and the NEW WEIGHT field.](/img/guide/easm/asset-settings-03.png)

The **ASSET WEIGHT** shown for an asset, in Inventory and in its drawer, is your weight when you have set one,
and the system weight otherwise. See [How security scores work](/guide/easm/security-score/) for how weight and score relate.

## Set a Main Asset

The confirmation describes the main asset as "the primary asset for all related assets, configurations, and
reports".

1. Open the asset's **…** menu and select **SET AS MAIN ASSET**.
2. Read the confirmation and select **CONFIRM**.

The asset now carries the **MAIN ASSET** ribbon (a star) in lists, in its drawer and on its page. A subdomain
can be a main asset too.

To undo it, open the same menu and select **REVERT TO NORMAL ASSET**. The confirmation keeps the title
**SET AS MAIN ASSET** but explains that the asset will no longer be the primary asset. Select **CONFIRM**.

## Enable or Disable Discovery for an Asset

Discovery looks for new assets related to the ones you have. With discovery enabled for an asset, discovery
uses it as a starting point. With discovery disabled, discovery stops finding new related assets through it.

1. Open the asset's **…** menu and select **SET DISCOVERY SETTINGS**.
2. Set the **\*DISCOVERY** switch to **Enabled** or **Disabled**.
3. Select **SAVE**.

Either way, the data you already have stays available, and you can change the setting again at any time. To
find the assets for which discovery is on or off, filter Inventory by **ASSET META** › **Discovery Enabled**.

![The SET DISCOVERY SETTINGS dialog with the DISCOVERY switch, CANCEL and SAVE.](/img/guide/easm/asset-settings-05.png)

To tune discovery for your whole organization rather than one asset, see
[Tune smart discovery](/guide/easm/discovery-settings/).

## Good to Know

- In the platform you change these settings one asset at a time. The only exception is **Apply to current
  subdomains of this domain** when you add a tag. The API can tag assets, set weights and turn discovery on or
  off for every asset that matches a filter in one call.
- A system weight can be higher than 100. The weight you set yourself is between 1 and 100.
- An inactive asset shows an **ASSET WEIGHT** of 0.

## Do This With the API

- Add tags: [Asset Set Tag](/reference/easm/asset-set-tag/)
- Take a tag off one asset: [Asset Remove Tag](/reference/easm/asset-remove-tag/)
- Rename a tag: [Asset Tag Update](/reference/easm/asset-tag-update/)
- Delete a tag from every asset: [Asset Tag Delete](/reference/easm/asset-tag-delete/)
- Set the weight: [Asset Set Weight](/reference/easm/asset-set-weight/)
- Mark a main asset, or turn discovery on or off for one asset: [Asset Update](/reference/easm/asset-update/)
- Turn discovery on or off for many assets: [Asset Enable Discovery](/reference/easm/asset-enable-discovery/)


---

# Remove and Restore Assets

URL: https://docs.deepinfo.com/guide/easm/remove-and-restore-assets/

Remove assets you no longer want to monitor, one at a time or several at once, and add them back from Deleted Assets.

Removing an asset takes it out of your inventory, so External Attack Surface Management (EASM) stops monitoring it. Removed assets are kept in
**Deleted Assets**, where you can add them back.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.

## Where to Find It

- Remove assets: **Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY** · **Tab:** **ASSETS LIST** · [https://platform.deepinfo.com/app/easm/assets](https://platform.deepinfo.com/app/easm/assets)
- Deleted Assets: **Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY**, then the **⋮** menu next to the **Inventory** title › **DELETED ASSETS** · [https://platform.deepinfo.com/app/easm/assets/deleted](https://platform.deepinfo.com/app/easm/assets/deleted)

## Remove an Asset

1. On **ASSETS LIST**, open the **…** menu on the asset's row. The same menu is in the asset drawer and on the
   asset's page.
2. Under **OTHER ACTIONS**, select **REMOVE THIS ASSET**. For an asset that seems inactive, the item is called
   **REMOVE FROM INVENTORY**.
3. The **Remove** confirmation asks whether you want to remove the asset from your assets. Select **REMOVE**.

After a few seconds the list refreshes. The asset is no longer in Inventory and is listed in **Deleted Assets**.

## Remove Several Assets at Once

1. On **ASSETS LIST**, tick the rows you want to remove. To tick every row on the page, open the checkbox menu
   in the header and select **SELECT THIS PAGE**.
2. The selection bar shows how many assets are selected, with **SCAN NOW** and **DELETE**.
3. Select **DELETE**, then **REMOVE** in the **Remove** confirmation.

> [!CAUTION]
> **SCAN NOW** sits next to **DELETE** in the selection bar and starts scanning the selected assets at once,
> without asking. Check which button you select.

Inventory selects at most one page at a time. To remove more, repeat on the next page or raise
**Result Per Page** under **VIEW SETTINGS**.

## Remove an Inactive Asset

An asset that seems inactive carries a **SEEMS INACTIVE** ribbon in lists. Its page shows a red banner, for
example **THIS DOMAIN IS CURRENTLY INACTIVE**, saying that no active DNS records or WHOIS information were found
and that there is no sign the asset is in use.

1. Open the asset's page.
2. Select **REMOVE FROM INVENTORY** in the banner.
3. Confirm with **REMOVE**.

To find inactive assets first, filter Inventory by **ASSET META** › **Seems Inactive**.

![The inactive banner at the top of an asset page, with the REMOVE FROM INVENTORY button.](/img/guide/easm/remove-and-restore-assets-02.png)

## Read Deleted Assets

![The Deleted Assets page with the filter bar, the type tabs and the list with RE-ADD AS ASSET buttons, numbered 1 to 3.](/img/guide/easm/remove-and-restore-assets-03.png)

1. **Filter bar:** the **SEARCH** box, the filter chips **ASSET**, **TAG**, **SOURCE**, **DATES** and
   **STATUS**, the number of deleted assets found, and **VIEW SETTINGS**.
2. **Tabs:** **ALL ASSETS**, **DOMAINS**, **SUBDOMAINS** and **IP ADDRESSES**. There is no **WEBSITES** tab, and
   the tabs show no counts.
3. **The list:**

| Column | What it shows |
|---|---|
| **ASSET NAME** | The asset, with **SEEMS INACTIVE** if it was inactive |
| **ADDED DATE** | When it was added to your inventory |
| **DELETED DATE** | When it was removed |
| **CREATION METHOD** | How it entered your inventory (see below) |
| **RE-ADD AS ASSET** | Adds it back |

| Creation method | Meaning |
|---|---|
| **MANUALLY ADDED** | It was added directly, for example on [Add assets](/guide/easm/add-assets/) |
| **MANUALLY APPROVED** | Someone approved it in [Discovery](/guide/easm/discovery/) |
| **AUTO APPROVED** | A discovery rule with auto approval added it |

## Add an Asset Back

1. On **Deleted Assets**, select **RE-ADD AS ASSET** on the row.
2. The **Re-Add As Asset** confirmation asks whether you want to re-add the asset. Select **RE-ADD AS ASSET**.
3. The asset is back in Inventory.

To add several back, tick their rows and use **RE-ADD AS ASSET** in the selection bar.

## Good to Know

- **A removed asset can come back through discovery.** Removing an asset does not stop discovery rules from
  finding it again. If a rule finds it, it appears in the [Discovery](/guide/easm/discovery/) review list, and
  approving it adds it back to your inventory. To keep an asset out of the discovery lists for good, add it to
  **Ignored Assets** under **Other Settings** on the Discovery **SETTINGS** tab; see
  [Tune smart discovery](/guide/easm/discovery-settings/).
- The same asset can be listed more than once in **Deleted Assets** if it was removed more than once.
- Removing is also the way to undo an approval from Discovery: an approved asset cannot be sent back to review.
- **Deleted Assets** has no export button. The API can export the list (see below).

## Do This With the API

- Remove assets: [Asset Delete](/reference/easm/asset-delete/)
- List deleted assets: [Deleted Asset Search](/reference/easm/deleted-asset-search/)
- Export deleted assets (API only): [Deleted Asset Export](/reference/easm/deleted-asset-export/)
- Add assets back: [Asset Create](/reference/easm/asset-create/)


---

# Asset Insights

URL: https://docs.deepinfo.com/guide/easm/asset-insights/

See how your assets are spread across registrars, name servers, mail servers, IP addresses and networks, certificates and HTTP status codes.

The **INSIGHTS** tab of Inventory shows how your assets are distributed: who registers your domains, which
name servers, mail servers and networks they use, which certificates they present and which HTTP status codes
they return. Use it to spot concentration and outliers across your attack surface.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.
- **Data:** at least one asset in your inventory.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY** · **Tab:** **INSIGHTS** · [https://platform.deepinfo.com/app/easm/assets/insights](https://platform.deepinfo.com/app/easm/assets/insights)

## Read the Screen

![The top of the Inventory INSIGHTS tab with the four cards, the TIMELINE chart, the ASSET TYPES chart and the distribution tabs, numbered 1 to 4.](/img/guide/easm/asset-insights-01.png)

1. **Cards:**
   - **TOTAL ASSETS**, with the change over the **LAST 30 DAYS**.
   - **DOMAIN WITH MOST SUBDOMAINS** and how many subdomains it has.
   - **TOP REGISTRAR**, the registrar that holds most of your domains.
   - **TOP ASN**, the most common network (autonomous system) among your assets.
2. **TIMELINE:** your number of assets over time, split into **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and
   **WEBSITES**. Choose **DAILY**, **WEEKLY** or **MONTHLY** in the dropdown.
3. **ASSET TYPES:** how your assets divide between the asset types.
4. **Distribution tabs:** four tabs, described next.

### The Distribution Tabs

| Tab | What it shows |
|---|---|
| **DOMAIN REGISTRATION** | **EXPIRATION DATE**: when your domain registrations expire. **REGISTRARS** and **WHOIS ORGANIZATION NAME**: the top five of each |
| **DNS INFRASTRUCTURE** | **NAME SERVER REDUNDANCY**. **NAME SERVERS**, split into **DOMAIN** and **SUBDOMAIN**. **MAIL SERVERS**: a **TOP PROVIDER** card, then the mail servers split into **DOMAIN** and **SUBDOMAIN** |
| **NETWORK & HOSTING** | **IP ADDRESSES**: **TOP IP ADDRESSES BY DOMAIN COUNT**. **ASN**: the networks, split into **DOMAIN**, **SUBDOMAIN** and **IP ADDRESS** |
| **SECURITY & WEB** | **SSL CERTIFICATES**: the top five certificates, by fingerprint. **SSL SUBJECT ORGANIZATION**: the organizations named in your certificates, per asset type. **HTTP STATUS**: status classes with a one-line explanation each. **SSL ISSUER**: who issued your certificates. **INDIVIDUAL STATUS CODES**: each status code with its reason, count and share |

The **HTTP STATUS** classes are **1XX INFORMATIONAL**, **2XX SUCCESS**, **3XX REDIRECT**, **4XX CLIENT ERROR**
and **5XX SERVER ERROR**.

![The DOMAIN REGISTRATION tab with the EXPIRATION DATE chart and the REGISTRARS and WHOIS ORGANIZATION NAME lists.](/img/guide/easm/asset-insights-02a.png)

![The DNS INFRASTRUCTURE tab with the NAME SERVERS and MAIL SERVERS distributions.](/img/guide/easm/asset-insights-02b.png)

![The NETWORK & HOSTING tab with the top IP addresses and the ASN distribution.](/img/guide/easm/asset-insights-02c.png)

![The SECURITY & WEB tab with SSL certificates, SSL subject organizations, HTTP status classes, SSL issuers and individual status codes.](/img/guide/easm/asset-insights-02d.png)

## Use the Page

- **Plan renewals:** on **DOMAIN REGISTRATION**, check **EXPIRATION DATE** for domains that expire soon, and
  **REGISTRARS** for domains held by a registrar you do not expect.
- **Check your DNS and mail setup:** on **DNS INFRASTRUCTURE**, look at **NAME SERVER REDUNDANCY**, and at name
  servers or mail providers that only a few assets use.
- **Find unexpected hosting:** on **NETWORK & HOSTING**, look for IP addresses and networks you do not
  recognize.
- **Review certificates and web responses:** on **SECURITY & WEB**, look for unexpected certificate issuers or
  subject organizations, and for many **4XX** or **5XX** responses.

To act on what you find, go back to **ASSETS LIST** and filter by the same field, for example **WHOIS** or
**SSL** in the filter bar.

## Good to Know

- The page is for reading only. It has no filters and no export, and its charts do not link to the assets
  behind them.
- Each distribution has a sentence that says how many domains and subdomains its top values are associated
  with. These numbers can be higher than the number of assets in your inventory, so use them to compare values,
  not as asset totals.
- The **HTTP STATUS** figures here can differ from the **HTTP STATUS** column on **ASSETS LIST**.
- The **OVERVIEW** tab of Inventory holds the summary cards; see
  [Browse your asset inventory](/guide/easm/asset-inventory/).

## Do This With the API

- Distributions by registrar, name server, certificate and more: [Insight Stats](/reference/easm/insight-stats/)
- Domains with the most subdomains: [Domains with Most Subdomains](/reference/easm/domains-with-most-subdomains/)
- Asset counts over time: [Asset Type Stats Timeline](/reference/easm/asset-type-stats-timeline/)
- Asset counts per type: [Asset Type Stats](/reference/easm/asset-type-stats/)


---

# Review Discovered Assets

URL: https://docs.deepinfo.com/guide/easm/discovery/

Approve the assets discovery found into your inventory or ignore them, and find past decisions in the Approved Assets and Ignored Assets lists.

Discovery rules look for assets related to the ones you already monitor. What they find waits on the
**DISCOVERED ASSETS** tab until you decide: add it to your inventory, or ignore it.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **DISCOVERY** · **Tab:** **DISCOVERED ASSETS** · [https://platform.deepinfo.com/app/easm/discoveries](https://platform.deepinfo.com/app/easm/discoveries)

Discovery has three in-page tabs:

| Tab | What it holds | Deep link |
|---|---|---|
| **OVERVIEW** | Summary cards (see [The OVERVIEW tab](#the-overview-tab)) | [/app/easm/discoveries/overview](https://platform.deepinfo.com/app/easm/discoveries/overview) |
| **DISCOVERED ASSETS** | The assets waiting for review, described on this page | [/app/easm/discoveries](https://platform.deepinfo.com/app/easm/discoveries) |
| **SETTINGS** | **Smart Discovery**, **Custom Rules** and **Other Settings**: the rules that find candidates; see [Tune smart discovery](/guide/easm/discovery-settings/) and [Create custom discovery rules](/guide/easm/custom-discovery-rules/) | [/app/easm/discoveries/settings/smart-discovery](https://platform.deepinfo.com/app/easm/discoveries/settings/smart-discovery) |

The **⋮** menu next to the **Discovery** title opens **IGNORED ASSETS** and **APPROVED ASSETS**.

Every discovered asset is **IN REVIEW**, **APPROVED** or **IGNORED**; see
[States](#states-colours-and-scores) below.

## Read the Screen

![The DISCOVERED ASSETS tab with the filter bar, the type tabs, the list with RULES badges and the row actions, numbered 1 to 4.](/img/guide/easm/discovery-01.png)

The header breadcrumb reads **EASM / ASSETS / DISCOVERY**.

1. **Filter bar:** **SEARCH**, the filter chips **ASSET**, **RULE** and **DISCOVERY**, and the list and quick
   view icons. Then the number of assets discovered (**N ASSETS DISCOVERED**) and **VIEW SETTINGS**.
2. **Type tabs** with counts: **ALL ASSETS**, **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES**.
   Large counts are shortened, for example `12.5K`.
3. **The list**, 25 per page:
   - **ASSET**
   - **DISCOVERY DATE**, when the asset was last discovered
   - **RULES**, a badge with the full name of each rule that found the asset. A bulb icon marks a smart rule
     managed by Deepinfo; a custom rule of your own has a different icon. Hover over a badge to see its seed
     value, the input the rule started from.
4. **Row actions:** **ADD TO MY ASSETS** and an ignore button (an icon without text).

![A discovered asset row with the tooltip of its RULES badge showing the seed value.](/img/guide/easm/discovery-02.png)

## Check an Asset Before You Decide

1. Select a row. The discovered-asset drawer opens.
2. Read **DISCOVERED DATE** and **RULES**. The drawer's icon tabs (**WHOIS** for domains, then **DNS**, **SSL**
   and **WEBSITE INFO**) hold the records captured on the discovery date. The info icon next to the date
   reminds you that they may have changed since.
3. To open the asset on its own page, select **OPEN IN NEW TAB**. The page has a **DISCOVERY** button to go
   back, and the same **ADD TO MY ASSETS** and **IGNORE** actions.

Subdomains have no **WHOIS** tab and open on **DNS**. IP addresses have no **DNS** tab.

## Add Assets to Your Inventory

1. On **DISCOVERED ASSETS**, select **ADD TO MY ASSETS** on the row. To add several, tick their rows first and
   use **ADD TO MY ASSETS** in the selection bar. To tick every row on the page, open the checkbox menu and
   select **SELECT THIS PAGE**; **CLEAR SELECTION** unticks them.
2. The **Add to Portfolio** confirmation shows how many assets you are adding ("portfolio" means your
   inventory). Select **ADD**, or **CANCEL** to go back.
3. After a few seconds the list refreshes. The assets are now in [Inventory](/guide/easm/asset-inventory/)
   and listed in **Approved Assets**.

## Ignore Assets

1. Select the ignore button on the row, or tick several rows and use **IGNORE** in the selection bar. You can
   also select **IGNORE** at the bottom of the drawer.
2. The **Confirmation** dialog shows how many assets you are ignoring. Select **IGNORE**, or **CANCEL**.
3. After a few seconds the list refreshes. The assets move to **Ignored Assets**.

## Undo an Ignore

1. Open **Ignored Assets**: **⋮** › **IGNORED ASSETS** next to the **Discovery** title.
2. Select **UNDO IGNORE** on the row, or tick several rows and use **UNDO IGNORE** in the selection bar. The
   drawer and the asset's page also have **UNDO IGNORE**.
3. Confirm with **REVERT**. The asset returns to review.

## Approved Assets and Ignored Assets

- **Approved Assets** (breadcrumb **EASM / ASSETS / DISCOVERY / APPROVED ASSETS**) lists the approved assets,
  with **ASSET**, **DISCOVERY DATE**, **APPROVED DATE** and **RULES**. It has the same filter chips and tabs
  as **DISCOVERED ASSETS**. It is a record: the list has no row or bulk actions, and the page of an approved
  asset has none either. Manage approved assets in [Inventory](/guide/easm/asset-inventory/).
- **Ignored Assets** lists what you ignored, with **ASSET**, **DISCOVERY DATE**, **IGNORED DATE**, **RULES**
  and **UNDO IGNORE**.

## Find Candidates

- **SEARCH** filters by asset name.
- The filter chips offer:
  - **ASSET**: Name, Organization, State
  - **RULE**: Name, Seed Value
  - **DISCOVERY**: Last Discovery Date, Ignore Date, Approve Date
- When Inventory's **SUBDOMAINS** tab is empty but discovery has found subdomains, its **GO TO DISCOVERY**
  button opens this list filtered to subdomains.

## The OVERVIEW Tab

![The Discovery OVERVIEW tab with the DISCOVERED ASSETS and STATE DISTRIBUTION cards and the recently approved and recently discovered asset tables.](/img/guide/easm/discovery-05.png)

| Card | What it shows |
|---|---|
| **DISCOVERED ASSETS** | How many discovered assets are waiting for review |
| **STATE DISTRIBUTION** | A pie of **IN REVIEW**, **APPROVED** and **IGNORED** |
| **RECENTLY APPROVED ASSETS** | **ASSET** and **APPROVED DATE** |
| **RECENTLY DISCOVERED ASSETS** | **ASSET** and **DISCOVERY DATE** |

## States, Colours and Scores

| State | Meaning | Where to find it |
|---|---|---|
| **IN REVIEW** | Found by a rule, waiting for a decision | **DISCOVERED ASSETS** |
| **APPROVED** | Added to your inventory | **Approved Assets** |
| **IGNORED** | Dismissed; it stays out of your inventory | **Ignored Assets** |

In the **STATE DISTRIBUTION** chart, **IN REVIEW** is dark blue, **APPROVED** blue and **IGNORED** light grey.

## Good to Know

- Actions take a few seconds to apply; the list refreshes on its own afterwards.
- A rule with **Auto Approval** turned on approves matching assets in review automatically. You set this on
  the **SETTINGS** tab; see [Tune smart discovery](/guide/easm/discovery-settings/).
- An asset you removed from Inventory can be found again by discovery and come back for review.
- The Discovery lists have no export button. The API can export discovered assets (see below).

## Do This With the API

- Search discovered assets: [Discovered Asset Search](/reference/easm/discovered-asset-search/)
- Get one: [Discovered Asset Detail](/reference/easm/discovered-asset-detail/)
- Approve: [Discovered Asset Approve](/reference/easm/discovered-asset-approve/)
- Ignore: [Discovered Asset Ignore](/reference/easm/discovered-asset-ignore/)
- Undo an ignore: [Discovered Asset Revert](/reference/easm/discovered-asset-revert/)
- Export (API only): [Discovered Asset Export](/reference/easm/discovered-asset-export/)


---

# Tune Smart Discovery

URL: https://docs.deepinfo.com/guide/easm/discovery-settings/

Turn Deepinfo's smart discovery and smart monitoring rules on or off, exclude seed assets and seed values, choose auto approval, and keep assets out of discovery for good.

Discovery runs rules that look for assets related to yours and puts what they find in the
[Discovery](/guide/easm/discovery/) review list. Deepinfo manages the smart rules, and you can tune them: turn
them on or off, tell them what not to start from, and let them approve what they find. You can also keep
assets out of discovery altogether.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.
- These settings apply to discovery for your whole organization. To turn discovery on or off for a single
  asset, see [Tag, weight and configure assets](/guide/easm/asset-settings/).

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **DISCOVERY** · **Tab:** **SETTINGS** · [https://platform.deepinfo.com/app/easm/discoveries/settings/smart-discovery](https://platform.deepinfo.com/app/easm/discoveries/settings/smart-discovery)

The **SETTINGS** tab has its own menu on the left:

- **Smart Discovery**: the rules Deepinfo runs for you (this page).
- **Custom Rules**: your own rules; see [Create custom discovery rules](/guide/easm/custom-discovery-rules/).
- **Other Settings**: the **Ignored Assets** list (this page), at
  [https://platform.deepinfo.com/app/easm/discoveries/settings/other-settings](https://platform.deepinfo.com/app/easm/discoveries/settings/other-settings).

## Concepts

- **Smart discovery rules** and **smart monitoring rules** are run and maintained by Deepinfo. Both put the
  assets they find in the Discovery review list. In that list, a bulb icon on a rule badge marks a smart rule.
- **Seed asset:** one of your assets that a rule starts from. An asset is used as a seed when discovery is
  enabled for it.
- **Seed value:** the input a rule started from when it found an asset. On the Discovery list, hover over a rule
  badge to see it.
- **Auto approval:** assets that a rule finds go straight into your inventory, without waiting for your review.

## Read the Smart Discovery Page

![Smart Discovery on the SMART DISCOVERY RULES tab with the tabs, the rules table and one expanded rule, numbered 1 to 3.](/img/guide/easm/discovery-settings-01.png)

1. **Tabs:** **SMART DISCOVERY RULES** and **SMART MONITORING RULES**.
2. **The rules table:**

   | Column | What it shows |
   |---|---|
   | **STATUS** | A switch, and **ACTIVE** when the rule runs |
   | **RULE NAME** | The rule |
   | **DISCOVERED ASSETS** | How many assets the rule has discovered |
   | (chevron) | Expands the rule's settings |

3. **An expanded rule** shows its excluded seed assets and seed values, **Auto Approval** and
   **Global Blacklist**, described below.

When this page was written, the smart rules were:

| Smart discovery rules | Smart monitoring rules |
|---|---|
| Same Whois Registrant Phone Rule | DNS A Records Smart Rule |
| Same DNS A Record (IP Address) Rule | SSL Certificate SANs Smart Rule |
| Same Whois Registrant Organization Rule | HTTP Redirection Follow Smart Rule |
| Subdomain Rule | DNS CNAME Record Smart Rule |
| Same SSL Certificate Rule | IP CIDR Smart Monitoring Rule |
| Same DNS MX Record (Mail Server) Rule | IP DNS PTR Record Smart Rule |
| Same DNS NS Record (Name Server) Rule | |
| Same SSL Subject Organization Rule | |
| Same Whois Name Server Rule | |
| Same Whois Registrant Email Rule | |
| Same Whois Registrant Apex Email Rule | |
| Same Whois Registrant Email (Historical) Rule | |

Deepinfo maintains these rules, so your list can differ.

## Change a Rule's Status

1. Select the rule's **STATUS** switch.
2. A **Confirmation** asks whether you want to activate or inactivate the rule. Select **ACTIVATE** or
   **INACTIVATE**.

The **STATUS** column then shows whether the rule is **ACTIVE** or **INACTIVE**.

## Exclude Seed Assets

If a rule finds unrelated assets because it starts from one of your assets, exclude that asset from the rule.

1. Expand the rule. Its excluded seed assets are listed under **EXCLUED SEED ASSETS** (the label is spelled
   this way on screen).
2. Select **MANAGE EXCLUDED SEED ASSETS**.
3. In **Manage Excluded Seed Assets**, find the asset under **YOUR ASSETS** (use **Search in your assets**) and
   move it to **EXCLUDED SEED ASSETS**. **YOUR ASSETS** lists your whole inventory.
4. Select **SAVE CHANGES** and confirm.

To take an asset off the list, select × on its chip under **EXCLUED SEED ASSETS** and confirm with **REMOVE**.

In this dialog, internationalized names appear in their punycode form (starting with `xn--`), not as they
appear in Inventory.

![The Manage Excluded Seed Assets dialog with the YOUR ASSETS list, the EXCLUDED SEED ASSETS list and SAVE CHANGES.](/img/guide/easm/discovery-settings-02.png)

## Exclude Seed Values

If a rule finds unrelated assets because of one seed value, exclude that value. Smart discovery rules have
this setting; smart monitoring rules do not.

1. Expand the rule and find **EXCLUED SEED VALUES**.
2. Select **+ MANAGE EXCLUDED SEED VALUES**.
3. In **Manage Excluded Seed Values**, enter the values, one per line.
4. Select **SAVE CHANGES**.

To find a seed value, hover over the rule's badge on an asset in the [Discovery](/guide/easm/discovery/) list.

## Approve a Rule's Findings Automatically

1. Expand the rule and select the **Auto Approval** switch. Its description explains that assets in the review
   list that match the rule are approved automatically.
2. The **Confirmation** asks whether you want to enable auto approval for the rule. Select **YES**, or
   **DISCARD** to leave it off.

Turning it off works the same way.

> [!CAUTION]
> Auto-approved assets go into your inventory without a review, and an approval cannot be undone from
> Discovery. To take such an asset out again, remove it; see
> [Remove and restore assets](/guide/easm/remove-and-restore-assets/). To find auto-approved assets, filter
> Inventory by **ASSET META** › **Creation Method**.

## Use the Global Blacklist

Deepinfo's data team maintains a global list of generic values and keeps it up to date. With it, a rule
ignores those values, which reduces false-positive discoveries.

1. Expand the rule and select the **Global Blacklist** switch.
2. Confirm with **YES**, or select **DISCARD**.

## Keep Assets Out of Discovery for Good

The **Ignored Assets** list on **Other Settings** holds domains, subdomains and IP addresses that never appear
in the discovered-asset lists, even when a rule finds them.

1. In the **SETTINGS** tab menu, select **Other Settings**.
2. Under **Ignored Assets**, enter the assets, one per line. Each line must be a domain, a subdomain or a
   public IPv4 address.
3. Select **SAVE CHANGES**. It is available once you have changed the list.

![Other Settings in the Discovery SETTINGS tab with the empty Ignored Assets field and SAVE CHANGES.](/img/guide/easm/discovery-settings-03.png)

## Good to Know

- Rule switches, **Auto Approval** and **Global Blacklist** always ask for confirmation before they change.
- **SAVE CHANGES** stays unavailable until you change something in its dialog or form.
- To dismiss a single candidate rather than keep an asset out for good, you can also ignore it in the Discovery
  list; see [Review discovered assets](/guide/easm/discovery/).

## Do This With the API

- List the smart discovery rules: [Asset Discovery Smart Discovery Rule List](/reference/easm/asset-discovery-smart-discovery-rule-list/)
- Tune a smart discovery rule: [Asset Discovery Smart Discovery Rule Update](/reference/easm/asset-discovery-smart-discovery-rule-update/)
- List the smart monitoring rules: [Asset Discovery Smart Monitoring Rule List](/reference/easm/asset-discovery-smart-monitoring-rule-list/)
- Tune a smart monitoring rule: [Asset Discovery Smart Monitoring Rule Update](/reference/easm/asset-discovery-smart-monitoring-rule-update/)
- Read the Ignored Assets list: [Asset Discovery Settings Detail](/reference/easm/asset-discovery-settings-detail/)
- Replace the Ignored Assets list: [Asset Discovery Settings Update](/reference/easm/asset-discovery-settings-update/)


---

# Create Custom Discovery Rules

URL: https://docs.deepinfo.com/guide/easm/custom-discovery-rules/

Build your own discovery rules from domain filters, add tags and auto approval, and edit, pause or delete them.

A custom discovery rule describes domains you want discovery to find, using filters on their WHOIS, DNS, SSL
and website data or on their names. The filters select which domains in Deepinfo's dataset become candidates.
What a rule finds appears in the [Discovery](/guide/easm/discovery/) review list, with the rule's name on its
badge.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.
- For the rules Deepinfo runs for you, see [Tune smart discovery](/guide/easm/discovery-settings/).

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **DISCOVERY** · **Tab:** **SETTINGS** · [https://platform.deepinfo.com/app/easm/discoveries/settings/custom-rules](https://platform.deepinfo.com/app/easm/discoveries/settings/custom-rules)

On the **SETTINGS** tab, select **Custom Rules** in the menu on the left.

## Read the Screen

![Custom Rules with the header, the rules table and one expanded rule showing its filters, tags and Auto Approval, numbered 1 to 3.](/img/guide/easm/custom-discovery-rules-01.png)

1. **Header:** the number of custom rules and **CREATE RULE +**.
2. **The rules table:**

   | Column | What it shows |
   |---|---|
   | **STATUS** | A switch, and whether the rule is active |
   | **RULE NAME** | The rule's name |
   | **DISCOVERED ASSETS** | How many assets the rule has discovered |
   | **CREATE DATE** | When the rule was created |
   | **LAST UPDATE DATE** | When it was last changed |
   | (chevron) | Expands the rule |

3. **An expanded rule** shows:
   - **FILTERS**, each written as rule · category · field · operator · value, for example
     **MUST** · **Webdata** · **HTTP** · **Final Domain** · **EQUAL** · a domain name;
   - **TAGS**;
   - the **Auto Approval** switch;
   - **EDIT THIS RULE** and **DELETE THIS RULE**.

## Create a Rule

1. Select **CREATE RULE +**. The **Custom Rules** dialog opens.
2. Enter a **RULE NAME**. You will see it on the rule badges in the Discovery lists.
3. Optional: choose **TAGS** from **Select**, or type a new tag.
4. Set **AUTO APPROVAL**. It is **Disabled** by default: what the rule finds waits for your review. With
   **Enabled**, what it finds is added to your inventory directly.
5. Set **STATUS**. It is **Active** by default.
6. Add at least one filter. Select a category chip: **Domain Type**, **Whois**, **DNS**, **SSL**, **Webdata**,
   **Domain Name**, **Extension** or **Subdomain**. In the popover:
   1. Pick the field, then the rule (**Must**, for example), the operator (**Equal**, for example) and the
      **Value**.
   2. Select **Add New** to add another condition, or **Clear All** to start over.
   3. Select **APPLY**.

   **Domain Type** takes **Only Domain** or **Only Subdomain**.
7. Select **CREATE**. It becomes available once the rule has a name and at least one filter.

![The Custom Rules dialog with the Webdata filter chip open on its Select field popover.](/img/guide/easm/custom-discovery-rules-02.png)

The rules **Must**, **Must Not** and **Should** work as in the API; see
[Search & filters](/getting-started/search-and-filters/) and
[Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

> [!CAUTION]
> With **AUTO APPROVAL** enabled, the assets the rule finds go straight into your inventory, and an approval
> cannot be undone from Discovery. Start with auto approval off, check what the rule finds in Discovery, and
> turn it on once the results look right.

## Change, Pause or Delete a Rule

Expand the rule first.

- **Change it:** select **EDIT THIS RULE**. The same dialog opens with your settings. Change them and select
  **UPDATE**.
- **Pause it:** turn off its **STATUS** switch and confirm. Turn it on again the same way.
- **Turn auto approval on or off:** select the **Auto Approval** switch and confirm.
- **Delete it:** select **DELETE THIS RULE**. The **Delete Rule** confirmation names the rule. Select **DELETE**.

## Good to Know

- A rule name can be long; the table may shorten it. Expand the rule to see its filters.
- A rule has up to 10 tags.
- To keep specific assets out of discovery whatever your rules find, use the **Ignored Assets** list; see
  [Tune smart discovery](/guide/easm/discovery-settings/).

## Do This With the API

- List your custom rules: [Asset Discovery Custom Discovery Rule Search](/reference/easm/asset-discovery-custom-discovery-rule-search/)
- Create a rule: [Asset Discovery Custom Discovery Rule Create](/reference/easm/asset-discovery-custom-discovery-rule-create/)
- Change a rule: [Asset Discovery Custom Discovery Rule Update](/reference/easm/asset-discovery-custom-discovery-rule-update/)
- Delete a rule: [Asset Discovery Custom Discovery Rule Delete](/reference/easm/asset-discovery-custom-discovery-rule-delete/)


---

# Triage Issues

URL: https://docs.deepinfo.com/guide/easm/issues/

Use the Issue List to see every security issue on your assets, grouped by issue type or one row per issue, and to filter, open, export and act on them.

The Issue List shows every security issue External Attack Surface Management (EASM) found on your assets. Start with the issue types that are most
severe or affect the most assets, then switch to one row per asset to work through them.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.
- **Terms:** an **issue type** is a kind of finding, for example an expired SSL certificate. An **issue** is
  one issue type on one asset. The screen says "Issues" for both.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ISSUES** · **Tab:** **ISSUE LIST** · [https://platform.deepinfo.com/app/easm/issues](https://platform.deepinfo.com/app/easm/issues)

The [EASM dashboard](/guide/easm/dashboard/)'s **GO TO ISSUES PAGE** and the
[Global dashboard](/guide/global-dashboard/)'s **TOTAL ISSUES** card open it too. Issues has three in-page
tabs:

| Tab | What it holds | Deep link |
|---|---|---|
| **OVERVIEW** | Summary cards (see [The OVERVIEW tab](#the-overview-tab)) | [/app/easm/issues/overview](https://platform.deepinfo.com/app/easm/issues/overview) |
| **ISSUE LIST** | The issues, described on this page | [/app/easm/issues](https://platform.deepinfo.com/app/easm/issues) |
| **INSIGHTS** | Resolution, reappearance and false-positive rates, states, categories and fix times; see [Issue insights](/guide/easm/issue-insights/) | [/app/easm/issues/insights](https://platform.deepinfo.com/app/easm/issues/insights) |

## Read the Screen

![The top of the ISSUE LIST tab grouped by issue type on ALL ISSUES, with the result row, severity tabs and list numbered 1 to 3.](/img/guide/easm/issues-01a.png)

![The bottom of the ISSUE LIST with the page selector, numbered 4.](/img/guide/easm/issues-01b.png)

The header breadcrumb reads **EASM / ISSUES / ISSUE LIST**.

1. **Result row:** the list and quick view icons, the number of issues detected (**N ISSUES DETECTED**),
   **GROUP BY ISSUE TYPES** and **EXPORT**. When the list is not grouped, the row also has the **SEARCH** box
   and the filter chips, **SHOW INACTIVES** and **VIEW SETTINGS**.
2. **Severity tabs:** **ALL ISSUES**, **CRITICAL**, **HIGH**, **MEDIUM**, **LOW** and **INFORMATION**. They do
   not show counts.
3. **The list.** It has two layouts, described next.
4. **Pages** of 25 rows below the list.

### Grouped by Issue Type (Default)

With **GROUP BY ISSUE TYPES** ticked, each row is one issue type. The list is ordered by severity, then by
the number of affected assets.

| Column | What it shows |
|---|---|
| **ISSUE NAME** | Severity chip and issue type name |
| **ASSETS** | Number of affected assets |
| **CATEGORY** | The issue type's category |

The grouped list has no search, filters or **VIEW SETTINGS**. Select a row to open the **issue type drawer**.
Its tabs are icons down the side; hover over an icon to see its name:

- **OVERVIEW:** **CATEGORY**, **ACTIVE DAYS**, **FIRST SEEN**, **LAST SEEN**, the impact,
  **AVERAGE ISSUE DURATION**, **AVERAGE FIX DURATION**, and **STATES**: the number of active and inactive
  issues of this type, with a chart of the active states. For the issue type's score, see the **SCORE**
  card on its page ([Issue type details](/guide/easm/issue-types/)).
- **ASSETS:** every asset with an active issue of this type, with **FIRST SEEN**, **LAST SEEN** and its
  **STATE**. Select an asset name to open it in a new tab.
- **VULNERABILITIES:** for issue types about a technology, the known CVEs. Each CVE links to its entry in
  the Deep Search & Insights (DSI) **VULNERABILITY SEARCH**, in a new tab.
- **ISSUE INFO:** **DESCRIPTION** with **External References**, **REMEDY** and **CLASSIFICATIONS**, the
  compliance frameworks the issue type maps to, each with its own description.

**OPEN IN NEW TAB** opens the **issue type page**, which shows the same issue type across all your assets.
Its tabs are **OVERVIEW** (with the issue type's **SCORE** and **TIMELINE**), **ASSETS**, **VULNERABILITIES**
and **ISSUE INFO**. On its **ASSETS** tab you can change the state of each asset's issue. See
[Issue type details](/guide/easm/issue-types/).

![The issue type drawer on its OVERVIEW tab with category, active days, first and last seen and the impact.](/img/guide/easm/issues-02a.png)

![The issue type drawer on its ASSETS tab listing the affected assets with first seen, last seen and state.](/img/guide/easm/issues-02b.png)

### One Row per Issue

Untick **GROUP BY ISSUE TYPES** to list each issue on each asset:

| Column | What it shows |
|---|---|
| **ISSUE** | Severity chip and issue type name |
| **ASSET** | The affected asset |
| **STATE** | The issue's state; select it to change it |
| **ACTIVE DAYS** | Days between first seen and last seen. After 30 days the value turns red and shows a fire icon |

Select a row to open the **issue drawer** for that one issue:

- A banner says you are viewing this issue only for one asset. **View for All Assets** opens the issue type
  page.
- The severity and state chips, and the **…** menu with **CHANGE STATE**.
- **ISSUE INFO:** **CATEGORY**, **ACTIVE DAYS**, **FIRST SEEN**, **LAST SEEN**, **DESCRIPTION** with
  **External References**, **REMEDY** and **CLASSIFICATIONS**, plus details that depend on the issue type,
  such as **IDENTIFIED VERSION** and **LATEST VERSION**.
- **PROOF:** the evidence for the issue, as JSON, with **COPY**.
- **VULNERABILITIES:** for issues about a technology, the known CVEs.

**OPEN IN NEW TAB** opens the issue on its asset's page (see [Investigate an asset](/guide/easm/asset-details/)).

![The drawer of a single issue with the banner for one asset, the severity and state chips and the ISSUE INFO tab.](/img/guide/easm/issues-03a.png)

![The same issue drawer on its PROOF tab with the JSON evidence and COPY.](/img/guide/easm/issues-03b.png)

## Triage the List

1. Pick a severity tab, starting with **CRITICAL**.
2. In the grouped list, the issue types at the top are the most severe and affect the most assets. Open a
   row to read the impact and the remedy.
3. Untick **GROUP BY ISSUE TYPES** to work issue by issue. **SEARCH** and the filter chips now appear.
4. Narrow the list with the filter chips: **ISSUE**, **CATEGORY**, **SEVERITY**, **ASSET**, **ASSET TYPE**,
   **FIRST SEEN DATE**, **LAST CHECK DATE**, **LAST SEEN DATE** and **STATE**. For example:
   - **SEVERITY** offers **Critical**, **High**, **Medium**, **Low** and **Information**.
   - **ASSET TYPE** offers **Domain**, **Subdomain**, **IP Address** and **Website**.
   - **STATE** offers every state, such as **Active - Newly Detected** or **Inactive - Risk Accepted**.
   - The date chips take an **AFTER** and a **BEFORE** date.

   **SEARCH** matches the issue name.
5. To order the list, open **VIEW SETTINGS** › **Sort By** and pick a field, such as **Issue Severity**,
   **Asset Name**, **First Seen Date** or **Issue Type Name**, and a direction. **Result Per Page** sets the
   page size.
6. Change states as you decide. See [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).

A filter chip opens a popover with the rule (**Must**, **Must Not** or **Should**), an operator and the
**Value**, plus **Add New**, **Clear All**, **CANCEL** and **APPLY**. The rules work as in the API; see
[Search & filters](/getting-started/search-and-filters/). When nothing matches, the list shows
**No Result Found.**

## See Inactive Issues

The ungrouped list shows active issues by default. Tick **SHOW INACTIVES** to include inactive issues too,
such as the ones you ignored, accepted as a risk, or marked as resolved or as a false positive.

## Export Issues

1. Select **EXPORT**. The **DOWNLOAD** dialog opens.
2. Choose the **RECORDS**: **ALL** exports every issue, of all severities, active and inactive, whatever tab
   you are on. **FILTERED** is offered only in the ungrouped list; it exports what the list shows, with the
   severity tab, **SHOW INACTIVES**, your filters and your sort.
3. Choose the **FILE FORMAT**, **CSV** or **JSON**, and select **DOWNLOAD**.

For the other options in the dialog, see
[Browse your asset inventory](/guide/easm/asset-inventory/#export-the-list).

## Quick View

Select the quick view icon to browse issue types by category on the left. The right side shows the selected
issue type, with **OPEN IN NEW TAB** and the tabs **OVERVIEW**, **ASSETS**, **VULNERABILITIES** and
**ISSUE INFO**. Quick view always groups by issue type, so filters are hidden.

## The OVERVIEW Tab

![The Issues OVERVIEW tab with its summary cards and the most critical and most seen issue tables.](/img/guide/easm/issues-04.png)

| Card | What it shows |
|---|---|
| **TOTAL ISSUES** | Active issues, with a change chip and **LAST 30 DAYS** |
| Severity card | The number of issues for the severities **CRITICAL**, **HIGH** and **MEDIUM** |
| **STATUS STATS** | **ACTIVE** and **INACTIVE** issues |
| **CATEGORY STATS** | Issue categories, largest first |
| **AVERAGE ISSUE AGE** | In days |
| **MOST CRITICAL ISSUES** | **ISSUE** and **ASSET COUNT** |
| **MOST SEEN ISSUES** | **ISSUE** and **ASSET COUNT** |

For the counts of every severity, see the **SEVERITY** chart on the **INSIGHTS** tab, or the **SEVERITY**
card on the [EASM dashboard](/guide/easm/dashboard/).

## States, Colours and Scores

| Severity | Colour |
|---|---|
| **CRITICAL** | red |
| **HIGH** | orange |
| **MEDIUM** | yellow |
| **LOW** | light yellow |
| **INFORMATION** | light blue |

For the states, see [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).
For the A to F grade, see [How security scores work](/guide/easm/security-score/).

## Good to Know

- **ACTIVE DAYS** is the time between the first and the last time the issue was seen, not its age today.
- **VIEW SETTINGS** (sorting, page size and columns) is available only in the ungrouped list.

## Do This With the API

- Search issues: [Issue Search](/reference/easm/issue-search/)
- Get one issue: [Issue Detail](/reference/easm/issue-detail/)
- Issue types with affected-asset counts: [Issue Type Stats](/reference/easm/issue-type-stats/)
- Export as CSV or JSON: [Issue Export](/reference/easm/issue-export/)


---

# Issue Type Details

URL: https://docs.deepinfo.com/guide/easm/issue-types/

Open one issue type to see its score, how long it stays open, which assets have it and in what state, its related CVEs, and its description, remedy and classifications.

An issue type is one kind of finding, for example an expired SSL certificate. Its page shows that issue type
across all your assets: its score, how long it stays open, which assets have it and in what state, and how to
fix it.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.
- **Terms:** an **issue** is one issue type on one asset. See [Triage issues](/guide/easm/issues/).

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ISSUES** · **Tab:** **ISSUE LIST** · [https://platform.deepinfo.com/app/easm/issues](https://platform.deepinfo.com/app/easm/issues)

Then open the issue type in one of these ways:

- In the list grouped by issue type, select a row to open the issue type drawer, then select **OPEN IN NEW TAB**.
- In the drawer of a single issue, select **View for All Assets** in the blue banner.
- In quick view, the right side shows the selected issue type's page; **OPEN IN NEW TAB** opens it on its own.
- On the EASM dashboard or the Issues **OVERVIEW** tab, select a row in **MOST CRITICAL ISSUES** or
  **MOST SEEN ISSUES**.

The page address is `https://platform.deepinfo.com/app/easm/issues/<issue type id>`.

## Read the Screen

![An issue type page on its OVERVIEW tab with the header and the tabs, numbered 1 and 2, above the INFO and SCORE cards.](/img/guide/easm/issue-types-01.png)

1. **Header:** the breadcrumb **EASM / ISSUES /** followed by the issue type's name in capitals, then the name
   as the page title.
2. **Tabs:** **OVERVIEW**, **ASSETS**, **VULNERABILITIES** (only for issue types about a technology) and
   **ISSUE INFO**.

### OVERVIEW

| Card | What it shows |
|---|---|
| **INFO** | **CATEGORY**, **FIRST SEEN** and **LAST SEEN** |
| **SCORE** | The issue type's A to F grade and score, and a **TIMELINE** chart. Choose **DAILY**, **WEEKLY** or **MONTHLY** in the dropdown |
| **AVERAGE ISSUE DURATION** | The average duration of issues of this type, in days |
| **AVERAGE FIX DURATION** | The average time taken to fix them, in days |
| **TOTAL ASSETS** | How many assets have this issue, split into **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES**. Select the chart to open **ASSETS** |
| **STATES** | The issues of this type by state, active and inactive |

### ASSETS

![The ASSETS tab of an issue type page with the SUBDOMAINS chip selected and the CHANGE STATUS menu open on a STATE chip.](/img/guide/easm/issue-types-02.png)

- **Header:** the number of assets, **EXPORT** and **VIEW SETTINGS**.
- **Chips:** **ALL**, **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES** narrow the list to one
  asset type.
- **Columns:** **ASSET NAME**, **FIRST SEEN**, **LAST SEEN** and **STATE**.

The tab lists the assets where the issue is active. Select a row to open the asset drawer. Select a **STATE**
chip to change the state of the issue on that asset.

### VULNERABILITIES

For an issue type about a technology, this tab lists the known CVEs of that technology.

- **Header:** the number of vulnerabilities, **EXPORT** (not available on this tab) and **VIEW SETTINGS**.
- **Chips:** **ALL**, **CRITICAL**, **HIGH**, **MEDIUM** and **LOW**.
- **Columns:** **CVE ID**, **SCORE/SEVERITY**, **PUBLISHED DATE** and **LAST MODIFIED DATE**. The columns do
  not sort.

Select a row to open the CVE drawer.

### ISSUE INFO

- A menu on the left jumps to **DESC.**, **REM.** and **CLASS.**
- **DESCRIPTION**, with **External References**.
- **REMEDY**: how to fix the issue.
- **CLASSIFICATIONS**: the compliance and weakness frameworks the issue type maps to, with the number found.
  Each shows the framework's logo, its identifier and a **DESCRIPTION**. Frameworks include OWASP Top 10
  (2021), CWE, CAPEC and WASC. Some issue types have no classification.

![The ISSUE INFO tab with the DESC., REM. and CLASS. side menu and the CLASSIFICATIONS section.](/img/guide/easm/issue-types-03.png)

## Work Through an Issue Type

1. On **ISSUE INFO**, read the **DESCRIPTION** and the **REMEDY**.
2. On **OVERVIEW**, check how many assets are affected and how the score has moved.
3. On **ASSETS**, narrow the list with a chip, for example **DOMAINS**, and open each asset to check it.
4. Fix the issue on the asset, or record your decision by changing its state: select the **STATE** chip, or
   tick several rows (or **SELECT THIS PAGE**) and use **CHANGE ALL STATUS**. See
   [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).
5. For an issue type about a technology, open **VULNERABILITIES** and start with the **CRITICAL** chip.

To export the affected assets, select **EXPORT** on **ASSETS**. For the export options, see
[Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

## States, Colours and Scores

- The grade on **SCORE** uses the same A to F bands as asset scores. See
  [How security scores work](/guide/easm/security-score/).
- For severity colours, see [Triage issues](/guide/easm/issues/). For the states, see
  [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).

## Good to Know

- **ASSETS** lists active issues only. To see this issue type's inactive issues, untick **GROUP BY ISSUE TYPES**
  on **ISSUE LIST**, tick **SHOW INACTIVES** and filter by **ISSUE**.
- If you open the address of an issue type that no longer exists, the platform returns you to **ISSUE LIST**
  with an error message.
- In the issue type drawer, the CVE cards can show the published date as **LAST MODIFIED DATE**. The
  **VULNERABILITIES** tab on this page shows both dates correctly.
- For one issue on one asset, with its proof, see [Investigate an asset](/guide/easm/asset-details/).

## Do This With the API

- The issue type: [Issue Type Detail](/reference/easm/issue-type-detail/)
- Its score over time: [Issue Type Security Score Timeline](/reference/easm/issue-type-security-score-timeline/)
- Average issue and fix durations: [Issue Duration Stats](/reference/easm/issue-duration-stats/)
- Affected assets per type: [Issue Asset Type Stats](/reference/easm/issue-asset-type-stats/)
- The issues of this type, per asset: [Issue Search](/reference/easm/issue-search/)
- Export them: [Issue Export](/reference/easm/issue-export/)
- The technology's known CVEs: [Technology Vulnerabilities](/reference/easm/technology-vulnerabilities/)


---

# Change the State of Issues and Vulnerabilities

URL: https://docs.deepinfo.com/guide/easm/change-issue-state/

Mark issues and asset vulnerabilities as ignored, risk accepted, resolved or false positive, one at a time or in bulk, and revert or undo the change.

When you have decided what to do about a finding, record it by changing its state: ignore it, accept the
risk, or mark it as resolved or as a false positive. The same states apply to issues and to vulnerabilities
on an asset.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.
- You need at least one issue, or one vulnerability on an asset.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ISSUES** · **Tab:** **ISSUE LIST** · [https://platform.deepinfo.com/app/easm/issues](https://platform.deepinfo.com/app/easm/issues)

On the **ISSUE LIST**, untick **GROUP BY ISSUE TYPES** first. You can also change a state wherever the state
chip can be selected, or through a menu:

| Where | How |
|---|---|
| [Issue List](/guide/easm/issues/), with **GROUP BY ISSUE TYPES** unticked | Select the **STATE** chip, or tick rows for a bulk change |
| Issue drawer, and the issue's own page under its asset | **…** › **CHANGE STATE** (on the page: **CHANGE STATE**) |
| Asset detail page, **ISSUES** tab | Select the **STATE** chip, or tick rows for a bulk change |
| Issue type page, **ASSETS** tab | Select the **STATE** chip of an asset |
| CVE drawer (from the [Vulnerability List](/guide/easm/vulnerabilities/)), **ASSETS** tab | Select the state chip of an asset |
| CVE page, **ASSETS** tab | Select the **STATE** chip of an asset |
| Asset detail page, **VULNERABILITIES** tab | Tick rows for a bulk change |

The **VULNERABILITIES LIST** itself has no state chips: its rows are CVEs, and a CVE is only **ACTIVE** or
**INACTIVE**. Change the state per asset instead.

## Change One Item From Its State Chip

1. Select the state chip.
2. The **CHANGE STATUS** menu lists **IGNORE**, **ACCEPT RISK**, **MARK AS RESOLVED** and
   **MARK AS FALSE POSITIVE**, without the current state. Select one.
3. A confirmation shows how many items will change and the new state. Select **CHANGE**.
4. The confirmation stays open for a few seconds while the change is applied. Then the list refreshes and a
   message confirms the change, with **UNDO**.

To leave the menu without a change, select **CANCEL**.

![The CHANGE STATUS menu open on a STATE chip, with IGNORE, ACCEPT RISK, MARK AS RESOLVED, MARK AS FALSE POSITIVE and CANCEL.](/img/guide/easm/change-issue-state-01.png)

## Change One Issue From Its Drawer

1. On the [Issue List](/guide/easm/issues/), untick **GROUP BY ISSUE TYPES** and select the issue's row.
2. In the drawer, open the **…** menu and select **CHANGE STATE**.
3. The **Change State** popup shows the **CURRENT STATE:** and, after an arrow, the **MARK AS:** list. The
   list starts on **IGNORED**; the other choices are **RISK ACCEPTED**, **MARKED AS RESOLVED** and
   **MARKED AS FALSE POSITIVE**. Check your choice before you select **CHANGE**.
4. Confirm with **CHANGE**.

To close the popup without a change, select **CANCEL**.

![The Change State popup with the current state, the MARK AS list open on the states you can set, and CANCEL.](/img/guide/easm/change-issue-state-02.png)

## Change Several Issues at Once

1. Tick the rows you want to change. To tick every row on the page, open the checkbox menu and select
   **SELECT THIS PAGE**. The bar shows how many rows are selected; **CLEAR SELECTION** unticks them.
2. Select **CHANGE ALL STATUS**.
3. Under **TO:**, choose **IGNORED**, **RISK ACCEPTED**, **MARKED AS RESOLVED** or
   **MARKED AS FALSE POSITIVE**.
4. Confirm with **CHANGE**.

On the Issue List, a bulk change applies to the rows you ticked.

![Two ticked issue rows with the CHANGE ALL STATUS menu open under TO:, listing the states you can set.](/img/guide/easm/change-issue-state-03.png)

## Revert or Undo a Change

You can take back a state you set in three ways:

- **UNDO** in the message that appears after a change. It asks you to confirm again.
- **REVERT IT** in the state chip's menu, shown for **IGNORED**, **RISK ACCEPTED**, **MARKED AS RESOLVED**
  and **MARKED AS FALSE POSITIVE**.
- **REVERT STATE** in the **Change State** popup, shown for the same states.

Each asks for confirmation. The bulk **TO:** menu has no revert option; use **UNDO** right after a bulk
change.

## Change the State of a Vulnerability on an Asset

A CVE can affect several assets, and each asset has its own state for it.

1. Open the CVE: select its row in the [Vulnerability List](/guide/easm/vulnerabilities/) and open the
   drawer's **ASSETS** tab, or open the CVE page and its **ASSETS** tab.
2. Select the state chip of the asset.
3. Choose **IGNORE**, **ACCEPT RISK**, **MARK AS RESOLVED** or **MARK AS FALSE POSITIVE**.
4. Confirm with **CHANGE**. A message confirms the change, with **UNDO**.

To change several vulnerabilities of one asset together, open the asset's detail page, go to the
**VULNERABILITIES** tab, tick the rows and select **CHANGE ALL STATUS**. Choose the new state under **TO:**
and confirm with **CHANGE**.

## The Issue States

Every issue, and every vulnerability on an asset, has one state. It is shown as a two-part chip, for example
**ACTIVE | NEWLY DETECTED**. Filters list the same states as **Active - Newly Detected** and so on.

| Group | State | Set by | Action that sets it |
|---|---|---|---|
| **ACTIVE** | **NEWLY DETECTED** | the platform | None |
| **ACTIVE** | **UNRESOLVED** | the platform | None |
| **ACTIVE** | **REAPPEARED** | the platform | None |
| **INACTIVE** | **NOT APPLICABLE** | the platform | None |
| **INACTIVE** | **VERIFIED RESOLVED** | the platform | None |
| **INACTIVE** | **IGNORED** | you | **IGNORE** |
| **INACTIVE** | **RISK ACCEPTED** | you | **ACCEPT RISK** |
| **INACTIVE** | **MARKED AS RESOLVED** | you | **MARK AS RESOLVED** |
| **INACTIVE** | **MARKED AS FALSE POSITIVE** | you | **MARK AS FALSE POSITIVE** |

Only the states you set (**IGNORED**, **RISK ACCEPTED**, **MARKED AS RESOLVED** and **MARKED AS FALSE
POSITIVE**) can be reverted. Reverting returns the item to its previous, active state.

## Good to Know

- The states you set are all inactive. Lists that show active items only drop the item after the change.
  In the Issue List and on the asset's **ISSUES** tab, tick **SHOW INACTIVES** to see it again.
- A change takes a few seconds to apply. Wait for the list to refresh before you check the result.
- The **CHANGE STATUS** menu also opens on states the platform set, such as **VERIFIED RESOLVED**. States set
  by the platform (**NEWLY DETECTED**, **UNRESOLVED**, **REAPPEARED**, **NOT APPLICABLE**,
  **VERIFIED RESOLVED**) cannot be reverted.

## Do This With the API

Issues:

- [Issue Ignore](/reference/easm/issue-ignore/)
- [Issue Accept Risk](/reference/easm/issue-accept-risk/)
- [Issue Mark Resolved](/reference/easm/issue-mark-resolved/)
- [Issue Mark False Positive](/reference/easm/issue-mark-false-positive/)
- [Issue Revert](/reference/easm/issue-revert/)

Vulnerabilities on an asset:

- [Vulnerability Ignore](/reference/easm/vulnerability-ignore/)
- [Vulnerability Accept Risk](/reference/easm/vulnerability-accept-risk/)
- [Vulnerability Mark Resolved](/reference/easm/vulnerability-mark-resolved/)
- [Vulnerability Mark False Positive](/reference/easm/vulnerability-mark-false-positive/)
- [Vulnerability Revert](/reference/easm/vulnerability-revert/)

> [!WARNING]
> These endpoints change every record that matches the filter you send, and an empty filter matches all
> records. Always send a filter.


---

# Issue Insights

URL: https://docs.deepinfo.com/guide/easm/issue-insights/

Track how your issues develop over time, from resolution, reappearance and false-positive rates to severity and state mix, categories, the most affected assets and fix times.

The **INSIGHTS** tab of Issues shows how your issues develop: how many you resolve, how many come back, how
they split by severity, state and category, which assets have the most, and how long fixes take.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ISSUES** · **Tab:** **INSIGHTS** · [https://platform.deepinfo.com/app/easm/issues/insights](https://platform.deepinfo.com/app/easm/issues/insights)

## Read the Screen

![The top of the Issues INSIGHTS tab with the four rate cards, the SEVERITY chart and the TIMELINE chart, numbered 1 to 3.](/img/guide/easm/issue-insights-01.png)

1. **Cards:**

   | Card | What it shows |
   |---|---|
   | **TOTAL ISSUES** | Your active issues, with the change over the **LAST 30 DAYS** |
   | **RESOLUTION RATE** | The share of your issues that are resolved, with the number of issues resolved |
   | **REAPPEARED RATE** | The share of your issues that were resolved and then came back |
   | **FALSE POSITIVE RATE** | The share of your issues marked as false positives |

2. **SEVERITY:** your issues per severity.
3. **TIMELINE:** issues per severity over time, with a legend for **CRITICAL**, **HIGH**, **MEDIUM**, **LOW** and
   **INFORMATION**. Choose the interval in the dropdown.
4. **STATES:** two charts, **ACTIVE ISSUES** and **INACTIVE ISSUES**, broken down by state.
5. **STATE DISTRIBUTION:** a pie of **ACTIVE**, **INACTIVE** and **RESOLVED**. See
   [Good to Know](#good-to-know) before you read it.
6. **ASSETS:**
   - **TOP AFFECTED DOMAINS**: the assets with the most active issues, with **ASSET** and **ISSUE COUNT** (the
     total and the count per severity).
   - **TOP 5 ASSETS BY RESOLVED ISSUE COUNT**: with **ASSET** and **RESOLVED**, shown as resolved issues out of
     all issues on the asset. An asset can carry the **SEEMS INACTIVE** ribbon.
7. **ISSUES CATEGORIES:** issues per category, broken down by severity.
8. **AVERAGE ISSUE DURATION** and **AVERAGE FIX DURATION**, in days.

![The STATES charts for active and inactive issues next to the STATE DISTRIBUTION pie.](/img/guide/easm/issue-insights-02.png)

![The ASSETS section with its two asset tables, the ISSUES CATEGORIES chart and the two duration cards.](/img/guide/easm/issue-insights-03.png)

## Use the Page

- **Measure progress:** watch **RESOLUTION RATE** rise and **AVERAGE FIX DURATION** fall over the weeks.
- **Catch regressions:** a rising **REAPPEARED RATE** means fixed issues are coming back. To list them, untick
  **GROUP BY ISSUE TYPES** on **ISSUE LIST** and filter **STATE** for **Active - Reappeared**.
- **Check your triage:** a high **FALSE POSITIVE RATE** is worth a look. To list those issues, untick
  **GROUP BY ISSUE TYPES** on **ISSUE LIST**, tick **SHOW INACTIVES** and filter **STATE** for
  **Inactive - Marked As False Positive**.
- **Choose where to work:** **TOP AFFECTED DOMAINS** shows the assets with the most active issues. Select a row
  to open the asset.

## States, Colours and Scores

| Figure | Counts | Out of |
|---|---|---|
| **TOTAL ISSUES** | Active issues | Not a rate: the count itself |
| **RESOLUTION RATE** | Resolved issues | All issues, active and inactive |
| **REAPPEARED RATE** | Issues in the state **REAPPEARED** | All issues, active and inactive |
| **FALSE POSITIVE RATE** | Issues in the state **MARKED AS FALSE POSITIVE** | All issues, active and inactive |

For what each state means, see
[Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).

## Good to Know

- **STATE DISTRIBUTION can count resolved issues twice.** The **RESOLVED** slice can also be included in
  **INACTIVE**, so the three slices can add up to more than your number of issues. For the plain split between
  active and inactive issues, use **STATES**.
- **TOTAL ISSUES** counts active issues only, while the three rates are shares of all your issues, active and
  inactive.
- The page is for reading only. It has no filters and no export.
- The Issues **OVERVIEW** tab has more summary cards; see [Triage issues](/guide/easm/issues/).

## Do This With the API

- Issues per severity: [Issue Severity Stats](/reference/easm/issue-severity-stats/)
- Issues per state: [Issue State Stats](/reference/easm/issue-state-stats/)
- Average issue and fix durations: [Issue Duration Stats](/reference/easm/issue-duration-stats/)
- Issues per category: [Issue Category Stats](/reference/easm/issue-category-stats/)
- Issues per severity over time: [Issue Severity Stats Timeline](/reference/easm/issue-severity-stats-timeline/)


---

# Prioritize Vulnerabilities

URL: https://docs.deepinfo.com/guide/easm/vulnerabilities/

Use the Vulnerability List to rank the CVEs on your assets by CVSS score, EPSS and CISA KEV status, open a CVE with its affected assets, and export the list.

The Vulnerability List shows every active CVE that affects at least one of your assets. Use its scores and
exploitation signals to decide which CVEs to fix first.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **VULNERABILITIES** · **Tab:** **VULNERABILITIES LIST** · [https://platform.deepinfo.com/app/easm/vulnerabilities](https://platform.deepinfo.com/app/easm/vulnerabilities)

The [EASM dashboard](/guide/easm/dashboard/)'s **GO TO VULNERABILITIES PAGE** and the
[Global dashboard](/guide/global-dashboard/)'s **TOTAL VULNERABILITIES** card open it too. Vulnerabilities has
three in-page tabs:

| Tab | What it holds | Deep link |
|---|---|---|
| **OVERVIEW** | Summary cards (see [The OVERVIEW tab](#the-overview-tab)) | [/app/easm/vulnerabilities/overview](https://platform.deepinfo.com/app/easm/vulnerabilities/overview) |
| **VULNERABILITIES LIST** | The CVEs, described on this page | [/app/easm/vulnerabilities](https://platform.deepinfo.com/app/easm/vulnerabilities) |
| **INSIGHTS** | Volume over time, exploitability and the top CVEs; see [Vulnerability insights](/guide/easm/vulnerability-insights/) | [/app/easm/vulnerabilities/insights](https://platform.deepinfo.com/app/easm/vulnerabilities/insights) |

## Read the Screen

![The VULNERABILITIES LIST tab on ALL VULNERABILITIES with the filter bar, result row, severity tabs and list, numbered 1 to 4.](/img/guide/easm/vulnerabilities-01.png)

The header breadcrumb reads **EASM / VULNERABILITIES / VULNERABILITIES LIST**.

1. **Filter bar:** **SEARCH** (by CVE ID), the category chips **CVE**, **CVSS**, **CWE**, **EPSS**,
   **CISA KEV**, **AFFECTED ASSETS**, **DATES** and **STATE**, and the list and quick view icons.
2. **Result row:** the number of vulnerabilities found, **EXPORT** and **VIEW SETTINGS**.
3. **Severity tabs** with counts: **ALL VULNERABILITIES**, **CRITICAL**, **HIGH**, **MEDIUM** and **LOW**.
4. **The list**, one row per CVE.

| Column | What it shows |
|---|---|
| **CVE ID** | The CVE ID, a red **EXPLOITABLE** pill above it for CVEs in the CISA KEV catalogue, a **Certain** or **Potential** icon, and the CWE name and number. A danger indicator of up to three bars sits next to it |
| **ASSETS** | How many of your assets it affects |
| **SCORE/SEVERITY** | The CVSS base score and the severity |
| **CLASSIFICATION** | A **C/I/A** chip with the impact on confidentiality, integrity and availability, one letter each (for example `C/I/A: H/L/N`; hover for details), and an **OWASP** chip |
| **EPSS** | The CVE's EPSS value, as a percentage bar |
| **FIRST SEEN DATE** | When it was first found on your assets, with the time since |
| **LAST SEEN DATE** | When it was last found, with the time since |

The danger indicator adds one bar each when the CVE is critical, when it is certain, and when it is in the
CISA KEV catalogue.

![Vulnerability list rows with EXPLOITABLE pills and the C/I/A tooltip open on one row.](/img/guide/easm/vulnerabilities-02.png)

## Prioritize the List

1. Start on the **CRITICAL** tab.
2. Look for the red **EXPLOITABLE** pill: the CVE is in the CISA KEV catalogue.
3. Sort the list. Select a column header (every column except **CLASSIFICATION** sorts), or open
   **VIEW SETTINGS** › **Sort By** and pick **CVE ID**, **Assets**, **Score/Severity**, **EPSS**,
   **First Seen Date** or **Last Seen Date** and a direction. **Assets**, **Score/Severity** and **EPSS** are
   the most useful for ranking.
4. Open a CVE to see which assets it affects and, for a CVE in the CISA KEV catalogue, the required action
   (see below).
5. On each affected asset, record your decision by changing the state. See
   [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/#change-the-state-of-a-vulnerability-on-an-asset).

## Filter the List

**SEARCH** matches the CVE ID. Each category chip opens **Select field**, where you pick one of its fields:

| Chip | Fields, for example |
|---|---|
| **CVE** | CVE ID, CVE Published, CVE Last Modified |
| **CVSS** | CVSS Version, CVSS Base Score, CVSS Base Severity, the impact on confidentiality, integrity and availability |
| **CWE** | CWE ID, CWE OWASP Top 10 (2021), CWE Name |
| **EPSS** | EPSS, EPSS Percentile, EPSS Date |
| **CISA KEV** | CISA KEV Vendor/Project, Product, Vulnerability Name, Date Added, Required Action, Due Date, Known Ransomware Campaign Use |
| **AFFECTED ASSETS** | The number of affected assets, in total and per asset type |
| **DATES** | First Seen Date, Last Seen Date, Last Check Date |
| **STATE** | The CVE's state |

Then set the rule (**Must**, **Must Not** or **Should**), the operator and the **Value**. Text fields offer
**Equal**, **Wildcard**, **Fuzzy**, **Contains Any**, **Start With** and **Exists**. Number fields, such as
**EPSS**, use **Between** with a minimum and a maximum. Select **APPLY**. A chip with active conditions shows
their number.

The rules work as in the API; see [Search & filters](/getting-started/search-and-filters/).

![The CISA KEV filter chip open with its Select field list of CISA KEV fields.](/img/guide/easm/vulnerabilities-03a.png)

![The EPSS filter chip with the EPSS field, the Must rule, the Between operator and the MINIMUM and MAXIMUM boxes.](/img/guide/easm/vulnerabilities-03b.png)

## Open a CVE

Select a row to open the CVE drawer. **OPEN IN NEW TAB** opens the CVE page.

The top of the drawer shows the score and severity, the **CERTAIN** or **POTENTIAL** flag, the CVE ID, the
CWE, the **C/I/A** chip and, for a new finding, a **NEW** badge. For a CVE in the CISA KEV catalogue, an
**EXPLOITABLE** strip and a CISA KEV block follow, with **ADDED TO KEV**, **REMEDIATION DUE**,
**REQUIRED ACTION**, **SHORT DESCRIPTION** and **NOTES**.

The drawer's tabs are icons down the side; hover over an icon to see its name.

| Tab | What it shows |
|---|---|
| **OVERVIEW** | Under **VULNERABILITY INFO**: **VENDOR**, **EPSS SCORE**, **PUBLISHED DATE**, **LAST MODIFIED DATE** and the CVE description |
| **ASSETS** | Your assets where the CVE is active, with **FIRST SEEN**, **LAST SEEN** and a **STATE** chip you can change. **EXPORT** downloads the list |
| **CISA KEV CATALOG** | The CISA KEV entry: **VENDOR / PROJECT**, **PRODUCT**, **DATE ADDED**, **KNOWN RANSOMWARE USE**, **SHORT DESCRIPTION**, **REQUIRED ACTION** and notes, with a **RANSOMWARE** badge when ransomware use is known |
| **IMPACT PROFILE** | Confidentiality, integrity and availability impact |
| **WEAKNESS IDENTITY** | The CWE with its description, impact badges and CAPEC references |
| **CVSS METRICS** | The CVSS vector and its values, **Exploitability**, **Impact**, **Base score** and **Severity** |
| **AFFECTED PRODUCT** | The affected products, with **PRODUCT TYPE**, **VENDOR**, **VERSION**, **ALL AFFECTED VERSIONS** and **ALL CPE NAMES** |
| **REFERENCES** | Reference links, each with its source and tags such as **EXPLOIT** |

**VENDOR** shows the first affected product listed for the CVE, with the number of others. For the full list,
open **AFFECTED PRODUCT**.

![The top of the CVE drawer for a CVE in the CISA KEV catalogue, with the EXPLOITABLE strip and the CISA KEV block.](/img/guide/easm/vulnerabilities-04a.png)

![The ASSETS tab of the CVE drawer with the CHANGE STATUS menu open on an asset's state chip.](/img/guide/easm/vulnerabilities-04b.png)

### The CVE Page

The CVE page (breadcrumb **EASM / VULNERABILITIES /** CVE ID) has the same header and three tabs. See
[Vulnerability details](/guide/easm/vulnerability-details/) for the full page.

- **OVERVIEW:** **INFO** (**VENDOR / PRODUCT**, **EPSS SCORE**, **PUBLISHED DATE**, **LAST MODIFIED DATE**),
  **CVSS SCORE** on a 0–10 gauge, and **AFFECTED ASSETS** with a count per asset type.
- **ASSETS:** **ASSET NAME**, **STATE**, **FIRST SEEN** and **LAST SEEN**, with chips to show one asset type.
  Change an asset's state from its **STATE** chip.
- **VULNERABILITY INFO:** **IMPACT PROFILE**, **WEAKNESS IDENTITY**, **ATTACK PROFILE**,
  **DETECTION & FORENSICS**, **AFFECTED PRODUCT** and **META INFO**.

## Export the List

1. Select **EXPORT**. The **DOWNLOAD** dialog opens.
2. Choose the **RECORDS**: **ALL** exports all active CVEs. **FILTERED** is offered when filters are applied
   and exports what you see: the current tab, your filters and your sort.
3. Choose the **FILE FORMAT**, **CSV** or **JSON**, and select **DOWNLOAD**.

For the other options in the dialog, see
[Browse your asset inventory](/guide/easm/asset-inventory/#export-the-list).

## Quick View

Select the quick view icon for a CVE list on the left and the selected CVE's full page on the right, with
**OPEN IN NEW TAB**. The left list shows each CVE's score, its ID and an **EXP.** pill for CISA KEV CVEs. Use
**LOAD MORE** to page through.

## The OVERVIEW Tab

![The Vulnerabilities OVERVIEW tab with its summary cards and the most critical and most seen vulnerability tables.](/img/guide/easm/vulnerabilities-05.png)

| Card | What it shows |
|---|---|
| **TOTAL VULNERABILITIES** | With a change chip and **LAST 30 DAYS** |
| **SEVERITY STATS** | The count for the severities **CRITICAL**, **HIGH** and **MEDIUM** |
| **AVERAGE EXPLOITABILITY SCORE** | As a percentage |
| **KNOWN EXPLOITABLE VULN.** | In red: the number of assets affected by known-exploitable vulnerabilities |
| **MOST CRITICAL VULNERABILITIES** | **CVE ID** and **SCORE/SEVERITY** |
| **MOST SEEN VULNERABILITIES** | **CVE ID** and **ASSETS** |

The severity tabs of the **VULNERABILITIES LIST** show the count of every severity.

## States, Colours and Scores

| Signal | Scale | Meaning |
|---|---|---|
| **SCORE/SEVERITY** | 0–10 | The CVSS base score (version 3, or version 2 when there is no version 3 score) |
| **EPSS** | percentage | The CVE's EPSS value |
| **EXPLOITABLE** / **EXP.** | yes or no | The CVE is in the CISA KEV catalogue |
| **Certain** | flag | "This vulnerability has been verified through testing and confirmed as valid." |
| **Potential** | flag | "This vulnerability has been identified through testing but not yet confirmed." |
| **NEW** | badge | First detected on your assets in the last 7 days |

These scales are not the security score. See [How security scores work](/guide/easm/security-score/).

## Good to Know

- The list shows active CVEs only.
- You cannot change a state from the list rows. Open the CVE and change it per asset on the **ASSETS** tab.
- **KNOWN EXPLOITABLE VULN.** counts affected assets, not CVEs.
- **VIEW SETTINGS** also sets the page size (25, 50, 75 or 100) and, under **SHOWN**, the visible columns.

## Do This With the API

- Search vulnerabilities: [Vulnerability Search](/reference/easm/vulnerability-search/)
- The assets a CVE affects: [Vulnerability Asset Search](/reference/easm/vulnerability-asset-search/)
- Export as CSV or JSON: [Vulnerability Export](/reference/easm/vulnerability-export/)
- Counts per severity: [Vulnerability Severity Stats](/reference/easm/vulnerability-severity-stats/)
- Known-exploitable counts: [Vulnerability Known Exploitable Stats](/reference/easm/vulnerability-known-exploitable-stats/)
- Average exploitability: [Vulnerability Exploitability Score Stats](/reference/easm/vulnerability-exploitability-score-stats/)


---

# Vulnerability Details

URL: https://docs.deepinfo.com/guide/easm/vulnerability-details/

Open one CVE to see its severity and exploitation signals, which of your assets it affects and in what state, and its full CVE record.

A vulnerability is a CVE that affects at least one of your assets. Its page shows how severe the CVE is,
whether it is known to be exploited, which of your assets it affects and in what state, and the full CVE
record.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **VULNERABILITIES** · **Tab:** **VULNERABILITIES LIST** · [https://platform.deepinfo.com/app/easm/vulnerabilities](https://platform.deepinfo.com/app/easm/vulnerabilities)

Select a CVE to open its drawer, then select **OPEN IN NEW TAB**. You can also reach the page from:

- quick view on **VULNERABILITIES LIST**: **OPEN IN NEW TAB** above the selected CVE;
- the **MOST CRITICAL VULNERABILITIES** and **MOST SEEN VULNERABILITIES** rows on the EASM dashboard and on
  the Vulnerabilities **OVERVIEW** tab, and **TOP VULNERABILITIES** on its **INSIGHTS** tab;
- an asset's **VULNERABILITIES** tab (see [Investigate an asset](/guide/easm/asset-details/)).

The page address is `https://platform.deepinfo.com/app/easm/vulnerabilities/<CVE ID>`.

## Read the Screen

![The header of a CVE page for a CVE in the CISA KEV catalogue, with the EXPLOITABLE strip, the KEV block and the tabs.](/img/guide/easm/vulnerability-details-01.png)

**Header.** The breadcrumb **EASM / VULNERABILITIES /** followed by the CVE ID, then:

- the score and severity, and a **CERTAIN** or **POTENTIAL** flag;
- the CVE ID, the CWE name and number, and the **C/I/A** chip (the impact on confidentiality, integrity and
  availability);
- for a CVE in the CISA KEV catalogue, a red **EXPLOITABLE** strip that says a weaponized exploit is
  somewhat likely, and a block with the vulnerability's name, the vendor and product, **ADDED TO KEV**,
  **REMEDIATION DUE**, **REQUIRED ACTION**, **SHORT DESCRIPTION** and **NOTES**.

**Tabs:** **OVERVIEW**, **ASSETS** and **VULNERABILITY INFO**.

### OVERVIEW

| Card | What it shows |
|---|---|
| **INFO** | **VENDOR / PRODUCT**: the first affected vendor and product, with a count of the others. **EPSS SCORE**, **PUBLISHED DATE** and **LAST MODIFIED DATE** |
| **CVSS SCORE** | The CVSS base score on a 0–10 gauge, with the severity |
| **AFFECTED ASSETS** | How many of your assets the CVE affects, with the count per asset type |

### ASSETS

![The ASSETS tab of a CVE page with the SUBDOMAINS chip selected and the list of affected assets with their states.](/img/guide/easm/vulnerability-details-02.png)

- **Header:** the number of assets, **EXPORT** (not available on this tab; see [Good to Know](#good-to-know))
  and **VIEW SETTINGS**.
- **Chips:** **ALL**, **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES**.
- **Columns:** **ASSET NAME**, **STATE**, **FIRST SEEN** and **LAST SEEN**. The columns do not sort.

The tab lists the assets where the CVE is active. Select a row to open the asset drawer.

### VULNERABILITY INFO

| Section | What it shows |
|---|---|
| **IMPACT PROFILE** | The impact on confidentiality, integrity and availability |
| **WEAKNESS IDENTITY** | The CWE, with its description, impact and related CAPEC entries |
| **ATTACK PROFILE** | **ATTACK VECTOR**, **ATTACK COMPLEXITY**, **PRIVILEGES REQUIRED**, **DESTINATION** and **SCOPE** |
| **DETECTION & FORENSICS** | **DETECTION METHOD**, **ATTACK STAGES**, **ANALYSIS DATE** and **CVE ORIGIN** |
| **AFFECTED PRODUCT** | The affected products |
| **META INFO** | **CVE ID**, **ASSIGNER**, **PROBLEM TYPE**, **REFERENCES** and **DATA VERSION** |

## Decide What to Do About a CVE

1. In the header, check whether the CVE is **EXPLOITABLE**. If it is, read **REQUIRED ACTION** and note the
   **REMEDIATION DUE** date.
2. On **OVERVIEW**, check the **CVSS SCORE** and the **EPSS SCORE**.
3. On **ASSETS**, see which assets are affected. Narrow the list with a chip and open each asset to check it.
4. Fix the CVE on the asset, or record your decision: select the asset's **STATE** chip and choose a state. The
   state applies to this CVE on this asset only. See
   [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).

To change the state of several vulnerabilities at once, use the **VULNERABILITIES** tab of an asset; see
[Investigate an asset](/guide/easm/asset-details/).

## States, Colours and Scores

| Signal | Scale | Meaning |
|---|---|---|
| Score and severity | 0–10 | The CVSS base score |
| **EPSS SCORE** | percentage | The CVE's EPSS value |
| **EXPLOITABLE** | yes or no | The CVE is in the CISA KEV catalogue |
| **CERTAIN** | flag | "This vulnerability has been verified through testing and confirmed as valid." |
| **POTENTIAL** | flag | "This vulnerability has been identified through testing but not yet confirmed." |
| **NEW** | badge | First detected on your assets in the last 7 days |

These scales are not the security score. See [Prioritize vulnerabilities](/guide/easm/vulnerabilities/) and
[How security scores work](/guide/easm/security-score/).

## Good to Know

- **Check the CVE ID in the address.** The address of a CVE ID that does not exist, for example a mistyped one,
  can still open a page with no data, without an error: a score of 0, no assets and today's date as the
  published date.
- To export the affected assets, use the **EXPORT** button on the **ASSETS** tab of the CVE drawer, which opens
  from **VULNERABILITIES LIST**.
- **VENDOR / PRODUCT** shows only the first product in the CVE's list. For the full list, open
  **VULNERABILITY INFO** › **AFFECTED PRODUCT**.

## Do This With the API

- The CVE record: [Vulnerability Detail](/reference/vulnerability/detail/)
- The CVE on your assets: [Vulnerability Search](/reference/easm/vulnerability-search/)
- The affected assets and their states: [Vulnerability Asset Search](/reference/easm/vulnerability-asset-search/)
- Export the affected assets: [Vulnerability Asset Export](/reference/easm/vulnerability-asset-export/)


---

# Vulnerability Insights

URL: https://docs.deepinfo.com/guide/easm/vulnerability-insights/

See how many vulnerabilities your assets have over time, how many assets are exposed to known-exploited CVEs, the average exploitability score and the highest-scoring CVEs.

The **INSIGHTS** tab of Vulnerabilities shows your vulnerabilities over time, how exposed your assets are to
CVEs that are known to be exploited, the average exploitability, and the CVEs with the highest scores.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **VULNERABILITIES** · **Tab:** **INSIGHTS** · [https://platform.deepinfo.com/app/easm/vulnerabilities/insights](https://platform.deepinfo.com/app/easm/vulnerabilities/insights)

## Read the Screen

![The Vulnerabilities INSIGHTS tab with the four cards, SEVERITY, TIMELINE, AVERAGE EXPLOITABILITY SCORE and TOP VULNERABILITIES, numbered 1 to 5.](/img/guide/easm/vulnerability-insights-01.png)

1. **Cards:**

   | Card | What it shows |
   |---|---|
   | **TOTAL VULNERABILITIES** | The sum of your vulnerabilities per severity, with the change over the **LAST 30 DAYS** |
   | **KNOWN EXPLOITABLE** | Labelled **ACTIVELY EXPLOITABLE CVEs**, but it counts your assets affected by CVEs in the CISA KEV catalogue, not the CVEs |
   | **ACTIVE** | The number of active vulnerabilities, labelled **REQUIRE ATTENTION** |
   | **AVG. EXPLOITABILITY SCORE** | The average exploitability score of your vulnerabilities, as a percentage, labelled **AVERAGE SCORE** |

2. **SEVERITY:** your vulnerabilities per severity.
3. **TIMELINE:** vulnerabilities per severity over time, with a legend for **CRITICAL**, **HIGH**, **MEDIUM**,
   **LOW**, **UNKNOWN** and **NONE**. Choose the interval in the dropdown.
4. **AVERAGE EXPLOITABILITY SCORE:** the same average as the card, as a meter.
5. **TOP VULNERABILITIES:** the CVEs with the highest CVSS scores, with **CVE ID**, **ASSETS** and
   **SCORE/SEVERITY**. Select a row to open the CVE's page; see
   [Vulnerability details](/guide/easm/vulnerability-details/).

## Use the Page

- **Watch the trend:** on **TIMELINE**, check whether critical and high vulnerabilities go down as you fix them.
- **Gauge your exposure to known exploits:** **KNOWN EXPLOITABLE** shows how many assets are affected by CVEs in
  the CISA KEV catalogue. To list those CVEs, open **VULNERABILITIES LIST** and look for the red
  **EXPLOITABLE** pill.
- **Start with the worst:** open the CVEs in **TOP VULNERABILITIES** and check their affected assets.

## Good to Know

- **TOTAL VULNERABILITIES and ACTIVE can show different numbers.** **TOTAL VULNERABILITIES** matches the counts
  on the severity tabs of **VULNERABILITIES LIST**. **ACTIVE** matches the result count above that list (the
  number before **VULNERABILITIES FOUND**).
- **KNOWN EXPLOITABLE** counts assets, not CVEs.
- **TOP VULNERABILITIES** ranks CVEs by score and does not check their state, so it can include a CVE that is
  no longer active on your assets. Check the CVE's **ASSETS** tab.
- The timeline can show **UNKNOWN** and **NONE** severities. **VULNERABILITIES LIST** has no tab for them.
- The page is for reading only. It has no filters and no export.
- The Vulnerabilities **OVERVIEW** tab has the summary cards; see
  [Prioritize vulnerabilities](/guide/easm/vulnerabilities/).

## Do This With the API

- Vulnerabilities per severity: [Vulnerability Severity Stats](/reference/easm/vulnerability-severity-stats/)
- Per severity over time: [Vulnerability Severity Stats Timeline](/reference/easm/vulnerability-severity-stats-timeline/)
- Known-exploitable counts (CVEs and assets): [Vulnerability Known Exploitable Stats](/reference/easm/vulnerability-known-exploitable-stats/)
- Average exploitability: [Vulnerability Exploitability Score Stats](/reference/easm/vulnerability-exploitability-score-stats/)
- Active vulnerabilities: [Vulnerability Search](/reference/easm/vulnerability-search/)


---

# Review Detected Technologies

URL: https://docs.deepinfo.com/guide/easm/technologies/

See the software, frameworks and services detected on your assets with their versions and known vulnerabilities, find out-of-date versions, and export the list.

External Attack Surface Management (EASM) detects the software, frameworks and services your assets run, for example a web server, an operating
system or a JavaScript library. The technology list shows each one with its versions, the latest
version, how many assets use it and its known vulnerabilities.

## Before You Start

- **Package:** EASM.
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **TECHNOLOGIES** · **Tab:** **TECHNOLOGIES LIST** · [https://platform.deepinfo.com/app/easm/technologies](https://platform.deepinfo.com/app/easm/technologies)

The **OVERVIEW** tab ([https://platform.deepinfo.com/app/easm/technologies/overview](https://platform.deepinfo.com/app/easm/technologies/overview))
holds the summary cards, and **INSIGHTS** the analysis; see [Technology insights](/guide/easm/technology-insights/).

## Read the Screen

![The TECHNOLOGIES LIST tab with the filter bar, the result line and the first rows of the list, numbered 1 to 3.](/img/guide/easm/technologies-01.png)

1. **Filter bar:** **SEARCH** (by technology name) and the filter chips **TECH. NAME**, **TECH. CATEGORY**,
   **AFFECTED ASSET COUNT**, **VERSIONS**, **VERSION SCOPE**, **LATEST VERSION** and **TOTAL VULN. COUNT**.
2. **Result line:** the number of technologies found, **EXPORT** and **VIEW SETTINGS**.
3. **The list:**

| Column | What it shows |
|---|---|
| **TECHNOLOGY** | The technology's name |
| **CATEGORY** | Its category, for example a JavaScript library |
| **VERSION** | The versions found on your assets, one per line |
| **LATEST VERSION** | The latest known version |
| **ASSETS** | How many of your assets use it |
| **VULNERABILITIES** | Its known vulnerabilities |

### The OVERVIEW Tab

| Card | What it shows |
|---|---|
| **TOTAL TECHNOLOGIES** | The number of technologies, with the change over the **LAST 30 DAYS** |
| **TOP CATEGORIES** | The categories with the most technologies |
| **MOST USED TECHNOLOGIES** | Technologies found on many of your assets |
| **VULNERABILITY STATS** | The vulnerabilities of your technologies, per severity |
| **OUTDATED TECHNOLOGIES** | Technologies with an out-of-date version: **TECHNOLOGY**, **VERSION**, **LATEST VERSION** |
| **MOST VULNERABLE TECHNOLOGIES** | Technologies with the most vulnerabilities: **TECHNOLOGY**, **VULNERABILITIES** |

## Find Outdated Technologies

1. Select the **VERSION SCOPE** chip.
2. Choose **Out of Date** as the value and select **APPLY**.

The list now shows only the technologies with an out-of-date version on your assets. The **ASSETS** and
**VULNERABILITIES** columns then count only the out-of-date use. To go back, choose **All**.

## Filter and Sort the List

- **SEARCH** matches the technology name.
- Each filter chip takes one condition, with no **Must** / **Must Not** / **Should** choice. For example,
  **VERSION SCOPE** takes **Equal** and a **Value**. Select **APPLY**, or **CANCEL** to close it.
- Select a column header to sort: once for descending order, again for ascending, and a third time to go back
  to the default order. All six columns sort.
- **VIEW SETTINGS** › **View Options** › **Sort By** sorts by **Technology**, **Categories**,
  **Affected Asset Count**, **Versions**, **Latest Versions** or **Vulnerability Stats**. **Result Per Page**
  sets 25, 50, 75 or 100 rows.

## Open a Technology

Select a row to open the technology drawer. The tabs on its left edge are icons; hover over one to see its name.
**OPEN IN NEW TAB** opens the full technology page; see [Technology details](/guide/easm/technology-details/).

![The technology drawer on its OVERVIEW tab with category, versions, latest version, description and INSIGHTS.](/img/guide/easm/technologies-02a.png)

![The technology drawer on its ASSETS tab listing each asset with its identified version.](/img/guide/easm/technologies-02b.png)

| Tab | What it shows |
|---|---|
| **OVERVIEW** | **CATEGORY**, the **VERSION** list, **LATEST VERSION**, a description, **INSIGHTS** with the number of assets that use it, and **FINDINGS** with its vulnerabilities |
| **ASSETS** | Every asset that uses it, each with its **IDENTIFIED VERSION** |
| **VULNERABILITIES** | The technology's known CVEs, each with **PUBLISHED DATE** and **LAST MODIFIED DATE** |
| **TECHNOLOGY INFO** | **DESCRIPTION**, **OFFICIAL WEBSITE**, the **EOL** (end-of-life) table and the list of the technology's CVEs |

## Export the List

1. Select **EXPORT**. The **DOWNLOAD** dialog opens.
2. Under **RECORDS**, choose **ALL**, or **FILTERED** for only the technologies that match your filters
   (offered when filters are applied).
3. Under **FILE FORMAT**, choose **CSV** or **JSON**, then select **DOWNLOAD**.

For the dialog's options, see [Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

## Good to Know

- **TECHNOLOGY INFO** describes the technology in general, not only its use on your assets.
- In the drawer, the CVE cards can show the published date as **LAST MODIFIED DATE**. The technology page's
  **VULNERABILITIES** tab shows both dates correctly.
- Technologies also appear per asset, on an asset's **TECHNOLOGIES** tab; see
  [Investigate an asset](/guide/easm/asset-details/).

## Do This With the API

- Search technologies: [Technology Search](/reference/easm/technology-search/)
- Export as CSV or JSON: [Technology Export](/reference/easm/technology-export/)
- One technology: [Technology Detail](/reference/easm/technology-detail/)
- The assets that use a technology: [Technology Asset Search](/reference/easm/technology-asset-search/)


---

# Technology Details

URL: https://docs.deepinfo.com/guide/easm/technology-details/

Open one technology to see which of your assets run it and in which version, its known vulnerabilities, and its end-of-life dates.

A technology's page shows which of your assets run it and in which version, the vulnerabilities known for it,
and when its releases reach end of life. Use it to plan upgrades.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **TECHNOLOGIES** · **Tab:** **TECHNOLOGIES LIST** · [https://platform.deepinfo.com/app/easm/technologies](https://platform.deepinfo.com/app/easm/technologies)

Select a technology to open its drawer, then select **OPEN IN NEW TAB**. You can also open a technology from
an asset's **TECHNOLOGIES** tab, or from the tables on the Technologies **OVERVIEW** and **INSIGHTS** tabs.

The page address is `https://platform.deepinfo.com/app/easm/technologies/<technology id>`.

## Read the Screen

![A technology page on its OVERVIEW tab with the header and the tabs, numbered 1 and 2, above the INFO, TOTAL ASSETS and FINDINGS cards.](/img/guide/easm/technology-details-01.png)

1. **Header:** the breadcrumb **EASM / TECHNOLOGIES /** followed by the technology's name in capitals, then
   the name as the page title.
2. **Tabs:** **OVERVIEW**, **ASSETS**, **VULNERABILITIES** and **TECHNOLOGY INFO**.

### OVERVIEW

| Card | What it shows |
|---|---|
| **INFO** | **CATEGORY** and **LATEST VERSION** |
| **TOTAL ASSETS** | How many of your assets use the technology, split into **DOMAINS**, **SUBDOMAINS**, **IP ADDRESSES** and **WEBSITES** |
| **FINDINGS** | The technology's vulnerabilities |

### ASSETS

- **Header:** the number of assets, **EXPORT** (not available on this tab) and **VIEW SETTINGS**.
- **Columns:** **ASSET NAME**, **IDENTIFIED VERSION** and **VULNERABILITIES** (one figure per severity).

Select a row to open the asset drawer.

### VULNERABILITIES

The technology's known CVEs.

- **Header:** the number of vulnerabilities, **EXPORT** (not available on this tab) and **VIEW SETTINGS**.
- **Chips:** **ALL**, **CRITICAL**, **HIGH**, **MEDIUM** and **LOW**.
- **Columns:** **CVE ID**, **SCORE/SEVERITY**, **PUBLISHED DATE** and **LAST MODIFIED DATE**.

### TECHNOLOGY INFO

A banner explains that this tab is the general information page of the technology: it describes the
technology and lists all its vulnerabilities, not only those relevant to your assets.

- A menu on the left jumps to **DESC.**, **EOL** and **VULN.**
- **DESCRIPTION** and **OFFICIAL WEBSITE**.
- **EOL**: the end-of-life table, one row per release, with **RELEASE**, **RELEASED**, **SECURITY SUPPORT** and
  **LATEST**.
- A vulnerabilities summary headed with the technology's name, then the full list of its known CVEs with
  **VIEW SETTINGS** and the columns **CVE ID**, **SCORE/SEVERITY**, **VENDOR**, **PRODUCT**, **PUBLISHED DATE**
  and **MODIFIED DATE**.

![The TECHNOLOGY INFO tab with its side menu, the DESCRIPTION and the EOL table of releases and security support.](/img/guide/easm/technology-details-02.png)

## Plan an Upgrade

1. On **ASSETS**, note which assets run the technology and their **IDENTIFIED VERSION**.
2. Compare those versions with **LATEST VERSION** on **OVERVIEW**.
3. On **TECHNOLOGY INFO**, find each version's release in the **EOL** table and check **SECURITY SUPPORT**.
4. On **VULNERABILITIES**, select **CRITICAL** and **HIGH** to see the most severe CVEs.
5. Open the affected assets and plan the upgrade, starting with the assets that run the oldest versions.

To find every technology with an out-of-date version, use the **VERSION SCOPE** filter on the list; see
[Review detected technologies](/guide/easm/technologies/).

## Good to Know

- If **EXPORT** on **ASSETS** or **VULNERABILITIES** does not download a file, use **EXPORT** on
  **TECHNOLOGIES LIST** to export technologies.
- **TECHNOLOGY INFO** lists every known CVE of the technology. For the vulnerabilities on your own assets, open
  the affected assets or **VULNERABILITIES LIST**; see [Prioritize vulnerabilities](/guide/easm/vulnerabilities/).

## Do This With the API

- The technology: [Technology Detail](/reference/easm/technology-detail/)
- The assets that use it: [Technology Asset Search](/reference/easm/technology-asset-search/)
- Its known CVEs: [Technology Vulnerabilities](/reference/easm/technology-vulnerabilities/)
- Its end-of-life dates: [Technology End Of Life Status](/reference/easm/technology-end-of-life-status/)


---

# Technology Insights

URL: https://docs.deepinfo.com/guide/easm/technology-insights/

See how many of your technologies are vulnerable or out of date, which categories dominate, and which technologies carry the most vulnerabilities.

The **INSIGHTS** tab of Technologies shows how healthy your technology stack is: how many technologies are
vulnerable or out of date, which categories you use most, and which technologies carry the most
vulnerabilities.

## Before You Start

- **Package:** External Attack Surface Management (EASM).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **EXTERNAL ATTACK SURFACE MANAGEMENT** › **TECHNOLOGIES** · **Tab:** **INSIGHTS** · [https://platform.deepinfo.com/app/easm/technologies/insights](https://platform.deepinfo.com/app/easm/technologies/insights)

## Read the Screen

![The top of the Technologies INSIGHTS tab with the four cards, the TECHNOLOGIES chart and the CATEGORIES table, numbered 1 to 3.](/img/guide/easm/technology-insights-01.png)

1. **Cards:**

   | Card | What it shows |
   |---|---|
   | **TOTAL TECHNOLOGIES** | The number of technologies on your assets, with the change over the **LAST 30 DAYS** |
   | **VULNERABLE TECHNOLOGIES** | How many technologies have known vulnerabilities, and their share **OF TOTAL** |
   | **OUTDATED VERSIONS** | How many technologies have an out-of-date version, and how many of them are **CRITICALLY OUTDATED** |
   | **TOP CATEGORY** | The category with the most technologies, and how many it has |

2. **Charts:**
   - **TECHNOLOGIES**: the number of technologies over time.
   - **OUTDATED VS UP TO DATE**: up-to-date technologies against outdated ones.
   - **SEVERITY**: the vulnerabilities of your technologies per severity: **CRITICAL**, **HIGH**, **MEDIUM**,
     **LOW** and **UNKNOWN**.
   - **MOST IDENTIFIED TECHNOLOGIES**: the technologies found on the most assets.
3. **Tables:**
   - **CATEGORIES**: each **CATEGORY** with its number of **TECHNOLOGIES**.
   - **OUTDATED TECHNOLOGIES**: **TECHNOLOGY**, the **VERSION** found and the **LATEST VERSION**.
   - **TOP VULNERABLE TECHNOLOGIES**: **TECHNOLOGY** and its **VULNERABILITY COUNT**, in total and per
     severity.

![The OUTDATED VS UP TO DATE bar, the OUTDATED TECHNOLOGIES and TOP VULNERABLE TECHNOLOGIES tables and the SEVERITY charts.](/img/guide/easm/technology-insights-02.png)

## Use the Page

- **Plan upgrades:** start with **OUTDATED TECHNOLOGIES**. Select a row to open the technology's page, where you
  can see the assets that run the old version and the end-of-life dates; see
  [Technology details](/guide/easm/technology-details/).
- **Reduce risk first where it is highest:** **TOP VULNERABLE TECHNOLOGIES** lists the technologies with the most
  vulnerabilities, and how many are critical or high.
- **Track progress:** over time, **OUTDATED VS UP TO DATE** should shift towards up to date.

## Good to Know

- **OUTDATED VERSIONS** counts the same technologies as the **Out of Date** value of the **VERSION SCOPE**
  filter on **TECHNOLOGIES LIST**, so you can list them there and export them.
- The page is for reading only. It has no filters and no export.
- The Technologies **OVERVIEW** tab has the summary cards; see
  [Review detected technologies](/guide/easm/technologies/).

## Do This With the API

- Technologies over time: [Technology Count Timeline](/reference/easm/technology-count-timeline/)
- The most vulnerable technologies: [Most Vulnerable Technologies](/reference/easm/most-vulnerable-technologies/)
- Technologies per category: [Technology Category Stats](/reference/easm/technology-category-stats/)
- Out-of-date technologies (filter by version scope): [Technology Search](/reference/easm/technology-search/)


---

# Cyber Threat Intelligence (CTI)

URL: https://docs.deepinfo.com/guide/cti/

Cyber Threat Intelligence (CTI) shows the employee, customer and payment card credentials found in leaked data for your organization, lets you record what you did about each one, and adds cyber security news and a dark web search.

Cyber Threat Intelligence (CTI) watches leaked data for credentials that belong to your organization: the
logins of your employees, the logins of your customers on your services, and payment card data. For each
one you can see where it was found and track what you did about it. CTI also brings curated cyber security
news and a search across dark web sources.

## Before You Start

- **Package:** CTI. **DARK WEB SEARCH** opens with either CTI or the Dark Web Search package; see
  [Search the dark web](/guide/cti/dark-web-search/). How locked screens look is explained in
  [What you can access](/guide/basics/packages-and-roles/).
- **Role:** Admin or Member.
- **Data:** CTI lists what Deepinfo finds in leaked data for your organization. A list stays empty until
  something is found; for example, **COMPROMISED PAYMENT CREDENTIALS** shows **No Result Found.** when no
  card data has been found.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **CTI DASHBOARD** · https://platform.deepinfo.com/app/cti/dashboard

The **CYBER THREAT INTELLIGENCE** group of the sidebar has the items below. When you collapse the sidebar, the group
is labelled **CTI**. Some items open a page with tabs; the sidebar opens the tab marked "opens first".

| Sidebar item | Tabs on the page | Guide pages |
|---|---|---|
| **CTI DASHBOARD** | None | [CTI dashboard](/guide/cti/dashboard/) |
| **COMPROMISED EMPLOYEE DATA** | **OVERVIEW** · **COMPROMISED EMPLOYEES** (opens first) · **EXPOSED CREDENTIALS** | [Overview](/guide/cti/compromised-employee-data/), [Investigate compromised employees](/guide/cti/compromised-employees/), [Review exposed credentials](/guide/cti/credential-exposures/) |
| **COMPROMISED CLIENT CREDENTIALS** | **OVERVIEW** · **COMPROMISED CLIENTS** (opens first) | [Review compromised client credentials](/guide/cti/compromised-client-credentials/) |
| **COMPROMISED PAYMENT CREDENTIALS** | **OVERVIEW** · **COMPROMISED PAYMENTS** (opens first) | [Review compromised payment credentials](/guide/cti/compromised-payment-credentials/) |
| **CYBER SECURITY NEWS** | None | [Cyber security news](/guide/cti/cybersecurity-news/) |
| **DARK WEB SEARCH** | search tabs that you open yourself | [Search the dark web](/guide/cti/dark-web-search/) |

The breadcrumb at the top of every CTI page starts with **CTI**, for example
**CTI / COMPROMISED EMPLOYEE DATA / EXPOSED CREDENTIALS**. The Global dashboard also has a CTI section with
a **GO TO CTI DASHBOARD** button; see [Global dashboard](/guide/global-dashboard/).

![The expanded sidebar with the CYBER THREAT INTELLIGENCE group next to the collapsed sidebar, where the group is labelled CTI.](/img/guide/cti/index-01.png)

## Concepts

### Compromised Employees and Exposed Credentials

A **compromised employee** is an employee account, identified by its e-mail address, that was found in
leaked credential data. Each leaked login of that account is an **exposed credential**: the site or app it
was used on, the account and the password.

Every compromised employee has a risk level, **CRITICAL**, **HIGH**, **MEDIUM** or **LOW**, which the
platform describes as "Composite priority based on credential, role, and recency." Every leaked password
gets a strength label from **VERY WEAK** to **VERY STRONG**, and the platform analyses the passwords of each
employee: how many there are, how strong they are and how often they are reused.

### Client Credentials

**Compromised client credentials** are the credentials of your customers for your own services that were
found in leaked data. Each record has a username or e-mail address and the login address it belongs to.

### Payment Credentials

**Compromised payment credentials** are payment card data related to your organization that was found in
leaked data.

### States

Every employee, client and payment credential has a **state**, shown as a chip such as
**ACTIVE · UNRESOLVED**. New credentials are active. You close a credential by ignoring it, accepting the
risk, or marking it as resolved or as a false positive. See
[Change the state of exposed credentials](/guide/cti/change-credential-state/).

### Masked Passwords

Leaked passwords are masked on screen until you choose to show them. See
[Handle leaked data safely](/guide/cti/sensitive-data/).

### News and Dark Web Search

**CYBER SECURITY NEWS** is a feed of curated articles, linked to the threat actors, targets, vendors,
products and CVEs they mention. **DARK WEB SEARCH** searches dark web sources such as forums, markets, paste
sites and chat channels.

## CTI in Other Parts of the Platform

- **Notifications:** notification rules can alert you on **New Employee Credential Detected**,
  **New Client Credential Detected**, **New Payment Credential Detected** and **New Cybersecurity News**.
  See [Create a notification rule](/guide/notifications/create-a-rule/).
- **Reports:** the **CTI REPORTS** tab of **REPORTS** has these CSV and JSON exports:
  **All Compromised Employee Credentials Report**, **All Compromised Client Credentials Report** and
  **All Compromised Payment Credentials Report**. See
  [Export all data as CSV or JSON](/guide/reports/export-data/).
- **Lists:** the CTI lists share the filter chips, views and **EXPORT** described in
  [Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

## Pages in This Section

1. [CTI dashboard](/guide/cti/dashboard/): the one-page summary.
2. [Compromised employee data overview](/guide/cti/compromised-employee-data/): totals, timeline and risk
   levels for employee credentials.
3. [Investigate compromised employees](/guide/cti/compromised-employees/): the employee list, security
   profiles and employee details.
4. [Review exposed credentials](/guide/cti/credential-exposures/): every leaked employee login, with its
   target and password analysis.
5. [Change the state of exposed credentials](/guide/cti/change-credential-state/): ignore, accept, resolve
   or mark as false positive, and revert.
6. [Review compromised client credentials](/guide/cti/compromised-client-credentials/): your customers'
   leaked logins.
7. [Review compromised payment credentials](/guide/cti/compromised-payment-credentials/): leaked payment
   card data.
8. [Handle leaked data safely](/guide/cti/sensitive-data/): what is masked and what is not.
9. [Cyber security news](/guide/cti/cybersecurity-news/): the news feed and articles.
10. [Search the dark web](/guide/cti/dark-web-search/): search dark web sources.

## Do This With the API

The [CTI reference](/reference/cti/) documents the same data: compromised employee accounts and
credentials, compromised client and payment credentials, and security news. Dark web search is in the
[Darkweb reference](/reference/darkweb/).


---

# CTI Dashboard

URL: https://docs.deepinfo.com/guide/cti/dashboard/

Read the one-page Cyber Threat Intelligence summary of employee, client and payment card credentials found in leaked data, with exposure timelines, risk levels, credential states and the latest exposures.

The Cyber Threat Intelligence (CTI) dashboard sums up, on one page, the credentials found in leaked data for your organization: those of
your employees, of your customers and of payment cards. Each section links to the full lists.

## Before You Start

- **Package:** CTI. Without it, the dashboard is replaced by a lock screen; see
  [What you can access](/guide/basics/packages-and-roles/).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **CTI DASHBOARD** · https://platform.deepinfo.com/app/cti/dashboard

From the [Global dashboard](/guide/global-dashboard/), the **CTI** card at the top and the
**GO TO CTI DASHBOARD** button open this page too.

## Read the Screen

The breadcrumb reads **CTI / CYBER THREAT INTELLIGENCE DASHBOARD** and the page title is
**Cyber Threat Intelligence Dashboard**. From top to bottom:

1. **Summary cards.** Four cards with the current totals:
   **COMPROMISED EMPLOYEE DATA**, **EXPOSED CREDENTIALS**, **COMPROMISED CLIENT CREDENTIALS** and
   **COMPROMISED PAYMENT CREDENTIALS**. A card shows **-** when there is nothing to count.
2. **COMPROMISED EMPLOYEE DATA** section.
3. **COMPROMISED CLIENT CREDENTIALS** section.
4. **COMPROMISED PAYMENT CREDENTIALS** section.

Each section has a **GO TO … PAGE** button that opens the section's page in a new browser tab.

![The four summary cards at the top of the CTI dashboard.](/img/guide/cti/dashboard-01.png)

### COMPROMISED EMPLOYEE DATA

**GO TO COMPROMISED EMPLOYEE DATA PAGE** opens the [overview](/guide/cti/compromised-employee-data/).

| Card | What it shows |
|---|---|
| **CREDENTIAL EXPOSURE TIMELINE** | A column chart of exposed employee credentials per period. Choose **DAILY** (the default), **WEEKLY** or **MONTHLY** in the card's interval list. |
| **RISK DISTRIBUTION** | A pie of compromised employees by risk level: **CRITICAL**, **HIGH**, **MEDIUM**, **LOW**. |
| **CREDENTIAL STATUS STATS** | A pie of employee credentials that are **ACTIVE** and **INACTIVE**. See [Change the state of exposed credentials](/guide/cti/change-credential-state/). |
| **RECENTLY EXPOSED CREDENTIALS** | The five most recent exposed credentials. Each row shows the service, a platform tag such as **WEB**, the host and the employee's e-mail address. The heading and its arrow open the [EXPOSED CREDENTIALS](/guide/cti/credential-exposures/) tab. |
| **RECENTLY EXPOSED EMPLOYEES** | The five most recently exposed employees. Each row shows the risk level, the e-mail address, **CREDS**, **PASSWORDS** and **AVG STRENGTH SCORE** (out of 10). The heading and its arrow open the [COMPROMISED EMPLOYEES](/guide/cti/compromised-employees/) tab; a row opens that employee's page. |

![The COMPROMISED EMPLOYEE DATA section of the CTI dashboard with the interval list of CREDENTIAL EXPOSURE TIMELINE open; e-mail addresses and organization names are blurred.](/img/guide/cti/dashboard-02.png)

### COMPROMISED CLIENT CREDENTIALS

**GO TO COMPROMISED CLIENT CREDENTIALS PAGE** opens
[Compromised Client Credentials](/guide/cti/compromised-client-credentials/).

- **CREDENTIAL EXPOSURE TIMELINE**: exposed client credentials per period.
- **RECENTLY EXPOSED CLIENTS**: the latest client credentials, each with the client's e-mail address and the
  date it was found.

### COMPROMISED PAYMENT CREDENTIALS

**GO TO COMPROMISED PAYMENT CREDENTIALS PAGE** opens
[Compromised Payment Credentials](/guide/cti/compromised-payment-credentials/).

- **CREDENTIAL EXPOSURE TIMELINE**: exposed payment credentials per period.
- **RECENTLY EXPOSED PAYMENTS**: the latest payment card records, or **No Result Found.** when there are none.

## Good to Know

- **Five bars at most.** The **CREDENTIAL EXPOSURE TIMELINE** of the employee section shows up to five
  periods. The same chart on the [overview](/guide/cti/compromised-employee-data/) shows up to twelve.
- **CREDS and PASSWORDS.** In **RECENTLY EXPOSED EMPLOYEES**, both columns can show the number of unique
  passwords. To see how many credentials an employee has, open the employee and read
  **CREDENTIAL LEAK**.
- **No score.** The CTI dashboard has no security score. Security scores belong to External Attack Surface Management (EASM).
- **No filters or export here.** To filter or export, open the lists. The **CTI REPORTS** tab of **REPORTS**
  has full exports of each credential type.

## Do This With the API

- [Compromised Employee Credential Stats](/reference/cti/compromised-employee-credential-stats/)
- [Compromised Employee Credential Exposure Timeline](/reference/cti/compromised-employee-credential-exposure-timeline/)
- [Compromised Employee Credential Status Stats](/reference/cti/compromised-employee-credential-status-stats/)
- [Compromised Employee Account Risk Distribution Stats](/reference/cti/compromised-employee-account-risk-distribution-stats/)
- [Compromised Client Credential Stats](/reference/cti/compromised-client-credential-stats/)
- [Compromised Payment Credential Stats](/reference/cti/compromised-payment-credential-stats/)


---

# Compromised Employee Data Overview

URL: https://docs.deepinfo.com/guide/cti/compromised-employee-data/

The OVERVIEW tab of Compromised Employee Data sums up the employee accounts and credentials found in leaked data, with totals, credential states, top domains, an exposure timeline, risk levels and the latest exposures.

Compromised Employee Data covers the employee accounts of your organization that were found in leaked
credential data, and the credentials found for them. Its **OVERVIEW** tab is the summary.

## Before You Start

- **Package:** Cyber Threat Intelligence (CTI).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **COMPROMISED EMPLOYEE DATA** · **Tab:** **OVERVIEW** · https://platform.deepinfo.com/app/cti/compromised-employee-data

The sidebar item opens the **COMPROMISED EMPLOYEES** tab; select **OVERVIEW**. The
**GO TO COMPROMISED EMPLOYEE DATA PAGE** button on the [CTI dashboard](/guide/cti/dashboard/) opens this tab
in a new browser tab.

## Read the Screen

The page title is **Compromised Employee Data**, with three tabs that belong together:

| Tab | What it shows | Guide page |
|---|---|---|
| **OVERVIEW** | This summary | this page |
| **COMPROMISED EMPLOYEES** | One row per employee account | [Investigate compromised employees](/guide/cti/compromised-employees/) |
| **EXPOSED CREDENTIALS** | One row per leaked login | [Review exposed credentials](/guide/cti/credential-exposures/) |

On the **OVERVIEW** tab, from top to bottom:

1. **Cards:**
   - **COMPROMISED EMPLOYEES**: the number of employee accounts found in leaked data.
   - **EXPOSED CREDENTIALS**: the number of leaked credentials, with a change indicator marked **BY YEAR**.
   - **STATUS STATS**: a pie of credentials that are **ACTIVE** and **INACTIVE**.
   - **TOP CREDENTIAL DOMAINS**: the three domains with the most exposed credentials, with their counts.
2. **CREDENTIAL EXPOSURE TIMELINE**: a column chart of exposed credentials per period. Choose **DAILY** (the
   default), **WEEKLY** or **MONTHLY** in the card's interval list. It shows up to twelve periods.
3. **RISK DISTRIBUTION**: one bar per risk level, **CRITICAL**, **HIGH**, **MEDIUM** and **LOW**, with the
   number of employees at that level.
4. **RECENTLY EXPOSED CREDENTIALS** and **RECENTLY EXPOSED EMPLOYEES**: the five latest of each, the same
   lists as on the [CTI dashboard](/guide/cti/dashboard/). Their headings and arrows open the
   **EXPOSED CREDENTIALS** and **COMPROMISED EMPLOYEES** tabs. A row in **RECENTLY EXPOSED EMPLOYEES** opens
   that employee's page.

![The OVERVIEW tab of Compromised Employee Data with its cards, the exposure timeline and the risk distribution; domain names are blurred.](/img/guide/cti/compromised-employee-data-01.png)

## Risk Levels

Each compromised employee has one of these risk levels, from highest to lowest: **CRITICAL**, **HIGH**,
**MEDIUM** and **LOW**. The platform describes the level as "Composite priority based on credential, role,
and recency." The thresholds behind the levels are not shown in the platform.

## Good to Know

- **Credential states.** **STATUS STATS** counts credentials, not employees. A credential moves to
  **INACTIVE** when it is closed, for example when you ignore it or mark it as resolved; see
  [Change the state of exposed credentials](/guide/cti/change-credential-state/).
- **No filters or export on this tab.** Use the **COMPROMISED EMPLOYEES** and **EXPOSED CREDENTIALS** tabs.

## Do This With the API

- [Compromised Employee Accounts Domain Stats](/reference/cti/compromised-employee-accounts-domain-stats/)
- [Compromised Employee Account Risk Distribution Stats](/reference/cti/compromised-employee-account-risk-distribution-stats/)
- [Compromised Employee Credential Exposure Timeline](/reference/cti/compromised-employee-credential-exposure-timeline/)
- [Compromised Employee Credential Status Stats](/reference/cti/compromised-employee-credential-status-stats/)


---

# Investigate Compromised Employees

URL: https://docs.deepinfo.com/guide/cti/compromised-employees/

Find the employees whose accounts appear in leaked credential data, see their risk level and password habits, review their exposed credentials, correct their details and export the list.

The **COMPROMISED EMPLOYEES** tab lists every employee account of your organization that was found in leaked
credential data. Use it to find the riskiest accounts, see how their passwords were built and reused, and
open each employee's credentials.

## Before You Start

- **Package:** Cyber Threat Intelligence (CTI).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **COMPROMISED EMPLOYEE DATA** · **Tab:** **COMPROMISED EMPLOYEES** · https://platform.deepinfo.com/app/cti/compromised-employee-data/list

The sidebar item opens this tab. The breadcrumb reads
**CTI / COMPROMISED EMPLOYEE DATA / COMPROMISED EMPLOYEES**.

## Read the List

From top to bottom:

1. **Filter row:** the **SEARCH** box; the filter chips **IDENTITY**, **EXPOSURE**, **PASSWORD BEHAVIOR**,
   **REUSE ANALYSIS**, **COMPOSITION**, **TEMPORAL**, **RISK** and **STATE**, some of which appear only after
   you select **SHOW ALL FILTERS ›**; and, on the right, the icons that switch between quick view and list
   view.
2. **Result line:** **\<n\> COMPROMISED EMPLOYEES FOUND**, **EXPORT** and **VIEW SETTINGS**.
3. **Domain tabs:** **ALL EMPLOYEES**, then one tab per domain of your organization, each with its count.
   Select a tab to list only that domain's employees.
4. **The list,** 25 rows per page by default:

| Column | What it shows |
|---|---|
| **EMPLOYEE** | The risk level (a bar and **CRITICAL**, **HIGH**, **MEDIUM** or **LOW**), the e-mail address and the domain |
| **DEPARTMENT** | The employee's department, when known |
| **PASSWORDS** | The number of unique leaked passwords, with a red **WEAK PASSWORD: \<n\>** chip |
| **REUSE** | The share of reused passwords, in % |
| **LAST EXPOSURE** | The date of the latest exposure, with the time since then |

The list is sorted by **LAST EXPOSURE**, newest first. To sort by another column, select the sort icon in
its header. **VIEW SETTINGS** opens **View Options**: **Sort By**, **Result Per Page** (25, 50, 75 or 100),
**Reset to Default View**, and the **SHOWN** list of columns.

![The COMPROMISED EMPLOYEES tab with the filter row, the domain tabs and the employee list, with e-mail addresses and domains blurred.](/img/guide/cti/compromised-employees-01.png)

## Filter the List

Select a filter chip to add a condition on one of its fields: choose the field, the rule (**Must**,
**Must Not** or **Should**), the operator and the value, then select **APPLY**. **Add New** adds another
condition and **Clear All** removes them. The general filter controls are described in
[Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

| Chip | Fields |
|---|---|
| **IDENTITY** | Email, Domain, Is Executive, First Name, Last Name, Title, LinkedIn URL, Department |
| **EXPOSURE** | First Exposure Date, Last Exposure Date, Exposure Span Days |
| **PASSWORD BEHAVIOR** | Unique Password Count, Avg Password Length, Avg Strength Score, Min Strength Score, Max Strength Score, Very Weak Password Count, Weak Password Count, Medium Password Count, Strong Password Count, Very Strong Password Count, Weak Password Percentage |
| **REUSE ANALYSIS** | Password Reuse Count, Password Reuse Percentage |
| **COMPOSITION** | Common Password Count, Dictionary Word Count, Keyboard Pattern Count, Date Pattern Count, Avg Character Classes, All Four Classes Percentage, Dominant Structure, Structure Variety Count |
| **TEMPORAL** | Days Since Last Exposure, Exposure Accelerating, Exposure Velocity |
| **RISK** | Risk Score, Risk Level |
| **STATE** | State, Total Credentials, Active Credential Count, Inactive Credential Count, Unresolved Credential Count, Resolved Credential Count, Risk Accepted Credential Count, Ignored Credential Count, False Positive Credential Count |

The **STATE** chip is useful for follow-up: for example, **Active Credential Count** finds the employees who
still have active credentials.

## Open an Employee

Select a row. A drawer opens on the right:

- At the top: **OPEN IN NEW TAB**, which opens the employee's own page; the risk level, e-mail address and
  domain; and a **⋮** menu with **EDIT DETAILS**.
- On the left, three icon tabs. Hover over an icon to see its name.

| Tab | What it shows |
|---|---|
| **OVERVIEW** | **DEPARTMENT**, **TITLE**, **FIRST EXPOSURE DATE** and **LAST EXPOSURE DATE**, then **INSIGHTS**: **PASSWORDS** with a breakdown into **VERY WEAK**, **WEAK**, **MEDIUM**, **STRONG** and **VERY STRONG**; **AVG STRENGTH SCORE** (out of 10); **REUSE RATE** (%); **VELOCITY** (credentials per month) |
| **SECURITY PROFILE** | The four blocks described under [Security profile](#security-profile) |
| **CREDENTIALS** | The employee's leaked credentials: **CREDENTIAL** (service, platform and host) and **STATE**. Tick **SHOW INACTIVES** to include inactive ones. This tab shows no passwords |

![The employee drawer on the OVERVIEW tab, with the e-mail address and the domain blurred.](/img/guide/cti/compromised-employees-02.png)

## Open the Employee's Page

Select **OPEN IN NEW TAB** in the drawer, or a row of **RECENTLY EXPOSED EMPLOYEES** on the
[CTI dashboard](/guide/cti/dashboard/) or the [overview](/guide/cti/compromised-employee-data/). The
breadcrumb reads **CTI / COMPROMISED EMPLOYEE DATA / EMPLOYEES / \<e-mail address\>**.

The header shows the e-mail address, the domain, a **⋮** menu with **EDIT DETAILS**, and four figures:

| Figure | The platform's description |
|---|---|
| **RISK LEVEL** | "Composite priority based on credential, role, and recency." |
| **CREDENTIAL LEAK** | "Count of credentials exposed in historical data leaks." |
| **UNIQUE PASSWORDS** | "Total number of non-duplicate passwords in use." |
| **AVG STRENGTH SCORE** | "Mean security score of the current password set." |

Below are two tabs:

- **SECURITY PROFILE** (open first): the four blocks described below.
- **CREDENTIALS**, with the number of credentials: a **SEARCH** box, **SHOW INACTIVES**, **SHOW PASSWORD**,
  and a checkbox in the header to select rows. The columns are **CREDENTIAL**, **STATE**, **PASSWORD**
  (masked), **STRENGTH** and **ADDED DATE**. Select a row to open the credential.

To show the passwords, see [Handle leaked data safely](/guide/cti/sensitive-data/).

![An employee's page with the header figures and the SECURITY PROFILE tab; the e-mail address and DOMINANT STRUCTURE are blurred.](/img/guide/cti/compromised-employees-03.png)

## Security Profile

The drawer and the employee's page show the same four blocks. On the employee's page, each block carries
the platform's description of it.

| Block | Description | Figures |
|---|---|---|
| **EXPOSURE TIMELINE** | "When this account was first detected, how long the exposure has run and whether the rate is rising." | **FIRST SEEN**, **LAST SEEN**, **EXPOSURE SPAN**, **DAYS SINCE LAST**, **VELOCITY**, **TREND** (for example **STABLE**) |
| **PASSWORD BEHAVIOR** | "Comprehensive analysis of user password habits and security compliance." | **UNIQUE PASSWORDS**, **AVG STRENGTH SCORE**, **WEAK PASSWORDS**, **AVG LENGTH**, **MIN / MAX SCORE** |
| **REUSE & PATTERNS** | "Analysis of identical passwords used across multiple platforms and common character sequences." | **REUSE RATE**, **REUSED PASSWORDS** |
| **COMPOSITIONS** | "Distribution of password elements such as uppercase letters, numbers, and special characters." | **COMMON PASSWORDS**, **DICTIONARY WORDS**, **DOMINANT STRUCTURE**, **AVG CHAR CLASSES**, **ALL CHAR CLASSES**, **STRUCTURE VARIETY**, **KEYBOARD PATTERNS**, **DATE PATTERNS** |

**DOMINANT STRUCTURE** shows the pattern of character types in the employee's passwords. It stays visible
while passwords are masked; see [Handle leaked data safely](/guide/cti/sensitive-data/).

## Edit an Employee's Details

You can add or correct the details the platform holds for an employee, such as the name, title, department
and whether the person is an executive. The **IDENTITY** filters use these details.

1. Open the employee's drawer or page.
2. Open the **⋮** menu and select **EDIT DETAILS**.
3. The **Edit Information** drawer opens: "You can edit the information for this employee account." Change
   any of **FIRST NAME**, **LAST NAME**, **CURRENT TITLE**, **DEPARTMENT**, **LINKEDIN URL** and
   **EXECUTIVE**. **EMAIL ADDRESS** cannot be changed.
4. Select **UPDATE**. The button becomes active once you change a field.

To leave without saving, select **CANCEL**.

![The Edit Information drawer of an employee with CANCEL and UPDATE at the bottom; the e-mail address is blurred.](/img/guide/cti/compromised-employees-04.png)

## Export the List

1. Filter the list if you want only part of it.
2. Select **EXPORT**. The **DOWNLOAD** window opens: "Choose the records, format, and level of detail for
   your export."
3. Choose:
   - **RECORDS**: **ALL**, or **FILTERED** for the records that match your filters;
   - **FILE FORMAT**: **CSV** or **JSON**;
   - **EXPORT SCOPE**: **DEFAULT**, **BASIC** or **EXTENDED**.
4. Select **EXPORT**. **CANCEL** closes the window without a download.

The file name starts with `COMPROMISED-EMPLOYEE-ACCOUNTS`, followed by the date and time.

## Good to Know

- **Password counts.** **PASSWORDS** and **UNIQUE PASSWORDS** count unique passwords, and
  **CREDENTIAL LEAK** counts credentials. The strength breakdown under **INSIGHTS** and the red
  **WEAK PASSWORD** chip can count credentials too, so they can show more than **PASSWORDS**.
- **States are set per credential.** To close an employee's credentials, see
  [Change the state of exposed credentials](/guide/cti/change-credential-state/).
- **Passwords are elsewhere.** The drawer's **CREDENTIALS** tab has no passwords. Use the employee's page or
  the [EXPOSED CREDENTIALS](/guide/cti/credential-exposures/) tab.

## Do This With the API

- [Compromised Employee Account Search](/reference/cti/compromised-employee-account-search/)
- [Compromised Employee Account Detail](/reference/cti/compromised-employee-account-detail/)
- [Compromised Employee Account Update](/reference/cti/compromised-employee-account-update/)
- [Compromised Employee Account Export](/reference/cti/compromised-employee-account-export/)
- [Search & filters](/getting-started/search-and-filters/): the **MUST**, **MUST NOT** and **SHOULD** model
  the filter chips use.


---

# Review Exposed Credentials

URL: https://docs.deepinfo.com/guide/cti/credential-exposures/

The EXPOSED CREDENTIALS tab lists every leaked login of your employees, with the site or app it belongs to, the masked password, its state and an analysis of the password.

The **EXPOSED CREDENTIALS** tab of Compromised Employee Data lists every leaked login of your employees: the
site or app it was used on, the employee account, the password (masked), its state and how strong the
password is. Each credential also has a detailed analysis of its target and its password.

## Before You Start

- **Package:** Cyber Threat Intelligence (CTI).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **COMPROMISED EMPLOYEE DATA** · **Tab:** **EXPOSED CREDENTIALS** · https://platform.deepinfo.com/app/cti/compromised-employee-data/credential-exposures

The breadcrumb reads **CTI / COMPROMISED EMPLOYEE DATA / EXPOSED CREDENTIALS**. The **EXPOSED CREDENTIALS**
card on the [Global dashboard](/guide/global-dashboard/) and the **RECENTLY EXPOSED CREDENTIALS** heading on
the [CTI dashboard](/guide/cti/dashboard/) also open this tab.

## Read the List

From top to bottom:

1. **Filter row:** the **SEARCH** box; the filter chips **CREDENTIAL**, **ACCOUNT**, **STRENGTH**,
   **COMPOSITION**, **PATTERNS**, **DICTIONARY** and **TARGET**, some of which appear only after you select
   **SHOW ALL FILTERS ›**; and, on the right, the icons that switch between quick view and list view.
2. **Result line:** **\<n\> EXPOSURES FOUND**, **SHOW INACTIVES**, **SHOW PASSWORD**, **EXPORT** and
   **VIEW SETTINGS**.
3. **Domain tabs:** **ALL EXPOSURES**, then one tab per domain of your organization.
4. **The list,** 25 rows per page by default:

| Column | What it shows |
|---|---|
| **SOURCE/SERVICE** | The service the credential was used on, a platform tag such as **WEB** or **ANDROID**, and the host |
| **ACCOUNT** | The employee account |
| **PASSWORD** | The leaked password, masked as `••••••` |
| **STATE** | The credential's state, for example **ACTIVE · UNRESOLVED** |
| **STRENGTH** | A bar and a label from **VERY WEAK** to **VERY STRONG** |
| **ADDED DATE** | When the credential was added, with the time since then |

- Tick **SHOW INACTIVES** to include credentials in an inactive state.
- To sort, select the sort icon in a column header.
- **VIEW SETTINGS** opens **View Options**: **Sort By**, **Result Per Page** (25, 50, 75 or 100),
  **Reset to Default View**, and the **SHOWN** list of columns.
- The checkbox in the header selects rows for a bulk state change; see
  [Change the state of exposed credentials](/guide/cti/change-credential-state/).

![The EXPOSED CREDENTIALS tab with the filter row, the result line, the domain tabs and the list, with passwords masked and accounts blurred.](/img/guide/cti/credential-exposures-01.png)

## Filter the List

Select a filter chip, choose a field, the rule (**Must**, **Must Not** or **Should**), the operator and the
value, then select **APPLY**. The general filter controls are described in
[Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

| Chip | Fields |
|---|---|
| **CREDENTIAL** | URL, Added At, Password, State |
| **ACCOUNT** | Email, Domain, Is Executive, First Name, Last Name, Department, Title, LinkedIn URL |
| **STRENGTH** | Strength Level, Strength Score, Strength Label, Entropy Bits |
| **COMPOSITION** | Length, Character Classes Used, Structure, Contains Uppercase, Contains Lowercase, Contains Number, Contains Special, Starts With Uppercase, Ends With Numbers, Ends With Special |
| **PATTERNS** | Has Keyboard Pattern, Has Date Pattern, Has Leet Speak, Has Sequential Chars, Has Repeated Chars |
| **DICTIONARY** | Is Common Password, Common Password Rank, Is Dictionary Word, Dictionary Word Found |
| **TARGET** | Target URL, Target FQDN, Target Domain, Target Service, Target Platform, Target Main Category, Target Sub Category, Target Risk Tier, Target Is Corporate, Target Requires MFA |

For example, **TARGET** › **Target Is Corporate** finds leaked logins to corporate services, and
**CREDENTIAL** › **State** narrows the list to one state.

## Open a Credential

Select a row. A drawer opens on the right:

- At the top: **OPEN IN NEW TAB**, which opens the credential's own page; the state chip; the service name;
  the platform tag and host; and a **⋮** menu with **CHANGE STATE**.
- On the left, three icon tabs. Hover over an icon to see its name.

| Tab | What it shows |
|---|---|
| **OVERVIEW** | **ACCOUNT**; **PASSWORD**, masked as `●●●●●●●●`, with an eye icon to show it; **STRENGTH**; **ADDED DATE** |
| **TARGET** | The site or app the credential belongs to: **SERVICE**, **PLATFORM**, **URL**, **URL RAW**, **FQDN**, **DOMAIN**, **MAIN CATEGORY**, **SUB CATEGORY**, **RISK TIER**, **CORPORATE** (whether it is a corporate service) and **MFA BY DEFAULT** (whether the service enforces multi-factor authentication by default) |
| **PASSWORD ANALYSIS** | How the password is built: see below |

![The drawer of an exposed credential on the TARGET tab.](/img/guide/cti/credential-exposures-02.png)

### Password Analysis

The **PASSWORD ANALYSIS** tab describes the leaked password without showing it:

- **LENGTH**: the number of characters.
- **CONTAINS**: chips for the character types the password uses: **AG** (uppercase letters), **ag**
  (lowercase letters), **17** (digits) and **?** (special characters).
- **CHARACTER CLASSES**: how many of these character types it uses.
- **STRUCTURE**: the pattern of character types.
- **ENTROPY**: an estimate of how hard the password is to guess.
- **YES** or **NO** for each check: **COMMON PASSWORD**, **KEYBOARD PATTERN**, **DATE PATTERN**,
  **LEET SPEAK**, **SEQUENTIAL CHARACTER**, **REPEATED CHARACTER**, **START WITH UPPERCASE**,
  **END WITH NUMBERS** and **END WITH SPECIAL CHARACTER**.

**STRUCTURE** reveals the shape of the password even while the password itself is masked; see
[Handle leaked data safely](/guide/cti/sensitive-data/).

## Use the Quick View

Select the quick view icon at the right of the filter row. The left side lists the credentials by host
under **CREDENTIALS**; **LOAD MORE** loads more. The right side shows the selected credential:
**OPEN IN NEW TAB**, the state chip, the host and URL, four figures and the **TARGET** and
**PASSWORD ANALYSIS** tabs.

| Figure | The platform's description |
|---|---|
| **ACCOUNT** | "Employee account associated with this credential." |
| **PASSWORD** | "Leaked password associated with this credential." (masked) |
| **STRENGTH** | "Evaluated strength score of the leaked password." |
| **ADDED DATE** | "Date this credential was added to the dataset." |

**SHOW INACTIVES**, **SHOW PASSWORD** and **VIEW SETTINGS** are not available in quick view. Switch back to
list view to use them.

## Open the Credential's Own Page

Select **OPEN IN NEW TAB** in the drawer or in the quick view. The breadcrumb reads
**CTI / COMPROMISED EMPLOYEE DATA / EXPOSED CREDENTIALS / \<host\>**. The header shows the state chip, the
host, the full URL and the same four figures as the quick view. Below are the **TARGET** and
**PASSWORD ANALYSIS** tabs; **PASSWORD ANALYSIS** opens first.

## Show Passwords

Passwords are masked. In list view, tick **SHOW PASSWORD** to show the passwords of the list in plain text
in your browser. In the drawer, select the eye icon next to **PASSWORD**. Before you do, read
[Handle leaked data safely](/guide/cti/sensitive-data/).

## Export the List

1. Filter the list if you want only part of it.
2. Select **EXPORT**. The **DOWNLOAD** window opens.
3. Choose **RECORDS** (**ALL** or **FILTERED**), **FILE FORMAT** (**CSV** or **JSON**) and **EXPORT SCOPE**
   (**DEFAULT**, **BASIC** or **EXTENDED**).
4. Select **EXPORT**.

The file name starts with `COMPROMISED-EMPLOYEE-CREDENTIALS`, followed by the date and time.

## Good to Know

- **Old bookmarks.** This tab replaced the former credentials page. Bookmarks to
  `/app/cti/compromised-employee-data/credentials` now open **PAGE NOT FOUND**; use the address above.
- **States.** To ignore a credential, accept its risk, or mark it as resolved or as a false positive, see
  [Change the state of exposed credentials](/guide/cti/change-credential-state/).

## Do This With the API

- [Compromised Employee Credential Search](/reference/cti/compromised-employee-credential-search/)
- [Compromised Employee Credential Export](/reference/cti/compromised-employee-credential-export/)
- [Search & filters](/getting-started/search-and-filters/): the filter model the chips use.


---

# Change the State of Exposed Credentials

URL: https://docs.deepinfo.com/guide/cti/change-credential-state/

Record what you did about a leaked credential by ignoring it, accepting the risk, or marking it as resolved or as a false positive, one at a time or in bulk, and revert the change.

When you have dealt with a leaked credential, record it by changing the credential's state: ignore it,
accept the risk, or mark it as resolved or as a false positive. The steps below are for the credentials of
your employees. Client and payment credentials have states too.

## Before You Start

- **Package:** Cyber Threat Intelligence (CTI).
- **Role:** Admin or Member.
- You need at least one exposed credential on the
  [EXPOSED CREDENTIALS](/guide/cti/credential-exposures/) tab.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **COMPROMISED EMPLOYEE DATA** · **Tab:** **EXPOSED CREDENTIALS** · https://platform.deepinfo.com/app/cti/compromised-employee-data/credential-exposures

The state of a credential appears in these places:

| Where | What you can do there |
|---|---|
| **EXPOSED CREDENTIALS** tab | Select a **STATE** chip, or select rows for a bulk change. **SHOW INACTIVES** includes inactive credentials |
| Credential drawer (select a row on **EXPOSED CREDENTIALS**) | **⋮** › **CHANGE STATE** |
| Employee's page, **CREDENTIALS** tab | **STATE** column and a header checkbox to select rows; **SHOW INACTIVES** |
| Employee drawer, **CREDENTIALS** tab | **STATE** column; **SHOW INACTIVES** |
| **COMPROMISED CLIENTS** tab of [Compromised Client Credentials](/guide/cti/compromised-client-credentials/) | **STATE** column; **SHOW INACTIVES** |
| **COMPROMISED PAYMENTS** tab of [Compromised Payment Credentials](/guide/cti/compromised-payment-credentials/) | **STATE** column |

## Change One Credential From Its State Chip

1. On the **EXPOSED CREDENTIALS** tab, find the credential. Tick **SHOW INACTIVES** if it is already inactive.
2. Select its **STATE** chip, for example **ACTIVE · UNRESOLVED**.
3. A menu headed **CHANGE STATUS** opens. Select **IGNORE**, **ACCEPT RISK**, **MARK AS RESOLVED** or
   **MARK AS FALSE POSITIVE**.
4. If the platform asks you to confirm, confirm the change.

To close the menu without a change, select **CANCEL**.

![The CHANGE STATUS menu open on a STATE chip in the EXPOSED CREDENTIALS list.](/img/guide/cti/change-credential-state-01.png)

## Change One Credential From Its Drawer

1. On the **EXPOSED CREDENTIALS** tab, select the credential's row to open its drawer.
2. Open the **⋮** menu and select **CHANGE STATE**.
3. The **Change State** window shows **CURRENT STATE:**, for example "ACTIVE - UNRESOLVED", and a
   **MARK AS:** list with **IGNORED**, **RISK ACCEPTED**, **MARKED AS RESOLVED** and
   **MARKED AS FALSE POSITIVE**. Choose the new state.
4. Select **CHANGE**. **CANCEL** closes the window without a change.

> [!IMPORTANT]
> **MARK AS:** is already set to **IGNORED** when the window opens. Check it before you select **CHANGE**,
> or the credential is ignored.

![The Change State window with CURRENT STATE, the MARK AS list, CANCEL and CHANGE.](/img/guide/cti/change-credential-state-02.png)

## Change Several Credentials at Once

1. Tick the rows you want to change. The checkbox in the header has a menu with **SELECT THIS PAGE**,
   **SELECT ALL RESULTS** and **CLEAR SELECTION**.
2. Select **CHANGE ALL STATES**.
3. Under **TO:**, choose the new state.
4. If the platform asks you to confirm, confirm the change.

You can do this on the **EXPOSED CREDENTIALS** tab and on the **CREDENTIALS** tab of an employee's page.

> [!WARNING]
> **SELECT ALL RESULTS** selects every result, on every page, not only the rows you can see, and the state
> you choose next applies to all of them. Use it only when you mean to change every result. Otherwise, tick
> the rows or use **SELECT THIS PAGE**, so that you can see each credential you change.

## Revert a Change

The states you set can be reverted. When the current state allows it, the **Change State** window
shows a **REVERT STATE** link. Reverting returns the credential to its previous, active state.

> [!CAUTION]
> Select **REVERT STATE** only when you mean to revert. It can take effect as soon as you select it, without
> asking you to confirm.

## The States

A credential's state is shown as a two-part chip: the group, then the state, for example
**ACTIVE · UNRESOLVED**.

| Group | State | Set by | Action that sets it |
|---|---|---|---|
| **ACTIVE** | **NEWLY DETECTED** | the platform | None |
| **ACTIVE** | **UNRESOLVED** | the platform | None |
| **INACTIVE** | **NOT APPLICABLE** | the platform | None |
| **INACTIVE** | **VERIFIED RESOLVED** | the platform | None |
| **INACTIVE** | **IGNORED** | you | **IGNORE** |
| **INACTIVE** | **RISK ACCEPTED** | you | **ACCEPT RISK** |
| **INACTIVE** | **MARKED AS RESOLVED** | you | **MARK AS RESOLVED** |
| **INACTIVE** | **MARKED AS FALSE POSITIVE** | you | **MARK AS FALSE POSITIVE** |

Only the states you set (**IGNORED**, **RISK ACCEPTED**, **MARKED AS RESOLVED** and **MARKED AS FALSE
POSITIVE**) can be reverted. States set by the platform cannot.

Issues and vulnerabilities in External Attack Surface Management (EASM) use a similar set of states; see
[Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/).

## Good to Know

- **Inactive credentials leave the list.** The states you set are inactive, so the credential drops
  out of lists that show active credentials only. Tick **SHOW INACTIVES** to see it again.
- **Changes take a few seconds.** The new state can take a few seconds to show. Wait for the list to refresh
  before you check the result.
- **Follow-up.** The **CREDENTIAL STATUS STATS** card on the [CTI dashboard](/guide/cti/dashboard/) and
  **STATUS STATS** on the [overview](/guide/cti/compromised-employee-data/) count active and inactive
  credentials. On the **COMPROMISED EMPLOYEES** tab, the **STATE** filter chip finds employees by the states
  of their credentials, for example by **Unresolved Credential Count**.

## Do This With the API

Employee credentials:

- [Compromised Employee Credential Ignore](/reference/cti/compromised-employee-credential-ignore/)
- [Compromised Employee Credential Accept Risk](/reference/cti/compromised-employee-credential-accept-risk/)
- [Compromised Employee Credential Mark Resolved](/reference/cti/compromised-employee-credential-mark-resolved/)
- [Compromised Employee Credential Mark False Positive](/reference/cti/compromised-employee-credential-mark-false-positive/)
- [Compromised Employee Credential Revert](/reference/cti/compromised-employee-credential-revert/)

Client credentials:

- [Compromised Client Credential Ignore](/reference/cti/compromised-client-credential-ignore/)
- [Compromised Client Credential Accept Risk](/reference/cti/compromised-client-credential-accept-risk/)
- [Compromised Client Credential Mark Resolved](/reference/cti/compromised-client-credential-mark-resolved/)
- [Compromised Client Credential Mark False Positive](/reference/cti/compromised-client-credential-mark-false-positive/)
- [Compromised Client Credential Revert](/reference/cti/compromised-client-credential-revert/)

Payment credentials:

- [Compromised Payment Credential Ignore](/reference/cti/compromised-payment-credential-ignore/)
- [Compromised Payment Credential Accept Risk](/reference/cti/compromised-payment-credential-accept-risk/)
- [Compromised Payment Credential Mark Resolved](/reference/cti/compromised-payment-credential-mark-resolved/)
- [Compromised Payment Credential Mark False Positive](/reference/cti/compromised-payment-credential-mark-false-positive/)
- [Compromised Payment Credential Revert](/reference/cti/compromised-payment-credential-revert/)

> [!WARNING]
> These endpoints change every record that matches the filter you send, and an empty filter matches all
> records. Always send a filter.


---

# Review Compromised Client Credentials

URL: https://docs.deepinfo.com/guide/cti/compromised-client-credentials/

See your customers' credentials for your services that were found in leaked data, with the login address, the state of each credential and an exposure timeline, and export them.

Compromised Client Credentials lists the credentials of your customers for your own services that were found
in leaked data. Use it to see which customer accounts are exposed and on which login pages.

## Before You Start

- **Package:** Cyber Threat Intelligence (CTI).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **COMPROMISED CLIENT CREDENTIALS** · **Tab:** **COMPROMISED CLIENTS** · https://platform.deepinfo.com/app/cti/compromised-client-credentials/list

The page title is **Compromised Client Credentials**, with two tabs: **OVERVIEW**
(https://platform.deepinfo.com/app/cti/compromised-client-credentials) and **COMPROMISED CLIENTS**. The
sidebar item opens **COMPROMISED CLIENTS**. The **GO TO COMPROMISED CLIENT CREDENTIALS PAGE** button on the
[CTI dashboard](/guide/cti/dashboard/) opens the page too.

## Read the OVERVIEW Tab

The breadcrumb reads **CTI / COMPROMISED CLIENT CREDENTIALS / OVERVIEW**.

- **COMPROMISED CLIENTS**: the number of compromised client credentials, with a change indicator marked
  **BY YEAR**.
- **CREDENTIAL EXPOSURE TIMELINE**: exposed client credentials per period.
- **RECENTLY EXPOSED CLIENTS**: the latest client credentials, each with the client's e-mail address and the
  date it was found.

![The OVERVIEW tab of Compromised Client Credentials with the count card, the exposure timeline and the recently exposed clients, with e-mail addresses blurred.](/img/guide/cti/compromised-client-credentials-01.png)

## Read the COMPROMISED CLIENTS Tab

The breadcrumb reads **CTI / COMPROMISED CLIENT CREDENTIALS / COMPROMISED CLIENTS**. From top to bottom:

1. **Filter row:** the **SEARCH** box and the filter chips **CREDENTIAL**, **ACCOUNT TYPE**, **PASSWORD**,
   **STATUS** and **TARGET**.
2. **Result line:** **\<n\> COMPROMISED CLIENTS FOUND**, **SHOW INACTIVES**, **EXPORT** and **VIEW SETTINGS**.
3. **Tab:** **ALL CLIENTS**, with the count.
4. **The list:**

| Column | What it shows |
|---|---|
| **USERNAME** | The customer's username or e-mail address |
| **TARGET** | The login address the credential belongs to, with its platform and domain |
| **STATE** | The credential's state, for example **ACTIVE · NEWLY DETECTED** or **ACTIVE · UNRESOLVED** |
| **ADDED DATE** | When the credential was added |

The list shows no passwords. Tick **SHOW INACTIVES** to include credentials in an inactive state; the states
are explained in [Change the state of exposed credentials](/guide/cti/change-credential-state/).

The filter chips work like the other CTI lists; see
[Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

![The COMPROMISED CLIENTS tab with the filter chips and the list, with usernames and targets blurred.](/img/guide/cti/compromised-client-credentials-02.png)

## Export the List

1. Filter the list if you want only part of it.
2. Select **EXPORT**. The **DOWNLOAD** window opens.
3. Choose **RECORDS** (**ALL** or **FILTERED**), **FILE FORMAT** (**CSV** or **JSON**) and **EXPORT SCOPE**
   (**DEFAULT**, **BASIC** or **EXTENDED**).
4. Select **EXPORT**.

## Good to Know

- **Full export.** The **CTI REPORTS** tab of **REPORTS** has **All Compromised Client Credentials Report**,
  a CSV or JSON file of every client credential. See
  [Export all data as CSV or JSON](/guide/reports/export-data/).
- **Alerts.** A notification rule on **New Client Credential Detected** tells you when a new client
  credential is found. It can be filtered by **Username Type** (**Email** or **Username**). See
  [Create a notification rule](/guide/notifications/create-a-rule/).
- **Handle with care.** Client credentials belong to your customers; see
  [Handle leaked data safely](/guide/cti/sensitive-data/).

## Do This With the API

- [Compromised Client Credential Search](/reference/cti/compromised-client-credential-search/)
- [Compromised Client Credential Export](/reference/cti/compromised-client-credential-export/)
- [Compromised Client Credential Stats](/reference/cti/compromised-client-credential-stats/)
- State changes: [Compromised Client Credential Ignore](/reference/cti/compromised-client-credential-ignore/)
  and the related actions listed in
  [Change the state of exposed credentials](/guide/cti/change-credential-state/).

The API responses include the `password` field of each client credential. Handle them as described in
[Handle leaked data safely](/guide/cti/sensitive-data/).


---

# Review Compromised Payment Credentials

URL: https://docs.deepinfo.com/guide/cti/compromised-payment-credentials/

See the payment card data related to your organization that was found in leaked data, with where it came from, how often it was seen and its state, and export it.

Compromised Payment Credentials lists payment card data related to your organization that was found in
leaked data. Use it to see which cards are exposed, where the records come from and how often each card
was seen.

## Before You Start

- **Package:** Cyber Threat Intelligence (CTI).
- **Role:** Admin or Member.
- **Data:** the page stays empty until payment card data is found for your organization. Until then, the
  **COMPROMISED PAYMENTS** count shows **-** and the lists show **No Result Found.**

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **COMPROMISED PAYMENT CREDENTIALS** · **Tab:** **COMPROMISED PAYMENTS** · https://platform.deepinfo.com/app/cti/compromised-payment-credentials/list

The page has two tabs: **OVERVIEW**
(https://platform.deepinfo.com/app/cti/compromised-payment-credentials) and **COMPROMISED PAYMENTS**. The
sidebar item opens **COMPROMISED PAYMENTS**. The **GO TO COMPROMISED PAYMENT CREDENTIALS PAGE** button on the
[CTI dashboard](/guide/cti/dashboard/) opens the page too.

## Read the OVERVIEW Tab

- **COMPROMISED PAYMENTS**: the number of compromised payment records, with a change indicator marked
  **BY YEAR**.
- **CREDENTIAL EXPOSURE TIMELINE**: exposed payment records per period.
- **RECENTLY EXPOSED PAYMENTS**: the latest payment records.

## Read the COMPROMISED PAYMENTS Tab

The breadcrumb reads **CTI / COMPROMISED PAYMENT CREDENTIALS / COMPROMISED PAYMENTS**. From top to bottom:

1. **Filter row:** the **SEARCH** box and the filter chips **CARD**, **ISSUER**, **VALIDATION** and
   **EXPOSURE**.
2. **Result line:** the number of records found, **EXPORT** and **VIEW SETTINGS**.
3. **Tab:** **ALL CARDS**, with the count.
4. **The list:**

| Column | What it shows |
|---|---|
| **PAN** | The card number (primary account number) |
| **CONFIDENCE** | The platform's confidence level for the record |
| **SOURCE** | The source the record comes from |
| **HACKISHNESS** | A hackishness score, as on [dark web search](/guide/cti/dark-web-search/) results |
| **TIMES SEEN** | How many times the card was seen |
| **STATE** | The record's state; see [Change the state of exposed credentials](/guide/cti/change-credential-state/) |
| **LAST SEEN** | When the card was last seen |

The filter chips work like the other CTI lists; see
[Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

![The COMPROMISED PAYMENTS tab with its filter chips and columns, showing No Result Found.](/img/guide/cti/compromised-payment-credentials-01.png)

## Export the List

1. Filter the list if you want only part of it.
2. Select **EXPORT**. The **DOWNLOAD** window opens.
3. Choose **RECORDS** (**ALL** or **FILTERED**), **FILE FORMAT** (**CSV** or **JSON**) and **EXPORT SCOPE**
   (**DEFAULT**, **BASIC** or **EXTENDED**).
4. Select **EXPORT**.

## Good to Know

- **Full export.** The **CTI REPORTS** tab of **REPORTS** has **All Compromised Payment Credentials Report**,
  described as including the card brand, BIN and current status. See
  [Export all data as CSV or JSON](/guide/reports/export-data/).
- **Alerts.** A notification rule on **New Payment Credential Detected** tells you when new card data is
  found. It can be filtered by **Card Brand** (**Visa**, **Mastercard**, **Amex**, **Discover**,
  **UnionPay**) and **BIN**. See [Create a notification rule](/guide/notifications/create-a-rule/).
- **Handle with care.** Card data is sensitive; see [Handle leaked data safely](/guide/cti/sensitive-data/).

## Do This With the API

- [Compromised Payment Credential Search](/reference/cti/compromised-payment-credential-search/)
- [Compromised Payment Credential Detail](/reference/cti/compromised-payment-credential-detail/)
- [Compromised Payment Credential Export](/reference/cti/compromised-payment-credential-export/)
- [Compromised Payment Credential Stats](/reference/cti/compromised-payment-credential-stats/)
- State changes: [Compromised Payment Credential Ignore](/reference/cti/compromised-payment-credential-ignore/)
  and the related actions listed in
  [Change the state of exposed credentials](/guide/cti/change-credential-state/).


---

# Handle Leaked Data Safely

URL: https://docs.deepinfo.com/guide/cti/sensitive-data/

See what Cyber Threat Intelligence masks on screen, what showing a password does, which leaked data stays visible, and how to handle leaked credentials, exports and dark web results responsibly.

Cyber Threat Intelligence (CTI) shows data found in leaks: your employees' passwords, your customers' logins, payment card data and
posts from dark web sources. This page lists what the platform masks on screen and what it shows as found,
so you can decide what to reveal, export or share.

## Before You Start

This applies to everyone who can open CTI; see [What you can access](/guide/basics/packages-and-roles/).

## Passwords Are Masked

Leaked passwords are masked on screen until you choose to show them:

| Where | How the password appears | How to show it |
|---|---|---|
| [EXPOSED CREDENTIALS](/guide/cti/credential-exposures/) tab, list view | `••••••` in the **PASSWORD** column | Tick **SHOW PASSWORD** |
| Credential drawer, **OVERVIEW** tab | `●●●●●●●●` next to **PASSWORD** | Select the eye icon |
| Quick view and the credential's own page | `••••••` in the **PASSWORD** figure | Use the list view or the drawer |
| Employee's page, **CREDENTIALS** tab | `••••••` in the **PASSWORD** column | Tick **SHOW PASSWORD** |

These screens show no passwords at all:

- the **CREDENTIALS** tab of the employee drawer;
- the **COMPROMISED CLIENTS** list of [Compromised Client Credentials](/guide/cti/compromised-client-credentials/);
- the dashboards and the overview tabs.

**SHOW PASSWORD** is not available in quick view. Switch to list view to use it.

## What Showing a Password Does

Ticking **SHOW PASSWORD**, or selecting the eye icon, shows the password in plain text in your browser.
Anyone who can see your screen can read it. Untick **SHOW PASSWORD** to mask the list again.

Show a password only when you need it, and mask it again as soon as you are done. Before you share your
screen or take a screenshot, check that no password is shown.

## What Stays Visible While Passwords Are Masked

- **Password analysis.** **STRUCTURE** on the **PASSWORD ANALYSIS** tab, and **DOMINANT STRUCTURE** in an
  employee's security profile, show the pattern of character types in a password. **LENGTH**, **CONTAINS**
  and the **YES** / **NO** checks describe it further. Together they reveal the shape of a password without
  its characters. Keep this in mind before you share a screenshot.
- **The Password filter.** On the **EXPOSED CREDENTIALS** tab, **CREDENTIAL** › **Password** filters the list
  by password value, whether or not passwords are shown. Anyone who can use the filters can look for a given
  password in the leaked data.
- **Account details.** Employees' e-mail addresses and details such as department and title, and the
  usernames and e-mail addresses of your customers, are shown as they are.

## Card Data and Dark Web Results

- **Payment cards.** The **COMPROMISED PAYMENTS** list has a **PAN** column for the card number; see
  [Review compromised payment credentials](/guide/cti/compromised-payment-credentials/). Handle everything on
  that page under your organization's rules for card data.
- **Dark web results.** Results of [Dark Web Search](/guide/cti/dark-web-search/) can contain e-mail
  addresses, IP addresses, card numbers, social security numbers and the full text of the source. Handle
  them under the same rules as card data.

## Data Kept in Your Browser

Dark Web Search keeps your search tabs, with their searches and results, in this browser for your user, so
they are still there after a reload. They are not shared with other browsers or computers. On a shared
computer, close the search tabs you no longer need, or clear the browser's site data for the platform when
you finish.

## Exports and Reports

**EXPORT** on the CTI lists and the exports on the **CTI REPORTS** tab of **REPORTS** create files on your
computer. The platform does not describe what each **EXPORT SCOPE** includes, so check an exported file for
passwords and other leaked values before you pass it on. Store exported files securely, share them only with
people who need them, and delete them when you no longer need them.

## Act on Leaked Data Responsibly

- **Use it only to protect the accounts concerned.** For example, have the leaked password changed on every
  service where it was used, and turn on multi-factor authentication where the service offers it. For your
  customers' accounts, follow your own process, such as asking the customer to reset the password.
- **Do not sign in with a leaked credential** to check whether it still works.
- **Do not copy passwords or card numbers** into tickets, e-mail or chat. Refer to a credential by its
  service and account instead, or share the address of its page in the platform.
- **Follow your organization's policies** for personal data and incident response.
- **Record what you did** by changing the credential's state; see
  [Change the state of exposed credentials](/guide/cti/change-credential-state/).

## Good to Know

- **Screenshots.** Take screenshots of CTI screens with passwords masked, and check the password analysis
  fields and e-mail addresses before you share them.

## Do This With the API

The search responses include the `password` field of each employee and client credential, and the card
number fields (`pan`, `pan_masked`, `pan_last_four`) of each payment record. Protect the responses, and any
files or logs your scripts write, as you would the platform's screens:

- [Compromised Employee Credential Search](/reference/cti/compromised-employee-credential-search/)
- [Compromised Client Credential Search](/reference/cti/compromised-client-credential-search/)
- [Compromised Payment Credential Search](/reference/cti/compromised-payment-credential-search/)


---

# Cyber Security News

URL: https://docs.deepinfo.com/guide/cti/cybersecurity-news/

Browse and filter curated cyber security news, read an article with the threat actors, targets, vendors, products and CVEs it mentions, and open the latest headlines from the top bar.

**CYBER SECURITY NEWS** is a feed of curated cyber security articles. Each article is linked to the threat
actors, target countries, industries and organizations, vendors, products and CVEs it mentions, so you can
follow a topic across articles.

## Before You Start

- **Package:** Cyber Threat Intelligence (CTI).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **CYBER SECURITY NEWS** · https://platform.deepinfo.com/app/cti/news

The newspaper icon in the top bar opens the latest headlines; see [The news menu](#the-news-menu).

## Read the News List

The breadcrumb reads **CTI / CYBER SECURITY NEWS**. From top to bottom:

1. The line "Stay ahead with real-time security news and insights.", a search box
   (**Search in news...**) and a filter icon.
2. Quick links: **#ransomware**, **#vulnerability**, **#stealerlogs**, **#cisa** and **#windows**. Each opens
   a search for that word in a new browser tab.
3. Article cards: the publication date, the title and tag chips.
4. Pages of 30 articles, with **Displaying Results** and page numbers below.

![The news list with the search box, the filter icon, the hashtag links and the first article cards; article images are hidden.](/img/guide/cti/cybersecurity-news-01.png)

## Search and Filter the News

- **Search:** type in **Search in news...** and press **Enter** to search article titles.
- **Tag:** select a tag chip on a card to list the articles with that tag.
- **Filters:** select the filter icon, fill in one or more of **Threat Actor**, **Target Country**,
  **Target Industry**, **Target Organization**, **Vendor**, **Product**, **CVE** and **Tags**, then select
  **SEARCH**.

Applied filters appear under **FILTERS APPLIED**, for example
**MUST · Threat Actor · Actor · EQUAL · \<name\>**, and the filter group shows a **+1** badge.
**CLEAR FILTERS** removes them all.

## Read an Article

Select a card. The breadcrumb reads **CTI / NEWS / \<title\>**.

- The article text, a link to the original source (it opens the publisher's page in a new browser tab) and
  the article's tags.
- A side panel with **THREAT ACTOR**, **TARGET COUNTRY**, **TARGET INDUSTRY**, **TARGET ORGANIZATION**,
  **VENDOR**, **PRODUCT** and **CVE**. A field shows **-** when the article mentions none. Select a threat
  actor or an industry to list the other articles about it. These lists have their own address, for
  example `https://platform.deepinfo.com/app/cti/news?actor=<name>`, which you can bookmark.
- **Latest News**: other recent articles.

![An article with its side panel of threat actor, target, vendor, product and CVE fields; the article image is hidden and the article text is blurred.](/img/guide/cti/cybersecurity-news-02.png)

## The News Menu

The newspaper icon in the top bar, marked with a dot, opens the **Cybersecurity News** menu from any page:

- **All**, with the number of recent articles;
- the articles of **TODAY** and of the **LAST 7 DAYS**, each with its age. Select one to open it;
- **Go to Cybersecurity News**, which opens the news list.

## Good to Know

- **Alerts.** A notification rule on **New Cybersecurity News** e-mails you about new articles, and can be
  filtered, for example by title, tags, country, industry, CVE or threat actor. See
  [Create a notification rule](/guide/notifications/create-a-rule/).
- **Third-party content.** Articles come from third-party publishers. The source link opens the original.

## Do This With the API

- [Security News Search](/reference/cti/security-news-search/)
- [Security News Detail](/reference/cti/security-news-detail/)


---

# Search the Dark Web

URL: https://docs.deepinfo.com/guide/cti/dark-web-search/

Search dark web sources such as forums, markets, paste sites and chat channels by text and filters, and open each result to read its details.

**DARK WEB SEARCH** searches dark web sources: forums, markets, paste sites, chat channels and leaks. Search by
text, narrow the results with filters, and open a result to read its details.

## Before You Start

- **Package:** either Cyber Threat Intelligence (CTI) or Dark Web Search opens the page. Running a search needs Dark Web Search. With
  neither, the page shows **DARK WEB SEARCH IS NOT INCLUDED IN YOUR PACKAGE**; see
  [What you can access](/guide/basics/packages-and-roles/).
- **Role:** Admin or Member.
- Results can contain personal data, such as e-mail addresses and card numbers. Read
  [Handle leaked data safely](/guide/cti/sensitive-data/) first.

## Where to Find It

**Sidebar:** **CYBER THREAT INTELLIGENCE** › **DARK WEB SEARCH** · https://platform.deepinfo.com/app/cti/dark-web-search

## Read the Screen

The breadcrumb reads **CTI / DARK WEB SEARCH** and the page title is **Dark Web Search**. From top to
bottom:

1. **Search tabs:** the first tab is **Dark Web Search**; **+** opens a new one. Each tab holds its own
   search. See [Work with search tabs](#work-with-search-tabs).
2. **The search box:** **Search dark web...**.
3. **The filter panel,** with its **FILTERS** tab, **HIDE FILTERS** and **SEARCH**.
4. Before your first search, a **Did you know?** panel: "Every day, terabytes of new data are exposed on the
   dark web."

![Dark Web Search before the first search, with the search box, the open filter panel and the Did you know? panel.](/img/guide/cti/dark-web-search-01.png)

## Run a Search

1. Type your text in **Search dark web...** and press **Enter**. The text becomes a filter chip,
   **MUST · Content · CONTAINS · \<text\>**. **Enter** does not start the search.
2. Add filters from the panel if you need them (see below).
3. Select **SEARCH**.

Your filters are listed under **FILTERS APPLIED**. **CLEAR FILTERS** removes them all.

If the page shows **An unexpected error has occurred.**, the search did not run. Try again later, and write
to [support@deepinfo.com](mailto:support@deepinfo.com) if the error persists.

## Filters

| Filter | What it matches |
|---|---|
| **CRAWL DATE**, **POST DATE** | A date range: when the page was collected, and when it was posted |
| **HACKISHNESS** | A score range |
| **WEBSITE MENTION** | A domain mentioned in the result |
| **EMAIL ADDRESS APEX** | E-mail addresses on a domain |
| **EMAIL ADDRESS** | One e-mail address |
| **IP ADDRESS** | An IP address |
| **CCN** | A card number |
| **CVE** | A CVE ID |
| **SSN** | A social security number |
| **CRYPTO ADDRESS** | A cryptocurrency address |
| **INCLUDE TEXT CONTENT** | Yes or no |
| **DATA LEAK** | A leak source |
| **SOURCE TYPE** | The kind of source, such as Discord, Onion, Telegram or IRC |
| **SOURCE GROUP** | The group of source, such as forums, markets, pastes or blogs |
| **SOURCE DOMAINS** | Domains the results come from |
| **DISCORD CHANNEL**, **TELEGRAM CHANNEL** | A chat channel |
| **LANGUAGES** | The language of the result |
| **INCLUDE SIMILAR** | Yes or no |

A search needs at least one criterion, such as text, an e-mail address, a domain, a CVE or a source.

**SAVE THIS SEARCH** and the **SAVED SEARCH** tab of the panel are not available.

## Read the Results

Select a result to open it. For the fields a result can carry, such as its metadata, leak details, the
values found in it and its raw text, see [Darkweb Search](/reference/darkweb/search/) in the API
reference.

## Work With Search Tabs

Search tabs work like browser tabs. Right-click a tab for **Duplicate**, **New Tab to The Right**,
**Close Tab**, **Close Other Tabs** and **Close Tabs to the Right**. **Add Tab to Saved Search** is not
available.

Your tabs, with their searches and results, are kept in this browser for your user, so they are still there
after a reload. They are not shared with other browsers or computers. See
[Handle leaked data safely](/guide/cti/sensitive-data/#data-kept-in-your-browser).

![The right-click menu of a search tab in Dark Web Search.](/img/guide/cti/dark-web-search-03.png)

## Good to Know

- **No export.** Results cannot be exported from this page. To take results out, use the API.
- **Treat results as sensitive.** A result can contain card numbers, social security numbers and e-mail
  addresses; see [Handle leaked data safely](/guide/cti/sensitive-data/).

## Do This With the API

- [Darkweb Search](/reference/darkweb/search/) in the Darkweb reference. The API returns 25 results
  per page, up to page 250.


---

# Brand Risk Protection (BRP)

URL: https://docs.deepinfo.com/guide/brp/

Brand Risk Protection (BRP) finds domain names that imitate your brand, lets you confirm them as fraudulent or ignore them, and keeps the confirmed ones on their own list with a risk score.

Brand Risk Protection (BRP) looks for domain names that imitate your brand. Detection rules that you set up pick
them out. Each domain a rule finds waits as a **suspicious domain** until you decide: mark it as fraudulent, or
ignore it. Fraudulent domains stay on their own list with their risk score and, when one is available, a
screenshot of the site.

## Before You Start

- **Package:** BRP. Without it, the BRP pages show a notice that the package is not included, with a
  **TALK TO US** button. See [What you can access](/guide/basics/packages-and-roles/).
- **Role:** Admin or Member.
- **Data:** detection rules. They decide which domains reach the suspicious list; see
  [Set up detection rules](/guide/brp/detection-rules/).

## Where to Find It

**Sidebar:** **BRAND RISK PROTECTION** › **FRAUDULENT DOMAINS** · **Tab:** **OVERVIEW** · [https://platform.deepinfo.com/app/brp/fraudulent/overview](https://platform.deepinfo.com/app/brp/fraudulent/overview)

**FRAUDULENT DOMAINS** is the only item under the orange **BRAND RISK PROTECTION** heading in the sidebar. It
opens the **Fraudulent Domains** page, which has three in-page tabs:

| In-page tab | What it holds | Guide page |
|---|---|---|
| **OVERVIEW** | Two counts and two short lists | [The OVERVIEW tab](#the-overview-tab), below |
| **FRAUDULENT DOMAINS** (opens first) | Two lists: **SUSPICIOUS DOMAINS** (shown first) and **FRAUDULENT DOMAINS** | [Review suspicious domains](/guide/brp/review-suspicious-domains/), [Track fraudulent domains](/guide/brp/fraudulent-domains/) |
| **SETTINGS** | **Custom Rules** and **Other Settings** | [Set up detection rules](/guide/brp/detection-rules/) |

The **⋮** menu at the top right of the page has one item, **IGNORED DOMAINS**; see
[Restore ignored domains](/guide/brp/ignored-domains/). The header breadcrumb starts with **BRP**, for example
**BRP / FRAUDULENT DOMAINS / OVERVIEW**.

The **BRP** section of the [Global dashboard](/guide/global-dashboard/) also links here: its
**FRAUDULENT DOMAINS** and **SUSPICIOUS DOMAINS** cards open the list in a new browser tab.

![The sidebar with the BRAND RISK PROTECTION group next to the Fraudulent Domains page and its OVERVIEW, FRAUDULENT DOMAINS and SETTINGS tabs.](/img/guide/brp/index-01.png)

## How BRP Works

### From Rule to Decision

1. A **detection rule** describes what to look for: a keyword, a match type and optional filters such as the
   extensions (TLDs) to include or leave out.
2. Every domain a rule detects appears on the **SUSPICIOUS DOMAINS** list with the rules that found it.
3. You review it and choose:
   - **MARK AS FRAUDULENT**: the domain moves to the **FRAUDULENT DOMAINS** list.
   - **IGNORE**: the domain moves to **Ignored Domains**. You can restore it later with **UNDO IGNORE**.
4. A rule with **Auto Approval** turned on marks the suspicious domains it matches as fraudulent for you.

To keep your own domains off the suspicious list, add them to **Ignored Assets** under
**SETTINGS › Other Settings**.

| State | List | How a domain gets there | What you can do |
|---|---|---|---|
| Suspicious | **SUSPICIOUS DOMAINS** | A rule detected it, or you restored it from Ignored Domains | **MARK AS FRAUDULENT**, **IGNORE** |
| Fraudulent | **FRAUDULENT DOMAINS** | You marked it, or a rule with **Auto Approval** did | **REMOVE FROM FRAUDULENT DOMAINS** |
| Ignored | **Ignored Domains** | You ignored it | **UNDO IGNORE** |

### Risk Score

Every detected domain has a **RISK SCORE** from 0 to 100, shown as a number, a label and a bar:

| Score | Label |
|---|---|
| 0 | none (the score shows as **0**) |
| 1 to 20 | **INFORMATION** |
| over 20, up to 40 | **LOW** |
| over 40, up to 60 | **MEDIUM** |
| over 60, up to 80 | **HIGH** |
| over 80 | **CRITICAL** |

A score exactly on a boundary takes the lower label: 20 is **INFORMATION**, 40 is **LOW**, 60 is **MEDIUM** and
80 is **HIGH**. This is not the same scale as the External Attack Surface Management (EASM) security score (see
[How security scores work](/guide/easm/security-score/)).

### Indicators

The **INDICATORS** column shows four icons: **DNS**, **DNS MX**, **SSL** and **HTTP**. Hover over an icon to see
its name. The **INDICATORS** filter finds the domains that have a given indicator.

### Badges

- **NEW**: the domain was first detected in the last 14 days.
- **SEEMS INACTIVE**: the domain looks inactive. See the [Glossary](/guide/glossary/).

> [!CAUTION]
> The external-link icon next to a domain name opens that domain in your browser. Suspicious and fraudulent
> domains can host phishing pages or malware. Open them only when you need to, and with care.

## The OVERVIEW Tab

The **OVERVIEW** tab summarizes the module on one screen:

1. **FRAUDULENT DOMAINS** and **SUSPICIOUS DOMAINS**: how many domains are on each list. Select a card to open
   that list.
2. **RECENTLY MARKED AS FRAUDULENT**: five recent domains from the fraudulent list, with **DOMAIN** and
   **RISK SCORE**.
3. **MOST CRITICAL SUSPICIOUS DOMAINS**: five suspicious domains with high risk scores, with **DOMAIN** and
   **RISK SCORE**.

![The OVERVIEW tab of Fraudulent Domains with the two count cards and the two short lists.](/img/guide/brp/index-02.png)

## Related Pages

- **Alerts:** a notification rule can watch the events **New Suspicious Domain** and **New Fraudulent Domain**,
  filtered by **Fraudulent Type** (Domain or Subdomain) and by **Rule**. See
  [Create a notification rule](/guide/notifications/create-a-rule/).
- **Full exports:** **REPORTS** has a **BRP REPORTS** tab with **All Fraudulent Domains Report** and
  **All Suspicious Domains Report** (CSV or JSON). See [Export all data as CSV or JSON](/guide/reports/export-data/).

## Pages in This Section

1. [Review suspicious domains](/guide/brp/review-suspicious-domains/): mark domains as fraudulent or ignore them.
2. [Track fraudulent domains](/guide/brp/fraudulent-domains/): the confirmed list, screenshots and risk over time.
3. [Restore ignored domains](/guide/brp/ignored-domains/): find what you ignored and undo it.
4. [Set up detection rules](/guide/brp/detection-rules/): custom rules and the domains to keep out.

## Do This With the API

- Counts per state: [Suspicious Domain State Stats](/reference/brp/suspicious-domain-state-stats/)
- Everything else: the [BRP API reference](/reference/brp/)


---

# Review Suspicious Domains

URL: https://docs.deepinfo.com/guide/brp/review-suspicious-domains/

Check the lookalike domains your detection rules found, then mark each one as fraudulent or ignore it, one at a time or in bulk.

Every domain your detection rules find lands on the **SUSPICIOUS DOMAINS** list. Check each one, then mark it as
fraudulent if it imitates your brand, or ignore it if it does not.

## Before You Start

- **Package:** Brand Risk Protection (BRP).
- **Role:** Admin or Member.
- **Data:** detection rules; see [Set up detection rules](/guide/brp/detection-rules/).

## Where to Find It

**Sidebar:** **BRAND RISK PROTECTION** › **FRAUDULENT DOMAINS** · **Tab:** **FRAUDULENT DOMAINS** › list tab **SUSPICIOUS DOMAINS** · [https://platform.deepinfo.com/app/brp/fraudulent?tab=suspicious](https://platform.deepinfo.com/app/brp/fraudulent?tab=suspicious)

This is the list the sidebar item opens. The **SUSPICIOUS DOMAINS** card on the **OVERVIEW** tab opens it too.

## Read the Screen

![The SUSPICIOUS DOMAINS list, numbered 1 to 5, with NEW badges and a SEEMS INACTIVE banner.](/img/guide/brp/review-suspicious-domains-01.png)

1. **Header:** the title **Fraudulent Domains**, the **⋮** menu (**IGNORED DOMAINS**) and the in-page tabs
   **OVERVIEW**, **FRAUDULENT DOMAINS** and **SETTINGS**.
2. **Filter bar:** **SEARCH**, the filter chips starting with **DOMAIN**, **TAGS**, **DETECTION DATE** and
   **TYPE**, **SHOW ALL FILTERS** for the rest, and the list view and quick view icons. A filter that holds a
   rule shows its count.
3. **Count line:** how many suspicious domains match, then **EXPORT** and **VIEW SETTINGS** (list view only).
4. **List tabs**, each with its count: **FRAUDULENT DOMAINS** and **SUSPICIOUS DOMAINS**.
5. **The list**, 25 rows per page, newest **DETECTION DATE** first. Select a column header to sort by it.
   - A checkbox on every row.
   - **DOMAIN**: the site icon and the name, with the **NEW** badge (first detected in the last 14 days), the
     **SEEMS INACTIVE** banner and an external-link icon.
   - **RISK SCORE**: the score, its label and a bar.
   - **INDICATORS**: **DNS**, **DNS MX**, **SSL** and **HTTP**.
   - **DETECTION DATE**: the date, the time and how many days ago.
   - **RULES**: the rules that detected the domain.
   - **MARK AS FRAUDULENT** and a **✕** button (ignore) at the end of the row.

[Brand Risk Protection (BRP)](/guide/brp/) explains the risk score, the indicators and the badges.

> [!CAUTION]
> The external-link icon opens the suspicious domain itself in your browser. It may host a phishing page or
> malware. Use the drawer tabs below to check a domain without visiting it.

## Check a Domain Before You Decide

1. Select a row. The domain's drawer opens on the right.
2. The drawer's tabs are icons; the name of the open tab is shown as its heading. Read:
   - **OVERVIEW**: **DETECTION DATE**, **LAST CHECK DATE**, **RISK SCORE**, **INDICATORS** and **RULES**.
   - **WHOIS**: **CREATE DATE**, **EXPIRATION DATE**, **UPDATED DATE**, **NAME SERVER**, **DOMAIN STATUS**,
     **REGISTRAR** and the **Registrant** block.
   - **DNS**: one table per record type (**A**, **AAAA**, **MX**, **NS**, **SOA** and more).
   - **SSL**: **Details**, **Fingerprint** and **Signature**.
   - **WEBSITE INFO**: **Metadata**, **Robots.txt**, **HTML**, **Favicon**, **HTTP Status** (with
     **REDIRECTION HISTORY**) and **HTTP Headers**.
3. Decide with the buttons at the bottom of the drawer: **IGNORE** or **MARK AS FRAUDULENT**.

The **WHOIS**, **DNS**, **SSL** and **WEBSITE INFO** tabs show the data stored for the domain at its last check.
Opening them does not run a new lookup. **LAST CHECK DATE** on **OVERVIEW** tells you when that data was
collected; compare it with today's date to judge how current it is.

To give the domain a page of its own, select **OPEN IN NEW TAB** at the top of the drawer. The page opens in a
new browser tab (`/app/brp/fraudulent/detected/<id>`) and has **MARK AS FRAUDULENT** and **IGNORE** at the top,
the tabs **OVERVIEW**, **WHOIS**, **DNS**, **SSL** and **WEBSITE INFO**, an **INFO** card (**RISK SCORE**,
**DETECTION DATE**, **LAST CHECK DATE**, **INDICATORS**) and a **RULES** card. The page has no back button; the
**FRAUDULENT DOMAINS** link in the header breadcrumb returns to the list.

![The drawer of a suspicious domain on OVERVIEW, with IGNORE and MARK AS FRAUDULENT at the bottom.](/img/guide/brp/review-suspicious-domains-02.png)

### Work Through the List in Quick View

Select the quick view icon in the filter bar. The domains are listed on the left (**LOAD MORE** adds more); the
selected domain opens on the right with **OPEN IN NEW TAB**, **MARK AS FRAUDULENT**, **IGNORE**, the same tabs and
the **INFO** and **RULES** cards.

## Mark a Domain as Fraudulent

1. Select **MARK AS FRAUDULENT** on the row, in the drawer, in quick view or on the domain's page.
2. Confirm with **APPROVE**.
3. After a few seconds the list refreshes. The domain is now on the **FRAUDULENT DOMAINS** list; see
   [Track fraudulent domains](/guide/brp/fraudulent-domains/).

## Ignore a Domain

1. Select the **✕** button at the end of the row, or **IGNORE** in the drawer, in quick view or on the domain's
   page.
2. Confirm with **IGNORE**.
3. After a few seconds the list refreshes. The domain is now on **Ignored Domains**, where you can restore it;
   see [Restore ignored domains](/guide/brp/ignored-domains/).

To keep a domain of your own from ever appearing here, add it to **Ignored Assets** instead; see
[Set up detection rules](/guide/brp/detection-rules/#keep-your-own-domains-out).

## Act on Several Domains at Once

1. Tick the rows you want. To tick every row on the page, open the arrow next to the header checkbox and
   select **SELECT THIS PAGE**; **CLEAR SELECTION** starts again.
2. Use **MARK AS FRAUDULENT** or **IGNORE** in the selection bar.
3. The confirmation shows how many domains you selected. Confirm.

## Find Domains

The first filter chips are always visible; **SHOW ALL FILTERS** shows the rest (and becomes **HIDE FILTERS**).

| Filter | What it matches |
|---|---|
| **DOMAIN** | The domain name |
| **TAGS** | Tags on the domain |
| **DETECTION DATE** | When the domain was detected |
| **TYPE** | **Domain** or **Subdomain** |
| **RISK SCORE** | A range from 0 to 100 (**MINIMUM**, **MAXIMUM**) |
| **INDICATORS** | **DNS**, **DNS MX**, **SSL**, **HTTP** |
| **SEEMS INACTIVE** | Whether the domain seems inactive |
| **IGNORED DATE** | When the domain was ignored. On this list, it can find domains that were ignored and later restored |
| **APPROVE DATE** | When the domain was marked as fraudulent |

A date filter takes **AFTER** or **BEFORE** a date; the risk score filter takes a range. Select **APPLY** to
use it. [Search, filter and export lists](/guide/basics/lists-filters-and-exports/) explains the filter
controls every list shares.

Switching between the **SUSPICIOUS DOMAINS** and **FRAUDULENT DOMAINS** tabs clears your filters.

## Export the List

1. Select **EXPORT** above the list.
2. In the **DOWNLOAD** dialog, choose **RECORDS** (**ALL** or **FILTERED**, the current filters) and
   **FILE FORMAT** (**CSV** or **JSON**).
3. Select **DOWNLOAD**.

## Good to Know

- Actions take a few seconds to apply; the list refreshes on its own afterwards.
- Marking and ignoring move the domain to another list. An ignored domain can be restored to this list.

## Do This With the API

- Search suspicious domains: [Suspicious Domain Search](/reference/brp/suspicious-domain-search/)
- Get one: [Suspicious Domain Detail](/reference/brp/suspicious-domain-detail/)
- Mark as fraudulent: [Suspicious Domain Approve](/reference/brp/suspicious-domain-approve/)
- Ignore: [Suspicious Domain Ignore](/reference/brp/suspicious-domain-ignore/)
- Export: [Suspicious Domain Export](/reference/brp/suspicious-domain-export/)


---

# Track Fraudulent Domains

URL: https://docs.deepinfo.com/guide/brp/fraudulent-domains/

Follow the domains you confirmed as fraudulent, with their risk score over time and a screenshot of the site, and remove a domain from the list.

When you mark a suspicious domain as fraudulent, it moves to the **FRAUDULENT DOMAINS** list. There you can
see each domain's risk score over time and a screenshot of its site, when one is available, and export the
list.

## Before You Start

- **Package:** Brand Risk Protection (BRP).
- **Role:** Admin or Member.
- **Data:** domains you marked as fraudulent (see [Review suspicious domains](/guide/brp/review-suspicious-domains/)),
  or a detection rule with **Auto Approval** turned on.

## Where to Find It

**Sidebar:** **BRAND RISK PROTECTION** › **FRAUDULENT DOMAINS** · **Tab:** **FRAUDULENT DOMAINS** › list tab **FRAUDULENT DOMAINS** · [https://platform.deepinfo.com/app/brp/fraudulent?tab=fraudulent](https://platform.deepinfo.com/app/brp/fraudulent?tab=fraudulent)

The sidebar item opens the suspicious list first. Select the **FRAUDULENT DOMAINS** list tab above the table to
switch. The **FRAUDULENT DOMAINS** card on the **OVERVIEW** tab also leads here.

## Read the Screen

![The FRAUDULENT DOMAINS list, numbered 1 to 4, with screenshot thumbnails and placeholders.](/img/guide/brp/fraudulent-domains-01.png)

1. **Filter bar:** **SEARCH**, the filter chips starting with **DOMAIN**, **TAGS**, **DETECTION DATE** and
   **TYPE**, **SHOW ALL FILTERS** for the rest, and the list view and quick view icons.
2. **Count line:** how many fraudulent domains match, then **EXPORT** and **VIEW SETTINGS** (list view only).
3. **List tabs:** **FRAUDULENT DOMAINS** and **SUSPICIOUS DOMAINS**, each with its count.
4. **The list**, 25 rows per page, newest **DETECTION DATE** first. Select a column header to sort by it.
   - **DOMAIN**: a thumbnail of the site's screenshot (a placeholder when there is none), the name, the
     **SEEMS INACTIVE** banner when it applies, and an external-link icon.
   - **RISK SCORE**, **INDICATORS**, **DETECTION DATE** and **RULES**, as on the suspicious list.
   - A **⋮** menu at the end of the row with **REMOVE FROM FRAUDULENT DOMAINS**.

This list has no checkboxes: you act on one domain at a time. The risk score, indicators and badges are
explained in [Brand Risk Protection (BRP)](/guide/brp/).

> [!CAUTION]
> The external-link icon opens the fraudulent domain itself in your browser. It may host a phishing page or
> malware. When a screenshot exists, use the **SCREENSHOT** tab to see the site without visiting it.

## Look at a Fraudulent Domain

1. Select a row. The domain's drawer opens on the right. Its tabs are icons; the open tab's name is shown as its
   heading.
2. Read the tabs:
   - **OVERVIEW**: **DETECTION DATE**, **LAST CHECK DATE**, **RISK SCORE**, **INDICATORS**, **RULES** and
     **SCORE TIMELINE**, a chart of the domain's risk score over time.
   - **WHOIS**, **DNS**, **SSL** and **WEBSITE INFO**: the data stored for the domain at its last check. When
     nothing is stored, the tab says so.
   - **SCREENSHOT**: the screenshot of the site, when one exists.
3. To open the domain on a page of its own, select **OPEN IN NEW TAB**. The page opens in a new browser tab
   (`/app/brp/fraudulent/approved/<id>`) and has the same tabs, an **INFO** card (**DETECTION DATE**,
   **LAST CHECK DATE**, **INDICATORS**), a **RULES** card and a **RISK SCORE** chart.

The drawer and the page of a fraudulent domain have no action buttons. The data tabs do not run a new lookup
when you open them; **LAST CHECK DATE** tells you when the stored data was collected.

![The drawer of a fraudulent domain on OVERVIEW with the SCORE TIMELINE chart.](/img/guide/brp/fraudulent-domains-02.png)

![The SCREENSHOT tab of a fraudulent domain's drawer.](/img/guide/brp/fraudulent-domains-03.png)

## Remove a Domain From the List

1. On the row, open the **⋮** menu and select **REMOVE FROM FRAUDULENT DOMAINS**.
2. A red **Remove** confirmation asks you to confirm. Select **REMOVE**.
3. After a few seconds the list refreshes and the domain is no longer on it.

Removing is only possible from the list, one domain at a time. The drawer and the domain's page have no remove
button.

![The red Remove confirmation with CANCEL and REMOVE.](/img/guide/brp/fraudulent-domains-04.png)

## Find Domains

The first filter chips are always visible; **SHOW ALL FILTERS** shows the rest.

| Filter | What it matches |
|---|---|
| **DOMAIN**, **TAGS**, **DETECTION DATE**, **TYPE**, **RISK SCORE**, **INDICATORS** | As on the [suspicious list](/guide/brp/review-suspicious-domains/#find-domains) |
| **SEEMS INACTIVE** | Whether the domain seems inactive |
| **ADDED DATE** | When the domain was added to this list |
| **IS LOGIN PAGE** | Whether the site has a login page |
| **SEEMS INACTIVE FIRST SEEN**, **SEEMS INACTIVE LAST SEEN** | When the domain was first and last seen inactive |

This list has no **IGNORED DATE** or **APPROVE DATE** filter. Switching between the list tabs clears your
filters. See also [Search, filter and export lists](/guide/basics/lists-filters-and-exports/).

## Export the List

1. Select **EXPORT** above the list.
2. In the **DOWNLOAD** dialog, choose **RECORDS** (**ALL** or **FILTERED**) and **FILE FORMAT** (**CSV** or
   **JSON**).
3. Select **DOWNLOAD**.

The full list is also available as **All Fraudulent Domains Report** under **REPORTS**; see
[Export all data as CSV or JSON](/guide/reports/export-data/).

## Good to Know

- To be told when a new fraudulent domain is found, create a notification rule for **New Fraudulent Domain**;
  see [Create a notification rule](/guide/notifications/create-a-rule/).
- Scans and per-layer history for a fraudulent domain are available through the API only (below).

## Do This With the API

- Search fraudulent domains: [Fraudulent Domain Search](/reference/brp/fraudulent-domain-search/)
- Get one: [Fraudulent Domain Detail](/reference/brp/fraudulent-domain-detail/)
- Risk score over time: [Fraudulent Domain Risk Score Timeline](/reference/brp/fraudulent-domain-risk-score-timeline/)
- Remove: [Fraudulent Domain Delete](/reference/brp/fraudulent-domain-delete/)
- Export: [Fraudulent Domain Export](/reference/brp/fraudulent-domain-export/)
- API only:
  - [Fraudulent Domain Instant Scan](/reference/brp/fraudulent-domain-instant-scan/)
  - [Fraudulent Domain Whois History](/reference/brp/fraudulent-domain-whois-history/),
    [DNS History](/reference/brp/fraudulent-domain-dns-history/),
    [SSL History](/reference/brp/fraudulent-domain-ssl-history/),
    [Webdata History](/reference/brp/fraudulent-domain-webdata-history/)


---

# Restore Ignored Domains

URL: https://docs.deepinfo.com/guide/brp/ignored-domains/

Find the suspicious domains you ignored and send them back for review with UNDO IGNORE.

Suspicious domains you ignore leave the review list and wait on **Ignored Domains**. If you change your mind,
**UNDO IGNORE** sends a domain back to **SUSPICIOUS DOMAINS** for review.

## Before You Start

- **Package:** Brand Risk Protection (BRP).
- **Role:** Admin or Member.
- **Data:** at least one domain you ignored (see [Review suspicious domains](/guide/brp/review-suspicious-domains/)).

## Where to Find It

**Sidebar:** **BRAND RISK PROTECTION** › **FRAUDULENT DOMAINS**, then **⋮** › **IGNORED DOMAINS** · [https://platform.deepinfo.com/app/brp/fraudulent/ignored](https://platform.deepinfo.com/app/brp/fraudulent/ignored)

The **⋮** menu is at the top right of the **Fraudulent Domains** page. The breadcrumb reads
**BRP / FRAUDULENT DOMAINS / IGNORED DOMAINS**. To return to the lists, use the sidebar.

## Read the Screen

![Ignored Domains, numbered 1 to 4, with an empty list.](/img/guide/brp/ignored-domains-01.png)

1. **Title:** **Ignored Domains**.
2. **Filter bar:** the same as on the suspicious list: **SEARCH**, filter chips, **SHOW ALL FILTERS** and the
   view icons. The filters are those of the suspicious list, including **IGNORED DATE**; see
   [Find domains](/guide/brp/review-suspicious-domains/#find-domains).
3. **Count line:** how many domains are ignored, then **EXPORT** and **VIEW SETTINGS**.
4. **The list**, on a single tab **ALL IGNORED DOMAINS** with its count. Columns: **DOMAIN**, **RISK SCORE**,
   **INDICATORS**, **DETECTION DATE**, **IGNORED DATE** and **RULES**.

When nothing is ignored, the list shows **No Result Found.**

## Undo an Ignore

1. Select **UNDO IGNORE** on the row. To restore several domains, tick their rows and use **UNDO IGNORE** in the
   selection bar. A domain's drawer and its page also have **UNDO IGNORE**.
2. Confirm with **REVERT**.
3. After a few seconds the list refreshes. The domain is back on **SUSPICIOUS DOMAINS**, where you can mark it
   as fraudulent or ignore it again.

## Export the List

Select **EXPORT**, choose **RECORDS** (**ALL** or **FILTERED**) and **FILE FORMAT** (**CSV** or **JSON**) in the
**DOWNLOAD** dialog, then select **DOWNLOAD**.

## Good to Know

- Ignoring is a decision about one detected domain. To keep a domain of your own from ever appearing as
  detected, add it to **Ignored Assets**; see
  [Keep your own domains out](/guide/brp/detection-rules/#keep-your-own-domains-out).
- On the suspicious list, the **IGNORED DATE** filter can find domains that were ignored and later restored.

## Do This With the API

- Undo an ignore: [Suspicious Domain Revert](/reference/brp/suspicious-domain-revert/)
- List ignored domains: [Suspicious Domain Search](/reference/brp/suspicious-domain-search/)
- Export: [Suspicious Domain Export](/reference/brp/suspicious-domain-export/)


---

# Set Up Detection Rules

URL: https://docs.deepinfo.com/guide/brp/detection-rules/

Create the custom rules that find domains imitating your brand, turn them on or off, let a rule mark its matches as fraudulent automatically, and keep your own domains out.

Detection rules tell Brand Risk Protection (BRP) which domain names to look for. Each rule has a keyword and a match type, and can take
further keywords and limits on domain extensions. Every domain a rule finds appears on the suspicious list for
your review, unless the domain is on your **Ignored Assets** list.

## Before You Start

- **Package:** BRP.
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **BRAND RISK PROTECTION** › **FRAUDULENT DOMAINS** · **Tab:** **SETTINGS** › **Custom Rules** · [https://platform.deepinfo.com/app/brp/fraudulent/settings/custom-rules](https://platform.deepinfo.com/app/brp/fraudulent/settings/custom-rules)

The **SETTINGS** tab has a menu on the left with **Custom Rules** (opens first) and **Other Settings**. The
breadcrumb reads **BRP / FRAUDULENT DOMAINS / CUSTOM RULES** or **… / OTHER SETTINGS**.

## Read the Rule List

![The Custom Rules list with one rule expanded.](/img/guide/brp/detection-rules-01.png)

1. **Count and action:** how many custom rules you have, and **CREATE RULE**.
2. **The list:**
   - **STATUS**: a toggle with **ACTIVE** or **INACTIVE**.
   - **RULE NAME**.
   - **DETECTED DOMAINS**: how many domains the rule has detected.
   - **CREATE DATE** and **LAST UPDATE DATE**.
   - A chevron at the end of the row.
3. **Expanded rule:** select a row to see its settings:
   - **FQDN TYPE** (whether the rule looks at domains or subdomains), **MATCH TYPE**, **START DETECTION**, **KEYWORD**,
     **HELPER KEYWORDS**, **NEGATIVE KEYWORDS**, **TLD MUST BE** and **TLD MUST NOT BE**. An empty setting shows
     **-**.
   - The **Auto Approval** toggle.
   - **EDIT THIS RULE** and **DELETE THIS RULE**.

## Create a Rule

1. Select **CREATE RULE**. The **Custom Rules** dialog opens.
2. Fill in the rule's settings:
   - **RULE NAME**: a name you will recognize in lists and alerts.
   - **TAGS**: optional labels for the rule.
   - **START DETECTION**: **From Now On** (the default) starts from now; **Include Past** also covers the past.
   - **STATUS**: **Active** (the default) or **Inactive**.
   - **AUTO APPROVAL**: **Disabled** (the default) or **Enabled**. See
     [Mark matches as fraudulent automatically](#mark-matches-as-fraudulent-automatically).
3. Under **Filters**, describe what to look for:
   - **Domain** (the default) or **Subdomain**.
   - **KEYWORD**: the word to look for, usually your brand name.
   - **MATCH TYPE**: how the keyword is matched (see below). The default is **Contains**.
   - **HELPER KEYWORDS** and **NEGATIVE KEYWORDS**: optional further keywords.
   - **TLD MUST BE** and **TLD MUST NOT BE**: optional domain extensions to limit the rule to, or to leave out.
4. Select **CREATE**. To leave without saving, select **CANCEL**.

New domains the rule detects appear on [the suspicious list](/guide/brp/review-suspicious-domains/).

![The Custom Rules dialog with the MATCH TYPE list open.](/img/guide/brp/detection-rules-02.png)

### Match Types

The **MATCH TYPE** list offers these options:

- **Exact**
- **Contains**
- **Fuzzy**
- **Fuzzy Contains**
- **Confusable Exact**
- **Confusable Contains**
- **Confusable Fuzzy**
- **Confusable Fuzzy Contains**

For advice on which match type fits your brand, write to
[support@deepinfo.com](mailto:support@deepinfo.com).

## Change a Rule

- **Turn it on or off:** use the **STATUS** toggle on the rule's row and confirm. An inactive rule stays in the
  list with **INACTIVE**.
- **Edit it:** expand the rule and select **EDIT THIS RULE**. The same dialog opens with the rule's settings.
  **START DETECTION** cannot be changed once the rule exists. Save with **UPDATE**.
- **Delete it:** expand the rule, select **DELETE THIS RULE** and confirm with **REMOVE**. If you may need the
  rule again, set it to inactive instead of deleting it.

## Mark Matches as Fraudulent Automatically

Each rule has an **Auto Approval** setting: **AUTO APPROVAL** in the dialog, or the **Auto Approval** toggle in
the expanded rule. The platform describes it this way: if the option is enabled and any domains waiting for
review match the rule, they are automatically marked as fraudulent.

Use it for rules you trust fully. Domains marked this way skip your review and go straight to
[the fraudulent list](/guide/brp/fraudulent-domains/).

## Keep Your Own Domains Out

**Other Settings** holds the **Ignored Assets** list: domains and subdomains that never appear as detected
domains, even when a detection rule matches them. Use it for your own domains and for other names you know are
legitimate.

**Sidebar:** **BRAND RISK PROTECTION** › **FRAUDULENT DOMAINS** · **Tab:** **SETTINGS** › **Other Settings** · [https://platform.deepinfo.com/app/brp/fraudulent/settings/other-settings](https://platform.deepinfo.com/app/brp/fraudulent/settings/other-settings)

1. Select **Other Settings** in the menu on the left.
2. Type the domains in the box, one per line.
3. Select **SAVE CHANGES**. The button becomes available once you change the list.

![Other Settings with the Ignored Assets box and SAVE CHANGES.](/img/guide/brp/detection-rules-03.png)

## Good to Know

- **Ignored Assets** is not the same as **Ignored Domains**. Ignored Assets keeps names off the detected lists
  altogether; Ignored Domains lists detected domains you dismissed one by one (see
  [Restore ignored domains](/guide/brp/ignored-domains/)).
- A notification rule for **New Suspicious Domain** or **New Fraudulent Domain** can be limited to some of your
  detection rules with its **Rule** filter; see [Create a notification rule](/guide/notifications/create-a-rule/).

## Do This With the API

- List rules: [Fraudulent Rule Search](/reference/brp/fraudulent-rule-search/)
- Get one: [Fraudulent Rule Detail](/reference/brp/fraudulent-rule-detail/)
- Create: [Fraudulent Rule Create](/reference/brp/fraudulent-rule-create/)
- Change (including status and auto approval): [Fraudulent Rule Update](/reference/brp/fraudulent-rule-update/)
- Delete: [Fraudulent Rule Delete](/reference/brp/fraudulent-rule-delete/)
- Ignored Assets: [Fraudulent Settings Detail](/reference/brp/fraudulent-settings-detail/) and
  [Fraudulent Settings Update](/reference/brp/fraudulent-settings-update/)


---

# Deep Search & Insights (DSI)

URL: https://docs.deepinfo.com/guide/dsi/

Deep Search & Insights (DSI) gives you Deepinfo's internet-wide data inside the platform, with domain and vulnerability statistics, domain and CVE search, real-time lookups and downloadable data feeds.

Deep Search & Insights (DSI) brings Deepinfo's internet-wide data into the platform. It is not about your own
assets: you can look at registration trends, search every domain or CVE in Deepinfo's data, run a real-time
lookup on one target, or download bulk data files.

## Before You Start

- **Package:** DSI features are part of your package one by one: a search page, a lookup type or a feed can be
  included while another is not. A feed outside your package offers sample data only; other features show a
  notice that they are not included. See [What you can access](/guide/basics/packages-and-roles/).
- **Role:** Admin or Member.
- **Data:** none. DSI works on Deepinfo's data, not on your inventory.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **DOMAIN INTELLIGENCE** · [https://platform.deepinfo.com/app/dsi/domain-intelligence](https://platform.deepinfo.com/app/dsi/domain-intelligence)

**DEEP SEARCH & INSIGHTS** is the green group heading in the sidebar. The heading is not a link and there is no
DSI start page: open one of its items. The header breadcrumb starts with **DSI**, for example
**DSI / DOMAIN SEARCH**.

| Sidebar item | What it does | Guide page |
|---|---|---|
| **DOMAIN INTELLIGENCE** | Statistics on domain registrations, TLDs and keywords | [Domain intelligence](/guide/dsi/domain-intelligence/) |
| **DOMAIN SEARCH** | Search Deepinfo's domain data with filters; open any domain's details | [Search domains](/guide/dsi/domain-search/), [Domain details and reverse lookups](/guide/dsi/domain-details/) |
| **VULNERABILITY INTELLIGENCE** | Statistics on CVEs, weaknesses (CWE) and the latest CVEs | [Vulnerability intelligence](/guide/dsi/vulnerability-intelligence/) |
| **VULNERABILITY SEARCH** | Search the CVE database with filters; open a CVE | [Search vulnerabilities](/guide/dsi/vulnerability-search/) |
| **INSTANT LOOKUP** | Real-time Whois, DNS, SSL, Webdata, Technology, Screenshot and Port Scanner lookups | [Run instant lookups](/guide/dsi/instant-lookup/) |
| **FEEDS** | Download daily and full domain and subdomain files | [Download data feeds](/guide/dsi/feeds/) |

Opening [https://platform.deepinfo.com/app/dsi](https://platform.deepinfo.com/app/dsi) takes you to
**Domain Search**. Older links to `/app/explore` open **Domain Search** too.

![The sidebar with the DEEP SEARCH & INSIGHTS group and the DSI / DOMAIN SEARCH breadcrumb.](/img/guide/dsi/index-01.png)

## Page Tabs in Domain Search, Vulnerability Search and Instant Lookup

These pages work like a browser: each search, domain, CVE or lookup can have its own page tab, and you
switch between them above the page.

- **Open a tab:** a search result or a suggestion can open in a new page tab (**OPEN IN NEW TAB**). In Instant
  Lookup, the **+** button adds a tab for the lookup type you pick.
- **Manage tabs:** right-click a tab for **Duplicate**, **New Tab to The Right**, **Close Tab**,
  **Close Other Tabs** and **Close Tabs to the Right**. The menu also lists **Add Tab to Saved Search**, which has
  no effect.
- **Tabs are kept in this browser.** Your open tabs, with their queries and the last Instant Lookup result, are
  kept in this browser for your user, so they are still there after a reload. They do not appear in another
  browser or on another computer. Close a tab to remove it.

Saving searches is not available: **SAVED SEARCH** and **SAVE THIS SEARCH** are visible but have no effect.

![Domain Search with three page tabs and the right-click menu of a tab open.](/img/guide/dsi/index-02.png)

## Filters

Domain Search and Vulnerability Search share one filter builder. The chips under the search box open groups of
fields; each rule you add is **MUST**, **MUST NOT** or **SHOULD** match. **SEARCH** runs the query, and the
**FILTERS APPLIED** bar then lists the rules in use, with **CLEAR FILTERS**. **HIDE FILTERS** folds the chips
away. See [Search, filter and export lists](/guide/basics/lists-filters-and-exports/) for the rule model; the
API search endpoints use the same one (see [Search and filters](/getting-started/search-and-filters/)).

## Pages in This Section

1. [Domain intelligence](/guide/dsi/domain-intelligence/): registration statistics, TLD and keyword analysis.
2. [Search domains](/guide/dsi/domain-search/): query the domain data and export results.
3. [Domain details and reverse lookups](/guide/dsi/domain-details/): one domain's full record.
4. [Vulnerability intelligence](/guide/dsi/vulnerability-intelligence/): CVE statistics, CWE categories, latest CVEs.
5. [Search vulnerabilities](/guide/dsi/vulnerability-search/): query the CVE database.
6. [Run instant lookups](/guide/dsi/instant-lookup/): one target, in real time.
7. [Download data feeds](/guide/dsi/feeds/): daily and full data files.

## Do This With the API

Most of DSI is also available through the public API:

- Domain Search and domain details: the [Discovery API](/reference/discovery/)
- Domain Intelligence: the [Domain Intelligence API](/reference/domain-intelligence/)
- Vulnerability Intelligence and Vulnerability Search: the [Vulnerability API](/reference/vulnerability/)
- Instant Lookup: the [Lookup API](/reference/lookup/)
- Feeds: the [Feeds API](/reference/feeds/)


---

# Domain Intelligence

URL: https://docs.deepinfo.com/guide/dsi/domain-intelligence/

Read global domain registration statistics, and rank TLDs and keywords in newly registered domain names over the period you choose.

Domain Intelligence shows how many domain names are registered worldwide and which extensions (TLDs) and
keywords are growing. The page and its detail pages show statistics only; there is nothing to export.

## Before You Start

- **Package:** Deep Search & Insights (DSI).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **DOMAIN INTELLIGENCE** · [https://platform.deepinfo.com/app/dsi/domain-intelligence](https://platform.deepinfo.com/app/dsi/domain-intelligence)

The breadcrumb reads **DSI / DOMAIN INTELLIGENCE**.

## Read the Screen

![The Domain Intelligence page with its six cards numbered 1 to 6.](/img/guide/dsi/domain-intelligence-01.png)

1. **TOTAL INDEXED DOMAINS** (**Live**): the number of domains Deepinfo has indexed. The counter keeps
   rising while you watch: your browser adds an estimate based on the daily registration rate. It is not a live
   count.
2. **AVERAGE DAILY REGISTRATIONS**: how many domains are registered on an average day.
3. **DAILY NEW REGISTRATIONS** (**30 DAYS**): a chart of the domains registered each day over the last 30 days,
   with **REGISTRATIONS** and their **AVERAGE**. The large number above the chart is the average per day over
   those 30 days. For the last day's registrations, read **LAST 24 HOURS** in the next card.
4. **DOMAIN REGISTRATION STATS**: registrations in the **LAST 24 HOURS** (with an **AVERAGE** per hour), the
   **LAST 7 DAYS**, the **LAST 30 DAYS** and the **LAST 365 DAYS** (each with an **AVERAGE** per day).
5. **TOP 10 TLDS** (**LAST 30 DAYS**): the extensions with the most new registrations. **VIEW ALL** opens
   [TLD Analysis](#tld-analysis).
6. **TOP KEYWORDS** (**LAST 30 DAYS**): 20 keywords that appear most in new domain names. **VIEW ALL** opens
   [Keyword Analysis](#keyword-analysis).

## TLD Analysis

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **DOMAIN INTELLIGENCE**, then **VIEW ALL** on **TOP 10 TLDS** · [https://platform.deepinfo.com/app/dsi/domain-intelligence/tld-analysis](https://platform.deepinfo.com/app/dsi/domain-intelligence/tld-analysis)

The breadcrumb reads **DSI / DOMAIN INTELLIGENCE / TLD ANALYSIS**, and the **DOMAIN INTELLIGENCE** button at the
top takes you back.

1. **TOP TLDS**: the extensions with the most new registrations. Pick the period with **24H**, **7D**,
   **30D**, **1Y** or **ALL TIME**.
2. **TRENDING LAST 7 DAYS**, **TRENDING LAST 30 DAYS** and **TRENDING LAST 365 DAYS**: each card names one
   extension: the fastest-growing one, with the percentage it grew by. The 365-day card names the most popular
   extension instead.
3. **DOMAIN EXTENSIONS**: the extensions with their **COUNT** of new registrations, 10 per page. Use **Search**
   to find an extension, and the period tabs to change the period.

![TLD Analysis with the period tabs of TOP TLDS and the trend cards.](/img/guide/dsi/domain-intelligence-02.png)

## Keyword Analysis

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **DOMAIN INTELLIGENCE**, then **VIEW ALL** on **TOP KEYWORDS** · [https://platform.deepinfo.com/app/dsi/domain-intelligence/keyword-analysis](https://platform.deepinfo.com/app/dsi/domain-intelligence/keyword-analysis)

The breadcrumb reads **DSI / DOMAIN INTELLIGENCE / KEYWORD ANALYSIS**, and a back button at the top returns to
**Domain Intelligence**.

1. **TRENDING KEYWORDS** (**LAST 30 DAYS**): 20 keywords that are gaining ground in new domain names.
2. **TOP KEYWORDS**: the most used keywords, with period tabs.
3. **KEYWORDS**: the keywords with their **COUNT**, with **Search** and period tabs.

## Good to Know

- The statistics cover all domains Deepinfo sees, not only yours. For your own domains, see
  [External Attack Surface Management (EASM)](/guide/easm/).
- To watch names that imitate your brand, use [Brand Risk Protection (BRP)](/guide/brp/) rather than the keyword statistics.

## Do This With the API

- Registration counts: [Registration Stats](/reference/domain-intelligence/registration-stats/)
- Daily registrations: [Registration Timeline](/reference/domain-intelligence/registration-timeline/)
- TLD ranking: [TLD Stats](/reference/domain-intelligence/tld-stats/)
- Keyword ranking: [Keyword Stats](/reference/domain-intelligence/keyword-stats/)


---

# Search Domains

URL: https://docs.deepinfo.com/guide/dsi/domain-search/

Search Deepinfo's domain and subdomain data by name, WHOIS, DNS, SSL and website fields, sort and trim the results, and export them.

Domain Search queries Deepinfo's data on domains and subdomains across the internet. Search by name, or combine
filters on registration (WHOIS), DNS, certificates (SSL), website data and name properties. Each result opens a
full record of the domain.

## Before You Start

- **Package:** Deep Search & Insights (DSI), with Domain Search included. Without it, the page shows a notice that it is not included in
  your package.
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **DOMAIN SEARCH** · [https://platform.deepinfo.com/app/dsi/domain-search](https://platform.deepinfo.com/app/dsi/domain-search)

The breadcrumb reads **DSI / DOMAIN SEARCH**. The page uses page tabs; see
[Page tabs](/guide/dsi/#page-tabs-in-domain-search-vulnerability-search-and-instant-lookup).

## Read the Screen

![Domain Search before the first search, numbered 1 to 4.](/img/guide/dsi/domain-search-01.png)

1. **Page tabs:** the first tab is **Domain Search**.
2. **Search box** (**Search domain...**) with the tabs **FILTERS** and **SAVED SEARCH**. Saving searches is not
   available, so **SAVED SEARCH** has no effect.
3. **Filter groups:** **DOMAIN TYPE**, **WHOIS**, **DNS**, **SSL**, **WEBDATA**, **DOMAIN NAME**, **EXTENSION**
   and **SUBDOMAIN**, then **HIDE FILTERS** and **SEARCH**.
4. Before your first search, a **Did you know?** panel shows a fact about domains.

## Search by Typing

1. Type a domain name, for example `acme.example`, in the search box.
2. A list of suggestions opens. For a domain name they are:
   - **OPEN IN NEW TAB**: open the domain's record in a new page tab (see
     [Domain details](/guide/dsi/domain-details/)).
   - **EXACT DOMAIN**: search for this name.
   - **SPLIT INTO PARTS**: search the name and the extension separately.
   - **OTHER EXTENSIONS**: the same name under other extensions.
   - **ALL SUBDOMAINS**: the domain's subdomains.
   - **LOOKALIKES**: names that look like this one.
   - **USES THIS NAMESERVER** and **USES THIS MAIL SERVER**: domains that share its name server or mail server.
3. Pick one with the mouse, or move through the list with the keyboard; the hints at the bottom of the list
   show the keys (**NAVIGATE**, **ADD TO FILTERS**, **REPLACE FILTERS**, **BACK**).

Other input, such as an e-mail address, an IP address, a URL or a plain keyword, gets its own suggestions.

Picking **EXACT DOMAIN** opens a new page tab and runs the search at once. Its results can include the
domain's subdomains; to keep only domains, add a **DOMAIN TYPE** filter.

![The suggestion list for a typed domain name, from OPEN IN NEW TAB to USES THIS MAIL SERVER, with the keyboard hints.](/img/guide/dsi/domain-search-02.png)

## Search With Filters

1. Select a filter group, for example **WHOIS**, and pick a field.
2. Choose the rule (**MUST**, **MUST NOT** or **SHOULD**), the operator and the value.
3. Add more rules if you need them, then select **SEARCH**.

The **FILTERS APPLIED** bar shows each rule with its type, group, field, operator and value, for example
**MUST** **Domain Name → Domain Name** **EQUAL** `'acme.example'`. **CLEAR FILTERS** removes them all.

| Group | Examples of fields |
|---|---|
| **DOMAIN TYPE** | Domains only or subdomains only |
| **WHOIS** | Create, expiry and update dates; registrant details; registrar; name servers; privacy |
| **DNS** | A, AAAA, CNAME, MX, NS, SOA and TXT records; IP history |
| **SSL** | Validity dates, fingerprints, subject and issuer, self-signed and valid flags |
| **WEBDATA** | HTTP status codes, redirection, final URL, headers, cookies |
| **DOMAIN NAME** | Name, length, keywords, language, and whether it contains numbers, hyphens or confusable characters |
| **EXTENSION** | Extension, type (gTLD or ccTLD), IDN |
| **SUBDOMAIN** | Subdomain name, length and level |

See [Search, filter and export lists](/guide/basics/lists-filters-and-exports/) for how rules combine.

## Read the Results

![A Domain Search result list with the FILTERS APPLIED bar above it.](/img/guide/dsi/domain-search-03.png)

- **Count line:** how many domains were found, then **EXPORT** and **VIEW SETTINGS**.
- **Columns:**
  - **DOMAIN**
  - **CREATE DATE** (sortable)
  - **DOMAIN EXPIRE ON** (sortable)
  - **SSL CERTIFICATE**: the expiry date and **ACTIVE**, **EXPIRES SOON** or **EXPIRED**
  - **HTTP STATUS**: **OK**, or the status or error found
  - **IP ADDRESSES**: two addresses, then **+n** for the rest
- Select a row to open the domain's drawer; see [Domain details](/guide/dsi/domain-details/).

### Sort, Page Size and Columns

**VIEW SETTINGS** opens **View Options**:

- **Sort By**: pick a field and an order, then **APPLY** (**CLEAR** resets it). The fields are **Domain**,
  **Extension**, **DNS Last Change Date**, **SSL Last Change Date**, **Whois Last Change Date**,
  **Whois Create Date**, **Whois Expiry Date** and **Whois Update Date**.
- **Result Per Page**: 25, 50, 75 or 100.
- **SHOWN**: turn columns on or off.
- **Reset to Default View**.

## Export the Results

1. Select **EXPORT**.
2. In the **DOWNLOAD** dialog, choose the **FILE FORMAT** (**CSV** or **JSON**) and the **EXPORT SCOPE**
   (**DEFAULT**, **BASIC** or **EXTENDED**).
3. Select **DOWNLOAD**.

The export covers your current search; there is no choice between all and filtered records here. The dialog does
not describe what each scope contains.

## Good to Know

- Domain Search looks at the internet as a whole. For the assets you monitor, use
  [External Attack Surface Management (EASM)](/guide/easm/).

## Do This With the API

- Search: [Domain Search](/reference/discovery/domain-search/)
- The query model: [Search and filters](/getting-started/search-and-filters/), [Pagination](/getting-started/pagination/)


---

# Domain Details and Reverse Lookups

URL: https://docs.deepinfo.com/guide/dsi/domain-details/

Open one domain's full record from Domain Search, with WHOIS and DNS history, certificate, website and name data, its subdomains and related domains, and find other domains that share its details.

Every domain in Domain Search has a full record: registration (WHOIS) with its history, DNS with its history,
the certificate, website data, facts about the name itself, and lists of related domains. You can read it in a
drawer next to your results, or open it in a page tab of its own.

## Before You Start

- **Package:** Deep Search & Insights (DSI), with Domain Search and domain details included.
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **DOMAIN SEARCH**, then a result · [https://platform.deepinfo.com/app/dsi/domain-search](https://platform.deepinfo.com/app/dsi/domain-search)

- **Drawer:** select a row in the Domain Search results.
- **Page tab:** select **OPEN IN NEW TAB** at the top of the drawer, or type a domain name in the search box and
  pick **OPEN IN NEW TAB** from the suggestions. The tab is named after the domain.

## The Drawer

![The domain drawer on the WHOIS tab, with the summary at the top and the tab icons on the left.](/img/guide/dsi/domain-details-01.png)

1. **OPEN IN NEW TAB** at the top.
2. **Summary:** **IP ADDRESSES**, **HTTP STATUS**, **DOMAIN EXPIRE** and **SSL CERTIFICATE**.
3. **Tabs** (icons; the open tab's name is its heading): **WHOIS**, **DNS**, **SSL**, **WEBSITE INFO**,
   **DOMAIN INFO**, **SUBDOMAINS**, **ASSOCIATED DOMAINS** and **OTHER TLDS**.

**SUBDOMAINS** loads as soon as you open it: the number of subdomains, **EXPORT**, and a list with **DOMAIN**
and **IP ADDRESS**.

## The Domain's Page Tab

![A domain's page tab with the summary at the top and the section menu.](/img/guide/dsi/domain-details-02.png)

**At the top:**

- The domain name with an external-link icon, and **EXPORT AS JSON** (it does not download anything; see
  [Good to know](#good-to-know)).
- **IP ADDRESS** (with **+n** when there are more), **DOMAIN EXPIRE ON**, **SSL CERTIFICATE** and **HTTP STATUS**.
- A section menu to jump down the page: **WHOIS**, **DNS**, **SSL**, **WEBSITE INFO**, **DOMAIN INFO**,
  **SUBDOMAINS**, **ASSOCIATED DOMAINS** and **OTHER TLDS**.

**Sections:**

| Section | What it shows |
|---|---|
| **Whois** | **CREATE DATE**, **EXPIRATION DATE**, **UPDATED DATE**, **NAME SERVER**, **DOMAIN STATUS**, **REGISTRAR**, and the **Registrant** block (**EMAIL**, **NAME**, **ORGANIZATION**, address, **PHONE:**). **SHOW HISTORICAL WHOIS RECORDS** |
| **DNS** | **A**, **AAAA**, **NS**, **MX** and **TXT Records**. **SHOW HISTORICAL DNS RECORDS** |
| **SSL** | **Details**, **Fingerprint**, **Signature** and **Extensions** |
| **Website Info** | **Http Status** (**FIRST STATUS CODE**, **FINAL STATUS CODE**, **REDIRECTION**, **FINAL URL**, **FINAL FQDN**, **FINAL DOMAIN**) and **Http Headers** |
| **Domain Info** | **DOMAIN NAME**, **EXTENSION**, **EXTENSION TYPE**, **NAME (SLD)**, **NAME (LATINIZED)**, **LENGTH**, **KEYWORDS**, **KEYWORD COUNT**, **KEYWORD LANGUAGE**, and whether the name contains letters, numbers, hyphens or confusable characters |
| **Subdomain**, **Associated Domains**, **Other TLDs** | Each starts closed; select **SHOW THE LIST** to load it |

A field shows **-** when the record has no value for it.

## See Older WHOIS and DNS Records

1. In the **Whois** section, select **SHOW HISTORICAL WHOIS RECORDS**. In **DNS**, select
   **SHOW HISTORICAL DNS RECORDS**.
2. A drawer opens, titled **Historical Whois Records** (or **Historical DNS Records**), with the number of
   records found and their dates.

![The Historical Whois Records drawer with the number of records found and their dates.](/img/guide/dsi/domain-details-03.png)

## Find Domains That Share a Detail (Reverse Lookups)

Some values in the record, such as a name server, are clickable. Hover over one: a tooltip asks whether you
would like to see what other domains are owned by it, with **SEE OTHERS**. Select **SEE OTHERS** to list the
domains that share that IP address, name server, mail server or registrant e-mail.

![The SEE OTHERS tooltip on a name server.](/img/guide/dsi/domain-details-04.png)

## Good to Know

- **EXPORT AS JSON** at the top of the page tab does not download anything. To get a domain's record as
  data, use [Domain Detail](/reference/discovery/domain-detail/) in the API.
- The external-link icon opens the domain itself in your browser.

## Do This With the API

- The record: [Domain Detail](/reference/discovery/domain-detail/)
- History: [WHOIS History](/reference/lookup/whois-history/), [DNS History](/reference/lookup/dns-history/)
- Related domains: [Subdomain Finder](/reference/discovery/subdomain-finder/),
  [Associated Domain Finder](/reference/discovery/associated-domain-finder/), [All TLDs](/reference/discovery/all-tlds/)
- Reverse lookups: [Reverse IP](/reference/discovery/reverse-ip/), [Reverse NS](/reference/discovery/reverse-ns/),
  [Reverse MX](/reference/discovery/reverse-mx/), [Reverse WHOIS Email](/reference/discovery/reverse-whois-email/)
- API only: [Same-Time Registered Domain Finder](/reference/discovery/same-time-registered-domain-finder/)


---

# Vulnerability Intelligence

URL: https://docs.deepinfo.com/guide/dsi/vulnerability-intelligence/

Read global CVE statistics, including recent CISA KEV additions, severity by year, the most common weaknesses (CWE), the CVSS distribution and the latest CVEs.

Vulnerability Intelligence summarizes the CVEs (publicly known vulnerabilities) in Deepinfo's database: how many
are tracked, how many were published or added to the CISA KEV catalog of exploited vulnerabilities recently, how
severe they are by year, which weaknesses (CWE) are most common, and which CVEs are the newest. It is about all
CVEs, not only those on your assets.

## Before You Start

- **Package:** Deep Search & Insights (DSI).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **VULNERABILITY INTELLIGENCE** · [https://platform.deepinfo.com/app/dsi/vulnerability-intelligence](https://platform.deepinfo.com/app/dsi/vulnerability-intelligence)

The breadcrumb reads **DSI / VULNERABILITY INTELLIGENCE**.

## Read the Screen

![The Vulnerability Intelligence page with its six cards numbered 1 to 6.](/img/guide/dsi/vulnerability-intelligence-01.png)

1. **TOTAL CVEs TRACKED** (**Live**): the number of CVEs in Deepinfo's database. Next to it, tiles count the
   CVEs recently added to the CISA KEV catalog: **EXPLOITABLE IN LAST 24 HOURS**,
   **EXPLOITABLE IN LAST 7 DAYS** and **EXPLOITABLE IN LAST 30 DAYS**.
2. **VULNERABILITY SEVERITY BY YEAR**: CVEs per year, split into **CRITICAL**, **HIGH**, **MEDIUM** and **LOW**.
   Choose **ALL YEARS**, **LAST 10 YEARS** or **LAST 5 YEARS**.
3. **VULNERABILITY PUBLISHED STATS**: CVEs **PUBLISHED IN LAST 24 HOURS**, **PUBLISHED IN LAST 7 DAYS** and
   **PUBLISHED IN LAST 30 DAYS**, each with a **MODIFIED** count.
4. **TOP CWE CATEGORIES**: the most common weaknesses, with **VIEW ALL**.
5. **CVSS SCORE DISTRIBUTION**: how many CVEs have each CVSS score.
6. **LATEST VULNERABILITIES**: the newest CVEs with **CVE ID**, **SCORE/SEVERITY**, **EPSS**, **PUBLISHED DATE**
   and **MODIFIED DATE**, with **VIEW ALL**.

Select a row in **LATEST VULNERABILITIES** to open the CVE in a drawer (see [Read a CVE](#read-a-cve)).

## CWE Categories

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **VULNERABILITY INTELLIGENCE**, then **VIEW ALL** on **TOP CWE CATEGORIES** · [https://platform.deepinfo.com/app/dsi/vulnerability-intelligence/cwe-categories](https://platform.deepinfo.com/app/dsi/vulnerability-intelligence/cwe-categories)

The breadcrumb reads **DSI / VULNERABILITY INTELLIGENCE / CWE CATEGORIES**, and a back button returns to the
main page.

1. **CWEs BY CATEGORIES**: a heatmap of the most common weaknesses per year. Use the range selector to choose
   the years.
2. **CWE**: a ranked table of weaknesses with their **COUNT**, one year at a time. Pick the year with the year
   tabs.

## Latest Vulnerabilities

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **VULNERABILITY INTELLIGENCE**, then **VIEW ALL** on **LATEST VULNERABILITIES** · [https://platform.deepinfo.com/app/dsi/vulnerability-intelligence/latest-vulnerabilities](https://platform.deepinfo.com/app/dsi/vulnerability-intelligence/latest-vulnerabilities)

The breadcrumb reads **DSI / VULNERABILITY INTELLIGENCE / LATEST VULNERABILITIES**. The table lists the 100 CVEs
most recently added to Deepinfo's database, with the same columns as on the main page. Sort by
**SCORE/SEVERITY**, **EPSS**, **PUBLISHED DATE** or **MODIFIED DATE** with the column headers. A CVE without a
score shows **-**, **NONE** and **0%**. Select a row to open the CVE in a drawer.

## Read a CVE

Selecting a CVE opens a drawer:

- **Header:** the score and severity, the CVE ID, the weakness (CWE), the impact on confidentiality, integrity
  and availability (**C/I/A**), and the OWASP category.
- **Tabs** (icons; the open tab's name is its heading):
  - **OVERVIEW**: the description, **VENDOR**, **PRODUCT**, **EPSS SCORE**, **CISA KEV**, **PUBLISHED** and
    **LAST MODIFIED**.
  - **CISA KEV CATALOG**: the CISA KEV entry, when there is one.
  - **WEAKNESS IDENTITY**: the CWE.
  - **CVSS METRICS**: the CVSS vector, explained metric by metric.
  - **AFFECTED PRODUCT**: the products the CVE affects.
  - **REFERENCES**: reference URLs, each with its source.

This drawer has no **OPEN IN NEW TAB**. To open a CVE in a page tab of its own, search for it in
[Vulnerability Search](/guide/dsi/vulnerability-search/).

The [Glossary](/guide/glossary/) explains CVSS, EPSS, CISA KEV and the C/I/A letters.

## Good to Know

- For the CVEs found on your own assets, see [Prioritize vulnerabilities](/guide/easm/vulnerabilities/).

## Do This With the API

- Totals: [CVE Stats](/reference/vulnerability/cve-stats/)
- Severity by year: [Severity By Year Stats](/reference/vulnerability/severity-by-year-stats/)
- CISA KEV additions: [CISA KEV Stats](/reference/vulnerability/cisa-kev-stats/)
- Weaknesses over time: [CWE Timeline](/reference/vulnerability/cwe-timeline/)
- CVSS distribution: [CVSS Score Stats](/reference/vulnerability/cvss-score-stats/)
- Latest CVEs: [Latest Added](/reference/vulnerability/latest-added/)
- One CVE: [Vulnerability Detail](/reference/vulnerability/detail/)


---

# Search Vulnerabilities

URL: https://docs.deepinfo.com/guide/dsi/vulnerability-search/

Search Deepinfo's CVE database by ID, product, weakness, CVSS metrics and exploitability, read a CVE with its CISA KEV entry, and export the results.

Vulnerability Search queries Deepinfo's database of CVEs (publicly known vulnerabilities), whether or not they
affect your assets. Search by CVE ID, vendor or product, or build filters on CVSS metrics, weaknesses and
exploitability, then open a CVE to read it in full.

## Before You Start

- **Package:** Deep Search & Insights (DSI), with Vulnerability Search included (and vulnerability details, to open a CVE).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **VULNERABILITY SEARCH** · [https://platform.deepinfo.com/app/dsi/vulnerability-search](https://platform.deepinfo.com/app/dsi/vulnerability-search)

The breadcrumb reads **DSI / VULNERABILITY SEARCH**. The page uses page tabs; see
[Page tabs](/guide/dsi/#page-tabs-in-domain-search-vulnerability-search-and-instant-lookup).

## Search

![Vulnerability Search with the four SHOULD rules made from a CVE ID in the FILTERS APPLIED bar.](/img/guide/dsi/vulnerability-search-01.png)

1. Type in the search box (**Search vulnerabilities...**): a CVE ID, a vendor, a product or a word from a
   weakness description. Press Enter.
2. The platform turns your text into four **SHOULD** rules, so a CVE matches on any of them:
   - **CVE META · CVE ID · EQUAL**
   - **WEAKNESS · CWE Description · CONTAINS ALL**
   - **PRODUCT · Vendor · EQUAL**
   - **PRODUCT · Product · EQUAL**
3. To narrow the search, add rules from the filter groups (below), then select **SEARCH**.

**CLEAR FILTERS** in the **FILTERS APPLIED** bar removes all rules. Saving searches is not available:
**SAVED SEARCH** and **SAVE THIS SEARCH** have no effect.

### Filter Groups

| Group | Examples of fields |
|---|---|
| **CVE META** | CVE ID, published and last modified dates, status, description, references |
| **CVSS METRIC V2**, **CVSS METRIC V3.0**, **CVSS METRIC V3.1**, **CVSS METRIC V4.0**, **CVSS METRIC** | The CVSS scores and vector metrics of each version |
| **PRODUCT** | Vendor, product, product type, affected versions, CPE names |
| **WEAKNESS** | CWE ID and name, OWASP Top 10 2021 category, CAPEC ID |
| **EXPLOITABILITY** | EPSS and its percentile; the CISA KEV fields (date added, due date, required action, known ransomware use) |

See [Search, filter and export lists](/guide/basics/lists-filters-and-exports/) for how **MUST**,
**MUST NOT** and **SHOULD** combine.

## Read the Results

- **Count line:** how many vulnerabilities were found, then **EXPORT** and **VIEW SETTINGS**.
- **Columns:**
  - **CVE ID**, with an **EXPLOITABLE** marker for CVEs in the CISA KEV catalog, and the weakness (CWE)
  - **SCORE/SEVERITY**
  - **CLASSIFICATION**: the impact on confidentiality, integrity and availability, for example **C/I/A: H/H/H**
  - **EPSS**
  - **VENDOR** and **PRODUCT**: the first few, then **n MORE**
  - **PUBLISHED DATE** and **MODIFIED DATE**
- The results come 25 per page and cannot be sorted. **VIEW SETTINGS** › **View Options** only lets you choose
  the columns (**SHOWN**) or **Reset to Default View**.

## Read a CVE

1. Select a row. The CVE opens in a drawer:
   - **Header:** the score, the severity, the CVE ID, the weakness (CWE) and **C/I/A**.
   - **CISA KEV banner**, when the CVE is in the catalog: **EXPLOITABLE**, the vulnerability's KEV name, the
     vendor and product, **ADDED TO KEV**, **REMEDIATION DUE**, **REQUIRED ACTION**, **SHORT DESCRIPTION** and
     **NOTES**.
   - **Tabs** (icons): **OVERVIEW**, **CISA KEV CATALOG** (with **VENDOR / PROJECT**, **PRODUCT**,
     **DATE ADDED**, **KNOWN RANSOMWARE USE**, **SHORT DESCRIPTION**, **REQUIRED ACTION**, and a **RANSOMWARE**
     tag when ransomware use is known), **WEAKNESS IDENTITY**, **CVSS METRICS**, **AFFECTED PRODUCT** and
     **REFERENCES**.
2. To keep the CVE open while you search on, select **OPEN IN NEW TAB**. The CVE gets its own page tab with:
   - **EXPORT AS JSON** and the CISA KEV banner;
   - a summary strip: **VENDOR / PROJECT** (the first vendor and product, with the number of others),
     **SCORE / SEVERITY**, **EPSS SCORE** and **CISA KEV** (**YES** when the CVE is in the catalog);
   - a section menu: **OVERVIEW**, **CISA KEV**, **WEAKNESS IDENTITY**, **CVSS METRICS**, **AFFECTED PRODUCT**
     and **REFERENCES**.

![The drawer of a CVE in the CISA KEV catalog, with the EXPLOITABLE banner.](/img/guide/dsi/vulnerability-search-02.png)

![A CVE's page tab with the CISA KEV banner, the summary strip and the section menu.](/img/guide/dsi/vulnerability-search-03.png)

The [Glossary](/guide/glossary/) explains CVSS, EPSS, CISA KEV and the C/I/A letters.

## Export the Results

1. Select **EXPORT**.
2. In the **DOWNLOAD** dialog, choose the **FILE FORMAT** (**CSV** or **JSON**).
3. Select **DOWNLOAD**.

## Good to Know

- Vulnerability Search covers every CVE in Deepinfo's database. To see which CVEs affect your own assets, use
  [Prioritize vulnerabilities](/guide/easm/vulnerabilities/).
- For statistics rather than a search, see [Vulnerability intelligence](/guide/dsi/vulnerability-intelligence/).

## Do This With the API

- Search: [Vulnerability Search](/reference/vulnerability/search/)
- One CVE: [Vulnerability Detail](/reference/vulnerability/detail/)


---

# Run Instant Lookups

URL: https://docs.deepinfo.com/guide/dsi/instant-lookup/

Run a real-time Whois, DNS, SSL, Webdata, Technology, Screenshot or Port Scanner lookup on one domain or IP address, read the parsed or raw result, and open its Whois or DNS history.

Instant Lookup queries one target in real time: its registration (Whois), DNS records, certificate (SSL),
website data, technologies, a screenshot, or a port scan. Use it when you need the current answer for a single
domain or IP address, rather than a search across Deepinfo's data.

## Before You Start

- **Package:** each lookup type is part of your package separately. A type that is not included says so in its
  tab.
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **INSTANT LOOKUP** · [https://platform.deepinfo.com/app/dsi/instant-lookup](https://platform.deepinfo.com/app/dsi/instant-lookup)

The breadcrumb reads **DSI / INSTANT LOOKUP**. Each lookup runs in a page tab named after its type, for example
**Whois Lookup**; see
[Page tabs](/guide/dsi/#page-tabs-in-domain-search-vulnerability-search-and-instant-lookup).

## The Lookup Types

Pick a type with the **+** button above the page (it opens a new tab) or with the type switcher at the start of
the input (it changes the current tab).

| Type | What to enter | Advanced options |
|---|---|---|
| **Whois Lookup** | A domain name or an IP address | None |
| **DNS Lookup** | A domain name or subdomain | The DNS record types to query |
| **SSL Lookup** | A domain name or an IP address | **PORT** and **PROXY** |
| **Webdata Lookup** | A domain name or a URL | **PROXY** |
| **Technology Lookup** | A domain name or an IP address | None |
| **Screenshot Lookup** | A domain name or an IP address | Page, image and browser options |
| **Port Scanner Lookup** | A domain name or an IP address | Scan mode and ports |

![The + menu with the lookup types.](/img/guide/dsi/instant-lookup-01.png)

## Run a Lookup

1. Choose the lookup type.
2. Type the target in the input.
3. Optional: select **SHOW ADVANCED OPTIONS** and set the options (see below).
4. Select **LOOKUP**.

Some lookups take a while; a Whois lookup can take close to a minute. The button shows a spinner meanwhile.
After a result, **LOOKUP** stays unavailable until you change the input.

> [!WARNING]
> When you switch the lookup type, the input is filled again with the last target you looked up, even if you had
> cleared it. Check the target before you select **LOOKUP**. Run **Port Scanner Lookup** only against hosts you
> own or are allowed to scan.

## Advanced Options

- **DNS Lookup** (**PARAMETERS**): tick the **DNS Types** to query. You can select up to 5 types per request.
  **SELECT DEFAULT ONES** picks A, TXT, MX, NS and CNAME; **UNSELECT ALL** clears the list.
- **SSL Lookup** (**PARAMETERS**): **PORT** (443 unless you set another) and **PROXY** (the address of a proxy
  to connect through). **CLEAR PARAMETERS** empties both.
- **Port Scanner Lookup**: **Light Mode** or **Full Mode**, and **PORTS**: **TCP & UDP Ports**, **TCP Ports**,
  **UDP Ports** or **Custom Ports**.
- **Screenshot Lookup**:
  - checkboxes such as **Full page screenshot**, **Lazy loading**, **Block Ads**, **No cookie banners**,
    **Disable Javascript**, **Retina**, **Mobile**, **Landscape** and **Touchscreen**;
  - **Export Image Options**: **DOCUMENT TYPE**, **IMAGE QUALITY** and **THUMBNAIL**;
  - **Browser Options**: **BROWSER SIZE WIDTH**, **BROWSER SIZE HEIGHT**, **SCALE**, **DELAY**, **TIMEOUT** and
    more;
  - **SEE ALL** adds **HTML Options**, such as the element to capture, headers, cookies, the user agent, a proxy,
    injected CSS and a location; **HIDE** folds them away.

## Read the Result

![A Whois lookup result in the parsed view, with RAW, CHECK HISTORICAL WHOIS RECORDS and EXPORT in the result header.](/img/guide/dsi/instant-lookup-02.png)

The result header shows the target, the kind of record (for example **Whois Record**), and:

- **RAW** and **PARSED**: switch between the raw data and a readable layout.
- **CHECK HISTORICAL WHOIS RECORDS** (Whois) or **CHECK HISTORICAL DNS RECORDS** (DNS): open a drawer with the
  stored history, for example **Historical Whois Records** with the number of records found and their dates.
  SSL results have no history button.
- **EXPORT**: save the result as a file.

What each result contains:

| Type | Result |
|---|---|
| **Whois Lookup** | The registration dates, name servers, status and registrar, and the **Registrant** block |
| **DNS Lookup** | One table per record type, for example **A Records**, **MX Records** (with **PRIORITY**), **NS Records** and **TXT Records**. A type with no record shows **No Result Found.** |
| **SSL Lookup** | **Details** (including the **SAN LIST**), **Fingerprint** (including the **PUBLIC KEY**), **Signature** (including **VALID**) and **Extensions** |

## Good to Know

- An instant lookup asks for the current data at the moment you run it. Domain Search and the domain details
  show the data Deepinfo has already collected; see [Search domains](/guide/dsi/domain-search/).
- Your lookup tabs and the last result are kept in this browser for your user, so they are still there after a
  reload. Close a tab to remove it.

## Do This With the API

- Whois: [Domain WHOIS](/reference/lookup/domain-whois/), [IP WHOIS](/reference/lookup/ip-whois/)
- DNS: [DNS](/reference/lookup/dns/)
- SSL: [SSL](/reference/lookup/ssl/)
- Webdata: [Web Data](/reference/lookup/web-data/)
- Technology: [Technology](/reference/lookup/technology/)
- Screenshot: [Screenshot](/reference/lookup/screenshot/)
- Port scan: [Port Scan](/reference/lookup/port-scan/)
- History: [WHOIS History](/reference/lookup/whois-history/), [DNS History](/reference/lookup/dns-history/)


---

# Download Data Feeds

URL: https://docs.deepinfo.com/guide/dsi/feeds/

Download Deepinfo's daily and full domain and subdomain data files, see when each was last updated, and get sample data for feeds outside your package.

**Feeds** offers Deepinfo's domain data as bulk files: daily lists of registered, updated and deleted domains
and discovered subdomains, and full lists of all domains and subdomains.

## Before You Start

- **Package:** each feed is part of your package separately. A feed that is not included offers sample data
  only.
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **DEEP SEARCH & INSIGHTS** › **FEEDS** · [https://platform.deepinfo.com/app/dsi/feeds](https://platform.deepinfo.com/app/dsi/feeds)

The breadcrumb reads **DSI / FEEDS**.

## Read the Screen

![The Feeds page with the DAILY FEEDS, EXCLUSIVE FEEDS and CUSTOM FEEDS groups.](/img/guide/dsi/feeds-01.png)

The page has these groups:

| Group | Feeds |
|---|---|
| **DAILY FEEDS** | **Daily Registered Domains**, **Daily Updated Domains**, **Daily Deleted Domains**, **Daily Discovered Subdomains** |
| **EXCLUSIVE FEEDS** | **All Domains**, **All Subdomains**, **Historical Whois Records**, **Historical DNS Records** |
| **CUSTOM FEEDS** | Feeds made for your organization, and examples under **Sample Custom Feeds** |

Each feed card shows:

- the feed's name;
- when the file was last updated, as a date and time and as a relative time (for example **21 HOURS AGO**);
- the number of lines;
- one button per file format, with the file's size.

![One feed card with its update time, line count and a download button for each file format.](/img/guide/dsi/feeds-02.png)

## Download a Feed

1. Find the feed's card.
2. Select the button of the format you want. The download starts in your browser.

The full files are large. Check the size on the button before you download.

## Feeds Outside Your Package

A card for a feed that is not in your package says **This feed is not included in your package** and
**You can only download the sample data:**, with a sample file and its size.

![A feed card for a feed outside the package, with its sample file.](/img/guide/dsi/feeds-03.png)

## Custom Feeds

When you have no custom feed, **CUSTOM FEEDS** says so and lists **Sample Custom Feeds**, five examples of what a
custom feed can contain. To ask about a custom feed, write to support@deepinfo.com; the
**TALK WITH AN EXPERT** button does not open a contact form.

## Do This With the API

- List the latest files: [List](/reference/feeds/list/)
- Daily feeds: [Daily Registered Domains](/reference/feeds/daily-registered-domains/),
  [Daily Updated Domains](/reference/feeds/daily-updated-domains/),
  [Daily Deleted Domains](/reference/feeds/daily-deleted-domains/),
  [Daily Discovered Subdomains](/reference/feeds/daily-discovered-subdomains/)
- Full lists: [All Domains](/reference/feeds/all-domains/), [All Subdomains](/reference/feeds/all-subdomains/)


---

# Reports

URL: https://docs.deepinfo.com/guide/reports/

The Reports screen lists the PDF reports you can generate and the CSV or JSON exports you can download, grouped by module; Scheduled Reports sends PDF reports by e-mail on a schedule.

The **Reports** screen is a catalogue of these kinds of output:

- **PDF reports** summarize your attack surface, one asset or one CVE. The platform generates them from
  your data, you read them in the browser, and you save them as PDF. Every copy is kept.
- **CSV and JSON exports** download a complete dataset, such as all your assets or all your exposed
  employee credentials, as one file.

**Scheduled Reports**, the second item under **REPORTS** in the sidebar, generates a PDF report daily,
weekly or monthly and e-mails it to the members you choose.

## Before You Start

- **Package:** your organization's package must include Reports. Reports and Notifications are included
  together. If they are not included, the screen is replaced by a notice with a **TALK TO US** button, which
  opens an e-mail to support@deepinfo.com. See [What you can access](/guide/basics/packages-and-roles/).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **REPORTS** › **REPORTS** · [https://platform.deepinfo.com/app/platform/reports](https://platform.deepinfo.com/app/platform/reports)

**REPORTS** has a chevron. Select it to show its items, **REPORTS** and **SCHEDULED REPORTS**.

## Read the Screen

![The Reports screen on the EASM REPORTS tab, with the GENERAL REPORTS section of PDF report cards and the CSV AND JSON REPORTS section of export cards.](/img/guide/reports/index-01.png)

1. **Breadcrumb and title:** **DEEPINFO / REPORTS** and **Reports**.
2. **Tabs:** **EASM REPORTS**, **CTI REPORTS** and **BRP REPORTS**, one for each module (External Attack
   Surface Management, Cyber Threat Intelligence and Brand Risk Protection). **EASM REPORTS** opens first.
3. **GENERAL REPORTS:** the PDF reports. Only the **EASM REPORTS** tab has this section. Each card has a
   **.PDF** badge, a title, a short description and a **GENERATE NEW REPORT** button.
4. **CSV AND JSON REPORTS:** the exports, on every tab. Each card shows CSV and JSON icons and a
   **DOWNLOAD** button.

Click the body of a PDF report card, not its button, to open the report's drawer. The drawer explains what
the report includes and lists the copies generated so far. See
[Generate and download a PDF report](/guide/reports/generate-a-report/).

![A PDF report card with its .PDF badge and GENERATE NEW REPORT button, next to an export card with its CSV and JSON icons and DOWNLOAD button.](/img/guide/reports/index-02.png)

## PDF Reports

Every PDF report is on the **EASM REPORTS** tab.

| Report | What it covers |
|---|---|
| **EASM Executive Summary Report** | An overview of your external attack surface: totals and score, then your assets, issues, technologies and vulnerabilities. |
| **Asset Detail Report** | One asset you choose: its issues, technologies, vulnerabilities and open ports. |
| **EASM Weekly Progress Report** | What changed over the week: assets, issues, technologies, vulnerabilities and open ports. |
| **Issue Overview Report** | Your issues: an overview, trends, the severity distribution and the list of issues. |
| **Vulnerability Overview Report** | Your vulnerabilities: severity, trends, and the most critical, most seen and most recently detected CVEs. |
| **Vulnerability Detail Report** | One CVE you choose: its details, the assets it affects, its impact and the affected product. |

[What each report contains](/guide/reports/report-contents/) lists the sections of each report.

## CSV and JSON Exports

| Tab | Export | Contains |
|---|---|---|
| **EASM REPORTS** | **All Assets Report** | Your assets |
| **EASM REPORTS** | **All Issues Report** | Your issues |
| **EASM REPORTS** | **All Technologies Report** | Your detected technologies |
| **EASM REPORTS** | **All Vulnerability Report** | Your vulnerabilities |
| **CTI REPORTS** | **All Compromised Employee Credentials Report** | Your employees' exposed credentials |
| **CTI REPORTS** | **All Compromised Client Credentials Report** | Your clients' exposed credentials |
| **CTI REPORTS** | **All Compromised Payment Credentials Report** | Exposed payment cards |
| **BRP REPORTS** | **All Fraudulent Domains Report** | Your fraudulent domains |
| **BRP REPORTS** | **All Suspicious Domains Report** | Your suspicious domains |

See [Export all data as CSV or JSON](/guide/reports/export-data/).

## Scheduled Reports

**REPORTS** › **SCHEDULED REPORTS** lists the reports that are sent on a schedule. You choose a PDF report,
a frequency (**DAILY**, **WEEKLY** or **MONTHLY**) and the members who receive it by e-mail. See
[Schedule a report](/guide/reports/schedule-a-report/).

## Pages in This Section

1. [Generate and download a PDF report](/guide/reports/generate-a-report/): create a report for your
   organization, one asset or one CVE, save it as PDF and reopen past reports.
2. [Schedule a report](/guide/reports/schedule-a-report/): have a PDF report e-mailed daily, weekly or
   monthly.
3. [What each report contains](/guide/reports/report-contents/): the sections of each PDF report.
4. [Export all data as CSV or JSON](/guide/reports/export-data/): download a whole dataset as one file.

## Good to Know

- **A saved PDF report is a snapshot.** When you reopen it from the drawer's **REPORTS HISTORY**, it shows
  the data from the moment it was generated. It is not generated again.
- **Reports cannot be deleted or renamed in the platform.** The API can delete a report; see
  [Generate and download a PDF report](/guide/reports/generate-a-report/#do-this-with-the-api).
- **An export here always contains the whole dataset.** To export only the records that match a filter,
  filter the list on its own screen, for example **INVENTORY** or **FRAUDULENT DOMAINS**, and use its
  **EXPORT** button. See [Search, filter and export lists](/guide/basics/lists-filters-and-exports/).


---

# Generate and Download a PDF Report

URL: https://docs.deepinfo.com/guide/reports/generate-a-report/

Generate a PDF report for your organization, one asset or one CVE, preview it in the browser, save it as PDF and reopen past reports.

The platform generates a PDF report from your current data. You preview the report in the browser and then
save it as a PDF. Every report you generate is kept, so you can open it again later.

> [!IMPORTANT]
> A report is created as soon as its page opens, with an automatic name. There is no name field and no
> confirmation step. **GENERATE NEW REPORT** opens that page straight away, except on the
> **Asset Detail Report** and **Vulnerability Detail Report**, which first ask you to pick an asset or a CVE.
> **CREATE A REPORT** and **CREATE REPORT** on an asset also open it straight away.

## Before You Start

- **Package:** your organization's package must include Reports. See [Reports](/guide/reports/).
- **Role:** Admin or Member.
- **Data:** the **Asset Detail Report** is for an asset in your inventory. The **Vulnerability Detail Report**
  is for a CVE found on your assets.

## Where to Find It

**Sidebar:** **REPORTS** › **REPORTS** · **Tab:** **EASM REPORTS** · [https://platform.deepinfo.com/app/platform/reports](https://platform.deepinfo.com/app/platform/reports)

The PDF reports are in the **GENERAL REPORTS** section of the **EASM REPORTS** tab, which opens first. For
one asset, you can also start from the asset itself (see [From an asset](#from-an-asset)).

## Read the Report Drawer

Click anywhere on a PDF report card except its button. A drawer opens on the right.

![The report drawer for EASM Executive Summary Report on the OVERVIEW tab, with What does it include?, Why This Report Matters and the GENERATE NEW REPORT button.](/img/guide/reports/generate-a-report-01.png)

- **Top:** the module tag **EASM**, a **NEW** tag on some report types, and the report title.
- **Two icon tabs** on the left side of the drawer. Hover over an icon to see its name:
  - **OVERVIEW:** the description, **What does it include?** (a summary and the list of sections) and
    **Why This Report Matters**.
  - **REPORTS HISTORY:** the reports of this type generated so far, newest first. The columns
    are **REPORT NAME** and **CREATED DATE**. Each row ends with an eye icon and a download icon. With no
    reports yet, the tab shows **No Result Found.**
- **GENERATE NEW REPORT** at the bottom of the drawer.

Press Esc to close the drawer.

![The report drawer on the REPORTS HISTORY tab, listing past reports with their name, creation date, eye icon and download icon.](/img/guide/reports/generate-a-report-02.png)

## Generate a Report for Your Organization

Use these steps for **EASM Executive Summary Report**, **EASM Weekly Progress Report**,
**Issue Overview Report** and **Vulnerability Overview Report**.

1. In the sidebar, select **REPORTS** › **REPORTS**. The **EASM REPORTS** tab opens.
2. On the report's card, select **GENERATE NEW REPORT**. The button at the bottom of the report's drawer
   does the same.
3. The report page opens and generation starts. The tile reads "The report is being generated..." and shows
   a progress bar.
4. When the report is ready, the tile turns blue and shows **SAVE AS PDF**. The report's pages appear below
   the tile, so you can read it before you download it.
5. Select **SAVE AS PDF**. The PDF opens in a new browser tab, and the message "Your report has been
   generated and downloaded to your device." appears.

## Generate a Report for One Asset or One CVE

The **Asset Detail Report** and the **Vulnerability Detail Report** ask what to report on first.

1. On the report's card, select **GENERATE NEW REPORT**.
2. Choose what the report is about:
   - **Asset Detail Report:** the **Select an asset** popup opens. Open **ASSETS** ("Select assets") and pick
     one asset. Type part of its name to search your whole inventory.
   - **Vulnerability Detail Report:** the **Select a CVE ID** popup opens. Open **CVE ID** ("Select CVE") and
     pick one CVE.
3. Select **SELECT**. If nothing is chosen, the popup shows "Please select an item."
4. The report page opens and generation starts. Continue with steps 3 to 5 of
   [Generate a report for your organization](#generate-a-report-for-your-organization).

To stop, select **CANCEL** in the popup. No report is created.

![The Select an asset popup with the ASSETS dropdown open, listing the assets you can report on.](/img/guide/reports/generate-a-report-05.png)

### From an Asset

1. Open the asset from **EXTERNAL ATTACK SURFACE MANAGEMENT** › **ASSETS** › **INVENTORY**. See
   [Investigate an asset](/guide/easm/asset-details/).
2. Select **CREATE A REPORT** at the top of the asset's page, or **CREATE REPORT** in the asset's **…** menu.
   The menu item opens the report in a new browser tab.
3. An Asset Detail Report for that asset is generated right away. When it is ready, select **SAVE AS PDF**.

## Reopen a Past Report

1. In the sidebar, select **REPORTS** › **REPORTS** and click the body of the report's card.
2. In the drawer, open the **REPORTS HISTORY** tab.
3. Click a row. The eye icon does the same. The report opens as it was generated; it is not generated again.
4. Select **SAVE AS PDF** to download it.

To download a past report without opening it, use the download icon on its row.

A saved report's page has no back button. Its breadcrumb reads **DEEPINFO / REPORTS /** followed by the
report type, for example **EASM EXECUTIVE SUMMARY REPORT**. To return to the catalogue, select
**REPORTS** › **REPORTS** in the sidebar.

![A saved EASM Executive Summary Report opened from REPORTS HISTORY, with its breadcrumb, the blue SAVE AS PDF tile and the top of the first preview page.](/img/guide/reports/generate-a-report-06.png)

## Good to Know

- **Each opening creates a report.** Every time a new-report page opens, the platform generates another
  report. To look at a report again, open it from **REPORTS HISTORY**.
- **Names are automatic.** A report is named after its type, or after the asset or CVE, followed by the date
  and time it was created. An Executive Summary, for example, is named `executive-summary-YYYY-MM-DD-HH:mm`.
  You cannot rename a report or add a description in the platform.
- **The preview leaves out the covers.** The report page shows the content pages. The cover, with the report
  title and creation date, and the back cover are in the PDF.
- **No delete in the platform.** Deleting a report is available through the API only (see below).
- **To receive a report regularly,** schedule it instead of generating it by hand. See
  [Schedule a report](/guide/reports/schedule-a-report/).

## Do This With the API

- [Create a report](/reference/platform/report-create/)
- [Search generated reports](/reference/platform/report-search/), for example all reports of one type
- [Get one report](/reference/platform/report-detail/)
- [Get a download link for a report's PDF](/reference/platform/report-download/)

Available through the API only:

- [Delete a report](/reference/platform/report-delete/)


---

# Schedule a Report

URL: https://docs.deepinfo.com/guide/reports/schedule-a-report/

Have the platform generate a PDF report daily, weekly or monthly and e-mail it to members of your organization.

A scheduled report generates one type of PDF report on a regular basis, daily, weekly or monthly, and
e-mails it to the members you choose. You set up and remove schedules on the **Scheduled Reports** screen.

## Before You Start

- **Package:** your organization's package must include Reports. See [Reports](/guide/reports/).
- **Role:** Admin or Member. Admins can send a schedule to any member of the organization; a member can
  choose only themselves as the recipient.
- **Recipients:** reports are e-mailed to members of your organization. To add people first, see
  [Manage members and invitations](/guide/settings/members/).

## Where to Find It

**Sidebar:** **REPORTS** › **SCHEDULED REPORTS** · [https://platform.deepinfo.com/app/platform/scheduled-reports](https://platform.deepinfo.com/app/platform/scheduled-reports)

## Read the Screen

1. **Breadcrumb and title:** **DEEPINFO / SCHEDULED REPORTS** and **Scheduled Reports**.
2. **SCHEDULE A REPORT:** opens the popup that creates a schedule.
3. **ALL REPORTS** tab: your schedules, one card each. A card shows "Scheduled for:" and
   "Last Sent Date:".

When there are no schedules yet, the screen shows **No scheduled reports** and "Schedule a report to have it
delivered to your inbox automatically."

![The Scheduled Reports screen with no schedules yet, showing No scheduled reports and the SCHEDULE A REPORT button.](/img/guide/reports/schedule-a-report-02.png)

## Schedule a Report

1. Select **SCHEDULE A REPORT**. The **SCHEDULE NEW REPORT** popup opens. It has two steps.
2. **Report Template:** under **REPORT TYPE**, select the report to send. Every template is a PDF report:
   - **EASM Executive Summary Report**
   - **EASM Weekly Progress Report**
   - **Asset Detail Report**
   - **Vulnerability Detail Report**
   - **Vulnerability Overview Report**
   - **Issue Overview Report**
   - **Issue Detail Report**
3. If you chose a report about one item, an extra field appears. Pick the item there:
   - **Asset Detail Report:** **ASSET** ("Select asset").
   - **Vulnerability Detail Report:** **CVE ID** ("Select CVE").
   - **Issue Detail Report:** **ISSUE** ("Select issue").
4. **Scheduling & Delivery:**
   1. Enter a **SCHEDULE NAME**.
   2. Under **FREQUENCY**, choose **DAILY**, **WEEKLY** or **MONTHLY**.
   3. Under **DELIVERY CHANNELS**, **Email** is switched on. In the **Add a member** box, choose the members
      who should receive the report. You can choose more than one.
5. Select **SCHEDULE REPORT**. The schedule appears in the list.

To close the popup without saving, press Esc.

![The SCHEDULE NEW REPORT popup at step 1, Report Template, with the PDF report tiles under REPORT TYPE.](/img/guide/reports/schedule-a-report-03.png)
![Step 2 of the popup, Scheduling & Delivery, with the SCHEDULE NAME field, a frequency chosen under FREQUENCY and the Add a member box under DELIVERY CHANNELS.](/img/guide/reports/schedule-a-report-04.png)

## See a Schedule's Details

Click a schedule's card. A drawer opens on the right with two tabs, **Overview** and **History**.
**Overview** shows **Frequency**, **Members** (the recipients), **Next Send Date** and **Last Sent Date**.

## Remove a Schedule

1. Open the schedule's drawer.
2. Select **DELETE**.
3. In the **Remove Scheduled Report** dialog, select **REMOVE**.

The report stops being sent.

## Change a Schedule

A schedule cannot be edited. To change its report, frequency or recipients, remove it and schedule the
report again with the new settings.

## Good to Know

- **Only PDF reports can be scheduled.** The CSV and JSON exports cannot be sent on a schedule. See
  [Export all data as CSV or JSON](/guide/reports/export-data/).
- **Issue Detail Report is available only here.** It covers one issue you choose, and it is not in the
  catalogue on **REPORTS** › **REPORTS**.
- **You cannot choose the hour or the day.** There is no control for the time of day or the day of the week.
  A schedule's drawer shows its **Next Send Date**.
- **E-mail is the only delivery channel.**
- **Each run generates a new report.** Every time a schedule is due, the platform generates the report and
  e-mails it. To generate a report yourself at any time, see
  [Generate and download a PDF report](/guide/reports/generate-a-report/).

## Do This With the API

- [List scheduled reports](/reference/platform/scheduled-report-rule-list/)
- [Get one scheduled report](/reference/platform/scheduled-report-rule-detail/), with its last and next send
  dates
- [Create a scheduled report](/reference/platform/scheduled-report-rule-create/)
- [Delete a scheduled report](/reference/platform/scheduled-report-rule-delete/)


---

# What Each Report Contains

URL: https://docs.deepinfo.com/guide/reports/report-contents/

See what each PDF report includes, from the EASM Executive Summary to the Vulnerability Detail Report, and what every report has in common.

Every PDF report is built from your data at the moment it is generated. This page lists what each report
type includes, so you can pick the right one before you generate or schedule it. To see a report's pages,
generate it once and read the preview.

The **Includes** line of each report below is the list its drawer shows under **What does it include?**. See
[Generate and download a PDF report](/guide/reports/generate-a-report/#read-the-report-drawer).

## Where to Find It

**Sidebar:** **REPORTS** › **REPORTS** · **Tab:** **EASM REPORTS** · [https://platform.deepinfo.com/app/platform/reports](https://platform.deepinfo.com/app/platform/reports)

Click the body of a PDF report card on the **EASM REPORTS** tab to open its drawer.

## What Every Report Has

- **A cover** with the module (**EASM**), the report title, the asset or CVE it is about (on the detail
  reports) and the date it was created.
- **A footer on every page** that reads "Deepinfo Security Platform" followed by the kind of report.
- **A back cover.**
- **An automatic name**, made of the report type, or the asset or CVE, and the date and time of creation.

The preview in the platform shows the content pages only. The covers are in the PDF.

## EASM Executive Summary Report

An overview of your organization's external attack surface.

**Includes:** General Overview, Insights, Assets, Issues, Technologies, Vulnerabilities.

**Pages:**

1. **Executive Summary Report:** **TOTAL ASSETS**, **TOTAL TECHNOLOGIES**, **TOTAL ISSUES** and
   **TOTAL VULNERABILITIES**, each with its change and the figure from last week (**LAST WEEK:**); your
   **SCORE** and its **TIMELINE**.
2. **Assets:** **ASSET TYPES** (domains, subdomains, IP addresses and websites) and **Top 5 Assets**, with
   **DOMAIN NAME**, **SECURITY RATING**, **ISSUES** and **TECHNOLOGIES**.
3. **Issues:** **SEVERITY** and **Most Critical Issues**, with **ISSUE NAME**, **ASSETS** and **CATEGORY**.
4. **Technologies:** **CATEGORY** and **Most Identified Technologies**, with **TECHNOLOGY**, **CATEGORIES**,
   **VERSION**, **LATEST VERSION**, **ASSETS** and **VULNERABILITIES**.
5. **Vulnerabilities:** **SEVERITY**, from **NONE** and **UNKNOWN** to **CRITICAL**.

**Name:** `executive-summary-YYYY-MM-DD-HH:mm`.

![The first preview page of an EASM Executive Summary Report, with the asset, technology, issue and vulnerability totals, the score and its timeline.](/img/guide/reports/report-contents-01.png)

## Asset Detail Report

A deep look at one asset you choose.

**Includes:** Asset Overview, Insights, Issues, Technologies, Vulnerabilities, Open Ports.

**Name:** the asset's name followed by `-YYYY-MM-DD-HH:mm`.

## EASM Weekly Progress Report

What changed on your attack surface over the week.

**Includes:** Weekly Progress Summary, Assets, Issues, Technologies, Vulnerabilities, Open Ports.

## Issue Overview Report

A high-level summary of your issues.

**Includes:** Issue Overview, Insights, Issues.

## Vulnerability Overview Report

A summary of the vulnerabilities found on your assets.

**Includes:** Vulnerability Overview, Insights, Most Critical Vulnerabilities, Most Seen Vulnerabilities,
Recently Detected Vulnerabilities.

## Vulnerability Detail Report

Technical detail on one CVE you choose.

**Includes:** Vulnerability Overview, Vulnerability Details, Insights, Affected Assets, Impact, Affected
Product.

## Issue Detail Report

A report on one issue you choose. It is available only as a scheduled report. See
[Schedule a report](/guide/reports/schedule-a-report/).

## Good to Know

- **A report is a snapshot.** It shows your data at the time it was generated. Reopening it from
  **REPORTS HISTORY** does not update it.
- **The CSV and JSON exports are not reports of this kind.** They contain raw records, not pages. See
  [Export all data as CSV or JSON](/guide/reports/export-data/).


---

# Export All Data as CSV or JSON

URL: https://docs.deepinfo.com/guide/reports/export-data/

Download your complete asset, issue, technology, vulnerability, compromised-credential, fraudulent-domain or suspicious-domain dataset as one CSV or JSON file.

The **CSV AND JSON REPORTS** cards on the Reports screen each download one complete dataset as a single file.
No filters are applied.

## Before You Start

- **Package:** your organization's package must include Reports. See [Reports](/guide/reports/).
- **Role:** Admin or Member.

## Where to Find It

**Sidebar:** **REPORTS** › **REPORTS** · [https://platform.deepinfo.com/app/platform/reports](https://platform.deepinfo.com/app/platform/reports)

The exports are in the **CSV AND JSON REPORTS** section of each tab: **EASM REPORTS**, **CTI REPORTS** and
**BRP REPORTS**, one for each module (External Attack Surface Management, Cyber Threat Intelligence and Brand
Risk Protection).

## The Exports

| Tab | Card | File name |
|---|---|---|
| **EASM REPORTS** | **All Assets Report** | `deepinfo-all-assets-<date>-<time>` |
| **EASM REPORTS** | **All Issues Report** | `deepinfo-all-issues-<date>-<time>` |
| **EASM REPORTS** | **All Technologies Report** | `deepinfo-all-technologies-<date>-<time>` |
| **EASM REPORTS** | **All Vulnerability Report** | `deepinfo-all-vulnerabilities-<date>-<time>` |
| **CTI REPORTS** | **All Compromised Employee Credentials Report** | `deepinfo-all-compromised-employee-credentials-<date>-<time>` |
| **CTI REPORTS** | **All Compromised Client Credentials Report** | `deepinfo-all-compromised-client-credentials-<date>-<time>` |
| **CTI REPORTS** | **All Compromised Payment Credentials Report** | `deepinfo-all-compromised-payment-credentials-<date>-<time>` |
| **BRP REPORTS** | **All Fraudulent Domains Report** | `deepinfo-all-fraudulent-domains-<date>-<time>` |
| **BRP REPORTS** | **All Suspicious Domains Report** | `deepinfo-all-fraudulent-suspicious-domains-<date>-<time>` |

`<date>` is `YYYYMMDD` and `<time>` is `HHmmss`, the moment you downloaded the file. The extension is `.csv`
or `.json`.

The Cyber Threat Intelligence (CTI) exports contain your employees' exposed credentials, your clients' exposed credentials and
exposed payment cards, as found in breach data.

## Download an Export

1. In the sidebar, select **REPORTS** › **REPORTS** and choose the tab: **EASM REPORTS**, **CTI REPORTS** or
   **BRP REPORTS**.
2. In **CSV AND JSON REPORTS**, select **DOWNLOAD** on the card you need. Clicking the card itself does the
   same.
3. The **DOWNLOAD REPORT** popup opens: "Please choose a file format to download your report:". Under
   **FILE FORMAT**, choose **CSV** or **JSON**. **JSON** is selected by default.
4. For **All Assets Report** only, choose an **EXPORT SCOPE**: **DEFAULT**, **BASIC** or **EXTENDED**.
   **DEFAULT** is selected by default.
5. Select **DOWNLOAD**. Your browser saves the file, and the message "Your report has been generated and
   downloaded to your device." appears.

To close the popup without downloading, select **CANCEL**.

![The DOWNLOAD REPORT popup for All Assets Report, with the FILE FORMAT and EXPORT SCOPE choices.](/img/guide/reports/export-data-01.png)
![The DOWNLOAD REPORT popup for All Issues Report, with only the FILE FORMAT choice.](/img/guide/reports/export-data-02.png)

## Good to Know

- **Everything, every time.** These exports ignore any filters you set on list screens. To export only part
  of a list, filter the list on its own screen, for example **INVENTORY** or **FRAUDULENT DOMAINS**, and
  select its **EXPORT** button. When a filter is set, the **DOWNLOAD** dialog there offers **RECORDS**:
  **ALL** or **FILTERED**. See [Search, filter and export lists](/guide/basics/lists-filters-and-exports/).
- **The scopes are not explained in the platform.** The popup does not say what **BASIC** or **EXTENDED**
  adds to or removes from the **DEFAULT** export.
- **Handle credential exports with care.** The CTI exports come from breach data about your employees,
  clients and payment cards. Store and share the files as carefully as the credentials themselves. See
  [Handle leaked data safely](/guide/cti/sensitive-data/).

## Do This With the API

The same datasets can be exported through the API. There you can also send filters, so the file contains
only the records you need. The filter syntax is described in
[Search & filters](/getting-started/search-and-filters/).

- [Export assets](/reference/easm/asset-export/)
- [Export issues](/reference/easm/issue-export/)
- [Export technologies](/reference/easm/technology-export/)
- [Export vulnerabilities](/reference/easm/vulnerability-export/)
- [Export compromised employee credentials](/reference/cti/compromised-employee-credential-export/)
- [Export compromised client credentials](/reference/cti/compromised-client-credential-export/)
- [Export compromised payment credentials](/reference/cti/compromised-payment-credential-export/)
- [Export fraudulent domains](/reference/brp/fraudulent-domain-export/)
- [Export suspicious domains](/reference/brp/suspicious-domain-export/)


---

# Notification Center

URL: https://docs.deepinfo.com/guide/notifications/

Notification rules e-mail the members you choose when something happens, such as a new asset, issue or vulnerability, a score change, a lookalike domain, a leaked credential or a security news item.

A notification rule watches for one kind of event, such as a new issue on your assets, and e-mails the members
you choose, at the frequency you set. You create and manage all rules in the **NOTIFICATION CENTER**, on the
**Notification Rules** screen.

> [!NOTE]
> Looking for Deepinfo's newsletter or product e-mails? Those are **e-mail preferences**, set by each user
> under **SETTINGS** › **USER SETTINGS** › **Notifications**: **Company Announcements**,
> **Monthly Newsletter**, **Product Feature Updates** and **Education Training**. They are not security
> alerts. See [Choose which Deepinfo e-mails you receive](/guide/settings/email-preferences/).

## Before You Start

- **Package:** your organization's package must include Notifications. Reports and Notifications are
  included together. If they are not included, the screen is replaced by a notice with a **TALK TO US**
  button, which opens an e-mail to support@deepinfo.com. See
  [What you can access](/guide/basics/packages-and-roles/).
- **Role:** Admin or Member. Admins can send a rule's e-mails to any member of the organization; a member
  can choose only themselves as the recipient.

## Where to Find It

**Sidebar:** **NOTIFICATION CENTER** · [https://platform.deepinfo.com/app/platform/notification/rules](https://platform.deepinfo.com/app/platform/notification/rules)

The breadcrumb reads **DEEPINFO / NOTIFICATION CENTER** and the page title is **Notification Rules**.

## How a Rule Works

Every rule has:

- **One event** that triggers it, for example **New Issue** or **Domain Score Decreased**.
- **Filters** (optional) that narrow the event, for example to one asset, to assets with certain tags, or to
  one severity.
- **A frequency:** **INSTANT**, **HOURLY**, **DAILY**, **WEEKLY** or **MONTHLY**.
- **Recipients:** at least one member of your organization, who gets the e-mails.
- **A status:** **ACTIVE** or **INACTIVE**. Only active rules send e-mails.

Notifications are delivered by e-mail. **Slack** and **Webhook** are shown in the rule settings with a
**Coming Soon** label and cannot be switched on.

## Events

The table groups the events by what they watch; the full list, with the filters each event offers, is in [Events and filters](/guide/notifications/events-and-filters/).

| What they watch | Events |
|---|---|
| Assets entering your inventory or discovery | **New Asset Added**, **New Asset Discovered** |
| Changes to your assets | **Whois Changed**, **DNS Changed**, **SSL Changed**, **New Open Port** |
| Issues and vulnerabilities | **New Issue**, **Issue Reappeared**, **New Vulnerability**, **Vulnerability Reappeared** |
| Security scores | **Asset Score Decreased**, **Asset Score Changed**, **Domain Score Decreased**, **Domain Score Changed** |
| Lookalike domains (Brand Risk Protection, BRP) | **New Suspicious Domain**, **New Fraudulent Domain** |
| Leaked credentials (Cyber Threat Intelligence, CTI) | **New Employee Credential Detected**, **New Client Credential Detected**, **New Payment Credential Detected** |
| Security news (CTI) | **New Cybersecurity News** |

The names above are the tiles you pick from when you create a rule. The rules list and the rule drawer use
longer names for some events, for example **New Issue Detected** for **New Issue**.

## Read the Screen

When your organization has no rules yet, the screen shows "You don't have any notification rules yet." and a
**CREATE NEW RULE** button.

![The Notification Rules screen with the filter bar and the rules table, including active and inactive rules.](/img/guide/notifications/index-02.png)

Once rules exist, the screen shows:

1. The title **Notification Rules** and the **CREATE NEW RULE** button.
2. A filter bar: **SEARCH**, the **TYPE**, **FREQUENCY** and **STATUS** filters, **SORT BY** and a **⋮** menu
   for bulk changes.
3. The rules table: **STATUS**, **RULE NAME**, **MEMBERS**, **SCOPE** (the event), **FREQUENCY**,
   **CREATE DATE**, **LAST UPDATE DATE** and a menu for each row.

[Manage notification rules](/guide/notifications/manage-rules/) explains each control.

## Pages in This Section

1. [Create a notification rule](/guide/notifications/create-a-rule/): the four-step wizard.
2. [Events and filters](/guide/notifications/events-and-filters/): every event and the filters it offers.
3. [Manage notification rules](/guide/notifications/manage-rules/): find, activate or deactivate, edit,
   duplicate and remove rules.

## Good to Know

- **The platform has no list of sent notifications.** To see which e-mails your rules have sent, use the API
  (below).
- **The newspaper icon in the header is not notifications.** It opens the **Cybersecurity News** menu.
- **You cannot choose when digests go out.** There is no control for the hour or the day of **HOURLY**,
  **DAILY**, **WEEKLY** and **MONTHLY** e-mails.

## Do This With the API

- [List notification rules](/reference/platform/notification-rule-list/)

Available through the API only:

- [List sent notification e-mails](/reference/platform/notification-email-list/): a log of the e-mails your rules
  have sent, with the rule, the time sent and the recipients.


---

# Create a Notification Rule

URL: https://docs.deepinfo.com/guide/notifications/create-a-rule/

Create a rule that e-mails chosen members when an event happens, in four steps: event, rule settings, filters and review.

A rule has one event, optional filters, a frequency and a list of recipients. You set them in a popup with
four numbered steps.

## Before You Start

- **Package:** your organization's package must include Notifications. See
  [Notification Center](/guide/notifications/).
- **Role:** Admin or Member. A member who is not an admin can choose only themselves as the recipient.
- **Recipients:** every rule needs at least one member of your organization. To add people first, see
  [Manage members and invitations](/guide/settings/members/).

## Where to Find It

**Sidebar:** **NOTIFICATION CENTER** · [https://platform.deepinfo.com/app/platform/notification/rules](https://platform.deepinfo.com/app/platform/notification/rules)

## Create a Rule

1. Select **CREATE NEW RULE**. The **CREATE NEW NOTIFICATION RULE** popup opens.
2. **Event Type:** under **NOTIFICATION TYPE**, select the tile of the event that should trigger the rule.
   **New Asset Discovered** is selected by default. The events are listed in
   [Events and filters](/guide/notifications/events-and-filters/).
3. **Rule Settings:**
   1. Enter a **RULE NAME**.
   2. Under **FREQUENCY**, choose **INSTANT**, **HOURLY**, **DAILY**, **WEEKLY** or **MONTHLY**. The default
      is **INSTANT**.
   3. Under **DELIVERY CHANNELS**, open the **Add a member** box for **Email** and choose the members who
      should receive the e-mails. You can choose more than one. The **Email** switch turns on by itself once
      a member is added.
4. **Filters:** narrow the event if you need to. Each filter is a chip; open it, set a value and select
   **APPLY**. The filter is then listed under **FILTERS APPLIED**. The filters on offer depend on the event
   (see [Events and filters](/guide/notifications/events-and-filters/)). Every filter is optional.
5. **Reviews:** look at a sample notification e-mail.
6. Select **CREATE RULE**. The popup closes and the new rule appears in the list.

To close the popup without saving, select × at the top.

![The CREATE NEW NOTIFICATION RULE popup at step 1, Event Type, with the grid of event tiles under NOTIFICATION TYPE.](/img/guide/notifications/create-a-rule-01.png)
![Step 2, Rule Settings, with the RULE NAME field, a frequency chosen under FREQUENCY and the Add a member box for Email under DELIVERY CHANNELS.](/img/guide/notifications/create-a-rule-02.png)
![Step 3, Filters, for the New Issue event, with the filter chips and one filter listed under FILTERS APPLIED.](/img/guide/notifications/create-a-rule-03.png)
![Step 4, Reviews, showing a sample notification e-mail for a new issue.](/img/guide/notifications/create-a-rule-04.png)

**CREATE RULE** checks the form when you select it:

- Without a rule name, the popup returns to **Rule Settings** with the message "This field cannot be left
  blank."
- Without a member, the popup returns to **Rule Settings** with the message "Add at least one member email."

If the platform cannot save the rule, the error appears at the bottom left of the popup.

![The RULE NAME field in Rule Settings with the message that it cannot be left blank.](/img/guide/notifications/create-a-rule-05.png)

## Set a Filter

A filter chip opens a small popover:

1. Under **OPERATOR**, the operator is **Equal**.
2. Under **VALUE**, choose or type the value. Filters that take numbers, such as **Port Number** or **EPSS**,
   have **+Add Value** to add another value. **Score** takes a range, **FROM** and **TO**.
3. Select **APPLY** to add the filter, or **CANCEL** to close the popover without it.

**Asset Score Decreased** and **Domain Score Decreased** start with two filters already set: **Unit** is
**Absolute** and **By** is 800. Change them if you need a different threshold.

## Good to Know

- **One event per rule.** To be alerted about several events, create a rule for each.
- **Choose carefully: most settings are fixed once saved.** After you create a rule you can change only its
  name, its recipients and whether it is active. To change the event, frequency or filters, duplicate the
  rule, adjust the copy and remove the old rule. See
  [Manage notification rules](/guide/notifications/manage-rules/).
- **Email is the only delivery channel.** **Slack** and **Webhook** carry a **Coming Soon** label and cannot
  be switched on.
- **You cannot switch Email off by hand.** The switch only shows whether the rule has recipients. To pause a
  rule, deactivate it in the list.
- **You cannot choose when e-mails go out.** There is no control for the hour or the day of **HOURLY**,
  **DAILY**, **WEEKLY** and **MONTHLY** e-mails.
- **The review step shows a sample.** **Reviews** shows an example notification e-mail. It is not a summary
  of your settings.

## Do This With the API

- [Create a notification rule](/reference/platform/notification-rule-create/)


---

# Events and Filters Reference

URL: https://docs.deepinfo.com/guide/notifications/events-and-filters/

Look up every notification event, the name each one has in the rules list, and the filters each event offers with their values.

A notification rule reacts to one event. This page lists every event you can choose in the
**CREATE NEW NOTIFICATION RULE** popup, and the filters each one offers in the **Filters** step.

## Where to Find It

**Sidebar:** **NOTIFICATION CENTER** · [https://platform.deepinfo.com/app/platform/notification/rules](https://platform.deepinfo.com/app/platform/notification/rules)

Select **CREATE NEW RULE**. The events are the tiles under **NOTIFICATION TYPE** in step 1, **Event Type**.
The filters for the selected event are the chips in step 3, **Filters**. See
[Create a notification rule](/guide/notifications/create-a-rule/).

## Events

The groups below are this guide's, to make the list easier to scan; the popup shows the tiles in the same
order, without group names.

The **Event** column gives the tile name. The rules list (**SCOPE** column), the **TYPE** filter and the rule
drawer use the name in the second column. The **TYPE** filter shows it in capitals, for example
**NEW ASSET ADDED**.

### Assets Entering Your Inventory or Discovery

| Event | Name in the rules list | Filters |
|---|---|---|
| **New Asset Added** | **New Asset Added** | **Asset Type**, **Asset Tags**, **Creation Method** |
| **New Asset Discovered** | **New Asset Discovered** | **Asset Type**, **Rule**, **Rule Type** |

### Changes to Your Assets

| Event | Name in the rules list | Filters |
|---|---|---|
| **Whois Changed** | **Asset Whois Changed** | **Asset**, **Asset Type**, **Asset Tags**, **Whois Data Changes** |
| **DNS Changed** | **Asset DNS Changed** | **Asset**, **Asset Type**, **Asset Tags**, **DNS Data Changes** |
| **SSL Changed** | **Asset SSL Certificate Changed** | **Asset**, **Asset Type**, **Asset Tags**, **SSL Data Changes** |
| **New Open Port** | **New Open Port Detected** | **Asset**, **Asset Type**, **Asset Tags**, **Port Protocol**, **Port Number** |

### Issues and Vulnerabilities

| Event | Name in the rules list | Filters |
|---|---|---|
| **New Issue** | **New Issue Detected** | **Asset**, **Asset Tags**, **Asset Type**, **Severity** |
| **Issue Reappeared** | **Reappeared Issue Detected** | **Asset**, **Asset Tags**, **Asset Type**, **Severity** |
| **New Vulnerability** | **New Vulnerability Detected** | **Asset**, **Asset Tags**, **Asset Type**, **CVE ID**, **EPSS**, **Base Score**, **Base Severity** |
| **Vulnerability Reappeared** | **Reappeared Vulnerability Detected** | **Asset**, **Asset Tags**, **Asset Type**, **CVE ID**, **EPSS**, **Base Score**, **Base Severity** |

### Security Scores

| Event | Name in the rules list | Filters |
|---|---|---|
| **Asset Score Decreased** | **Asset Security Score Decreased** | **Asset**, **Asset Tags**, **Unit**, **By** |
| **Asset Score Changed** | **Asset Security Score Changed** | **Asset**, **Asset Type**, **Asset Tags**, **Score** |
| **Domain Score Decreased** | **Domain Security Score Decreased** | **Asset**, **Asset Tags**, **Unit**, **By** |
| **Domain Score Changed** | **Domain Security Score Changed** | **Asset**, **Asset Tags**, **Score** |

See [How security scores work](/guide/easm/security-score/).

### Lookalike Domains (Brand Risk Protection, BRP)

| Event | Name in the rules list | Filters |
|---|---|---|
| **New Suspicious Domain** | **New Suspicious Domain** | **Fraudulent Type**, **Rule** |
| **New Fraudulent Domain** | **New Fraudulent Domain Detected** | **Fraudulent Type**, **Rule** |

See [Review suspicious domains](/guide/brp/review-suspicious-domains/).

### Leaked Credentials (Cyber Threat Intelligence, CTI)

| Event | Name in the rules list | Filters |
|---|---|---|
| **New Employee Credential Detected** | **New Employee Credential Detected** | **Username Type** |
| **New Client Credential Detected** | **New Client Credential Detected** | **Username Type** |
| **New Payment Credential Detected** | **New Payment Credential Detected** | **Card Brand**, **BIN** |

See [Cyber Threat Intelligence (CTI)](/guide/cti/).

### Security News (CTI)

| Event | Name in the rules list | Filters |
|---|---|---|
| **New Cybersecurity News** | **New Cybersecurity News** | **Title**, **Source**, **Publish Date From**, **Publish Date To**, **Tags**, **Country**, **Industry**, **Organization**, **CVE Vendor**, **CVE Product**, **CVE ID**, **Featured**, **Threat Actor**, **Related Issue Types** |

## What Each Filter Takes

Every filter is optional. A filter you leave empty does not restrict the rule. To set one, open its chip,
choose a value and select **APPLY** (see
[Create a notification rule](/guide/notifications/create-a-rule/#set-a-filter)).

### Asset Filters

| Filter | Value |
|---|---|
| **Asset** | An asset from your inventory. |
| **Asset Type** | **Domain**, **Subdomain**, **IP Address** or **Website**. |
| **Asset Tags** | One or more of your asset tags. |
| **Creation Method** | How the asset entered your inventory: **Manually Added**, **Manually Approved** or **Auto Approved**. |

### Discovery Filters (New Asset Discovered)

| Filter | Value |
|---|---|
| **Rule Type** | **Smart Discovery**, **Smart Monitoring** or **Custom**. |
| **Rule** | The rule that discovered the asset: **Subdomain**, **Same Whois Registrant Email**, **Same Whois Registrant Email Apex**, **Same Whois Registrant Email Historical**, **Same Whois Registrant Organization**, **Same Whois Registrant Phone**, **Same Whois NS**, **Same DNS A**, **Same DNS NS**, **Same DNS MX**, **Same SSL Subject Organization**, **Same SSL Certificate**, **DNS A**, **DNS CNAME**, **SSL Certificate SAN** or **HTTP Redirection**. |

These are short names of Deepinfo's smart discovery and smart monitoring rules. See
[Review discovered assets](/guide/easm/discovery/).

### Change Filters (Whois, DNS and SSL Changed)

| Filter | Value |
|---|---|
| **Whois Data Changes** | The WHOIS fields whose change should trigger the rule, ticked in a list of fields, for example the registrar, the name servers or the expiry date. |
| **DNS Data Changes** | The DNS record fields whose change should trigger the rule, ticked in a list. |
| **SSL Data Changes** | The certificate fields whose change should trigger the rule, ticked in a list, for example the issuer or the validity end date. |

### Port Filters (New Open Port)

| Filter | Value |
|---|---|
| **Port Protocol** | **TCP**, **UDP** or both. |
| **Port Number** | One or more port numbers, from 1 to 65535. Use **+Add Value** for each extra port. |

### Issue and Vulnerability Filters

| Filter | Value |
|---|---|
| **Severity** | **Critical**, **High**, **Medium**, **Low** or **Information**. |
| **CVE ID** | A CVE ID. |
| **EPSS** | The CVE's EPSS value. |
| **Base Score** | The CVE's CVSS base score. |
| **Base Severity** | **Critical**, **High**, **Medium** or **Low**. |

### Score Filters

| Filter | Value |
|---|---|
| **Unit** | **Absolute** (the default) or **Percentage**. With **Absolute**, you are notified when the score falls below the value in **By**. With **Percentage**, you are notified when the score changes by the percentage in **By**. |
| **By** | The threshold. It starts at 800. |
| **Score** | A score range, **FROM** and **TO**. |

### BRP Filters

| Filter | Value |
|---|---|
| **Fraudulent Type** | **Domain** or **Subdomain**. |
| **Rule** | One of your BRP custom rules, the detection rule that found the domain. See [Set up detection rules](/guide/brp/detection-rules/). |

### Credential Filters

| Filter | Value |
|---|---|
| **Username Type** | **Email** or **Username**: whether the leaked login is an e-mail address or a user name. |
| **Card Brand** | **Visa**, **Mastercard**, **Amex**, **Discover** or **UnionPay**. |
| **BIN** | The card's bank identification number. |

### News Filters

**New Cybersecurity News** offers the filters **Title**, **Source**, **Publish Date From**,
**Publish Date To**, **Tags**, **Country**, **Industry**, **Organization**, **CVE Vendor**, **CVE Product**,
**CVE ID**, **Featured**, **Threat Actor** and **Related Issue Types**.

## How a Rule Shows Its Filters

Click a rule in the list to open its drawer. The **RULES** block lists each filter as a label and a value,
for example **SCORE UNIT:** and **BY:**, **FROM:** and **TO:**, or **EPSS SCORE:** and **BASE SCORE:**.
A rule without filters shows **-**. See
[Manage notification rules](/guide/notifications/manage-rules/#see-a-rules-settings).

## Good to Know

- **Filters cannot be changed after the rule is saved.** To change them, duplicate the rule. See
  [Manage notification rules](/guide/notifications/manage-rules/).
- **Every event has filters,** so the **Filters** step always appears in the popup.
- **Only e-mail is available** for every event.

## Do This With the API

- [Create a notification rule](/reference/platform/notification-rule-create/), where the event is the rule's
  `scope`
- [List sent notification e-mails](/reference/platform/notification-email-list/), which you can filter by event


---

# Manage Notification Rules

URL: https://docs.deepinfo.com/guide/notifications/manage-rules/

Find your notification rules, activate or deactivate them one by one or in bulk, edit their name and recipients, duplicate them and remove them.

All notification rules are listed on the **Notification Rules** screen. From there you can see what each rule
does, switch rules on and off, and change or remove them.

## Before You Start

- **Package:** your organization's package must include Notifications. See
  [Notification Center](/guide/notifications/).
- **Role:** Admin or Member.
- **Data:** at least one rule. To create one, see
  [Create a notification rule](/guide/notifications/create-a-rule/).

## Where to Find It

**Sidebar:** **NOTIFICATION CENTER** · [https://platform.deepinfo.com/app/platform/notification/rules](https://platform.deepinfo.com/app/platform/notification/rules)

## Read the Screen

![The Notification Rules list with the filter bar and the rules table, including active and inactive rules.](/img/guide/notifications/index-02.png)

1. **Notification Rules** and the **CREATE NEW RULE** button.
2. **Filter bar:**
   - **SEARCH:** type part of a rule name and press Enter.
   - **TYPE:** show the rules for an event. The list has every event, in capitals.
   - **FREQUENCY:** **INSTANT**, **DAILY** or **WEEKLY**.
   - **STATUS:** **ACTIVE** or **INACTIVE**.
   - **SORT BY:** see [Sort the list](#sort-the-list).
   - **⋮:** **DEACTIVATE ALL RULES** and **ACTIVATE ALL RULES**.
3. **Table:**

   | Column | Shows |
   |---|---|
   | **STATUS** | An **ACTIVE** / **INACTIVE** switch. Inactive rows are greyed out. |
   | **RULE NAME** | The rule's name |
   | **MEMBERS** | The recipients' e-mail addresses |
   | **SCOPE** | The event, as a coloured chip, for example **Reappeared Issue Detected** |
   | **FREQUENCY** | How often the rule sends, for example **INSTANT** |
   | **CREATE DATE** | When the rule was created, with how long ago below the date |
   | **LAST UPDATE DATE** | When the rule last changed, with how long ago below the date |
   | (last column) | The row menu: **UPDATE RULE**, **DUPLICATE RULE**, **REMOVE RULE** |

The icon in the header of the last column opens **View Options**:

- **Result Per Page:** 25, 50, 75 or 100 rows. The default is 25.
- **Reset to Default View.**
- **SHOWN:** a switch for each column, to hide or show it.

![The TYPE filter open, listing the events you can filter the rules by.](/img/guide/notifications/manage-rules-02.png)
![A rule's row menu open, with UPDATE RULE, DUPLICATE RULE and REMOVE RULE.](/img/guide/notifications/manage-rules-03.png)

## Sort the List

- **Click a column header** to sort by that column. Every column sorts except **MEMBERS**.
- **SORT BY** opens a popover. Choose a field (**Rule Name**, **Scope**, **Active**, **Frequency**,
  **Create Date** or **Last Update Date**), then a direction (**Ascending** or **Descending**), and select
  **APPLY**. The button then shows the field and the direction, **ASC** or **DESC**. **CLEAR** clears the
  choice.

> [!NOTE]
> **SORT BY** › **Create Date** may not reorder the list, even though the button shows the choice. To sort by
> creation date, click the **CREATE DATE** column header instead.

## See a Rule's Settings

Click a rule's row. A drawer opens on the right with:

- **EDIT THIS RULE**, the event chip, for example **NEW ISSUE DETECTED**, and the rule name;
- **OVERVIEW:** **STATUS** (a switch that works like the one in the list), **FREQUENCY**, **ADDED DATE**,
  **LAST UPDATE DATE** and **MEMBERS**, the recipients;
- **RULES:** every filter of the rule, as a label and a value. A rule without filters shows **-**. See
  [Events and filters](/guide/notifications/events-and-filters/#how-a-rule-shows-its-filters).

![The rule drawer with EDIT THIS RULE, the event chip, the OVERVIEW block and the rule's filters under RULES.](/img/guide/notifications/manage-rules-04.png)

## Activate or Deactivate a Rule

1. In the rule's row, click the **STATUS** switch. You can also use **STATUS** in the rule's drawer.
2. In the **Confirmation** dialog, select **UPDATE**.

An inactive rule is kept with all its settings but sends no e-mails.

## Activate or Deactivate Many Rules

1. Filter the list so that it shows the rules you want to change. If needed, raise **Result Per Page** so
   they all fit on one page.
2. Open the **⋮** menu in the filter bar and select **ACTIVATE ALL RULES** or **DEACTIVATE ALL RULES**.
3. The **Confirmation** dialog asks you to confirm the change for all rules in the current results. Select
   **ACTIVE** to activate them, or **DEACTIVE** to deactivate them.

Only the rules on the current page change. Each menu item is unavailable when the list is empty or when every
rule shown already has that status.

![The ⋮ menu open in the filter bar, with DEACTIVATE ALL RULES and ACTIVATE ALL RULES.](/img/guide/notifications/manage-rules-06.png)

## Edit a Rule's Name or Recipients

1. In the rule's row, open the row menu and select **UPDATE RULE**. In the drawer, **EDIT THIS RULE** does
   the same.
2. The **UPDATE NOTIFICATION RULE** popup opens. Change the **RULE NAME**, or add and remove recipients in
   **Add a member**. The rule needs at least one member.
3. Select **UPDATE**.

The event, the frequency and the filters are read-only in this popup. They cannot be changed.

![The UPDATE NOTIFICATION RULE popup, with the event tiles, frequency and filters read-only and the rule name and recipients editable.](/img/guide/notifications/manage-rules-07.png)

## Change a Rule's Event, Frequency or Filters

A saved rule keeps its event, frequency and filters. To change them, make a new rule from the old one:

1. In the rule's row, open the row menu and select **DUPLICATE RULE**.
2. The **CREATE NEW NOTIFICATION RULE** popup opens with the rule's settings filled in. The name starts
   with `NEW - `.
3. Change the event, frequency or filters, and the name if you like.
4. Select **CREATE RULE**.
5. Remove the old rule (below).

## Remove a Rule

1. In the rule's row, open the row menu and select **REMOVE RULE**.
2. The **Remove Rule** dialog asks whether to remove the rule. Select **REMOVE**.

![The Remove Rule dialog asking you to confirm, with CANCEL and REMOVE.](/img/guide/notifications/manage-rules-08.png)

## Good to Know

- **Bulk changes stop at the page.** **ACTIVATE ALL RULES** and **DEACTIVATE ALL RULES** change only the rules
  on the page you are looking at.
- **Deactivate instead of removing** if you may need the rule again: an inactive rule keeps its settings.
- **The FREQUENCY filter has no HOURLY or MONTHLY.** To find those rules, sort the list by the
  **FREQUENCY** column.
- **Recipients are listed in two places:** the **MEMBERS** column and the **MEMBERS** block in the rule's
  drawer.

## Do This With the API

- [List notification rules](/reference/platform/notification-rule-list/)
- [Get one notification rule](/reference/platform/notification-rule-detail/)
- [Update a notification rule](/reference/platform/notification-rule-update/)
- [Delete a notification rule](/reference/platform/notification-rule-delete/)


---

# Glossary

URL: https://docs.deepinfo.com/guide/glossary/

Look up the terms and UI labels used in the Deepinfo Platform and in this guide, and what each one means.

The platform shows many labels in capital letters. This guide quotes them in **bold**, exactly as they appear
on screen, so you can match them. Where the platform uses two names for one thing, the entry says so.

> [!IMPORTANT]
> The platform uses several scores and levels. They cannot be compared with each other:
> - **Security score** (External Attack Surface Management, EASM): a number with a letter grade, **A** from 800 down to **F** from 300.
> - **Risk Score** (Brand Risk Protection, BRP): 0 to 100, in bands from **INFORMATION** to **CRITICAL**.
> - **Risk level** (Cyber Threat Intelligence, CTI): labels from **CRITICAL** to **LOW**.
> - **AVG STRENGTH SCORE** (CTI): the strength of an employee's leaked passwords, out of 10.
> - **CVSS** (**SCORE/SEVERITY**): 0 to 10.
> - **EPSS** and **AVERAGE EXPLOITABILITY SCORE**: percentages.

## Account and Access

| Term | UI labels | Meaning |
|---|---|---|
| Organization | **ORGANIZATION SETTINGS** / **Organization Details** | Your company's account on the platform. Each user belongs to exactly one organization; there is no switching between organizations. |
| Admin, Member | **ADMIN** / **MEMBER** / **SET AS ADMIN** / **SET AS MEMBER** | The roles. Only admins see the organization's **Settings**, **Members** and **Security** pages. See [Manage members and invitations](/guide/settings/members/). |
| Package | **… IS NOT INCLUDED IN YOUR PACKAGE** / **TALK TO US** / "This feed is not included in your package" | What your organization has bought. A screen outside your package is covered by a notice whose **TALK TO US** button opens an e-mail to Deepinfo support. See [What you can access](/guide/basics/packages-and-roles/). |
| API key, default API key | **API Keys** / **Default API Key** / **Set as Default** / **TEAM MEMBER** | A key for calling the Deepinfo API at api.deepinfo.com (demo accounts use a different address; see [Environments & base URL](/getting-started/environments-and-base-url/)). Each key belongs to a member, shown under **TEAM MEMBER**. The default key is marked with a badge and cannot be deleted. The platform also uses it for its own calls to the API. See [Create and manage API keys](/guide/settings/api-keys/). |
| Quota | **QUOTA:** / **USED:** / **REMAINING:** | Your package's allowance for a group of API endpoints. On **API Usage**, the bar and the percentage show the share that remains. The period is not shown. See [Check API usage and quota](/guide/settings/api-usage/). |
| Two-factor authentication, recovery code | **Two Factor Authentication** / **Use a Recovery Code** / **DOWNLOAD CODE AND CLOSE** | A 6-digit code from an authenticator app, asked for at sign-in. Recovery codes let you sign in without the app. Each works once, and you can download them only when you set up two-factor authentication. See [Use two-factor authentication](/guide/basics/two-factor-authentication/). |

## Finding Your Way

| Term | UI labels | Meaning |
|---|---|---|
| Sidebar | Group headings **EXTERNAL ATTACK SURFACE MANAGEMENT** / **CYBER THREAT INTELLIGENCE** / **BRAND RISK PROTECTION** / **DEEP SEARCH & INSIGHTS**; **Collapse sidebar** / **Expand sidebar** | The menu on the left. The module items sit under the coloured module group headings, followed by **REPORTS**, **NOTIFICATION CENTER** and **SETTINGS**. Collapsed, the sidebar shows icons and the short group names **EASM**, **CTI**, **BRP** and **DSI**. See [Find your way around](/guide/basics/navigation/). |
| Breadcrumb | For example **EASM / ISSUES / ISSUE LIST** | The path at the top left of every page, from the module to the page you are on. |
| In-page tabs | **OVERVIEW**, then a list tab such as **ISSUE LIST**, then **INSIGHTS** or **SETTINGS** | Tabs under a page's title. **OVERVIEW** holds the key figures, the list tab holds the records, **INSIGHTS** holds charts and distributions, and **SETTINGS** holds the area's settings. |

## Lists and Records

| Term | UI labels | Meaning |
|---|---|---|
| Quick view, list view | Two icons: an eye and a list | The two layouts of a list: a split pane with the list on the left and the selected record on the right (quick view), or a table (list view). |
| Drawer | **OPEN IN NEW TAB** | A panel that opens on the right with a record's details. Its tabs are icons down its left side; hover over an icon to see its name. **OPEN IN NEW TAB** opens the record's full page. |
| Filter, filter rule | Filter chips; **SHOW ALL FILTERS** / **HIDE FILTERS**; **Must** / **Must Not** / **Should** | Filters sit above a list as chips. A chip opens a popover where you choose a field, a rule, an operator and a value. The rule includes (**Must**), excludes (**Must Not**) or prefers (**Should**) matching records. API search filters use the same model; see [Search & filters](/getting-started/search-and-filters/). |
| View options | **VIEW SETTINGS** / **View Options** / **Sort By** / **Result Per Page** / **Reset to Default View** / **SHOWN** | A list's display settings: the sort order, the number of rows per page and which columns are shown. |
| Export, export scope | **EXPORT** / **DOWNLOAD** / **RECORDS** (**ALL** / **FILTERED**) / **FILE FORMAT** (**CSV** / **JSON**) / **EXPORT SCOPE** (**DEFAULT** / **BASIC** / **EXTENDED**) | Download a list as a CSV or JSON file: every record, or only the records that match your filters. Some lists also let you choose an export scope. See [Search, filter and export lists](/guide/basics/lists-filters-and-exports/). |

## Assets

| Term | UI labels | Meaning |
|---|---|---|
| Asset | Tabs **DOMAINS** / **SUBDOMAINS** / **IP ADDRESSES** / **WEBSITES**; filter values **Domain** / **Subdomain** / **IP Address** / **Website** | Something you monitor: a domain, a subdomain, an IP address or a website. A website's name includes its port (`host:port`). See [Browse your asset inventory](/guide/easm/asset-inventory/). |
| Inventory ("portfolio") | **Inventory** / **Add to Portfolio** / "… in your portfolio" | Your monitored assets. Where the platform says "portfolio", it means the same thing. |
| Main asset | **MAIN ASSET** / **SET AS MAIN ASSET** / **REVERT TO NORMAL ASSET** | An asset you mark as main. The platform describes it as "the primary asset for all related assets, configurations, and reports." |
| Seems inactive | **SEEMS INACTIVE** / **THIS … IS CURRENTLY INACTIVE** | The platform's message says it found no active DNS records or WHOIS information for the asset; for a subdomain, no DNS records. |
| Parked, Redirected, Login page, IDN | **Parked** / **Redirected** / **Login Page** / **IDN:** | Icons next to an asset's name. The **Parked** and **Redirected** tooltips show the name the asset redirects to. **Login Page** means the asset has a login page. **IDN:** marks an internationalized name and shows its punycode form. Parked assets are shown muted in tables. |
| Asset weight | **ASSET WEIGHT** / **SYSTEM WEIGHT** / **NEW WEIGHT** / **SET ASSET WEIGHT** | How important an asset is to your organization. The system calculates a **SYSTEM WEIGHT**, which can be above 100. With **SET ASSET WEIGHT** you can set your own weight, from 1 to 100. The weight affects your organization's security score. |
| Security score, rating | **SECURITY RATING** / **SCORE** / **A** to **F** | The EASM security score and its letter grade: **A** from 800, **B** from 700, **C** from 600, **D** from 500, **E** from 400 and **F** from 300. Below 300, or without a score, the grade shows `-`. See [How security scores work](/guide/easm/security-score/). |
| Scan | **SCAN NOW** / **START PORT SCAN** / **LAST CHECK DATE** | An on-demand rescan of an asset (**SCAN NOW**) or of its ports (**START PORT SCAN**). **LAST CHECK DATE** shows when the asset was last checked. On an asset's page, **SCAN NOW** is unavailable for 5 minutes after a manual scan. |
| Historical records | **SHOW HISTORICAL … RECORDS** / **Compare Dates (Up to 3 Records)** | Earlier snapshots of an asset's WHOIS, DNS, SSL, website info and open ports. You can compare up to three dates side by side. |
| Expiry status | **ACTIVE** / **EXPIRES SOON** / **EXPIRED** / **INVALID CERTIFICATE** | The status of an SSL certificate or a domain registration: more than a month left, less than a month left, expired, or an invalid certificate. |
| Port state | **OPEN** / **OPEN FILTERED** / **CLOSED** / **CLOSED FILTERED** / **FILTERED** / **UNFILTERED** | The state of a scanned port. The **OPEN PORTS** tab shows open ports by default. |
| Creation method | **MANUALLY ADDED** / **MANUALLY APPROVED** / **AUTO APPROVED** | How an asset entered your inventory. |

## Discovery

| Term | UI labels | Meaning |
|---|---|---|
| Discovery, discovered asset | **DISCOVERED ASSETS** / **IN REVIEW** / **APPROVED** / **IGNORED** / **ADD TO MY ASSETS** / **IGNORE** / **UNDO IGNORE** | A discovered asset is a candidate that discovery rules found around your attack surface. It stays **IN REVIEW** until it is approved into your assets (with **ADD TO MY ASSETS**, or automatically by **Auto Approval**) or ignored. **UNDO IGNORE** reverses an ignore. See [Review discovered assets](/guide/easm/discovery/). |
| Smart and custom discovery rules | **SMART DISCOVERY RULES** / **SMART MONITORING RULES** / **Custom Rules** | Smart rules are managed by Deepinfo; you can switch them on or off and tune them. Custom rules are discovery rules you build from filters. All of them are on the **SETTINGS** tab of **DISCOVERY**. |
| Seed asset, seed value | **MANAGE EXCLUDED SEED ASSETS** / **MANAGE EXCLUDED SEED VALUES** | The assets and values a smart rule starts from. A rule skips the seeds you exclude. |
| Auto approval | **Auto Approval** / **AUTO APPROVAL** | On a discovery rule: assets in review that match the rule are approved automatically. On a BRP detection rule: suspicious domains that match the rule are marked as fraudulent automatically. |
| Global Blacklist | **Global Blacklist** | A list that Deepinfo's data team manages and updates. It excludes generic values to reduce false-positive discoveries. |
| Ignored Assets (discovery) | **Ignored Assets** | A list in the discovery settings. Domains, subdomains and IP addresses on it never appear in discovery lists, even when a rule finds them. |

## Issues and Vulnerabilities

| Term | UI labels | Meaning |
|---|---|---|
| Issue type, issue | **ISSUES** / **GROUP BY ISSUE TYPES** | An issue type is a kind of finding, such as an expired SSL certificate. An issue is one issue type found on one asset. The issue list is grouped by issue type by default. See [Triage issues](/guide/easm/issues/). |
| Issue category | **CATEGORY** / **CATEGORY STATS** | A group of related issue types. |
| Severity | **CRITICAL** / **HIGH** / **MEDIUM** / **LOW** / **INFORMATION** | The severity levels of issue types and issues. |
| State | **ACTIVE**: **NEWLY DETECTED** / **UNRESOLVED** / **REAPPEARED**; **INACTIVE**: **NOT APPLICABLE** / **VERIFIED RESOLVED** / **IGNORED** / **RISK ACCEPTED** / **MARKED AS RESOLVED** / **MARKED AS FALSE POSITIVE**; **SHOW INACTIVES** | Where an issue, or a CVE on one asset, stands. The states are grouped as active or inactive. The platform sets **NEWLY DETECTED**, **UNRESOLVED**, **REAPPEARED**, **NOT APPLICABLE** and **VERIFIED RESOLVED**. Users set the others. Lists show only active records until you tick **SHOW INACTIVES**. See [Change the state of issues and vulnerabilities](/guide/easm/change-issue-state/). |
| State actions | **CHANGE STATUS** / **IGNORE** / **ACCEPT RISK** / **MARK AS RESOLVED** / **MARK AS FALSE POSITIVE** / **REVERT IT** / **UNDO** / **CHANGE STATE** / **CHANGE ALL STATUS** | The actions that set a user state, on one record or in bulk. Only states set by a user can be reverted. A change shows a few seconds after you confirm it. |
| Active days | **ACTIVE DAYS** | The days between an issue's first and last detection, not its age up to today. After 30 days the value turns red with a fire icon. |
| Issue duration, fix duration, issue age | **AVERAGE ISSUE DURATION** / **AVERAGE FIX DURATION** / **AVERAGE ISSUE AGE** | Averages, in days. |
| Proof | **PROOF** | The evidence for an issue, shown as JSON. |
| Classifications | **CLASSIFICATIONS** | The compliance frameworks an issue type maps to, such as OWASP Top 10 2021, PCI 3.2, CAPEC, CWE, HIPAA and WASC. |
| Vulnerability (CVE), asset vulnerability | **VULNERABILITIES** / **CVE ID** | A CVE that affects at least one of your assets. Its state is changed per asset, not for the CVE as a whole. See [Prioritize vulnerabilities](/guide/easm/vulnerabilities/). |
| Certain, Potential | **CERTAIN** / **POTENTIAL** | Certain: "This vulnerability has been verified through testing and confirmed as valid." Potential: "This vulnerability has been identified through testing but not yet confirmed." |
| CVSS score | **SCORE/SEVERITY** / **CVSS SCORE** | The CVE's CVSS base score, from 0 to 10, with its severity. CVSS v3 is used, or v2 when v3 is missing. |
| EPSS | **EPSS** / **EPSS SCORE** | The CVE's EPSS value, shown as a percentage. |
| Exploitable (CISA KEV) | **EXPLOITABLE** / **EXP.** / **CISA KEV CATALOG** | Shown when the CVE is in the CISA KEV catalog. |
| Classification chips | **C/I/A: H/L/N** / **OWASP …** | **C/I/A** shows the CVE's impact on confidentiality, integrity and availability, as the first letter of each impact level. **OWASP** shows its OWASP category. |
| New vulnerability | **NEW** | "This vulnerability was first detected on your assets in the last 7 days." |
| Technology version | **LATEST VERSION** / **VERSION SCOPE** (**Out of Date**) / **EOL** | The latest known version of a technology, a filter for technologies on an out-of-date version, and the product's end-of-life table. |

## Cyber Threat Intelligence (CTI)

| Term | UI labels | Meaning |
|---|---|---|
| Compromised employee | **COMPROMISED EMPLOYEE DATA** / **COMPROMISED EMPLOYEES** | An employee account on your domains that was found in leaked credential data. See [Investigate compromised employees](/guide/cti/compromised-employees/). |
| Exposed credential | **EXPOSED CREDENTIALS** / **CREDENTIAL** / **SHOW PASSWORD** | One leaked login of an employee: the site or service, the account and the password. Passwords are masked until you reveal them with **SHOW PASSWORD** or the eye icon; revealing shows the password in plain text in your browser. See [Review exposed credentials](/guide/cti/credential-exposures/). |
| Credential state | **STATE**, for example **ACTIVE · UNRESOLVED** or **ACTIVE · NEWLY DETECTED**; **IGNORED** / **RISK ACCEPTED** / **MARKED AS RESOLVED** / **MARKED AS FALSE POSITIVE**; **CHANGE STATE** / **CHANGE ALL STATES** / **REVERT STATE**; **SHOW INACTIVES** | Where an exposed credential stands: **ACTIVE** or **INACTIVE**, with a detail, like an issue state. You can ignore a credential, accept its risk, or mark it as resolved or as a false positive, one at a time or in bulk; these states are inactive. **REVERT STATE** undoes a state you set. Inactive credentials are hidden until you tick **SHOW INACTIVES**. Client and payment credentials have a **STATE** too. See [Change the state of exposed credentials](/guide/cti/change-credential-state/). |
| Compromised client credential | **COMPROMISED CLIENT CREDENTIALS** / **COMPROMISED CLIENTS** | A login of one of your clients or customers that was found in breach data: the username and the site it belongs to. The list does not show passwords. See [Review compromised client credentials](/guide/cti/compromised-client-credentials/). |
| Compromised payment credential | **COMPROMISED PAYMENT CREDENTIALS** / **COMPROMISED PAYMENTS** / **PAN** / **CONFIDENCE** / **TIMES SEEN** | A payment card that was found in breach data. The list shows the card number (**PAN**), **CONFIDENCE**, **SOURCE**, **HACKISHNESS**, **TIMES SEEN**, **STATE** and **LAST SEEN**. See [Review compromised payment credentials](/guide/cti/compromised-payment-credentials/). |
| Risk level (CTI) | **CRITICAL** / **HIGH** / **MEDIUM** / **LOW** | An employee's priority. The platform describes it as "Composite priority based on credential, role, and recency." |
| Password strength | **VERY WEAK** / **WEAK** / **MEDIUM** / **STRONG** / **VERY STRONG**; **AVG STRENGTH SCORE** | A five-level strength label for a leaked password. **AVG STRENGTH SCORE** is the average strength of an employee's passwords, out of 10. |
| Exposure velocity, trend | **VELOCITY** / **TREND** / **EXPOSURE SPAN** | Part of an employee's security profile, which shows "how long the exposure has run and whether the rate is rising." **VELOCITY** is in credentials per month (`cred/mo`); **TREND** shows the direction, for example **STABLE**. |
| Executive | **Is Executive** / **EXECUTIVE** | A flag you set on an employee. Executives are shown with a VIP icon. |
| Target service attributes | **CORPORATE** / **MFA BY DEFAULT** (**ENFORCED** / **NOT ENFORCED**) / **RISK TIER** | Properties of the site or service a leaked credential belongs to. |
| Hackishness | **HACKISHNESS** / **Hackishness** | A score shown on dark-web search results and on compromised payment records. |
| Dark-web source | **SOURCE TYPE** / **SOURCE GROUP** | Where a dark-web result comes from: the type, such as Discord, Onion or Telegram, and the group, such as Forums, Markets or Pastes. See [Search the dark web](/guide/cti/dark-web-search/). |

## Brand Risk Protection (BRP)

| Term | UI labels | Meaning |
|---|---|---|
| Suspicious domain | **SUSPICIOUS DOMAINS** | A lookalike domain that your detection rules found. It waits for your review. See [Review suspicious domains](/guide/brp/review-suspicious-domains/). |
| Fraudulent domain | **FRAUDULENT DOMAINS** / **MARK AS FRAUDULENT** / **REMOVE FROM FRAUDULENT DOMAINS** | A suspicious domain you confirmed as fraudulent. It moves to the **FRAUDULENT DOMAINS** tab. See [Track fraudulent domains](/guide/brp/fraudulent-domains/). |
| Ignored domain | **IGNORED DOMAINS** / **UNDO IGNORE** | A suspicious domain you dismissed. **UNDO IGNORE** restores it. See [Restore ignored domains](/guide/brp/ignored-domains/). |
| Risk Score (BRP) | **RISK SCORE** / **INFORMATION** / **LOW** / **MEDIUM** / **HIGH** / **CRITICAL** | A score from 0 to 100 for a detected domain, in bands: **INFORMATION** from 1 to 20, **LOW** above 20 up to 40, **MEDIUM** above 40 up to 60, **HIGH** above 60 up to 80, **CRITICAL** above 80. It is not on the same scale as the security score. |
| Indicators | **DNS** / **DNS MX** / **SSL** / **HTTP** | Four signals shown for a detected domain. An icon is dark when the signal is present and light when it is not. |
| Match type | **Exact** / **Contains** / **Fuzzy** / **Fuzzy Contains** / **Confusable Exact** / **Confusable Contains** / **Confusable Fuzzy** / **Confusable Fuzzy Contains** | How a detection rule matches its keyword against domain names. The default is **Contains**. |
| Keywords and TLDs | **KEYWORD** / **HELPER KEYWORDS** / **NEGATIVE KEYWORDS** / **TLD MUST BE** / **TLD MUST NOT BE** | The inputs of a BRP detection rule. **KEYWORD** is required and has at least 3 characters. **TLD MUST BE** and **TLD MUST NOT BE** take extensions from a fixed list. See [Set up detection rules](/guide/brp/detection-rules/). |
| Start detection | **From Now On** / **Include Past** | Whether a new detection rule starts from now (**From Now On**, the default) or also covers the past (**Include Past**). It cannot be changed after the rule is created. |
| Ignored Assets (BRP) | **Ignored Assets** | A list in the BRP settings. Domains and subdomains on it never appear as detected, even when a detection rule matches them. |

## Deep Search & Insights (DSI)

| Term | UI labels | Meaning |
|---|---|---|
| DSI | **DEEP SEARCH & INSIGHTS** / **DSI** | The sidebar group of search and research tools: **DOMAIN INTELLIGENCE**, **DOMAIN SEARCH**, **VULNERABILITY INTELLIGENCE**, **VULNERABILITY SEARCH**, **INSTANT LOOKUP** and **FEEDS**. Its breadcrumbs start with **DSI**, which is also its short name in the collapsed sidebar. See [Deep Search & Insights (DSI)](/guide/dsi/). |
| Page tabs | **Duplicate** / **New Tab to The Right** / **Close Tab** / **Close Other Tabs** / **Close Tabs to the Right** | Browser-like tabs in Domain Search, Vulnerability Search, Instant Lookup and Dark Web Search. They are saved in your browser, so they survive a reload. |
| Reverse lookup | **SEE OTHERS** / **Domain with same IP Address** / **Domain with same Name Server** / **Domain with same Mail Exchanger** / **Domain with same Email** | Other domains that share an IP address, name server, mail server or registrant e-mail with the domain you are looking at. See [Domain details and reverse lookups](/guide/dsi/domain-details/). |
| Instant lookup | **LOOKUP** / **PARSED** / **RAW** | A real-time query about a single target: WHOIS, DNS, SSL, webdata, technology, screenshot or port scan. **PARSED** and **RAW** switch between the formatted result and the JSON. See [Run instant lookups](/guide/dsi/instant-lookup/). |
| Feeds | **DAILY FEEDS** / **EXCLUSIVE FEEDS** / **CUSTOM FEEDS** | Bulk data files you can download, such as the domains registered each day. See [Download data feeds](/guide/dsi/feeds/). |

## Reports and Notifications

| Term | UI labels | Meaning |
|---|---|---|
| General report, CSV/JSON report | **GENERAL REPORTS** / **CSV AND JSON REPORTS** / **.PDF** | A general report is a PDF that the platform generates from your data. A CSV/JSON report downloads a whole dataset as a file. See [Reports](/guide/reports/). |
| Reports history | **REPORTS HISTORY** | The copies of a report type generated so far, listed in the report's drawer. Each copy is a snapshot of your data at the time it was generated. |
| Scheduled report | **SCHEDULED REPORTS** / **SCHEDULE A REPORT** / **SCHEDULE NEW REPORT** | A PDF report that the platform generates daily, weekly or monthly and e-mails to the members you choose. See [Schedule a report](/guide/reports/schedule-a-report/). |
| Notification rule | **Notification Rules** / **Event Type** / **Rule Settings** / **Filters** / **Reviews** / **SCOPE** | A rule that e-mails chosen members when an event happens. It has one event, optional filters, a frequency and at least one recipient. The rules list shows the event in the **SCOPE** column. See [Notification Center](/guide/notifications/). |
| Frequency | **INSTANT** / **HOURLY** / **DAILY** / **WEEKLY** / **MONTHLY** | How often a notification rule sends e-mails. Scheduled reports offer **DAILY**, **WEEKLY** and **MONTHLY**. |
| Delivery channel | **Email** / **Slack** / **Webhook** | How a rule's notifications are delivered. Only **Email** can be used; **Slack** and **Webhook** are shown but not available. |
| E-mail preferences, notification rules | **SETTINGS** › **USER SETTINGS** › **Notifications** vs **NOTIFICATION CENTER** | E-mail preferences choose which Deepinfo e-mails you receive: announcements, newsletter, product updates and training. Notification rules send alerts about your organization's data. See [Choose which Deepinfo e-mails you receive](/guide/settings/email-preferences/). |


---

# Changelog

URL: https://docs.deepinfo.com/changelog/

What changed in the Deepinfo API, the Deepinfo Platform and this documentation, newest first.

Atom feed: https://docs.deepinfo.com/changelog/feed.xml

- 2026-10-05: [The New Deepinfo Documentation Site](/changelog/the-new-documentation-site/) (API, Docs). docs.deepinfo.com now documents every API endpoint, generated from the Deepinfo Postman collection, with Getting Started guides, search and a Markdown version of every page.
- 2026-09-27: [Operator Support per Field](/changelog/operator-support/) (API, Docs). Search endpoints now list their searchable fields grouped by the operators each field accepts, measured against the API, and the docs show the forms a filter error takes.
- 2026-09-24: [A Guide to the Deepinfo Platform](/changelog/platform-guide/) (Platform, Guide). A new section of the documentation explains the Deepinfo Platform screen by screen, from your first sign-in to reports and notification rules.
- 2026-09-23: [Rate Limits per Endpoint and Rate-Limit Headers](/changelog/rate-limits/) (API, Docs). Rate limits apply per API key and per endpoint, default to 1 request per second, and responses report them in ratelimit headers.
- 2026-09-23: [Production and Demo Environments](/changelog/production-and-demo-environments/) (API, Platform, Docs). The documentation now states which addresses each account uses, and the Environment switch in the API Reference sidebar shows every example with the Demo addresses.
- 2026-09-23: [Port Scan Is Documented as a POST Request](/changelog/port-scan-post/) (API, Docs). The Port Scan lookup is documented as POST /lookup/port-scan, with the scan options in a JSON body; the previous documentation showed a GET request.
- 2026-09-23: [Both Error Formats Documented](/changelog/error-formats/) (API, Docs). Gateway errors and application errors have different JSON bodies; the Errors page describes both, with a request and response for each status code.


---

# The New Deepinfo Documentation Site

URL: https://docs.deepinfo.com/changelog/the-new-documentation-site/

docs.deepinfo.com now documents every API endpoint, generated from the Deepinfo Postman collection, with Getting Started guides, search and a Markdown version of every page.

Date: 2026-10-05 · Tags: API, Docs

The Deepinfo documentation has a new site. The API reference is generated from the Deepinfo Postman
collection, so every endpoint, parameter and example on it comes from one source.

## What's New

- **[API Reference](/reference/)**: every endpoint, module by module (Lookup, Discovery, Darkweb,
  Vulnerability, Domain Intelligence, Feeds, External Attack Surface Management (EASM), Cyber Threat Intelligence (CTI), Brand Risk Protection (BRP) and Platform). Every endpoint page lists its
  parameters and, where they apply, its request body and response fields, shows at least one saved
  example response, and has code you can run in curl, Python, JavaScript and Go.
- **[Getting Started](/getting-started/)**: pages on authentication, environments and the base URL,
  rate limits, pagination, search filters and errors.
- **Search** across the documentation, and a dark theme that follows your system setting or your own
  choice.
- **Markdown for tools and AI assistants**: replace the trailing `/` of a page URL with `.md` to get its
  Markdown version, for example `/getting-started/errors.md` for `/getting-started/errors/`.
  [llms.txt](/llms.txt) lists every page, and [llms-full.txt](/llms-full.txt) has all of them in one file,
  without the examples.

Links to the previous documentation site keep working: they redirect to the matching endpoint page where
one exists, and to the related section otherwise. Endpoints the API no longer offers are not documented:
Domain Availability, the DMA registration monitors, and the domain extractor, IP extractor and Punycode
converter utilities. Their old pages redirect to the closest section.


---

# Operator Support per Field

URL: https://docs.deepinfo.com/changelog/operator-support/

Search endpoints now list their searchable fields grouped by the operators each field accepts, measured against the API, and the docs show the forms a filter error takes.

Date: 2026-09-27 · Tags: API, Docs

Which filter operators a search field accepts is set per field, and the field's type does not tell you.
The reference now shows it for each field.

- **Fields grouped by operator.** On each search endpoint's reference page, **Filtering** lists the
  searchable fields grouped by the operators they accept. The groups come from measurement: each operator
  was sent to each field against the API. [Search & Filters](/getting-started/search-and-filters/#which-operators-a-field-accepts)
  explains the groups and links the **Filtering** section of each search.
- **Fields that could not be measured.** `website.parent_asset.type` in Asset Search, and
  `source_format` and `network` in Compromised Payment Credential Search, take a value from a fixed list.
  The API's error message does not name the values they accept, and the demo account used for the
  measurement had no records that use them. These fields are listed under **Operators: not measured**, on the search and on
  its exports and bulk actions.
- **`gt` and `lt` as a filter `type`: Vulnerability Search only.** [Vulnerability Search](/reference/vulnerability/search/)
  of the CVE database accepts `gt` and `lt` on each of its date and number fields and on `id`. Every other
  search with `must`, `should` and `must_not` lists returns 400 for them, so use `gte` and `lte` there.
  The operators do exist elsewhere in the API: the
  [searches with another filter format](/getting-started/search-and-filters/#searches-with-another-filter-format)
  take `gt` and `lt` as keys of a range filter, and
  [Email Breach List](/reference/cti/email-breach-list/), a
  [list endpoint](/getting-started/search-and-filters/#list-endpoints), as the `__gt` and `__lt` suffixes.
- **Request templates.** Each of these searches, with its exports and bulk actions, shows a
  **Request Template** among its examples: a request body with the endpoint's filters, an operator each
  field accepts and placeholder values, ready to copy. A template is a request only, without a response.
- **Filter errors.** An operator that a field does not accept returns 400, and today the message comes
  back in one of three forms, depending on the endpoint. One of them uses code `30004`, which also stands
  for a state change that is not allowed. An operator the search does not know at all, such as `gt` outside
  Vulnerability Search of the CVE database, returns 400 with `Select a valid choice.` for the filter's `type`. A value of the
  wrong type returns 400 with a message of its own.
  [Search & Filters](/getting-started/search-and-filters/#filter-errors) shows each one with the filter
  behind it, and [Errors](/getting-started/errors/#filter-errors) lists them with the other error codes.
- **The other filter format.** [Search & Filters](/getting-started/search-and-filters/#searches-with-another-filter-format)
  now names every search that takes `filters` as an object with one key per field: the technology
  searches, the custom discovery rule search, the fraudulent rule search and Report Search.


---

# A Guide to the Deepinfo Platform

URL: https://docs.deepinfo.com/changelog/platform-guide/

A new section of the documentation explains the Deepinfo Platform screen by screen, from your first sign-in to reports and notification rules.

Date: 2026-09-24 · Tags: Platform, Guide

The new [Platform guide](/guide/) explains the Deepinfo Platform, the web application your security team
works in: what each screen shows, how to read it and what you can do there.

- [Getting started with the platform](/guide/basics/): signing in, two-factor authentication, finding your
  way around, and the list, filter and export controls that every module shares.
- [Account and workspace](/guide/settings/): your own account, your organization's API keys, API usage and
  API logs and, for admins, the organization's name, logo, members and two-factor requirement.
- [Global dashboard](/guide/global-dashboard/), [External Attack Surface Management (EASM)](/guide/easm/), [Cyber Threat Intelligence (CTI)](/guide/cti/),
  [Brand Risk Protection (BRP)](/guide/brp/) and [Deep Search & Insights (DSI)](/guide/dsi/): what each module shows and what you can do there.
- [Reports](/guide/reports/) and the [Notification Center](/guide/notifications/).
- A [glossary](/guide/glossary/) of the terms and UI labels used in the platform.

Many pages end with a **Do This With the API** section that links to the matching API endpoints.

The previous documentation site's workspace pages, on organization and members, API keys, API usage and
API logs, now redirect to the matching pages of this guide.


---

# Rate Limits per Endpoint and Rate-Limit Headers

URL: https://docs.deepinfo.com/changelog/rate-limits/

Rate limits apply per API key and per endpoint, default to 1 request per second, and responses report them in ratelimit headers.

Date: 2026-09-23 · Tags: API, Docs

Rate limits depend on your plan and apply **per API key and per endpoint**. Unless your plan says
otherwise, the default is **1 request per second**.

Responses tell you where you stand. For the current window:

- `ratelimit-limit`
- `ratelimit-remaining`
- `ratelimit-reset`

For each window configured on your plan:

- `x-ratelimit-limit-second`
- `x-ratelimit-limit-minute`
- `x-ratelimit-limit-hour`
- `x-ratelimit-remaining-second`
- `x-ratelimit-remaining-minute`
- `x-ratelimit-remaining-hour`

Over the limit, the API returns **429 Too Many Requests**. Wait `ratelimit-reset` seconds before you
retry. Some endpoints, such as lookups, also count against a quota on your plan: one unit per request.

See [Rate limits](/getting-started/rate-limits/) and the
[429 example](/getting-started/errors/#429-rate-limit-exceeded).


---

# Production and Demo Environments

URL: https://docs.deepinfo.com/changelog/production-and-demo-environments/

The documentation now states which addresses each account uses, and the Environment switch in the API Reference sidebar shows every example with the Demo addresses.

Date: 2026-09-23 · Tags: API, Platform, Docs

Deepinfo runs a Production and a Demo environment, and every account belongs to one of them:

- **Production**, for paid customer accounts: the platform at platform.deepinfo.com and the API at
  api.deepinfo.com/v1.
- **Demo**, for demo accounts: the platform at platform.deepinfodemo.com and the API at
  api.deepinfodemo.com/v1.

The examples on this site use the Production addresses. With a demo account, choose **Demo** in the
**Environment** switch at the top of the API Reference sidebar: code examples and platform links then show the Demo addresses,
and **Copy** copies them as shown. Your choice is remembered in this browser.

The details, including the Postman variables, are on
[Environments & base URL](/getting-started/environments-and-base-url/).


---

# Port Scan Is Documented as a POST Request

URL: https://docs.deepinfo.com/changelog/port-scan-post/

The Port Scan lookup is documented as POST /lookup/port-scan, with the scan options in a JSON body; the previous documentation showed a GET request.

Date: 2026-09-23 · Tags: API, Docs

[Port Scan](/reference/lookup/port-scan/) is documented as a `POST` request. The host goes in the `target`
query parameter, and the scan options go in a JSON body:

```bash
curl -X POST "https://api.deepinfo.com/v1/lookup/port-scan?target=deepinfo.com" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tcp_ports": "80,443", "mode": "light", "version": true}'
```

`tcp_ports` takes a list (`"80,443"`), a range (`"440-445"`) or both. Without it, the default port set of
`mode` is scanned. The reference page lists the other options and the response fields.

The previous documentation site showed this lookup as a `GET` request. Send it as `POST`, as documented.


---

# Both Error Formats Documented

URL: https://docs.deepinfo.com/changelog/error-formats/

Gateway errors and application errors have different JSON bodies; the Errors page describes both, with a request and response for each status code.

Date: 2026-09-23 · Tags: API, Docs

Errors from the Deepinfo API come in one of these formats, depending on where the request stopped:

- **Gateway errors** cover authentication, plan access, rate limiting and unknown URLs (401, 403, 404,
  429). Their body has `message` and `request_id`.
- **Application errors** cover invalid input, missing resources and unexpected errors (400, 404, 500).
  Their body has `code`, `details`, `parameters` and `solution`.

Error responses also carry a `deepinfo-request-id` header. The `request_id` in a gateway error body is a
different value, so include both when you contact support.

A few errors are not JSON: when a very large export runs too long, the request ends with **502 Bad
Gateway** and a plain-text body. Narrow large exports with filters to avoid it.

[Errors](/getting-started/errors/) lists the messages and codes, with an example request and response for
each one.