# Asset Search

POST /easm/assets/search: Searches your monitored assets with filters and sorting. An empty body {} returns all assets.

Source: https://docs.deepinfo.com/reference/easm/asset-search/

Last updated: 2026-09-27

---
`POST https://api.deepinfo.com/v1/easm/assets/search`

Searches your monitored assets with filters and sorting. An empty body `{}` returns all assets. See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the filter syntax; `name` accepts every searchable asset field (see [Filtering](#ref-filtering)).

## Authentication

Send your API key in the `apikey` request header.

## Query Parameters

| Parameter | Required | Description | Example |
|---|---|---|---|
| `page_size` | Optional | Min `25`, max `100`. Default `100`. | `25` |
| `page` | Optional | Min `1`, max `800`. Default `1`. | `1` |

## Request Body

| Parameter | Type | Required | Description |
|---|---|---|---|
| `filters` | object | Optional | See [Filtering](#ref-filtering) below |
| `sort` | array | Optional | List of `{field, order}` |

```json
{}
```

## Filtering

Example body:

```json
{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}
```

See [Getting Started → Search & Filters](/getting-started/search-and-filters/) for the operators.

The Request Template example holds this body with some of the filters of this endpoint, one entry per field, each with an operator the field accepts and a placeholder value; Searchable Fields lists them all. Copy it, keep the filters you need and set their values.

### Searchable Fields

Grouped by the operators they accept (measured against the API; sending another operator returns 400).

Operators: `eq`, `in`, `startswith`, `endswith`, `wildcard`, `fuzzy`, `contains_any`, `contains_all`, `exists`

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `tags` | Your own labels on the asset, such as a business unit or an environment; each tag is 3 to 100 characters long. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.name.unicode` | The host name without its extension, in Unicode: `acme` for `acme.example`, `www.acme` for `www.acme.example`. |
| `fqdn.name.latinized` | Latin-letter spellings of a name that has non-Latin or accented letters, so a search for `istanbul` also finds names written with `İ`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_sub.unicode` | The second-level part of a two-part extension, such as `co` in `co.uk`; empty for single-part extensions. |
| `website.path` | The URL path of a website asset, such as `/`. |
| `website.scheme` | The URL scheme of a website asset, such as `http`. |
| `website.parent_asset.id` | The ID of the domain or subdomain asset that a website asset belongs to. |
| `website.parent_asset.name` | The name of the domain or subdomain asset that a website asset belongs to. |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.name` | The registrant's name in WHOIS; often a privacy placeholder such as `redacted for privacy`. |
| `whois.registrant.country` | The registrant's country in WHOIS, as a two-letter code in lower case such as `us`. |
| `whois.registrant.state` | The registrant's state or province in WHOIS. |
| `whois.registrant.city` | The registrant's city in WHOIS. |
| `whois.registrant.street` | The registrant's street address in WHOIS. |
| `whois.registrant.postal_code` | The registrant's postal code in WHOIS. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `whois_registrant_email_historical` | Every registrant e-mail address seen for the domain over time, the current one included. |
| `whois_normalized.registrar` | The registrar reduced to a short normalized name, such as `godaddy` or `gandi`, so the same registrar matches across spellings. |
| `whois_normalized.registrant.email` | The registrant e-mail address after WHOIS normalization. |
| `whois_normalized.registrant.email_real` | Another normalized registrant e-mail field, set on fewer domains than `whois_normalized.registrant.email`; in the samples it is set only where `whois_privacy_enabled` is false, with the same address. |
| `whois_normalized.registrant.email_domain_apex` | The registrable domain of the registrant e-mail address: `acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.email_fqdn_apex` | The full host name after the `@` of the registrant e-mail address: `mail.acme.example` for `user@mail.acme.example`. |
| `whois_normalized.registrant.organization` | The registrant organization cleaned up across registrars: lower case, with spaces and punctuation removed, such as `domainsbyproxyllc`. |
| `whois_normalized.registrant.phone` | The registrant phone number reduced to its digits, such as `14805551234`. |
| `whois_last_change_data` | The WHOIS fields that changed in the last change seen, as field paths such as `whois.update_date` or `whois.domain_status`. |
| `dns.a.value` | The asset's current A records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.a.value_previous` | The asset's A records as they were before the last change, in the same text form as `dns.a.value`. |
| `dns.a.rcode` | The DNS response code returned for the asset's A lookup, such as `NOERROR`. |
| `dns.a.rcode_previous` | The DNS response code of the A lookup before it last changed. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.entities` | The handles of the registry contacts and organizations linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, when it is kept. |
| `dns.a.ip_addresses.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address. |
| `dns.a.ip_addresses.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the A-record address. |
| `dns.a.ip_addresses.raw` | The raw IP WHOIS response for the A-record address, when it is kept; empty on every sampled asset. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.a.ip_addresses.network.start_address` | The first address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.end_address` | The last address of the registered network block that contains the A-record address. |
| `dns.a.ip_addresses.network.handle` | The registry handle of the network that contains the A-record address, such as `NET-192-0-2-0-1`. |
| `dns.a.ip_addresses.network.ip_version` | The IP version of the network that contains the A-record address: `v4` or `v6`. |
| `dns.a.ip_addresses.network.links` | Links to the registry record of the network that contains the A-record address, such as its RDAP and WHOIS URLs. |
| `dns.a.ip_addresses.network.parent_handle` | The handle of the larger network block from which the network of the A-record address was allocated. |
| `dns.a.ip_addresses.network.raw` | The raw RDAP network object for the A-record address, when it is kept. |
| `dns.a.ip_addresses.network.status` | The registry status of the network that contains the A-record address, such as `active`. |
| `dns.a.ip_addresses.network.type` | The registry's allocation type for the network that contains the A-record address, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `dns.a.ip_addresses.network.notices.title` | The title of a notice the registry attached to the network record of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.network.notices.description` | The text of a notice the registry attached to the network record of the A-record address. |
| `dns.a.ip_addresses.network.notices.links` | Links given in a notice on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.title` | The title of a remark on the network record of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.network.remarks.description` | The text of a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.remarks.links` | Links given in a remark on the network record of the A-record address. |
| `dns.a.ip_addresses.network.events.action` | An event in the history of the network record of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.network.events.actor` | Who performed an event on the network record of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the A-record address, such as `ACME-ARIN`. |
| `dns.a.ip_addresses.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the A-record address, such as `abuse`. |
| `dns.a.ip_addresses.objects.contact.email.value` | An e-mail address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.address.value` | A postal address of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the A-record address, such as `voice` or `work`. |
| `dns.a.ip_addresses.objects.contact.phone.value` | A phone number of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.kind` | What kind of contact is linked to the network of the A-record address: `org`, `group` or `individual`. |
| `dns.a.ip_addresses.objects.contact.name` | The name of a contact or organization linked to the network of the A-record address, such as `Abuse` or a company name. |
| `dns.a.ip_addresses.objects.contact.role` | The role given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.contact.title` | The title given in the contact card of an entity linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.entities` | Handles of further entities listed under a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.events.action` | An event in the history of a contact record linked to the network of the A-record address, such as `registration` or `last changed`. |
| `dns.a.ip_addresses.objects.events.actor` | Who performed an event on a contact record linked to the network of the A-record address, when the registry names one. |
| `dns.a.ip_addresses.objects.events_actor` | Events in which a contact linked to the network of the A-record address is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `dns.a.ip_addresses.objects.handle` | The registry handle of a contact or organization linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.links` | Links to the registry record of a contact linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.title` | The title of a notice on a contact record linked to the network of the A-record address, such as `Terms of Service`. |
| `dns.a.ip_addresses.objects.notices.description` | The text of a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.notices.links` | Links given in a notice on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.raw` | The raw RDAP object of a contact linked to the network of the A-record address, when it is kept. |
| `dns.a.ip_addresses.objects.remarks.title` | The title of a remark on a contact record linked to the network of the A-record address, such as `Registration Comments`. |
| `dns.a.ip_addresses.objects.remarks.description` | The text of a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the A-record address. |
| `dns.a.ip_addresses.objects.roles` | The roles of a contact for the network of the A-record address, such as `registrant`, `abuse` or `technical`. |
| `dns.a.ip_addresses.objects.status` | The registry status of a contact linked to the network of the A-record address, such as `validated`. |
| `dns.a.ip_history` | Every IPv4 address seen in the asset's A records over time, the current ones included. |
| `dns.aaaa.value` | The asset's current AAAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.aaaa.value_previous` | The asset's AAAA records as they were before the last change, in the same text form as `dns.aaaa.value`. |
| `dns.aaaa.rcode` | The DNS response code returned for the asset's AAAA lookup, such as `NOERROR`. |
| `dns.aaaa.rcode_previous` | The DNS response code of the AAAA lookup before it last changed. |
| `dns.aaaa.ip_addresses` | The IPv6 addresses in the asset's AAAA records. |
| `dns.caa.value` | The asset's current CAA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.caa.value_previous` | The asset's CAA records as they were before the last change, in the same text form as `dns.caa.value`. |
| `dns.caa.rcode` | The DNS response code returned for the asset's CAA lookup, such as `NOERROR`. |
| `dns.caa.rcode_previous` | The DNS response code of the CAA lookup before it last changed. |
| `dns.caa.issue_fqdns` | The certificate authorities allowed to issue certificates for the name, from the CAA `issue` tags, such as `fernhill.example` or `kestrel.example`. |
| `dns.caa.issuewild_fqdns` | The certificate authorities allowed to issue wildcard certificates for the name, from the CAA `issuewild` tags. |
| `dns.caa.iodef_emails` | The e-mail addresses from the CAA `iodef` tags, where certificate authorities report requests that break the CAA policy. |
| `dns.cname.value` | The asset's current CNAME records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.cname.value_previous` | The asset's CNAME records as they were before the last change, in the same text form as `dns.cname.value`. |
| `dns.cname.rcode` | The DNS response code returned for the asset's CNAME lookup, such as `NOERROR`. |
| `dns.cname.rcode_previous` | The DNS response code of the CNAME lookup before it last changed. |
| `dns.cname.canonical_fqdns` | The host names the asset's CNAME records point to (the alias targets). |
| `dns.dnskey.value` | The asset's current DNSKEY records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.dnskey.value_previous` | The asset's DNSKEY records as they were before the last change, in the same text form as `dns.dnskey.value`. |
| `dns.dnskey.rcode` | The DNS response code returned for the asset's DNSKEY lookup, such as `NOERROR`. |
| `dns.dnskey.rcode_previous` | The DNS response code of the DNSKEY lookup before it last changed. |
| `dns.dnskey.records.public_key` | The public key of a DNSKEY record, Base64-encoded and split into space-separated groups as in the zone-file text. |
| `dns.ds.value` | The asset's current DS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ds.value_previous` | The asset's DS records as they were before the last change, in the same text form as `dns.ds.value`. |
| `dns.ds.rcode` | The DNS response code returned for the asset's DS lookup, such as `NOERROR`. |
| `dns.ds.rcode_previous` | The DNS response code of the DS lookup before it last changed. |
| `dns.ds.records.digest` | The digest of a DS record, the hash of the DNSKEY it refers to. |
| `dns.mx.value` | The asset's current MX records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.mx.value_previous` | The asset's MX records as they were before the last change, in the same text form as `dns.mx.value`. |
| `dns.mx.rcode` | The DNS response code returned for the asset's MX lookup, such as `NOERROR`. |
| `dns.mx.rcode_previous` | The DNS response code of the MX lookup before it last changed. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns.mx.domains` | The registrable domains of the asset's mail servers, such as `acme.example`. |
| `dns.ns.value` | The asset's current NS records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.ns.value_previous` | The asset's NS records as they were before the last change, in the same text form as `dns.ns.value`. |
| `dns.ns.rcode` | The DNS response code returned for the asset's NS lookup, such as `NOERROR`. |
| `dns.ns.rcode_previous` | The DNS response code of the NS lookup before it last changed. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.ns.domains` | The registrable domains of the asset's name servers, such as `acme.example`. |
| `dns.nsec.value` | The asset's current NSEC records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec.value_previous` | The asset's NSEC records as they were before the last change, in the same text form as `dns.nsec.value`. |
| `dns.nsec.rcode` | The DNS response code returned for the asset's NSEC lookup, such as `NOERROR`. |
| `dns.nsec.rcode_previous` | The DNS response code of the NSEC lookup before it last changed. |
| `dns.nsec.records.next_domain` | The next name in the zone, from an NSEC record. |
| `dns.nsec.records.record_types` | The record types that exist at the name, from an NSEC record's type list, such as `A`, `NS` or `SOA`. |
| `dns.nsec3.value` | The asset's current NSEC3 records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.nsec3.value_previous` | The asset's NSEC3 records as they were before the last change, in the same text form as `dns.nsec3.value`. |
| `dns.nsec3.rcode` | The DNS response code returned for the asset's NSEC3 lookup, such as `NOERROR`. |
| `dns.nsec3.rcode_previous` | The DNS response code of the NSEC3 lookup before it last changed. |
| `dns.nsec3.records.next_domain_hashed` | The hashed next name in the zone, from an NSEC3 record. |
| `dns.nsec3.records.record_types` | The record types that exist at the name, from an NSEC3 record's type list, such as `A` or `MX`. |
| `dns.rrsig.value` | The asset's current RRSIG records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.rrsig.value_previous` | The asset's RRSIG records as they were before the last change, in the same text form as `dns.rrsig.value`. |
| `dns.rrsig.rcode` | The DNS response code returned for the asset's RRSIG lookup, such as `NOERROR`. |
| `dns.rrsig.rcode_previous` | The DNS response code of the RRSIG lookup before it last changed. |
| `dns.rrsig.type_covered` | The record type that an RRSIG signature covers, such as `A` or `SOA`. |
| `dns.rrsig.signature` | The signature data of an RRSIG record, Base64-encoded. |
| `dns.soa.value` | The asset's current SOA records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.soa.value_previous` | The asset's SOA records as they were before the last change, in the same text form as `dns.soa.value`. |
| `dns.soa.rcode` | The DNS response code returned for the asset's SOA lookup, such as `NOERROR`. |
| `dns.soa.rcode_previous` | The DNS response code of the SOA lookup before it last changed. |
| `dns.soa.mnames` | The MNAME of the SOA record: the primary name server of the zone, such as `ns1.acme.example`. |
| `dns.soa.rnames` | The RNAME of the SOA record, the zone administrator's mailbox in DNS form: `hostmaster.acme.example` stands for the mailbox `hostmaster` at `acme.example`. |
| `dns.soa.rname_emails` | The RNAME of the SOA record written as an e-mail address, such as `user@acme.example`. |
| `dns.srv.value` | The asset's current SRV records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.srv.value_previous` | The asset's SRV records as they were before the last change, in the same text form as `dns.srv.value`. |
| `dns.srv.rcode` | The DNS response code returned for the asset's SRV lookup, such as `NOERROR`. |
| `dns.srv.rcode_previous` | The DNS response code of the SRV lookup before it last changed. |
| `dns.srv.records.service` | The service named in an SRV record (the `_service` part of its name). |
| `dns.srv.records.protocol` | The protocol named in an SRV record (the `_proto` part of its name, such as TCP or UDP). |
| `dns.srv.records.target` | The host name an SRV record points to. |
| `dns.txt.value` | The asset's current TXT records as zone-file text (name, TTL, class, type and data), all records in one string. |
| `dns.txt.value_previous` | The asset's TXT records as they were before the last change, in the same text form as `dns.txt.value`. |
| `dns.txt.rcode` | The DNS response code returned for the asset's TXT lookup, such as `NOERROR`. |
| `dns.txt.rcode_previous` | The DNS response code of the TXT lookup before it last changed. |
| `dns.txt.values` | Each TXT record of the asset as its quoted text, such as `"v=spf1 include:_spf.acme.example ~all"`; the quotes are part of the value. |
| `dns.txt.spf_list.value` | The text of an SPF record (a TXT record that starts with `v=spf1`), quoted as in `dns.txt.values`. |
| `dns.txt.spf_list.allowed_domains` | The registrable domains that an SPF record refers to, such as `acme.example` for `include:_spf.acme.example`. |
| `dns.txt.spf_list.allowed_ips` | The IP addresses and ranges that an SPF record authorizes to send mail (its `ip4:` and `ip6:` entries). |
| `dns.txt.verifications.value` | The text of a site-verification TXT record, quoted as in `dns.txt.values`. |
| `dns.txt.verifications.domain` | The domain of the service a verification record is for, such as `acme.example`, `fernhill.example` or `kestrel.example`. |
| `dns.txt.verifications.name` | The name of a verification record, such as `site-verification` or `domain-verification`. |
| `dns_last_change_data` | The DNS fields that changed in the last change seen, as field paths such as `dns.soa.mnames`. |
| `ssl.target` | The host name that the asset's TLS certificate was collected from, normally the asset itself. |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.md5` | The MD5 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.fingerprint.sha256` | The SHA-256 fingerprint of the asset's TLS certificate, as lower-case hex; one fingerprint identifies one certificate. |
| `ssl.issuer.common_name` | The common name (CN) of the certificate authority that issued the asset's TLS certificate, such as `WE1` or `YE2`. |
| `ssl.issuer.country` | The country (C) of the certificate authority that issued the asset's TLS certificate, as a two-letter code such as `US`. |
| `ssl.issuer.state` | The state or province (ST) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.locality` | The locality or city (L) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer.organization` | The organization (O) of the certificate authority that issued the asset's TLS certificate, such as `Let's Encrypt` or `Google Trust Services`. |
| `ssl.issuer.organizational_unit` | The organizational unit (OU) of the certificate authority that issued the asset's TLS certificate. |
| `ssl.issuer_dn` | The full distinguished name of the issuer of the asset's TLS certificate, as one string such as `CN=WE1,O=Google Trust Services,C=US`. |
| `ssl.subject.common_name` | The common name (CN) of the subject (holder) of the asset's TLS certificate, usually a host name such as `acme.example`. |
| `ssl.subject.country` | The country (C) of the subject (holder) of the asset's TLS certificate, as a two-letter code. |
| `ssl.subject.state` | The state or province (ST) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.locality` | The locality or city (L) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject.organizational_unit` | The organizational unit (OU) of the subject (holder) of the asset's TLS certificate. |
| `ssl.subject_dn` | The full distinguished name of the subject of the asset's TLS certificate, such as `CN=acme.example`; one that starts with `CN=*.` belongs to a wildcard certificate. |
| `ssl.signature.value` | The signature of the asset's TLS certificate, Base64-encoded. |
| `ssl.signature.invalid_reason` | Why certificate validation failed, such as a host name mismatch or `unable to get issuer certificate`. |
| `ssl.signature.algorithm.name` | The hash algorithm of the signature on the asset's TLS certificate, such as `sha256` or `sha384`. |
| `ssl.signature.algorithm.oid` | The object identifier (OID) of the signature algorithm, such as `1.2.840.113549.1.1.11` (SHA-256 with RSA) or `1.2.840.10045.4.3.2` (ECDSA with SHA-256). |
| `ssl.extensions.authority_key_id` | The Authority Key Identifier extension, which identifies the issuer's key, Base64-encoded. |
| `ssl.extensions.certificate_policies` | The policy OIDs in the Certificate Policies extension, such as `2.23.140.1.2.1` (domain validated). |
| `ssl.extensions.signed_certificate_timestamps.log_id` | The ID of the Certificate Transparency log that issued a signed certificate timestamp (SCT) for the certificate, Base64-encoded. |
| `ssl.extensions.signed_certificate_timestamps.signature` | The log's signature on a signed certificate timestamp, Base64-encoded. |
| `ssl.extensions.subject_alt_name.dns_names` | The host names in the certificate's Subject Alternative Name extension, including wildcard names such as `*.acme.example`. |
| `ssl.extensions.subject_key_id` | The Subject Key Identifier extension, which identifies the certificate's own key, Base64-encoded. |
| `ssl.subject_key_info.fingerprint.hash_algorithm` | The hash algorithm used for `ssl.subject_key_info.fingerprint.value`, such as `sha256` or `sha384`. |
| `ssl.subject_key_info.fingerprint.value` | A hex fingerprint recorded under the certificate's subject key information, made with the hash in `hash_algorithm`. In the samples it equals `ssl.fingerprint.sha256` when that hash is SHA-256. |
| `ssl.subject_key_info.key_algorithm.name` | The algorithm of the certificate's public key, such as `RSA` or `ECDSA`. |
| `ssl.version.name` | The X.509 version of the certificate, such as `v3`. |
| `ssl.version.value` | The X.509 version as encoded in the certificate, counted from zero: `2` means `v3`. |
| `ssl.tbs_fingerprint` | A SHA-256 fingerprint (hex) of the certificate's to-be-signed part, the certificate content without its signature. |
| `ssl.certificate` | The whole certificate, Base64-encoded (a PEM body without the header and footer lines). |
| `ssl.fqdn_list` | The host names the certificate covers, with the `*.` of wildcard names removed and duplicates merged, so `*.acme.example` and `acme.example` both give `acme.example`. |
| `ssl_last_change_data` | The certificate fields that changed in the last change seen, as field paths such as `ssl.validity.end_date`. |
| `http.requested_url` | The URL the HTTP check started from, such as `http://acme.example`. |
| `http.requested_domain` | The registrable domain of the URL the HTTP check started from. |
| `http.requested_fqdn` | The host name of the URL the HTTP check started from. |
| `http.final_url` | The URL the HTTP check ended on after following all redirects. |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.redirection_history.url` | A URL in the redirect chain of the HTTP check, listed in the order visited. |
| `http.headers.accept` | The `Accept` header, when it was returned in the HTTP check. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the HTTP check. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `http.headers.accept_language` | The `Accept-Language` header, when it was returned in the HTTP check. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the HTTP check; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the HTTP check; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the HTTP check; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the HTTP check; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the HTTP check; it lists the response headers that scripts from other origins may read (CORS). |
| `http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the HTTP check; it says how many seconds browsers may cache a CORS preflight result. |
| `http.headers.alt_svc` | The `Alt-Svc` header returned in the HTTP check; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `http.headers.authorization` | The `Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `http.headers.cache_control` | The `Cache-Control` header returned in the HTTP check; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the HTTP check; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `http.headers.content_disposition` | The `Content-Disposition` header returned in the HTTP check; it says whether the content is shown in the browser or downloaded as a file. |
| `http.headers.content_encoding` | The `Content-Encoding` header returned in the HTTP check; it names the compression applied to the response body, for example `gzip` or `br`. |
| `http.headers.content_language` | The `Content-Language` header returned in the HTTP check; it gives the language of the content, for example `en` or `tr`. |
| `http.headers.content_length` | The `Content-Length` header returned in the HTTP check; it gives the size of the response body in bytes. |
| `http.headers.content_range` | The `Content-Range` header returned in the HTTP check; it says which part of the full body a partial response holds. |
| `http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the HTTP check; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `http.headers.content_type` | The `Content-Type` header returned in the HTTP check; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `http.headers.cookie` | The `Cookie` header, when it was returned in the HTTP check. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the HTTP check; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the HTTP check; it controls whether the page shares its browsing context with cross-origin windows. |
| `http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the HTTP check; it controls which sites may load the resource. |
| `http.headers.date` | The `Date` header returned in the HTTP check; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `http.headers.early_data` | The `Early-Data` header, when it was returned in the HTTP check. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `http.headers.expect_ct` | The `Expect-CT` header returned in the HTTP check; it is a deprecated header about Certificate Transparency enforcement. |
| `http.headers.expires` | The `Expires` header returned in the HTTP check; it gives the date after which the response counts as stale, in HTTP date format. |
| `http.headers.feature_policy` | The `Feature-Policy` header returned in the HTTP check; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `http.headers.host` | The `Host` header, when it was returned in the HTTP check. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the HTTP check. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the HTTP check. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `http.headers.last_modified` | The `Last-Modified` header returned in the HTTP check; it gives the time the server says the resource last changed, in HTTP date format. |
| `http.headers.origin_isolation` | The `Origin-Isolation` header returned in the HTTP check; it is an experimental header that asks browsers to isolate the site's origin. |
| `http.headers.others.name` | The name of a header returned in the HTTP check that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `http.headers.others.value` | The value of a header listed in `headers.others` for the HTTP check. |
| `http.headers.permission_policy` | The `Permission-Policy` header returned in the HTTP check; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `http.headers.permissions_policy` | The `Permissions-Policy` header returned in the HTTP check; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `http.headers.pragma` | The `Pragma` header returned in the HTTP check; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the HTTP check; it tells a client how to authenticate to a proxy. |
| `http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the HTTP check. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the HTTP check; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `http.headers.range` | The `Range` header, when it was returned in the HTTP check. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `http.headers.referer` | The `Referer` header, when it was returned in the HTTP check. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `http.headers.referrer_policy` | The `Referrer-Policy` header returned in the HTTP check; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the HTTP check. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the HTTP check. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `http.headers.server` | The `Server` header returned in the HTTP check; it names the server software the site reports, for example `nginx` or `Apache`. |
| `http.headers.set_cookie` | The `Set-Cookie` header returned in the HTTP check; it sets cookies, with their attributes. |
| `http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the HTTP check; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `http.headers.te` | The `TE` header, when it was returned in the HTTP check. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the HTTP check; it says how the body is transferred, for example `chunked`. |
| `http.headers.upgrade` | The `Upgrade` header returned in the HTTP check; it offers or asks for a switch to another protocol. |
| `http.headers.user_agent` | The `User-Agent` header, when it was returned in the HTTP check. It is normally a request header (the client software), so it is rarely set. |
| `http.headers.vary` | The `Vary` header returned in the HTTP check; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the HTTP check; it tells a client how to authenticate, usually with a `401` response. |
| `http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the HTTP check; it stops browsers from guessing the content type when set to `nosniff`. |
| `http.headers.x_download_options` | The `X-Download-Options` header returned in the HTTP check; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `http.headers.x_frame_options` | The `X-Frame-Options` header returned in the HTTP check; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the HTTP check; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `http.headers.x_powered_by` | The `X-Powered-By` header returned in the HTTP check; it names the technology the server reports running on, for example `Express`. |
| `http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the HTTP check; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `http.cookies.name` | The name of a cookie set in the HTTP check. |
| `http.cookies.value` | The value of a cookie set in the HTTP check. |
| `http.html.source_code_hash` | A SHA-256 hash of the page source returned in the HTTP check; the same hash means the same source. |
| `http_last_change_data` | The HTTP check fields that changed in the last change seen, as field paths such as `http.html.source_code_hash`. |
| `webdata.requested_url` | The URL the web data scan started from, such as `http://acme.example`. |
| `webdata.requested_domain` | The registrable domain of the URL the web data scan started from. |
| `webdata.requested_fqdn` | The host name of the URL the web data scan started from. |
| `webdata.html.internal_links_fqdns` | The host names of links on the scanned page that stay within the site's own domain, such as other subdomains. |
| `webdata.html.external_links_domains` | The registrable domains of links on the scanned page that point to other domains, such as `kestrel.example`. |
| `webdata.html.external_links_fqdns` | The host names of links on the scanned page that point to other domains, such as `www.kestrel.example`. |
| `webdata.html.external_links` | The full URLs of links on the scanned page that point to other domains. |
| `webdata.html.script_links` | The URLs of the scripts the scanned page loads. |
| `webdata.html.iframe_links` | The URLs of the frames (iframes) embedded in the scanned page. |
| `webdata.html.trackers.name` | The name of an analytics or advertising tracker found on the scanned page, such as `google_adsense` or `google_tag_manager`. |
| `webdata.html.trackers.values` | The IDs found for a tracker, such as a Google Analytics ID that starts with `G-` or `UA-`. |
| `webdata.html.emails` | The e-mail addresses found on the scanned page. |
| `webdata.html.emails_internal` | The e-mail addresses found on the scanned page that belong to the site's own domain. |
| `webdata.html.source_code_hash` | A SHA-256 hash of the page source in the web data scan; the same hash means the same source. |
| `webdata.html.content_hash` | A SHA-256 hash of the page content in the web data scan, kept apart from `source_code_hash`, the hash of the raw source. |
| `webdata.html.content_top_keywords` | The most frequent words in the text of the scanned page. |
| `webdata.html.favicon_links` | The URLs of the icons the scanned page declares, such as its favicon and touch icons. |
| `webdata.html.html_meta.name` | The site or application name declared in the scanned page's metadata. |
| `webdata.html.html_meta.description` | The meta description of the scanned page. |
| `webdata.html.html_meta.language` | The language the scanned page declares, such as `en`, `tr` or `en-US`. |
| `webdata.html.html_meta.language_alternatives` | The languages of the alternative versions the scanned page links to, such as `en` or `ar`. |
| `webdata.html.html_meta.keywords` | The keywords listed in the keywords meta tag of the scanned page. |
| `webdata.html.html_meta.encoding` | The character encoding the scanned page declares, such as `utf-8`. |
| `webdata.html.html_meta.canonical_url` | The canonical URL the scanned page declares. |
| `webdata.html.html_meta.title` | The title of the scanned page. |
| `webdata.favicon.url` | The URL of a site icon (favicon) recorded by the web data scan. |
| `webdata.favicon.hash` | A SHA-256 hash of a site icon; the same hash means the same icon. |
| `webdata.http.final_url` | The URL the web data scan ended on after following all redirects. |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.redirection_history.url` | A URL in the redirect chain of the web data scan, listed in the order visited. |
| `webdata.http.redirection_history.method` | How a step of the web data scan's redirect chain was made; `http-header` (a redirect sent in the HTTP response) is the value in the samples. |
| `webdata.http.headers.accept` | The `Accept` header, when it was returned in the web data scan. It is normally a request header (the content types a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_encoding` | The `Accept-Encoding` header, when it was returned in the web data scan. It is normally a request header (the compression formats a client accepts), so it is rarely set. |
| `webdata.http.headers.accept_language` | The `Accept-Language` header, when it was returned in the web data scan. It is normally a request header (the languages a client prefers), so it is rarely set. |
| `webdata.http.headers.access_control_allow_credentials` | The `Access-Control-Allow-Credentials` header returned in the web data scan; it tells browsers whether cross-origin requests may carry credentials such as cookies (CORS). |
| `webdata.http.headers.access_control_allow_headers` | The `Access-Control-Allow-Headers` header returned in the web data scan; it lists the request headers allowed in cross-origin requests (CORS), for example `*`. |
| `webdata.http.headers.access_control_allow_methods` | The `Access-Control-Allow-Methods` header returned in the web data scan; it lists the HTTP methods allowed in cross-origin requests (CORS), for example `GET`. |
| `webdata.http.headers.access_control_allow_origin` | The `Access-Control-Allow-Origin` header returned in the web data scan; it names the origins allowed to read the response (CORS), where `*` allows any origin. |
| `webdata.http.headers.access_control_expose_headers` | The `Access-Control-Expose-Headers` header returned in the web data scan; it lists the response headers that scripts from other origins may read (CORS). |
| `webdata.http.headers.access_control_max_age` | The `Access-Control-Max-Age` header returned in the web data scan; it says how many seconds browsers may cache a CORS preflight result. |
| `webdata.http.headers.alt_svc` | The `Alt-Svc` header returned in the web data scan; it advertises other protocols or ports that serve the site, for example `h3=":443"; ma=86400` for HTTP/3. |
| `webdata.http.headers.authorization` | The `Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to the server), so it is rarely set. |
| `webdata.http.headers.cache_control` | The `Cache-Control` header returned in the web data scan; it sets the caching rules for the response, for example `no-cache, must-revalidate`. |
| `webdata.http.headers.clear_site_data` | The `Clear-Site-Data` header returned in the web data scan; it tells browsers to clear stored data for the site, such as cookies, storage or cache. |
| `webdata.http.headers.content_disposition` | The `Content-Disposition` header returned in the web data scan; it says whether the content is shown in the browser or downloaded as a file. |
| `webdata.http.headers.content_encoding` | The `Content-Encoding` header returned in the web data scan; it names the compression applied to the response body, for example `gzip` or `br`. |
| `webdata.http.headers.content_language` | The `Content-Language` header returned in the web data scan; it gives the language of the content, for example `en` or `tr`. |
| `webdata.http.headers.content_length` | The `Content-Length` header returned in the web data scan; it gives the size of the response body in bytes. |
| `webdata.http.headers.content_range` | The `Content-Range` header returned in the web data scan; it says which part of the full body a partial response holds. |
| `webdata.http.headers.content_security_policy` | The `Content-Security-Policy` header returned in the web data scan; it sets the Content Security Policy (CSP), which limits where the page may load scripts and other content from. |
| `webdata.http.headers.content_type` | The `Content-Type` header returned in the web data scan; it gives the media type and character set of the response body, for example `text/html; charset=utf-8`. |
| `webdata.http.headers.cookie` | The `Cookie` header, when it was returned in the web data scan. It is normally a request header (the cookies a client sends), so it is rarely set. |
| `webdata.http.headers.cross_origin_embedder_policy` | The `Cross-Origin-Embedder-Policy` header returned in the web data scan; it controls whether the page may embed cross-origin resources that do not explicitly allow it. |
| `webdata.http.headers.cross_origin_opener_policy` | The `Cross-Origin-Opener-Policy` header returned in the web data scan; it controls whether the page shares its browsing context with cross-origin windows. |
| `webdata.http.headers.cross_origin_resource_policy` | The `Cross-Origin-Resource-Policy` header returned in the web data scan; it controls which sites may load the resource. |
| `webdata.http.headers.date` | The `Date` header returned in the web data scan; it gives the time the server generated the response, in HTTP date format, for example `Sun, 01 Jun 2025 08:00:00 GMT`. |
| `webdata.http.headers.early_data` | The `Early-Data` header, when it was returned in the web data scan. It is normally a request header (a marker that a request was sent in TLS early data), so it is rarely set. |
| `webdata.http.headers.expect_ct` | The `Expect-CT` header returned in the web data scan; it is a deprecated header about Certificate Transparency enforcement. |
| `webdata.http.headers.expires` | The `Expires` header returned in the web data scan; it gives the date after which the response counts as stale, in HTTP date format. |
| `webdata.http.headers.feature_policy` | The `Feature-Policy` header returned in the web data scan; it is the older name of `Permissions-Policy` and limits the browser features the page may use. |
| `webdata.http.headers.host` | The `Host` header, when it was returned in the web data scan. It is normally a request header (the host name a client asks for), so it is rarely set. |
| `webdata.http.headers.if_modified_since` | The `If-Modified-Since` header, when it was returned in the web data scan. It is normally a request header (a condition to send the content only if it changed after a date), so it is rarely set. |
| `webdata.http.headers.if_none_match` | The `If-None-Match` header, when it was returned in the web data scan. It is normally a request header (a condition based on an ETag), so it is rarely set. |
| `webdata.http.headers.last_modified` | The `Last-Modified` header returned in the web data scan; it gives the time the server says the resource last changed, in HTTP date format. |
| `webdata.http.headers.origin_isolation` | The `Origin-Isolation` header returned in the web data scan; it is an experimental header that asks browsers to isolate the site's origin. |
| `webdata.http.headers.others.name` | The name of a header returned in the web data scan that has no field of its own under `headers`, in lower case such as `etag` or `cf-cache-status`. |
| `webdata.http.headers.others.value` | The value of a header listed in `headers.others` for the web data scan. |
| `webdata.http.headers.permission_policy` | The `Permission-Policy` header returned in the web data scan; it is recorded under this singular spelling, separately from `Permissions-Policy`. |
| `webdata.http.headers.permissions_policy` | The `Permissions-Policy` header returned in the web data scan; it limits the browser features the page may use, for example `camera=(), microphone=(), geolocation=()`. |
| `webdata.http.headers.pragma` | The `Pragma` header returned in the web data scan; it is an older HTTP/1.0 caching header, for example `no-cache`. |
| `webdata.http.headers.proxy_authenticate` | The `Proxy-Authenticate` header returned in the web data scan; it tells a client how to authenticate to a proxy. |
| `webdata.http.headers.proxy_authorization` | The `Proxy-Authorization` header, when it was returned in the web data scan. It is normally a request header (the credentials a client sends to a proxy), so it is rarely set. |
| `webdata.http.headers.public_key_pins` | The `Public-Key-Pins` header returned in the web data scan; it is a deprecated header (HPKP) that pinned the site's public keys. |
| `webdata.http.headers.range` | The `Range` header, when it was returned in the web data scan. It is normally a request header (a request for only part of a resource), so it is rarely set. |
| `webdata.http.headers.referer` | The `Referer` header, when it was returned in the web data scan. It is normally a request header (the address of the page a request came from), so it is rarely set. |
| `webdata.http.headers.referrer_policy` | The `Referrer-Policy` header returned in the web data scan; it sets how much referrer information browsers send when leaving the page, for example `strict-origin-when-cross-origin`. |
| `webdata.http.headers.sec_fetch_dest` | The `Sec-Fetch-Dest` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the response will be used), so it is rarely set. |
| `webdata.http.headers.sec_fetch_mode` | The `Sec-Fetch-Mode` header, when it was returned in the web data scan. It is normally a request header (browser metadata on the request mode), so it is rarely set. |
| `webdata.http.headers.sec_fetch_site` | The `Sec-Fetch-Site` header, when it was returned in the web data scan. It is normally a request header (browser metadata on how the requesting site relates to the target), so it is rarely set. |
| `webdata.http.headers.sec_fetch_user` | The `Sec-Fetch-User` header, when it was returned in the web data scan. It is normally a request header (browser metadata that marks a request started by the user), so it is rarely set. |
| `webdata.http.headers.server` | The `Server` header returned in the web data scan; it names the server software the site reports, for example `nginx` or `Apache`. |
| `webdata.http.headers.set_cookie` | The `Set-Cookie` header returned in the web data scan; it sets cookies, with their attributes. |
| `webdata.http.headers.strict_transport_security` | The `Strict-Transport-Security` header returned in the web data scan; it tells browsers to reach the site over HTTPS only (HSTS), for example `max-age=31536000; includeSubDomains; preload`. |
| `webdata.http.headers.te` | The `TE` header, when it was returned in the web data scan. It is normally a request header (the transfer encodings a client accepts), so it is rarely set. |
| `webdata.http.headers.transfer_encoding` | The `Transfer-Encoding` header returned in the web data scan; it says how the body is transferred, for example `chunked`. |
| `webdata.http.headers.upgrade` | The `Upgrade` header returned in the web data scan; it offers or asks for a switch to another protocol. |
| `webdata.http.headers.user_agent` | The `User-Agent` header, when it was returned in the web data scan. It is normally a request header (the client software), so it is rarely set. |
| `webdata.http.headers.vary` | The `Vary` header returned in the web data scan; it tells caches which request headers change the response, for example `Accept-Encoding`. |
| `webdata.http.headers.www_authenticate` | The `WWW-Authenticate` header returned in the web data scan; it tells a client how to authenticate, usually with a `401` response. |
| `webdata.http.headers.x_content_type_options` | The `X-Content-Type-Options` header returned in the web data scan; it stops browsers from guessing the content type when set to `nosniff`. |
| `webdata.http.headers.x_download_options` | The `X-Download-Options` header returned in the web data scan; it stops Internet Explorer from opening downloads directly when set to `noopen`. |
| `webdata.http.headers.x_frame_options` | The `X-Frame-Options` header returned in the web data scan; it says whether the page may be shown in a frame (a protection against clickjacking), for example `DENY` or `SAMEORIGIN`. |
| `webdata.http.headers.x_permitted_cross_domain_policies` | The `X-Permitted-Cross-Domain-Policies` header returned in the web data scan; it says whether Adobe clients such as Flash or Acrobat may load cross-domain policy files. |
| `webdata.http.headers.x_powered_by` | The `X-Powered-By` header returned in the web data scan; it names the technology the server reports running on, for example `Express`. |
| `webdata.http.headers.x_xss_protection` | The `X-XSS-Protection` header returned in the web data scan; it is an older setting for the browser's cross-site scripting filter, for example `1; mode=block` or `0`. |
| `webdata.http.cookies.name` | The name of a cookie set in the web data scan. |
| `webdata.http.cookies.value` | The value of a cookie set in the web data scan. |
| `webdata.http.cookies.domain` | The domain a cookie set in the web data scan applies to, such as `.acme.example`. |
| `webdata.http.cookies.path` | The path a cookie set in the web data scan applies to, such as `/`. |
| `webdata.http.cookies.same_party` | The SameParty attribute of a cookie set in the web data scan; in the samples it always holds the same value as `same_site`, such as `Lax` or `None`. |
| `webdata.http.cookies.priority` | The Priority attribute of a cookie set in the web data scan (`Low`, `Medium` or `High` in Chromium-based browsers). |
| `webdata.http.cookies.same_site` | The SameSite attribute of a cookie set in the web data scan, such as `Lax`, `Strict` or `None`. |
| `webdata.technology.stacks.slug` | A short identifier of a technology detected on the site, such as `iis` or `windows-server`. |
| `webdata.technology.stacks.name` | The name of a technology detected on the site, such as `IIS` or `Microsoft ASP.NET`. |
| `webdata.technology.stacks.icon` | The file name of a detected technology's icon, such as `acme.png`. |
| `webdata.technology.stacks.website` | The website of a detected technology's vendor or project. |
| `webdata.technology.stacks.cpe` | The CPE identifier of a detected technology, such as `cpe:/a:acme:acme-portal`, used to match it to known vulnerabilities. |
| `webdata.technology.stacks.version` | The detected version of a technology, such as `1.0`. |
| `webdata.technology.stacks.categories` | The categories of a detected technology, such as `Web servers` or `Operating systems`. |
| `webdata.technology.stacks.description` | A short description of a detected technology. |
| `webdata_last_change_data` | The web data fields that changed in the last change seen, as field paths under `webdata`. |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.entities` | The handles of the registry contacts and organizations linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.nir.nets.address` | The postal address of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.nir.nets.contacts.admin.division` | The division of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.email` | The e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.fax` | The fax number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.organization` | The organization of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.phone` | The phone number of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.reply_email` | The reply e-mail address of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.name` | The name of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.admin.title` | The job title of the administrative contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.division` | The division of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.email` | The e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.fax` | The fax number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.organization` | The organization of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.phone` | The phone number of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.reply_email` | The reply e-mail address of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.name` | The name of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.contacts.tech.title` | The job title of the technical contact of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.country` | The country code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.handle` | The registry handle of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.name` | The name of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.nameservers` | The name servers listed for a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.postal_code` | The postal code of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.nets.range` | The address range (first and last address) of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.nir.raw` | The raw text of the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, when it is kept. |
| `ipwhois.nir.query` | The IP address sent in the query for the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset. |
| `ipwhois.query` | The IP address that was looked up in IP WHOIS (RDAP), that is the IP address asset. |
| `ipwhois.raw` | The raw IP WHOIS response for the IP address asset, when it is kept; empty on every sampled asset. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `ipwhois.network.start_address` | The first address of the registered network block that contains the IP address asset. |
| `ipwhois.network.end_address` | The last address of the registered network block that contains the IP address asset. |
| `ipwhois.network.handle` | The registry handle of the network that contains the IP address asset, such as `NET-192-0-2-0-1`. |
| `ipwhois.network.ip_version` | The IP version of the network that contains the IP address asset: `v4` or `v6`. |
| `ipwhois.network.links` | Links to the registry record of the network that contains the IP address asset, such as its RDAP and WHOIS URLs. |
| `ipwhois.network.parent_handle` | The handle of the larger network block from which the network of the IP address asset was allocated. |
| `ipwhois.network.raw` | The raw RDAP network object for the IP address asset, when it is kept. |
| `ipwhois.network.status` | The registry status of the network that contains the IP address asset, such as `active`. |
| `ipwhois.network.type` | The registry's allocation type for the network that contains the IP address asset, such as `DIRECT ALLOCATION`, `ALLOCATION` or `ALLOCATED PA`. |
| `ipwhois.network.notices.title` | The title of a notice the registry attached to the network record of the IP address asset, such as `Terms of Service`. |
| `ipwhois.network.notices.description` | The text of a notice the registry attached to the network record of the IP address asset. |
| `ipwhois.network.notices.links` | Links given in a notice on the network record of the IP address asset. |
| `ipwhois.network.remarks.title` | The title of a remark on the network record of the IP address asset, such as `Registration Comments`. |
| `ipwhois.network.remarks.description` | The text of a remark on the network record of the IP address asset. |
| `ipwhois.network.remarks.links` | Links given in a remark on the network record of the IP address asset. |
| `ipwhois.network.events.action` | An event in the history of the network record of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.network.events.actor` | Who performed an event on the network record of the IP address asset, when the registry names one. |
| `ipwhois.objects.uid` | The handle of a registry contact or organization (RDAP entity) linked to the network of the IP address asset, such as `ACME-ARIN`. |
| `ipwhois.objects.contact.email.type` | The type of an e-mail address of a contact linked to the network of the IP address asset, such as `abuse`. |
| `ipwhois.objects.contact.email.value` | An e-mail address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.type` | The type of a postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.address.value` | A postal address of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.phone.type` | The type of a phone number of a contact linked to the network of the IP address asset, such as `voice` or `work`. |
| `ipwhois.objects.contact.phone.value` | A phone number of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.contact.kind` | What kind of contact is linked to the network of the IP address asset: `org`, `group` or `individual`. |
| `ipwhois.objects.contact.name` | The name of a contact or organization linked to the network of the IP address asset, such as `Abuse` or a company name. |
| `ipwhois.objects.contact.role` | The role given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.contact.title` | The title given in the contact card of an entity linked to the network of the IP address asset. |
| `ipwhois.objects.entities` | Handles of further entities listed under a contact linked to the network of the IP address asset. |
| `ipwhois.objects.events.action` | An event in the history of a contact record linked to the network of the IP address asset, such as `registration` or `last changed`. |
| `ipwhois.objects.events.actor` | Who performed an event on a contact record linked to the network of the IP address asset, when the registry names one. |
| `ipwhois.objects.events_actor` | Events in which a contact linked to the network of the IP address asset is itself the actor (the RDAP `asEventActor` list), as text; empty on every sampled record. |
| `ipwhois.objects.handle` | The registry handle of a contact or organization linked to the network of the IP address asset. |
| `ipwhois.objects.links` | Links to the registry record of a contact linked to the network of the IP address asset. |
| `ipwhois.objects.notices.title` | The title of a notice on a contact record linked to the network of the IP address asset, such as `Terms of Service`. |
| `ipwhois.objects.notices.description` | The text of a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.notices.links` | Links given in a notice on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.raw` | The raw RDAP object of a contact linked to the network of the IP address asset, when it is kept. |
| `ipwhois.objects.remarks.title` | The title of a remark on a contact record linked to the network of the IP address asset, such as `Registration Comments`. |
| `ipwhois.objects.remarks.description` | The text of a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.remarks.links` | Links given in a remark on a contact record linked to the network of the IP address asset. |
| `ipwhois.objects.roles` | The roles of a contact for the network of the IP address asset, such as `registrant`, `abuse` or `technical`. |
| `ipwhois.objects.status` | The registry status of a contact linked to the network of the IP address asset, such as `validated`. |
| `ipwhois_last_change_data` | The IP WHOIS fields that changed in the last change seen, as field paths under `ipwhois`. |
| `ipdns.ptr_records` | The PTR (reverse DNS) host names of an IP address asset. |
| `ipdns_last_change_data` | The reverse DNS fields that changed in the last change seen, as field paths under `ipdns`. |
| `issue_category_stats.name` | The name of an issue category in the per-category issue counts of the asset, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. |
| `technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the asset, such as `Web servers` or `Analytics`. |
| `domain_snapshot.issue_category_stats.name` | The name of an issue category in the per-category issue counts of the domain and its subdomains together, such as `DNS`, `SSL/TLS`, `Web Application`, `Domain/Whois` or `Network`. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.name` | The name of a technology category in the per-category technology counts of the domain and its subdomains together, such as `Web servers` or `Analytics`. Set on domain assets. |

Operators: `eq`, `in`, `gte`, `lte`, `exists`

| Field | Description |
|---|---|
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.name.length` | The number of characters in the name without the extension: `4` for `acme.example`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois_create_date_historical` | Every creation date seen for the domain over time, so a domain that was deleted and registered again keeps its earlier dates too (UTC date-times). |
| `whois_check_date` | When the WHOIS record of the asset was last checked (UTC date-time). |
| `whois_last_change_date` | When a change in the WHOIS record of the asset was last seen (UTC date-time). |
| `dns.a.value_last_change_date` | When the A record text (`dns.a.value`) last changed (UTC date-time). |
| `dns.a.rcode_last_change_date` | When the response code of the A lookup (`dns.a.rcode`) last changed (UTC date-time). |
| `dns.a.last_change_date` | When the asset's A records last changed, in their text or their response code (UTC date-time). |
| `dns.a.ip_addresses.asn_date` | The registry allocation date that the ASN lookup reports for the A-record address, as a date at midnight UTC. |
| `dns.a.ip_addresses.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was created (UTC date-time). |
| `dns.a.ip_addresses.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address was last updated (UTC date-time). |
| `dns.a.ip_addresses.network.events.timestamp` | When an event on the network record of the A-record address happened (UTC date-time). |
| `dns.a.ip_addresses.objects.events.timestamp` | When an event on a contact record linked to the network of the A-record address happened (UTC date-time). |
| `dns.aaaa.value_last_change_date` | When the AAAA record text (`dns.aaaa.value`) last changed (UTC date-time). |
| `dns.aaaa.rcode_last_change_date` | When the response code of the AAAA lookup (`dns.aaaa.rcode`) last changed (UTC date-time). |
| `dns.aaaa.last_change_date` | When the asset's AAAA records last changed, in their text or their response code (UTC date-time). |
| `dns.caa.value_last_change_date` | When the CAA record text (`dns.caa.value`) last changed (UTC date-time). |
| `dns.caa.rcode_last_change_date` | When the response code of the CAA lookup (`dns.caa.rcode`) last changed (UTC date-time). |
| `dns.caa.last_change_date` | When the asset's CAA records last changed, in their text or their response code (UTC date-time). |
| `dns.cname.value_last_change_date` | When the CNAME record text (`dns.cname.value`) last changed (UTC date-time). |
| `dns.cname.rcode_last_change_date` | When the response code of the CNAME lookup (`dns.cname.rcode`) last changed (UTC date-time). |
| `dns.cname.last_change_date` | When the asset's CNAME records last changed, in their text or their response code (UTC date-time). |
| `dns.dnskey.value_last_change_date` | When the DNSKEY record text (`dns.dnskey.value`) last changed (UTC date-time). |
| `dns.dnskey.rcode_last_change_date` | When the response code of the DNSKEY lookup (`dns.dnskey.rcode`) last changed (UTC date-time). |
| `dns.dnskey.last_change_date` | When the asset's DNSKEY records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.value_last_change_date` | When the DS record text (`dns.ds.value`) last changed (UTC date-time). |
| `dns.ds.rcode_last_change_date` | When the response code of the DS lookup (`dns.ds.rcode`) last changed (UTC date-time). |
| `dns.ds.last_change_date` | When the asset's DS records last changed, in their text or their response code (UTC date-time). |
| `dns.ds.records.key_tag` | The key tag (a number) of the DNSKEY that a DS record refers to. |
| `dns.mx.value_last_change_date` | When the MX record text (`dns.mx.value`) last changed (UTC date-time). |
| `dns.mx.rcode_last_change_date` | When the response code of the MX lookup (`dns.mx.rcode`) last changed (UTC date-time). |
| `dns.mx.last_change_date` | When the asset's MX records last changed, in their text or their response code (UTC date-time). |
| `dns.ns.value_last_change_date` | When the NS record text (`dns.ns.value`) last changed (UTC date-time). |
| `dns.ns.rcode_last_change_date` | When the response code of the NS lookup (`dns.ns.rcode`) last changed (UTC date-time). |
| `dns.ns.last_change_date` | When the asset's NS records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec.value_last_change_date` | When the NSEC record text (`dns.nsec.value`) last changed (UTC date-time). |
| `dns.nsec.rcode_last_change_date` | When the response code of the NSEC lookup (`dns.nsec.rcode`) last changed (UTC date-time). |
| `dns.nsec.last_change_date` | When the asset's NSEC records last changed, in their text or their response code (UTC date-time). |
| `dns.nsec3.value_last_change_date` | When the NSEC3 record text (`dns.nsec3.value`) last changed (UTC date-time). |
| `dns.nsec3.rcode_last_change_date` | When the response code of the NSEC3 lookup (`dns.nsec3.rcode`) last changed (UTC date-time). |
| `dns.nsec3.last_change_date` | When the asset's NSEC3 records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.value_last_change_date` | When the RRSIG record text (`dns.rrsig.value`) last changed (UTC date-time). |
| `dns.rrsig.rcode_last_change_date` | When the response code of the RRSIG lookup (`dns.rrsig.rcode`) last changed (UTC date-time). |
| `dns.rrsig.last_change_date` | When the asset's RRSIG records last changed, in their text or their response code (UTC date-time). |
| `dns.rrsig.signature_inception` | When an RRSIG signature becomes valid (UTC date-time). |
| `dns.rrsig.signature_expiration` | When an RRSIG signature expires (UTC date-time). |
| `dns.soa.value_last_change_date` | When the SOA record text (`dns.soa.value`) last changed (UTC date-time). |
| `dns.soa.rcode_last_change_date` | When the response code of the SOA lookup (`dns.soa.rcode`) last changed (UTC date-time). |
| `dns.soa.last_change_date` | When the asset's SOA records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.value_last_change_date` | When the SRV record text (`dns.srv.value`) last changed (UTC date-time). |
| `dns.srv.rcode_last_change_date` | When the response code of the SRV lookup (`dns.srv.rcode`) last changed (UTC date-time). |
| `dns.srv.last_change_date` | When the asset's SRV records last changed, in their text or their response code (UTC date-time). |
| `dns.srv.records.port` | The port an SRV record points to. |
| `dns.txt.value_last_change_date` | When the TXT record text (`dns.txt.value`) last changed (UTC date-time). |
| `dns.txt.rcode_last_change_date` | When the response code of the TXT lookup (`dns.txt.rcode`) last changed (UTC date-time). |
| `dns.txt.last_change_date` | When the asset's TXT records last changed, in their text or their response code (UTC date-time). |
| `dns_check_date` | When the DNS records of the asset were last checked (UTC date-time). |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.port` | The port that the asset's TLS certificate was collected on, such as `443`. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl.validity.length` | The validity period of the certificate in seconds: 7,776,000 seconds are 90 days. |
| `ssl.extensions.signed_certificate_timestamps.timestamp` | When a Certificate Transparency log recorded the certificate, from a signed certificate timestamp (UTC date-time). |
| `ssl.extensions.signed_certificate_timestamps.version` | The version of a signed certificate timestamp; `0` stands for version 1. |
| `ssl_check_date` | When the TLS certificate of the asset was last checked (UTC date-time). |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the HTTP check, such as `301` or `200`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_check_date` | When the HTTP check of the asset last ran (UTC date-time). |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.redirection_history.status_code` | The HTTP status code at a step of the redirect chain of the web data scan, such as `301` or `200`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata.http.cookies.size` | The size of a cookie set in the web data scan, in bytes (name plus value). |
| `webdata.http.cookies.expires` | When a cookie set in the web data scan expires (UTC date-time); session cookies show `1969-12-31T23:59:59Z`. |
| `webdata.technology.stacks.confidence` | How certain the detection of a technology is, from 0 to 100; every sampled detection has `100`. |
| `webdata.technology.stacks.clean_version` | The major version of a detected technology as a whole number, such as `1` for version `1.0`. |
| `webdata_check_date` | When the web data scan of the asset, which collects the page content, headers and technologies, last ran (UTC date-time). |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn_date` | The registry allocation date that the ASN lookup reports for the IP address asset, as a date at midnight UTC. |
| `ipwhois.nir.nets.contacts.admin.updated` | When the administrative contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.contacts.tech.updated` | When the technical contact entry of a network block was last updated, in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset (UTC date-time). |
| `ipwhois.nir.nets.created` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was created (UTC date-time). |
| `ipwhois.nir.nets.updated` | When a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset was last updated (UTC date-time). |
| `ipwhois.network.events.timestamp` | When an event on the network record of the IP address asset happened (UTC date-time). |
| `ipwhois.objects.events.timestamp` | When an event on a contact record linked to the network of the IP address asset happened (UTC date-time). |
| `ipwhois_check_date` | When the IP WHOIS record of an IP address asset was last checked (UTC date-time). |
| `ipwhois_last_change_date` | When a change in the IP WHOIS record of an IP address asset was last seen (UTC date-time). |
| `ipdns_check_date` | When the reverse DNS (PTR) records of an IP address asset were last checked (UTC date-time). |
| `ipdns_last_change_date` | When a change in the reverse DNS (PTR) records of an IP address asset was last seen (UTC date-time). |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `open_port_count` | The number of open ports found on the asset. |
| `open_ports` | The open port numbers found on the asset, such as `80`, `443` or `8080`. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_category_stats.count` | The number of active issues in that category on the asset. |
| `issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the asset. |
| `issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the asset. |
| `issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the asset. |
| `issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the asset. |
| `issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the asset. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `issue_count.active_by_severity.low` | The number of active issues of low severity on the asset. |
| `issue_count.active_by_severity.information` | The number of active issues of information severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `technology_count.by_category.count` | The number of technologies in that category on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity on the asset. |
| `vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity on the asset. |
| `vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity on the asset. |
| `vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) on the asset whose severity is `none`. |
| `vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) on the asset whose severity is `unknown`. |
| `security_score` | The asset's External Attack Surface Management (EASM) security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.count` | The number of active issues in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.critical` | The number of active issues of critical severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.high` | The number of active issues of high severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.medium` | The number of active issues of medium severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.low` | The number of active issues of low severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_category_stats.severity_stats.information` | The number of active issues of information severity in that category on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.technology_count.by_category.count` | The number of distinct technologies in that category across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

Operators: `eq`, `exists`

| Field | Description |
|---|---|
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `fqdn.is_idn` | True when the host name is an internationalized domain name (IDN) with non-ASCII characters. |
| `fqdn.name.contains_confusable` | True when the name contains confusable characters that look like other letters, such as Cyrillic `а` for Latin `a`, a common trick in look-alike domains. |
| `fqdn.name.contains_hyphen` | True when the name (without the extension) contains a hyphen. |
| `fqdn.name.contains_letter` | True when the name (without the extension) contains a letter. |
| `fqdn.name.contains_number` | True when the name (without the extension) contains a digit. |
| `fqdn.domain.is_idn` | True when the registrable domain is an internationalized domain name (IDN) with non-ASCII characters. |
| `whois_privacy_enabled` | True when the platform flagged WHOIS privacy protection on the domain's registrant details; set on domain assets. |
| `ssl.signature.is_valid` | True when the asset's TLS certificate passed validation for the host; when false, `ssl.signature.invalid_reason` says why. |
| `ssl.signature.is_valid_chain` | A flag for whether the certificate chain of the asset's TLS certificate is valid. It was true on every sampled certificate, even one whose validation failed with `unable to get issuer certificate`. |
| `ssl.signature.is_self_signed` | True when the asset's TLS certificate is self-signed, that is signed by its own key rather than by a certificate authority. |
| `ssl.extensions.basic_constraints.is_ca` | True when the certificate is a certificate authority (CA) certificate, from its Basic Constraints extension. |
| `ssl.extensions.extended_key_usage.client_auth` | True when the Extended Key Usage extension allows TLS client authentication. |
| `ssl.extensions.extended_key_usage.server_auth` | True when the Extended Key Usage extension allows TLS server authentication, as website certificates need. |
| `ssl.extensions.key_usage.content_commitment` | True when the Key Usage extension allows the certificate's key to be used for content commitment (non-repudiation). |
| `ssl.extensions.key_usage.crl_sign` | True when the Key Usage extension allows the certificate's key to be used for signing certificate revocation lists (CRL sign). |
| `ssl.extensions.key_usage.data_encipherment` | True when the Key Usage extension allows the certificate's key to be used for data encipherment. |
| `ssl.extensions.key_usage.digital_signature` | True when the Key Usage extension allows the certificate's key to be used for digital signatures. |
| `ssl.extensions.key_usage.key_agreement` | True when the Key Usage extension allows the certificate's key to be used for key agreement. |
| `ssl.extensions.key_usage.key_cert_sign` | True when the Key Usage extension allows the certificate's key to be used for signing other certificates (certificate sign). |
| `ssl.extensions.key_usage.key_encipherment` | True when the Key Usage extension allows the certificate's key to be used for key encipherment. |
| `ssl.has_expired` | True when the asset's TLS certificate is past its end date. |
| `http.external_domain_redirection` | True when the HTTP check ended on a different registrable domain than it started on. |
| `http.external_fqdn_redirection` | True when the HTTP check ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.html.inspect_disabled` | A flag of the web data scan that marks pages whose inspection was disabled; it was `false` on every sampled asset. |
| `webdata.html.html_meta.no_index_status` | True when the scanned page asks search engines not to index it (a `noindex` robots directive). |
| `webdata.http.external_domain_redirection` | True when the web data scan ended on a different registrable domain than it started on. |
| `webdata.http.external_fqdn_redirection` | True when the web data scan ended on a different host name than it started on, for example `acme.example` to `www.acme.example`. |
| `webdata.http.cookies.secure` | True when a cookie set in the web data scan is sent over HTTPS only (Secure attribute). |
| `webdata.http.cookies.http_only` | True when scripts on the page cannot read a cookie set in the web data scan (HttpOnly attribute). |
| `webdata.http.cookies.session` | True when a cookie set in the web data scan is a session cookie, deleted when the browser closes. |
| `is_parked` | True when the asset is parked; Inventory marks it with a P badge whose tooltip shows where it redirects. |

Operators: `eq`, `in`, `exists`

| Field | Description |
|---|---|
| `asset_type` | The asset type: `domain`, `subdomain`, `ip` or `website`. |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `dns.dnskey.records.key_type` | The role of a DNSKEY: `ZSK` (zone-signing key), `KSK` (key-signing key) or `KSK_REVOKED` (revoked key-signing key). |
| `dns.dnskey.records.algorithm` | The DNSSEC algorithm of a DNSKEY, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.algorithm` | The DNSSEC algorithm of the key that a DS record refers to, such as `ECDSAP256SHA256` or `RSASHA256`. |
| `dns.ds.records.digest_type` | The hash used for a DS record's digest: `SHA1`, `SHA256`, `SHA384`, `GOST` or `NULL`. |
| `dns.rrsig.algorithm` | The DNSSEC algorithm of an RRSIG signature, such as `ECDSAP256SHA256` or `RSASHA256`. |

Operators: not measured

| Field | Description |
|---|---|
| `website.parent_asset.type` | The asset type of the website's parent asset, such as `subdomain`. |

### Sortable Fields

| Field | Description |
|---|---|
| `asset` | The asset's name: a domain, subdomain or IP address, or for a website asset `host:port`. |
| `added_date` | When the asset was added to your inventory (UTC date-time). |
| `creation_method` | How the asset entered your inventory: `manually_added` (added directly), `manually_approved` (approved by someone in Discovery) or `auto_approved` (added by a discovery rule with auto approval). |
| `latest_scan_date` | When the asset was last scanned, shown as the last check date in Inventory (UTC date-time). |
| `is_main_asset` | True for an asset you set as a main asset, which the platform describes as the primary asset for all related assets, configurations and reports. |
| `seems_inactive` | True when the platform found no active DNS records or WHOIS information for the asset (for a subdomain: no DNS records). An inactive asset gets no security score. |
| `seems_inactive_first_seen` | When the asset was first found to seem inactive (UTC date-time). |
| `seems_inactive_last_seen` | When the asset was most recently found to seem inactive (UTC date-time). |
| `discovery_enabled` | True when discovery uses the asset as a starting point to find related assets; false when discovery no longer finds new assets through it. |
| `dns_wildcard_active` | True when the asset has an active wildcard DNS record (such as `*.acme.example`), so any subdomain name under it resolves. |
| `is_login_page` | True when the asset serves a login page; Inventory marks it with a login page icon. |
| `login_page_probability` | The login page detector's confidence, from 0 to 1, that the asset serves a login page. In the samples it is set only on assets where `is_login_page` is true. |
| `fqdn.unicode` | The asset's full host name (FQDN) in its readable Unicode form. |
| `fqdn.punycode` | The asset's full host name (FQDN) in its ASCII (punycode) form, as used in DNS; for names without special characters it equals `fqdn.unicode`. |
| `fqdn.domain.unicode` | The registrable domain the asset belongs to, in Unicode: `acme.example` for both `acme.example` and `www.acme.example`. |
| `fqdn.domain.punycode` | The registrable domain the asset belongs to, in its ASCII (punycode) form. |
| `fqdn.domain.extension.unicode` | The domain's extension, everything after the name, such as `com` or `co.uk`. |
| `fqdn.domain.extension_root.unicode` | The top-level part of the extension: `uk` for both `uk` and `co.uk`. |
| `fqdn.domain.extension_type` | The kind of extension: `gTLD` for generic extensions such as `com`, `ccTLD` for country-code extensions such as `de` or `co.uk`. |
| `website.port` | The port of a website asset, such as `443`. |
| `whois.create_date` | When the domain was registered (created), from the WHOIS record of a domain asset (UTC date-time). |
| `whois.update_date` | When the domain registration was last updated, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.expiry_date` | When the domain registration expires, from the WHOIS record of a domain asset (UTC date-time). |
| `whois.domain_status` | The domain's EPP status codes from WHOIS, in lower case without spaces, such as `clienttransferprohibited`. |
| `whois.name_servers` | The name servers listed in the WHOIS record, such as `ns1.acme.example`. |
| `whois.registrar` | The registrar the domain is registered through, as written in WHOIS (usually lower case). |
| `whois.registrant.organization` | The registrant's organization in WHOIS; often a privacy placeholder such as `redacted for privacy` or a proxy service. |
| `whois.registrant.email` | The registrant's e-mail address in WHOIS; some registrars put a contact-form URL here instead. |
| `whois.registrant.phone` | The registrant's phone number in WHOIS, in the registry format such as `+1.4805551234`. |
| `dns.a.ip_addresses.ip` | An IPv4 address from the asset's A records (the A-record address); the other `dns.a.ip_addresses` fields hold its IP WHOIS (RDAP) data. |
| `dns.a.ip_addresses.asn` | The number of the autonomous system (ASN) that announces the A-record address, as a string such as `13335`. |
| `dns.a.ip_addresses.asn_cidr` | The routed prefix that contains the A-record address, in CIDR notation, from the ASN lookup. |
| `dns.a.ip_addresses.asn_description` | The name and holder of the autonomous system that announces the A-record address, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `dns.a.ip_addresses.asn_country_code` | The country of the autonomous system that announces the A-record address, as a two-letter code such as `US`. |
| `dns.a.ip_addresses.asn_registry` | The regional internet registry responsible for the A-record address, such as `arin` or `ripencc`. |
| `dns.a.ip_addresses.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the A-record address, in CIDR notation. |
| `dns.a.ip_addresses.network.cidr` | The registered network block that contains the A-record address, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `dns.a.ip_addresses.network.name` | The name of the registered network that contains the A-record address, such as `CLOUDFLARENET`. |
| `dns.a.ip_addresses.network.country` | The country of the registered network that contains the A-record address, as a two-letter code such as `FR`. |
| `dns.ns.name_servers` | The name server host names from the asset's NS records, such as `ns1.acme.example`. |
| `dns.mx.mail_servers` | The mail server host names from the asset's MX records, such as `mail.acme.example`. |
| `dns_last_change_date` | When a change in the DNS records of the asset was last seen (UTC date-time). |
| `ssl.serial_number` | The serial number of the asset's TLS certificate, as a decimal string. |
| `ssl.fingerprint.sha1` | The SHA-1 fingerprint of the asset's TLS certificate, as lower-case hex. |
| `ssl.subject.organization` | The organization (O) of the subject (holder) of the asset's TLS certificate. |
| `ssl.validity.start_date` | The date the asset's TLS certificate becomes valid (Not Before), as a UTC date-time. |
| `ssl.validity.end_date` | The date the asset's TLS certificate expires (Not After), as a UTC date-time. |
| `ssl_last_change_date` | When a change in the TLS certificate of the asset was last seen (UTC date-time). |
| `http.final_domain` | The registrable domain the HTTP check ended on after redirects, such as `acme.example`. |
| `http.final_fqdn` | The host name the HTTP check ended on after redirects, such as `www.acme.example`. |
| `http.first_status_code` | The HTTP status code of the first response in the HTTP check, such as `301` for a redirect or `200`. |
| `http.final_status_code` | The HTTP status code of the last response in the HTTP check, after redirects, such as `200`, `404` or `502`. Inventory's HTTP status column shows this value. |
| `http_last_change_date` | When a change in the HTTP check result of the asset was last seen (UTC date-time). |
| `webdata.http.final_domain` | The registrable domain the web data scan ended on after redirects, such as `acme.example`. |
| `webdata.http.final_fqdn` | The host name the web data scan ended on after redirects, such as `www.acme.example`. |
| `webdata.http.first_status_code` | The HTTP status code of the first response in the web data scan, such as `301` for a redirect or `200`. |
| `webdata.http.final_status_code` | The HTTP status code of the last response in the web data scan, after redirects, such as `200`, `404` or `502`. |
| `webdata_last_change_date` | When a change in the web data of the asset was last seen (UTC date-time). |
| `ipwhois.asn` | The number of the autonomous system (ASN) that announces the IP address asset, as a string such as `13335`. |
| `ipwhois.asn_cidr` | The routed prefix that contains the IP address asset, in CIDR notation, from the ASN lookup. |
| `ipwhois.asn_description` | The name and holder of the autonomous system that announces the IP address asset, such as `CLOUDFLARENET - Cloudflare, Inc., US`. |
| `ipwhois.asn_country_code` | The country of the autonomous system that announces the IP address asset, as a two-letter code such as `US`. |
| `ipwhois.asn_registry` | The regional internet registry responsible for the IP address asset, such as `arin` or `ripencc`. |
| `ipwhois.nir.nets.cidr` | The range of a network block in the NIR (national internet registry, such as JPNIC or KRNIC) record of the IP address asset, in CIDR notation. |
| `ipwhois.network.cidr` | The registered network block that contains the IP address asset, in CIDR notation, such as `192.0.2.0/24`; a network made of several blocks lists them separated by commas. |
| `ipwhois.network.name` | The name of the registered network that contains the IP address asset, such as `CLOUDFLARENET`. |
| `ipwhois.network.country` | The country of the registered network that contains the IP address asset, as a two-letter code such as `FR`. |
| `subdomain_count` | The number of subdomains of the domain in your inventory; set on domain assets. |
| `website_count` | The number of website assets (`host:port`) in your inventory that belong to this asset. |
| `pointed_fqdn_count` | A count of host names (FQDNs) that point to the asset; no sampled asset had a value. |
| `redirected_domain_count` | The number of domain assets in your inventory whose HTTP check ends on this asset after redirects. |
| `redirected_asset_count` | The number of assets of any type in your inventory whose HTTP check ends on this asset after redirects. |
| `open_port_count` | The number of open ports found on the asset. |
| `average_issue_duration` | The average duration of the issues on the asset, in seconds. |
| `average_fix_duration` | The average time taken to fix the issues on the asset, in seconds. |
| `issue_state_stats.newly_detected` | The number of issues on the asset in the `newly_detected` state, an active state set by the platform. |
| `issue_state_stats.reappeared` | The number of issues on the asset in the `reappeared` state, an active state set by the platform. |
| `issue_state_stats.unresolved` | The number of issues on the asset in the `unresolved` state, an active state set by the platform. |
| `issue_state_stats.marked_as_resolved` | The number of issues on the asset in the `marked_as_resolved` state, an inactive state that a user sets. |
| `issue_state_stats.risk_accepted` | The number of issues on the asset in the `risk_accepted` state, an inactive state that a user sets. |
| `issue_state_stats.ignored` | The number of issues on the asset in the `ignored` state, an inactive state that a user sets. |
| `issue_state_stats.marked_as_false_positive` | The number of issues on the asset in the `marked_as_false_positive` state, an inactive state that a user sets. |
| `issue_state_stats.not_applicable` | The number of issues on the asset in the `not_applicable` state, an inactive state set by the platform. |
| `issue_state_stats.verified_resolved` | The number of issues on the asset in the `verified_resolved` state, an inactive state set by the platform. |
| `issue_count.total` | The number of issues on the asset in any state, active or inactive. |
| `issue_count.active` | The number of active issues on the asset: those in the `newly_detected`, `unresolved` or `reappeared` state. |
| `issue_count.active_by_severity.critical` | The number of active issues of critical severity on the asset. |
| `issue_count.active_by_severity.high` | The number of active issues of high severity on the asset. |
| `issue_count.active_by_severity.medium` | The number of active issues of medium severity on the asset. |
| `technology_count.total` | The number of technologies detected on the asset. |
| `vulnerability_count.total` | The number of vulnerabilities (CVEs) found on the asset. |
| `vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity on the asset. |
| `security_score` | The asset's EASM security score; higher is better. Grades: A from 800, B from 700, C from 600, D from 500, E from 400, F from 300, and no grade below 300. |
| `weight` | The asset's effective weight: your user weight if you set one, otherwise the system weight. It affects your organization's overall security score. |
| `user_weight` | The weight you set for the asset, from 1 to 100; empty when you have not set one. |
| `system_weight` | The weight the platform calculates for the asset from many criteria; it can be above 100. |
| `domain_snapshot.average_issue_duration` | The average duration of the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.average_fix_duration` | The average time taken to fix the issues on the domain and its subdomains together, in seconds. Set on domain assets. |
| `domain_snapshot.open_port_count` | The number of open ports found on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.security_score` | The domain-level security score, which includes the impact of the domain's subdomains; it uses the same A to F bands as `security_score`. Set on domain assets. |
| `domain_snapshot.issue_count.total` | The number of issues on the domain and its subdomains together in any state, active or inactive. Set on domain assets. |
| `domain_snapshot.issue_count.active` | The number of active issues on the domain and its subdomains together: those in the `newly_detected`, `unresolved` or `reappeared` state. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.critical` | The number of active issues of critical severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.high` | The number of active issues of high severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.medium` | The number of active issues of medium severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.low` | The number of active issues of low severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_count.active_by_severity.information` | The number of active issues of information severity on the domain and its subdomains together. Set on domain assets. |
| `domain_snapshot.issue_state_stats.newly_detected` | The number of issues on the domain and its subdomains together in the `newly_detected` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.reappeared` | The number of issues on the domain and its subdomains together in the `reappeared` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.unresolved` | The number of issues on the domain and its subdomains together in the `unresolved` state, an active state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_resolved` | The number of issues on the domain and its subdomains together in the `marked_as_resolved` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.risk_accepted` | The number of issues on the domain and its subdomains together in the `risk_accepted` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.ignored` | The number of issues on the domain and its subdomains together in the `ignored` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.marked_as_false_positive` | The number of issues on the domain and its subdomains together in the `marked_as_false_positive` state, an inactive state that a user sets. Set on domain assets. |
| `domain_snapshot.issue_state_stats.not_applicable` | The number of issues on the domain and its subdomains together in the `not_applicable` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.issue_state_stats.verified_resolved` | The number of issues on the domain and its subdomains together in the `verified_resolved` state, an inactive state set by the platform. Set on domain assets. |
| `domain_snapshot.technology_count.total` | The number of distinct technologies detected across the domain and its subdomains, each counted once. Set on domain assets. |
| `domain_snapshot.vulnerability_count.total` | The number of vulnerabilities (CVEs) found across the domain and its subdomains, which in the samples is lower than the sum of their own counts. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.critical` | The number of vulnerabilities (CVEs) of critical severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.high` | The number of vulnerabilities (CVEs) of high severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.medium` | The number of vulnerabilities (CVEs) of medium severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.low` | The number of vulnerabilities (CVEs) of low severity across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.none` | The number of vulnerabilities (CVEs) whose severity is `none` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |
| `domain_snapshot.vulnerability_count.by_severity.unknown` | The number of vulnerabilities (CVEs) whose severity is `unknown` across the domain and its subdomains, counted like `domain_snapshot.vulnerability_count.total`. Set on domain assets. |

## Response Fields

| Field | Type | Description |
|---|---|---|
| `page` | integer |  |
| `page_size` | integer |  |
| `result_count` | integer |  |
| `results` | array of object |  |
| `results[].id` | string |  |
| `results[].asset` | string |  |
| `results[].asset_type` | string | One of `domain`, `subdomain`, `ip`, `website` |
| `results[].added_date` | string | date-time |
| `results[].tags` | array of string |  |
| `results[].creation_method` | string | One of `manually_added`, `manually_approved`, `auto_approved` |
| `results[].favicon` | string |  |
| `results[].screenshot` | string |  |
| `results[].thumbnail` | string |  |
| `results[].latest_scan_date` | string | date-time |
| `results[].is_main_asset` | boolean |  |
| `results[].seems_inactive` | boolean |  |
| `results[].seems_inactive_first_seen` | string | date-time |
| `results[].seems_inactive_last_seen` | string | date-time |
| `results[].discovery_enabled` | boolean |  |
| `results[].dns_wildcard_active` | boolean |  |
| `results[].is_login_page` | boolean |  |
| `results[].login_page_probability` | number |  |
| `results[].fqdn` | object |  |
| `results[].website` | object |  |
| `results[].whois` | object |  |
| `results[].whois_privacy_enabled` | boolean |  |
| `results[].whois_registrant_email_historical` | array of string |  |
| `results[].whois_create_date_historical` | array of string |  |
| `results[].whois_normalized` | object |  |
| `results[].whois_check_date` | string | date-time |
| `results[].whois_last_change_date` | string | date-time |
| `results[].whois_last_change_data` | array of string |  |
| `results[].dns` | object |  |
| `results[].dns_check_date` | string | date-time |
| `results[].dns_last_change_date` | string | date-time |
| `results[].dns_last_change_data` | array of string |  |
| `results[].ssl` | object |  |
| `results[].ssl_check_date` | string | date-time |
| `results[].ssl_last_change_date` | string | date-time |
| `results[].ssl_last_change_data` | array of string |  |
| `results[].http` | object |  |
| `results[].http_check_date` | string | date-time |
| `results[].http_last_change_date` | string | date-time |
| `results[].http_last_change_data` | array of string |  |
| `results[].webdata` | object |  |
| `results[].webdata_check_date` | string | date-time |
| `results[].webdata_last_change_date` | string | date-time |
| `results[].webdata_last_change_data` | array of string |  |
| `results[].ipwhois` | object |  |
| `results[].ipwhois_check_date` | string | date-time |
| `results[].ipwhois_last_change_date` | string | date-time |
| `results[].ipwhois_last_change_data` | array of string |  |
| `results[].ipdns` | object |  |
| `results[].ipdns_check_date` | string | date-time |
| `results[].ipdns_last_change_date` | string | date-time |
| `results[].ipdns_last_change_data` | array of string |  |
| `results[].subdomain_count` | integer |  |
| `results[].website_count` | integer |  |
| `results[].pointed_fqdn_count` | integer |  |
| `results[].redirected_domain_count` | integer |  |
| `results[].redirected_asset_count` | integer |  |
| `results[].average_issue_duration` | integer |  |
| `results[].average_fix_duration` | integer |  |
| `results[].is_parked` | boolean |  |
| `results[].open_port_count` | integer |  |
| `results[].open_ports` | array of integer |  |
| `results[].issue_state_stats` | object |  |
| `results[].issue_category_stats` | array of object |  |
| `results[].issue_count` | object |  |
| `results[].technology_count` | object |  |
| `results[].vulnerability_count` | object |  |
| `results[].security_score` | number |  |
| `results[].weight` | integer |  |
| `results[].user_weight` | integer |  |
| `results[].system_weight` | integer |  |
| `results[].domain_snapshot` | object |  |

Paginated. See [Getting Started → Pagination](/getting-started/pagination/).

## Response Schema

_Inferred from examples._ Built from the saved 2xx example response: the fields it contains, with the types seen there. It is not a contract.

| Field | Type |
|---|---|
| `page` | number |
| `page_size` | number |
| `result_count` | number |
| `results` | array<object> |
| `results[].id` | string |
| `results[].asset` | string |
| `results[].asset_type` | string |
| `results[].added_date` | string |
| `results[].tags` | array |
| `results[].creation_method` | string |
| `results[].favicon` | null |
| `results[].screenshot` | string \| null |
| `results[].thumbnail` | string \| null |
| `results[].latest_scan_date` | string |
| `results[].is_main_asset` | boolean |
| `results[].seems_inactive` | boolean |
| `results[].seems_inactive_first_seen` | null |
| `results[].seems_inactive_last_seen` | null |
| `results[].discovery_enabled` | boolean |
| `results[].dns_wildcard_active` | boolean \| null |
| `results[].is_login_page` | boolean |
| `results[].login_page_probability` | null |
| `results[].fqdn` | object |
| `results[].fqdn.unicode` | string |
| `results[].fqdn.punycode` | string |
| `results[].fqdn.is_idn` | boolean |
| `results[].fqdn.name` | object |
| `results[].fqdn.name.unicode` | string |
| `results[].fqdn.name.contains_confusable` | boolean |
| `results[].fqdn.name.latinized` | array |
| `results[].fqdn.name.contains_hyphen` | boolean |
| `results[].fqdn.name.contains_letter` | boolean |
| `results[].fqdn.name.contains_number` | boolean |
| `results[].fqdn.name.length` | number |
| `results[].fqdn.domain` | object |
| `results[].fqdn.domain.unicode` | string |
| `results[].fqdn.domain.punycode` | string |
| `results[].fqdn.domain.is_idn` | boolean |
| `results[].fqdn.domain.extension` | object |
| `results[].fqdn.domain.extension.unicode` | string |
| `results[].fqdn.domain.extension_root` | object |
| `results[].fqdn.domain.extension_root.unicode` | string |
| `results[].fqdn.domain.extension_sub` | null |
| `results[].fqdn.domain.extension_type` | string |
| `results[].website` | null |
| `results[].whois` | object |
| `results[].whois.create_date` | string |
| `results[].whois.update_date` | string |
| `results[].whois.expiry_date` | string |
| `results[].whois.domain_status` | array<string> |
| `results[].whois.name_servers` | array<string> |
| `results[].whois.registrar` | string |
| `results[].whois.registrant` | object |
| `results[].whois.registrant.organization` | string |
| `results[].whois.registrant.name` | string |
| `results[].whois.registrant.country` | string |
| `results[].whois.registrant.state` | string \| null |
| `results[].whois.registrant.city` | string |
| `results[].whois.registrant.street` | string |
| `results[].whois.registrant.postal_code` | string |
| `results[].whois.registrant.email` | string |
| `results[].whois.registrant.phone` | string |
| `results[].whois_privacy_enabled` | boolean |
| `results[].whois_registrant_email_historical` | array<string> |
| `results[].whois_create_date_historical` | array<string> |
| `results[].whois_normalized` | object |
| `results[].whois_normalized.registrar` | string |
| `results[].whois_normalized.registrant` | object |
| `results[].whois_normalized.registrant.email` | string \| null |
| `results[].whois_normalized.registrant.email_real` | null |
| `results[].whois_normalized.registrant.email_domain_apex` | string \| null |
| `results[].whois_normalized.registrant.email_fqdn_apex` | string \| null |
| `results[].whois_normalized.registrant.organization` | string |
| `results[].whois_normalized.registrant.phone` | string \| null |
| `results[].whois_check_date` | string |
| `results[].whois_last_change_date` | string |
| `results[].whois_last_change_data` | array<string> |
| `results[].dns` | object |
| `results[].dns.a` | object |
| `results[].dns.a.value` | string |
| `results[].dns.a.value_previous` | null |
| `results[].dns.a.value_last_change_date` | null |
| `results[].dns.a.rcode` | string |
| `results[].dns.a.rcode_previous` | null |
| `results[].dns.a.rcode_last_change_date` | null |
| `results[].dns.a.last_change_date` | null |
| `results[].dns.a.ip_addresses` | array<object> |
| `results[].dns.a.ip_addresses[].asn` | string |
| `results[].dns.a.ip_addresses[].asn_cidr` | string |
| `results[].dns.a.ip_addresses[].asn_description` | string |
| `results[].dns.a.ip_addresses[].asn_country_code` | string |
| `results[].dns.a.ip_addresses[].asn_registry` | string |
| `results[].dns.a.ip_addresses[].entities` | array<string> |
| `results[].dns.a.ip_addresses[].asn_date` | string |
| `results[].dns.a.ip_addresses[].nir` | null |
| `results[].dns.a.ip_addresses[].query` | string |
| `results[].dns.a.ip_addresses[].raw` | null |
| `results[].dns.a.ip_addresses[].network` | object |
| `results[].dns.a.ip_addresses[].network.cidr` | string |
| `results[].dns.a.ip_addresses[].network.name` | string |
| `results[].dns.a.ip_addresses[].network.country` | null |
| `results[].dns.a.ip_addresses[].network.start_address` | string |
| `results[].dns.a.ip_addresses[].network.end_address` | string |
| `results[].dns.a.ip_addresses[].network.handle` | string |
| `results[].dns.a.ip_addresses[].network.ip_version` | string |
| `results[].dns.a.ip_addresses[].network.links` | array<string> |
| `results[].dns.a.ip_addresses[].network.parent_handle` | string |
| `results[].dns.a.ip_addresses[].network.raw` | null |
| `results[].dns.a.ip_addresses[].network.status` | array<string> |
| `results[].dns.a.ip_addresses[].network.type` | string |
| `results[].dns.a.ip_addresses[].network.notices` | array<object> |
| `results[].dns.a.ip_addresses[].network.notices[].title` | string |
| `results[].dns.a.ip_addresses[].network.notices[].description` | string |
| `results[].dns.a.ip_addresses[].network.notices[].links` | array<string> |
| `results[].dns.a.ip_addresses[].network.remarks` | array<object> |
| `results[].dns.a.ip_addresses[].network.remarks[].title` | string |
| `results[].dns.a.ip_addresses[].network.remarks[].description` | string |
| `results[].dns.a.ip_addresses[].network.remarks[].links` | array |
| `results[].dns.a.ip_addresses[].network.events` | array<object> |
| `results[].dns.a.ip_addresses[].network.events[].action` | string |
| `results[].dns.a.ip_addresses[].network.events[].actor` | null |
| `results[].dns.a.ip_addresses[].network.events[].timestamp` | string |
| `results[].dns.a.ip_addresses[].objects` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].uid` | string |
| `results[].dns.a.ip_addresses[].objects[].contact` | object |
| `results[].dns.a.ip_addresses[].objects[].contact.email` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].contact.email[].type` | array |
| `results[].dns.a.ip_addresses[].objects[].contact.email[].value` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.address` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].contact.address[].type` | array |
| `results[].dns.a.ip_addresses[].objects[].contact.address[].value` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.phone` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].contact.phone[].type` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].contact.phone[].value` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.kind` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.name` | string |
| `results[].dns.a.ip_addresses[].objects[].contact.role` | null |
| `results[].dns.a.ip_addresses[].objects[].contact.title` | null |
| `results[].dns.a.ip_addresses[].objects[].entities` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].events` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].events[].action` | string |
| `results[].dns.a.ip_addresses[].objects[].events[].actor` | null |
| `results[].dns.a.ip_addresses[].objects[].events[].timestamp` | string |
| `results[].dns.a.ip_addresses[].objects[].events_actor` | array |
| `results[].dns.a.ip_addresses[].objects[].handle` | string |
| `results[].dns.a.ip_addresses[].objects[].links` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].notices` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].notices[].title` | string |
| `results[].dns.a.ip_addresses[].objects[].notices[].description` | string |
| `results[].dns.a.ip_addresses[].objects[].notices[].links` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].raw` | null |
| `results[].dns.a.ip_addresses[].objects[].remarks` | array<object> |
| `results[].dns.a.ip_addresses[].objects[].remarks[].title` | string |
| `results[].dns.a.ip_addresses[].objects[].remarks[].description` | string |
| `results[].dns.a.ip_addresses[].objects[].remarks[].links` | array |
| `results[].dns.a.ip_addresses[].objects[].roles` | array<string> |
| `results[].dns.a.ip_addresses[].objects[].status` | array<string> |
| `results[].dns.a.ip_addresses[].ip` | string |
| `results[].dns.a.ip_history` | array<string> |
| `results[].dns.aaaa` | object \| null |
| `results[].dns.aaaa.value` | string |
| `results[].dns.aaaa.value_previous` | null |
| `results[].dns.aaaa.value_last_change_date` | null |
| `results[].dns.aaaa.rcode` | string |
| `results[].dns.aaaa.rcode_previous` | null |
| `results[].dns.aaaa.rcode_last_change_date` | null |
| `results[].dns.aaaa.last_change_date` | null |
| `results[].dns.aaaa.ip_addresses` | array<string> |
| `results[].dns.caa` | null |
| `results[].dns.cname` | null |
| `results[].dns.dnskey` | null |
| `results[].dns.ds` | null |
| `results[].dns.ns` | object |
| `results[].dns.ns.value` | string |
| `results[].dns.ns.value_previous` | string \| null |
| `results[].dns.ns.value_last_change_date` | string \| null |
| `results[].dns.ns.rcode` | string |
| `results[].dns.ns.rcode_previous` | null |
| `results[].dns.ns.rcode_last_change_date` | null |
| `results[].dns.ns.last_change_date` | string \| null |
| `results[].dns.ns.name_servers` | array<string> |
| `results[].dns.ns.domains` | array<string> |
| `results[].dns.mx` | object |
| `results[].dns.mx.value` | string |
| `results[].dns.mx.value_previous` | null |
| `results[].dns.mx.value_last_change_date` | null |
| `results[].dns.mx.rcode` | string |
| `results[].dns.mx.rcode_previous` | null |
| `results[].dns.mx.rcode_last_change_date` | null |
| `results[].dns.mx.last_change_date` | null |
| `results[].dns.mx.mail_servers` | array<string> |
| `results[].dns.mx.domains` | array<string> |
| `results[].dns.nsec` | null |
| `results[].dns.nsec3` | null |
| `results[].dns.rrsig` | null |
| `results[].dns.soa` | object |
| `results[].dns.soa.value` | string |
| `results[].dns.soa.value_previous` | string \| null |
| `results[].dns.soa.value_last_change_date` | string \| null |
| `results[].dns.soa.rcode` | string |
| `results[].dns.soa.rcode_previous` | null |
| `results[].dns.soa.rcode_last_change_date` | null |
| `results[].dns.soa.last_change_date` | string \| null |
| `results[].dns.soa.mnames` | array<string> |
| `results[].dns.soa.rnames` | array<string> |
| `results[].dns.soa.rname_emails` | array<string> |
| `results[].dns.srv` | null |
| `results[].dns.txt` | object |
| `results[].dns.txt.value` | string |
| `results[].dns.txt.value_previous` | null |
| `results[].dns.txt.value_last_change_date` | null |
| `results[].dns.txt.rcode` | string |
| `results[].dns.txt.rcode_previous` | null |
| `results[].dns.txt.rcode_last_change_date` | null |
| `results[].dns.txt.last_change_date` | null |
| `results[].dns.txt.values` | array<string> |
| `results[].dns.txt.spf_list` | array<object> |
| `results[].dns.txt.spf_list[].value` | string |
| `results[].dns.txt.spf_list[].allowed_domains` | array<string> |
| `results[].dns.txt.spf_list[].allowed_ips` | array |
| `results[].dns.txt.verifications` | array<object> |
| `results[].dns.txt.verifications[].value` | string |
| `results[].dns.txt.verifications[].domain` | string |
| `results[].dns.txt.verifications[].name` | string |
| `results[].dns_check_date` | string |
| `results[].dns_last_change_date` | string \| null |
| `results[].dns_last_change_data` | array<string> |
| `results[].ssl` | object \| null |
| `results[].ssl.target` | string |
| `results[].ssl.port` | number |
| `results[].ssl.serial_number` | string |
| `results[].ssl.fingerprint` | object |
| `results[].ssl.fingerprint.md5` | string |
| `results[].ssl.fingerprint.sha1` | string |
| `results[].ssl.fingerprint.sha256` | string |
| `results[].ssl.issuer` | object |
| `results[].ssl.issuer.common_name` | string |
| `results[].ssl.issuer.country` | string |
| `results[].ssl.issuer.state` | null |
| `results[].ssl.issuer.locality` | null |
| `results[].ssl.issuer.organization` | string |
| `results[].ssl.issuer.organizational_unit` | null |
| `results[].ssl.issuer_dn` | string |
| `results[].ssl.subject` | object |
| `results[].ssl.subject.common_name` | string |
| `results[].ssl.subject.country` | null |
| `results[].ssl.subject.state` | null |
| `results[].ssl.subject.locality` | null |
| `results[].ssl.subject.organization` | null |
| `results[].ssl.subject.organizational_unit` | null |
| `results[].ssl.subject_dn` | string |
| `results[].ssl.signature` | object |
| `results[].ssl.signature.value` | string |
| `results[].ssl.signature.is_valid` | boolean |
| `results[].ssl.signature.invalid_reason` | null |
| `results[].ssl.signature.is_valid_chain` | boolean |
| `results[].ssl.signature.is_self_signed` | boolean |
| `results[].ssl.signature.algorithm` | object |
| `results[].ssl.signature.algorithm.name` | string |
| `results[].ssl.signature.algorithm.oid` | string |
| `results[].ssl.validity` | object |
| `results[].ssl.validity.start_date` | string |
| `results[].ssl.validity.end_date` | string |
| `results[].ssl.validity.length` | number |
| `results[].ssl.extensions` | object |
| `results[].ssl.extensions.authority_key_id` | string |
| `results[].ssl.extensions.basic_constraints` | object |
| `results[].ssl.extensions.basic_constraints.is_ca` | boolean |
| `results[].ssl.extensions.certificate_policies` | array<string> |
| `results[].ssl.extensions.extended_key_usage` | object |
| `results[].ssl.extensions.extended_key_usage.client_auth` | null |
| `results[].ssl.extensions.extended_key_usage.server_auth` | boolean |
| `results[].ssl.extensions.key_usage` | object |
| `results[].ssl.extensions.key_usage.content_commitment` | boolean |
| `results[].ssl.extensions.key_usage.crl_sign` | boolean |
| `results[].ssl.extensions.key_usage.data_encipherment` | boolean |
| `results[].ssl.extensions.key_usage.digital_signature` | boolean |
| `results[].ssl.extensions.key_usage.key_agreement` | boolean |
| `results[].ssl.extensions.key_usage.key_cert_sign` | boolean |
| `results[].ssl.extensions.key_usage.key_encipherment` | boolean |
| `results[].ssl.extensions.signed_certificate_timestamps` | array<object> |
| `results[].ssl.extensions.signed_certificate_timestamps[].log_id` | string |
| `results[].ssl.extensions.signed_certificate_timestamps[].timestamp` | string |
| `results[].ssl.extensions.signed_certificate_timestamps[].version` | number |
| `results[].ssl.extensions.signed_certificate_timestamps[].signature` | string |
| `results[].ssl.extensions.subject_alt_name` | object |
| `results[].ssl.extensions.subject_alt_name.dns_names` | array<string> |
| `results[].ssl.extensions.subject_key_id` | string |
| `results[].ssl.subject_key_info` | object |
| `results[].ssl.subject_key_info.fingerprint` | object |
| `results[].ssl.subject_key_info.fingerprint.hash_algorithm` | string |
| `results[].ssl.subject_key_info.fingerprint.value` | string |
| `results[].ssl.subject_key_info.key_algorithm` | object |
| `results[].ssl.subject_key_info.key_algorithm.name` | string |
| `results[].ssl.version` | object |
| `results[].ssl.version.name` | string |
| `results[].ssl.version.value` | string |
| `results[].ssl.tbs_fingerprint` | string |
| `results[].ssl.certificate` | string |
| `results[].ssl.has_expired` | boolean |
| `results[].ssl.fqdn_list` | array<string> |
| `results[].ssl_check_date` | string |
| `results[].ssl_last_change_date` | string \| null |
| `results[].ssl_last_change_data` | array<string> |
| `results[].http` | object |
| `results[].http.requested_url` | string |
| `results[].http.requested_domain` | string |
| `results[].http.requested_fqdn` | string |
| `results[].http.final_url` | string |
| `results[].http.final_domain` | string |
| `results[].http.final_fqdn` | string |
| `results[].http.redirection_history` | array<object> |
| `results[].http.redirection_history[].url` | string |
| `results[].http.redirection_history[].status_code` | number |
| `results[].http.external_domain_redirection` | boolean |
| `results[].http.external_fqdn_redirection` | boolean |
| `results[].http.first_status_code` | number |
| `results[].http.final_status_code` | number |
| `results[].http.headers` | object |
| `results[].http.headers.accept` | null |
| `results[].http.headers.accept_encoding` | null |
| `results[].http.headers.accept_language` | null |
| `results[].http.headers.access_control_allow_credentials` | null |
| `results[].http.headers.access_control_allow_headers` | null |
| `results[].http.headers.access_control_allow_methods` | null |
| `results[].http.headers.access_control_allow_origin` | string \| null |
| `results[].http.headers.access_control_expose_headers` | null |
| `results[].http.headers.access_control_max_age` | null |
| `results[].http.headers.alt_svc` | null |
| `results[].http.headers.authorization` | null |
| `results[].http.headers.cache_control` | string \| null |
| `results[].http.headers.clear_site_data` | null |
| `results[].http.headers.content_disposition` | null |
| `results[].http.headers.content_encoding` | string |
| `results[].http.headers.content_language` | null |
| `results[].http.headers.content_length` | string \| null |
| `results[].http.headers.content_range` | null |
| `results[].http.headers.content_security_policy` | string \| null |
| `results[].http.headers.content_type` | string |
| `results[].http.headers.cookie` | null |
| `results[].http.headers.cross_origin_embedder_policy` | null |
| `results[].http.headers.cross_origin_opener_policy` | null |
| `results[].http.headers.cross_origin_resource_policy` | null |
| `results[].http.headers.date` | string |
| `results[].http.headers.early_data` | null |
| `results[].http.headers.expect_ct` | null |
| `results[].http.headers.expires` | null |
| `results[].http.headers.feature_policy` | null |
| `results[].http.headers.host` | null |
| `results[].http.headers.if_modified_since` | null |
| `results[].http.headers.if_none_match` | null |
| `results[].http.headers.last_modified` | string \| null |
| `results[].http.headers.origin_isolation` | null |
| `results[].http.headers.others` | array<object> |
| `results[].http.headers.others[].name` | string |
| `results[].http.headers.others[].value` | string |
| `results[].http.headers.permission_policy` | null |
| `results[].http.headers.permissions_policy` | string \| null |
| `results[].http.headers.pragma` | null |
| `results[].http.headers.proxy_authenticate` | null |
| `results[].http.headers.proxy_authorization` | null |
| `results[].http.headers.public_key_pins` | null |
| `results[].http.headers.range` | null |
| `results[].http.headers.referer` | null |
| `results[].http.headers.referrer_policy` | string \| null |
| `results[].http.headers.sec_fetch_dest` | null |
| `results[].http.headers.sec_fetch_mode` | null |
| `results[].http.headers.sec_fetch_site` | null |
| `results[].http.headers.sec_fetch_user` | null |
| `results[].http.headers.server` | string |
| `results[].http.headers.set_cookie` | null |
| `results[].http.headers.strict_transport_security` | string \| null |
| `results[].http.headers.te` | null |
| `results[].http.headers.transfer_encoding` | string \| null |
| `results[].http.headers.upgrade` | null |
| `results[].http.headers.user_agent` | null |
| `results[].http.headers.vary` | string |
| `results[].http.headers.www_authenticate` | null |
| `results[].http.headers.x_content_type_options` | string \| null |
| `results[].http.headers.x_download_options` | null |
| `results[].http.headers.x_frame_options` | string \| null |
| `results[].http.headers.x_permitted_cross_domain_policies` | null |
| `results[].http.headers.x_powered_by` | string \| null |
| `results[].http.headers.x_xss_protection` | null |
| `results[].http.cookies` | array |
| `results[].http.html` | object |
| `results[].http.html.source_code_hash` | string |
| `results[].http_check_date` | string |
| `results[].http_last_change_date` | string |
| `results[].http_last_change_data` | array<string> |
| `results[].webdata` | object \| null |
| `results[].webdata.requested_url` | string |
| `results[].webdata.requested_domain` | string |
| `results[].webdata.requested_fqdn` | string |
| `results[].webdata.html` | object |
| `results[].webdata.html.internal_links_fqdns` | array<string> |
| `results[].webdata.html.external_links_domains` | array |
| `results[].webdata.html.external_links_fqdns` | array |
| `results[].webdata.html.external_links` | array |
| `results[].webdata.html.script_links` | array |
| `results[].webdata.html.iframe_links` | array |
| `results[].webdata.html.trackers` | array |
| `results[].webdata.html.emails` | array |
| `results[].webdata.html.emails_internal` | array |
| `results[].webdata.html.inspect_disabled` | boolean |
| `results[].webdata.html.source_code_hash` | string |
| `results[].webdata.html.content_hash` | string |
| `results[].webdata.html.content_top_keywords` | array<string> |
| `results[].webdata.html.favicon_links` | array |
| `results[].webdata.html.html_meta` | object |
| `results[].webdata.html.html_meta.name` | null |
| `results[].webdata.html.html_meta.description` | null |
| `results[].webdata.html.html_meta.language` | string |
| `results[].webdata.html.html_meta.language_alternatives` | array |
| `results[].webdata.html.html_meta.keywords` | array |
| `results[].webdata.html.html_meta.no_index_status` | boolean |
| `results[].webdata.html.html_meta.encoding` | null |
| `results[].webdata.html.html_meta.canonical_url` | null |
| `results[].webdata.html.html_meta.title` | string |
| `results[].webdata.favicon` | array |
| `results[].webdata.http` | object |
| `results[].webdata.http.final_url` | string |
| `results[].webdata.http.final_domain` | string |
| `results[].webdata.http.final_fqdn` | string |
| `results[].webdata.http.redirection_history` | array<object> |
| `results[].webdata.http.redirection_history[].url` | string |
| `results[].webdata.http.redirection_history[].status_code` | number |
| `results[].webdata.http.redirection_history[].method` | null |
| `results[].webdata.http.external_domain_redirection` | boolean |
| `results[].webdata.http.external_fqdn_redirection` | boolean |
| `results[].webdata.http.first_status_code` | number |
| `results[].webdata.http.final_status_code` | number |
| `results[].webdata.http.headers` | object |
| `results[].webdata.http.headers.accept` | null |
| `results[].webdata.http.headers.accept_encoding` | null |
| `results[].webdata.http.headers.accept_language` | null |
| `results[].webdata.http.headers.access_control_allow_credentials` | null |
| `results[].webdata.http.headers.access_control_allow_headers` | null |
| `results[].webdata.http.headers.access_control_allow_methods` | null |
| `results[].webdata.http.headers.access_control_allow_origin` | null |
| `results[].webdata.http.headers.access_control_expose_headers` | null |
| `results[].webdata.http.headers.access_control_max_age` | null |
| `results[].webdata.http.headers.alt_svc` | null |
| `results[].webdata.http.headers.authorization` | null |
| `results[].webdata.http.headers.cache_control` | null |
| `results[].webdata.http.headers.clear_site_data` | null |
| `results[].webdata.http.headers.content_disposition` | null |
| `results[].webdata.http.headers.content_encoding` | string |
| `results[].webdata.http.headers.content_language` | null |
| `results[].webdata.http.headers.content_length` | string |
| `results[].webdata.http.headers.content_range` | null |
| `results[].webdata.http.headers.content_security_policy` | null |
| `results[].webdata.http.headers.content_type` | string |
| `results[].webdata.http.headers.cookie` | null |
| `results[].webdata.http.headers.cross_origin_embedder_policy` | null |
| `results[].webdata.http.headers.cross_origin_opener_policy` | null |
| `results[].webdata.http.headers.cross_origin_resource_policy` | null |
| `results[].webdata.http.headers.date` | string |
| `results[].webdata.http.headers.early_data` | null |
| `results[].webdata.http.headers.expect_ct` | null |
| `results[].webdata.http.headers.expires` | null |
| `results[].webdata.http.headers.feature_policy` | null |
| `results[].webdata.http.headers.host` | null |
| `results[].webdata.http.headers.if_modified_since` | null |
| `results[].webdata.http.headers.if_none_match` | null |
| `results[].webdata.http.headers.last_modified` | string |
| `results[].webdata.http.headers.origin_isolation` | null |
| `results[].webdata.http.headers.others` | array<object> |
| `results[].webdata.http.headers.others[].name` | string |
| `results[].webdata.http.headers.others[].value` | string |
| `results[].webdata.http.headers.permission_policy` | null |
| `results[].webdata.http.headers.permissions_policy` | null |
| `results[].webdata.http.headers.pragma` | null |
| `results[].webdata.http.headers.proxy_authenticate` | null |
| `results[].webdata.http.headers.proxy_authorization` | null |
| `results[].webdata.http.headers.public_key_pins` | null |
| `results[].webdata.http.headers.range` | null |
| `results[].webdata.http.headers.referer` | null |
| `results[].webdata.http.headers.referrer_policy` | null |
| `results[].webdata.http.headers.sec_fetch_dest` | null |
| `results[].webdata.http.headers.sec_fetch_mode` | null |
| `results[].webdata.http.headers.sec_fetch_site` | null |
| `results[].webdata.http.headers.sec_fetch_user` | null |
| `results[].webdata.http.headers.server` | string |
| `results[].webdata.http.headers.set_cookie` | null |
| `results[].webdata.http.headers.strict_transport_security` | null |
| `results[].webdata.http.headers.te` | null |
| `results[].webdata.http.headers.transfer_encoding` | null |
| `results[].webdata.http.headers.upgrade` | null |
| `results[].webdata.http.headers.user_agent` | null |
| `results[].webdata.http.headers.vary` | string |
| `results[].webdata.http.headers.www_authenticate` | null |
| `results[].webdata.http.headers.x_content_type_options` | null |
| `results[].webdata.http.headers.x_download_options` | null |
| `results[].webdata.http.headers.x_frame_options` | null |
| `results[].webdata.http.headers.x_permitted_cross_domain_policies` | null |
| `results[].webdata.http.headers.x_powered_by` | string |
| `results[].webdata.http.headers.x_xss_protection` | null |
| `results[].webdata.http.cookies` | array |
| `results[].webdata.technology` | object |
| `results[].webdata.technology.stacks` | array<object> |
| `results[].webdata.technology.stacks[].slug` | string |
| `results[].webdata.technology.stacks[].name` | string |
| `results[].webdata.technology.stacks[].confidence` | number |
| `results[].webdata.technology.stacks[].icon` | string |
| `results[].webdata.technology.stacks[].website` | string |
| `results[].webdata.technology.stacks[].cpe` | string |
| `results[].webdata.technology.stacks[].version` | string |
| `results[].webdata.technology.stacks[].categories` | array<string> |
| `results[].webdata.technology.stacks[].description` | string |
| `results[].webdata.technology.stacks[].clean_version` | null |
| `results[].webdata_check_date` | string \| null |
| `results[].webdata_last_change_date` | string \| null |
| `results[].webdata_last_change_data` | array<string> |
| `results[].ipwhois` | null |
| `results[].ipwhois_check_date` | null |
| `results[].ipwhois_last_change_date` | null |
| `results[].ipwhois_last_change_data` | array |
| `results[].ipdns` | null |
| `results[].ipdns_check_date` | null |
| `results[].ipdns_last_change_date` | null |
| `results[].ipdns_last_change_data` | array |
| `results[].subdomain_count` | number |
| `results[].website_count` | number |
| `results[].pointed_fqdn_count` | null |
| `results[].redirected_domain_count` | number |
| `results[].redirected_asset_count` | number |
| `results[].average_issue_duration` | number |
| `results[].average_fix_duration` | number |
| `results[].is_parked` | boolean |
| `results[].open_port_count` | number |
| `results[].open_ports` | array<number> |
| `results[].issue_state_stats` | object |
| `results[].issue_state_stats.newly_detected` | number |
| `results[].issue_state_stats.reappeared` | number |
| `results[].issue_state_stats.unresolved` | number |
| `results[].issue_state_stats.marked_as_resolved` | number |
| `results[].issue_state_stats.risk_accepted` | number |
| `results[].issue_state_stats.ignored` | number |
| `results[].issue_state_stats.marked_as_false_positive` | number |
| `results[].issue_state_stats.not_applicable` | number |
| `results[].issue_state_stats.verified_resolved` | number |
| `results[].issue_category_stats` | array<object> |
| `results[].issue_category_stats[].name` | string |
| `results[].issue_category_stats[].count` | number |
| `results[].issue_category_stats[].severity_stats` | object |
| `results[].issue_category_stats[].severity_stats.critical` | number |
| `results[].issue_category_stats[].severity_stats.high` | number |
| `results[].issue_category_stats[].severity_stats.medium` | number |
| `results[].issue_category_stats[].severity_stats.low` | number |
| `results[].issue_category_stats[].severity_stats.information` | number |
| `results[].issue_count` | object |
| `results[].issue_count.total` | number |
| `results[].issue_count.active` | number |
| `results[].issue_count.active_by_severity` | object |
| `results[].issue_count.active_by_severity.critical` | number |
| `results[].issue_count.active_by_severity.high` | number |
| `results[].issue_count.active_by_severity.medium` | number |
| `results[].issue_count.active_by_severity.low` | number |
| `results[].issue_count.active_by_severity.information` | number |
| `results[].technology_count` | object |
| `results[].technology_count.total` | number |
| `results[].technology_count.by_category` | array<object> |
| `results[].technology_count.by_category[].name` | string |
| `results[].technology_count.by_category[].count` | number |
| `results[].vulnerability_count` | object |
| `results[].vulnerability_count.total` | number |
| `results[].vulnerability_count.by_severity` | object |
| `results[].vulnerability_count.by_severity.critical` | number |
| `results[].vulnerability_count.by_severity.high` | number |
| `results[].vulnerability_count.by_severity.medium` | number |
| `results[].vulnerability_count.by_severity.low` | number |
| `results[].vulnerability_count.by_severity.none` | number |
| `results[].vulnerability_count.by_severity.unknown` | number |
| `results[].security_score` | number |
| `results[].weight` | number |
| `results[].user_weight` | null |
| `results[].system_weight` | number |
| `results[].domain_snapshot` | object |
| `results[].domain_snapshot.issue_count` | object |
| `results[].domain_snapshot.issue_count.total` | number |
| `results[].domain_snapshot.issue_count.active` | number |
| `results[].domain_snapshot.issue_count.active_by_severity` | object |
| `results[].domain_snapshot.issue_count.active_by_severity.critical` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.high` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.medium` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.low` | number |
| `results[].domain_snapshot.issue_count.active_by_severity.information` | number |
| `results[].domain_snapshot.issue_category_stats` | array<object> |
| `results[].domain_snapshot.issue_category_stats[].name` | string |
| `results[].domain_snapshot.issue_category_stats[].count` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats` | object |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.critical` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.high` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.medium` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.low` | number |
| `results[].domain_snapshot.issue_category_stats[].severity_stats.information` | number |
| `results[].domain_snapshot.issue_state_stats` | object |
| `results[].domain_snapshot.issue_state_stats.newly_detected` | number |
| `results[].domain_snapshot.issue_state_stats.reappeared` | number |
| `results[].domain_snapshot.issue_state_stats.unresolved` | number |
| `results[].domain_snapshot.issue_state_stats.marked_as_resolved` | number |
| `results[].domain_snapshot.issue_state_stats.risk_accepted` | number |
| `results[].domain_snapshot.issue_state_stats.ignored` | number |
| `results[].domain_snapshot.issue_state_stats.marked_as_false_positive` | number |
| `results[].domain_snapshot.issue_state_stats.not_applicable` | number |
| `results[].domain_snapshot.issue_state_stats.verified_resolved` | number |
| `results[].domain_snapshot.average_issue_duration` | number |
| `results[].domain_snapshot.average_fix_duration` | number |
| `results[].domain_snapshot.technology_count` | object |
| `results[].domain_snapshot.technology_count.total` | number |
| `results[].domain_snapshot.technology_count.by_category` | array<object> |
| `results[].domain_snapshot.technology_count.by_category[].name` | string |
| `results[].domain_snapshot.technology_count.by_category[].count` | number |
| `results[].domain_snapshot.open_port_count` | number |
| `results[].domain_snapshot.vulnerability_count` | object |
| `results[].domain_snapshot.vulnerability_count.total` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity` | object |
| `results[].domain_snapshot.vulnerability_count.by_severity.critical` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.high` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.medium` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.low` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.none` | number |
| `results[].domain_snapshot.vulnerability_count.by_severity.unknown` | number |
| `results[].domain_snapshot.security_score` | number |

## Examples

### 200 · OK

```bash
curl -X POST 'https://api.deepinfo.com/v1/easm/assets/search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

`Content-Type: application/json` · `deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001`

```json
{
  "page": 1,
  "page_size": 25,
  "result_count": 21,
  "results": [
    {
      "id": "000000000000000ea4f90001",
      "asset": "acme.example",
      "asset_type": "domain",
      "added_date": "2025-06-01T08:00:00Z",
      "tags": [],
      "creation_method": "manually_added",
      "favicon": null,
      "screenshot": null,
      "thumbnail": null,
      "latest_scan_date": "2025-07-31T08:00:00Z",
      "is_main_asset": true,
      "seems_inactive": false,
      "seems_inactive_first_seen": null,
      "seems_inactive_last_seen": null,
      "discovery_enabled": true,
      "dns_wildcard_active": null,
      "is_login_page": false,
      "login_page_probability": null,
      "fqdn": {
        "unicode": "acme.example",
        "punycode": "acme.example",
        "is_idn": false,
        "name": {
          "unicode": "acme",
          "contains_confusable": false,
          "latinized": [],
          "contains_hyphen": false,
          "contains_letter": true,
          "contains_number": false,
          "length": 4
        },
        "domain": {
          "unicode": "acme.example",
          "punycode": "acme.example",
          "is_idn": false,
          "extension": {
            "unicode": "example"
          },
          "extension_root": {
            "unicode": "example"
          },
          "extension_sub": null,
          "extension_type": "gTLD"
        }
      },
      "website": null,
      "whois": {
        "create_date": "2025-06-01T08:00:00Z",
        "update_date": "2025-07-01T08:00:00Z",
        "expiry_date": "2026-06-01T08:00:00Z",
        "domain_status": [
          "clientdeleteprohibited",
          "clientrenewprohibited"
        ],
        "name_servers": [
          "ns1.acme.example",
          "ns2.acme.example"
        ],
        "registrar": "Kestrel Domains",
        "registrant": {
          "organization": "REDACTED FOR PRIVACY",
          "name": "REDACTED FOR PRIVACY",
          "country": "US",
          "state": "REDACTED FOR PRIVACY",
          "city": "Springfield",
          "street": "REDACTED FOR PRIVACY",
          "postal_code": "REDACTED FOR PRIVACY",
          "email": "https://www.fernhill.example/",
          "phone": "+1-555-0100"
        }
      },
      "whois_privacy_enabled": true,
      "whois_registrant_email_historical": [
        "https://www.fernhill.example/"
      ],
      "whois_create_date_historical": [
        "2025-06-01T08:00:00Z"
      ],
      "whois_normalized": {
        "registrar": "Kestrel Domains",
        "registrant": {
          "email": null,
          "email_real": null,
          "email_domain_apex": null,
          "email_fqdn_apex": null,
          "organization": "REDACTED FOR PRIVACY",
          "phone": "+1-555-0100"
        }
      },
      "whois_check_date": "2025-07-31T08:00:00Z",
      "whois_last_change_date": "2025-07-01T08:00:00Z",
      "whois_last_change_data": [
        "whois.create_date"
      ],
      "dns": {
        "a": {
          "value": "acme.example. 300 IN A 192.0.2.10\nacme.example. 300 IN A 192.0.2.11",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "ip_addresses": [
            {
              "asn": "64496",
              "asn_cidr": "192.0.2.0/24",
              "asn_description": "ACME-AS",
              "asn_country_code": "US",
              "asn_registry": "arin",
              "entities": [
                "ACME-NET",
                "ACME-NET-2"
              ],
              "asn_date": "2025-07-16T08:00:00Z",
              "nir": null,
              "query": "192.0.2.10",
              "raw": null,
              "network": {
                "cidr": "192.0.2.0/24",
                "name": "ACME-NET",
                "country": null,
                "start_address": "192.0.2.0",
                "end_address": "192.0.2.255",
                "handle": "NET-192-0-2-0-2",
                "ip_version": "v4",
                "links": [
                  "https://www.fernhill.example/",
                  "https://app.fernhill.example/"
                ],
                "parent_handle": "NET-192-0-2-0-1",
                "raw": null,
                "status": [
                  "active"
                ],
                "type": "DIRECT ALLOCATION",
                "notices": [
                  {
                    "title": "Terms of Service",
                    "description": "A notice from the registry about this registration.",
                    "links": [
                      "https://www.fernhill.example/"
                    ]
                  },
                  {
                    "title": "Status Codes",
                    "description": "A notice from the registry about this registration.",
                    "links": [
                      "https://www.fernhill.example/"
                    ]
                  }
                ],
                "remarks": [
                  {
                    "title": "Terms of Service",
                    "description": "A notice from the registry about this registration.",
                    "links": []
                  }
                ],
                "events": [
                  {
                    "action": "last changed",
                    "actor": null,
                    "timestamp": "2025-07-31T08:00:00Z"
                  },
                  {
                    "action": "registration",
                    "actor": null,
                    "timestamp": "2025-07-24T08:00:00Z"
                  }
                ]
              },
              "objects": [
                {
                  "uid": "acme-object",
                  "contact": {
                    "email": [],
                    "address": [
                      {
                        "type": [],
                        "value": "REDACTED FOR PRIVACY"
                      }
                    ],
                    "phone": [],
                    "kind": "org",
                    "name": "REDACTED FOR PRIVACY",
                    "role": null,
                    "title": null
                  },
                  "entities": [
                    "ACME-NET",
                    "ACME-NET-2"
                  ],
                  "events": [
                    {
                      "action": "last changed",
                      "actor": null,
                      "timestamp": "2025-07-31T08:00:00Z"
                    },
                    {
                      "action": "registration",
                      "actor": null,
                      "timestamp": "2025-07-24T08:00:00Z"
                    }
                  ],
                  "events_actor": [],
                  "handle": "ACME-NET",
                  "links": [
                    "https://www.fernhill.example/",
                    "https://app.fernhill.example/"
                  ],
                  "notices": [],
                  "raw": null,
                  "remarks": [],
                  "roles": [
                    "registrant"
                  ],
                  "status": []
                },
                {
                  "uid": "acme-object-2",
                  "contact": {
                    "email": [
                      {
                        "type": [],
                        "value": "user@fernhill.example"
                      }
                    ],
                    "address": [
                      {
                        "type": [],
                        "value": "REDACTED FOR PRIVACY"
                      }
                    ],
                    "phone": [
                      {
                        "type": [
                          "work",
                          "voice"
                        ],
                        "value": "+1-555-0100"
                      }
                    ],
                    "kind": "group",
                    "name": "REDACTED FOR PRIVACY",
                    "role": null,
                    "title": null
                  },
                  "entities": [],
                  "events": [
                    {
                      "action": "last changed",
                      "actor": null,
                      "timestamp": "2025-07-10T08:00:00Z"
                    },
                    {
                      "action": "registration",
                      "actor": null,
                      "timestamp": "2025-07-03T08:00:00Z"
                    }
                  ],
                  "events_actor": [],
                  "handle": "ACME-NET-2",
                  "links": [
                    "https://www.fernhill.example/",
                    "https://app.fernhill.example/"
                  ],
                  "notices": [],
                  "raw": null,
                  "remarks": [
                    {
                      "title": "Inaccuracy Report",
                      "description": "A notice from the registry about this registration.",
                      "links": []
                    },
                    {
                      "title": "Remarks",
                      "description": "A notice from the registry about this registration.",
                      "links": []
                    }
                  ],
                  "roles": [
                    "abuse"
                  ],
                  "status": []
                }
              ],
              "ip": "192.0.2.10"
            },
            {
              "asn": "64496",
              "asn_cidr": "192.0.2.0/24",
              "asn_description": "ACME-AS",
              "asn_country_code": "US",
              "asn_registry": "arin",
              "entities": [
                "ACME-NET-4",
                "ACME-NET-5"
              ],
              "asn_date": "2025-07-09T08:00:00Z",
              "nir": null,
              "query": "192.0.2.11",
              "raw": null,
              "network": {
                "cidr": "192.0.2.0/24",
                "name": "ACME-NET",
                "country": null,
                "start_address": "192.0.2.0",
                "end_address": "192.0.2.255",
                "handle": "NET-192-0-2-0-2",
                "ip_version": "v4",
                "links": [
                  "https://www.fernhill.example/",
                  "https://app.fernhill.example/"
                ],
                "parent_handle": "NET-192-0-2-0-1",
                "raw": null,
                "status": [
                  "active"
                ],
                "type": "DIRECT ALLOCATION",
                "notices": [
                  {
                    "title": "Inaccuracy Report",
                    "description": "A notice from the registry about this registration.",
                    "links": [
                      "https://www.fernhill.example/"
                    ]
                  },
                  {
                    "title": "Remarks",
                    "description": "A notice from the registry about this registration.",
                    "links": [
                      "https://www.fernhill.example/"
                    ]
                  }
                ],
                "remarks": [
                  {
                    "title": "Inaccuracy Report",
                    "description": "A notice from the registry about this registration.",
                    "links": []
                  }
                ],
                "events": [
                  {
                    "action": "last changed",
                    "actor": null,
                    "timestamp": "2025-07-10T08:00:00Z"
                  },
                  {
                    "action": "registration",
                    "actor": null,
                    "timestamp": "2025-07-03T08:00:00Z"
                  }
                ]
              },
              "objects": [
                {
                  "uid": "acme-object-4",
                  "contact": {
                    "email": [],
                    "address": [
                      {
                        "type": [],
                        "value": "REDACTED FOR PRIVACY"
                      }
                    ],
                    "phone": [],
                    "kind": "org",
                    "name": "REDACTED FOR PRIVACY",
                    "role": null,
                    "title": null
                  },
                  "entities": [
                    "ACME-NET-10",
                    "ACME-NET-11"
                  ],
                  "events": [
                    {
                      "action": "last changed",
                      "actor": null,
                      "timestamp": "2025-05-29T08:00:00Z"
                    },
                    {
                      "action": "registration",
                      "actor": null,
                      "timestamp": "2025-05-22T08:00:00Z"
                    }
                  ],
                  "events_actor": [],
                  "handle": "ACME-NET-4",
                  "links": [
                    "https://www.fernhill.example/",
                    "https://app.fernhill.example/"
                  ],
                  "notices": [],
                  "raw": null,
                  "remarks": [],
                  "roles": [
                    "registrant"
                  ],
                  "status": []
                },
                {
                  "uid": "acme-object-5",
                  "contact": {
                    "email": [
                      {
                        "type": [],
                        "value": "user@fernhill.example"
                      }
                    ],
                    "address": [
                      {
                        "type": [],
                        "value": "REDACTED FOR PRIVACY"
                      }
                    ],
                    "phone": [
                      {
                        "type": [
                          "work",
                          "voice"
                        ],
                        "value": "+1-555-0100"
                      }
                    ],
                    "kind": "group",
                    "name": "REDACTED FOR PRIVACY",
                    "role": null,
                    "title": null
                  },
                  "entities": [],
                  "events": [
                    {
                      "action": "last changed",
                      "actor": null,
                      "timestamp": "2025-05-08T08:00:00Z"
                    },
                    {
                      "action": "registration",
                      "actor": null,
                      "timestamp": "2025-05-01T08:00:00Z"
                    }
                  ],
                  "events_actor": [],
                  "handle": "ACME-NET-5",
                  "links": [
                    "https://www.fernhill.example/",
                    "https://app.fernhill.example/"
                  ],
                  "notices": [],
                  "raw": null,
                  "remarks": [
                    {
                      "title": "Inaccuracy Report",
                      "description": "A notice from the registry about this registration.",
                      "links": []
                    },
                    {
                      "title": "Remarks",
                      "description": "A notice from the registry about this registration.",
                      "links": []
                    }
                  ],
                  "roles": [
                    "abuse"
                  ],
                  "status": []
                }
              ],
              "ip": "192.0.2.11"
            }
          ],
          "ip_history": [
            "192.0.2.10",
            "192.0.2.11"
          ]
        },
        "aaaa": {
          "value": "acme.example. 300 IN AAAA 2001:db8::1\nacme.example. 300 IN AAAA 2001:db8::2",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "ip_addresses": [
            "2001:db8::1",
            "2001:db8::2"
          ]
        },
        "caa": null,
        "cname": null,
        "dnskey": null,
        "ds": null,
        "ns": {
          "value": "acme.example. 86400 IN NS ns1.acme.example.\nacme.example. 86400 IN NS ns2.acme.example.",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "name_servers": [
            "ns1.acme.example",
            "ns2.acme.example"
          ],
          "domains": [
            "acme.example"
          ]
        },
        "mx": {
          "value": "acme.example. 300 IN MX 10 mail.acme.example.\nacme.example. 300 IN MX 20 mx2.acme.example.",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "mail_servers": [
            "mail.acme.example",
            "mx2.acme.example"
          ],
          "domains": [
            "acme.example"
          ]
        },
        "nsec": null,
        "nsec3": null,
        "rrsig": null,
        "soa": {
          "value": "acme.example. 3600 IN SOA ns1.acme.example. hostmaster.acme.example. 2 7200 3600 1209600 3600",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "mnames": [
            "ns1.acme.example"
          ],
          "rnames": [
            "hostmaster.acme.example"
          ],
          "rname_emails": [
            "user@acme.example"
          ]
        },
        "srv": null,
        "txt": {
          "value": "acme.example. 300 IN TXT \"v=spf1 include:_spf.fernhill.example ~all\"\nacme.example. 300 IN TXT \"site-verification=AbCdEf0123456789\"\nacme.example. 300 IN TXT \"domain-verification=AbCdEf0123456789\"",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "values": [
            "\"v=spf1 include:_spf.fernhill.example ~all\"",
            "\"site-verification=AbCdEf0123456789\"",
            "\"domain-verification=AbCdEf0123456789\""
          ],
          "spf_list": [
            {
              "value": "\"v=spf1 include:_spf.fernhill.example ~all\"",
              "allowed_domains": [
                "fernhill.example"
              ],
              "allowed_ips": []
            }
          ],
          "verifications": [
            {
              "value": "\"site-verification=AbCdEf0123456789\"",
              "domain": "fernhill.example",
              "name": "site-verification"
            },
            {
              "value": "\"domain-verification=AbCdEf0123456789\"",
              "domain": "fernhill.example",
              "name": "domain-verification"
            }
          ]
        }
      },
      "dns_check_date": "2025-07-31T08:00:00Z",
      "dns_last_change_date": null,
      "dns_last_change_data": [],
      "ssl": {
        "target": "acme.example",
        "port": 443,
        "serial_number": "123456789012345678901234567890123456789",
        "fingerprint": {
          "md5": "126f00abcdef0123456789126f00abcd",
          "sha1": "8cf500abcdef01234567898cf500abcdef012345",
          "sha256": "954a00abcdef0123456789954a00abcdef0123456789954a00abcdef01234567"
        },
        "issuer": {
          "common_name": "Kestrel Trust CA",
          "country": "US",
          "state": null,
          "locality": null,
          "organization": "Kestrel Trust",
          "organizational_unit": null
        },
        "issuer_dn": "CN=Kestrel Trust CA, O=Kestrel Trust, C=US",
        "subject": {
          "common_name": "www.acme.example",
          "country": null,
          "state": null,
          "locality": null,
          "organization": null,
          "organizational_unit": null
        },
        "subject_dn": "CN=www.acme.example",
        "signature": {
          "value": "<data>",
          "is_valid": true,
          "invalid_reason": null,
          "is_valid_chain": true,
          "is_self_signed": false,
          "algorithm": {
            "name": "sha256",
            "oid": "1.0.0.0.0.0.0"
          }
        },
        "validity": {
          "start_date": "2025-06-01T08:00:00Z",
          "end_date": "2026-06-01T08:00:00Z",
          "length": 7776000
        },
        "extensions": {
          "authority_key_id": "<public-key>",
          "basic_constraints": {
            "is_ca": false
          },
          "certificate_policies": [
            "1.0.0.0.0.0"
          ],
          "extended_key_usage": {
            "client_auth": null,
            "server_auth": true
          },
          "key_usage": {
            "content_commitment": true,
            "crl_sign": true,
            "data_encipherment": true,
            "digital_signature": true,
            "key_agreement": false,
            "key_cert_sign": true,
            "key_encipherment": true
          },
          "signed_certificate_timestamps": [
            {
              "log_id": "<data>",
              "timestamp": "2025-07-31T08:00:00Z",
              "version": 1,
              "signature": "<signature>"
            },
            {
              "log_id": "<data>",
              "timestamp": "2025-07-24T08:00:00Z",
              "version": 1,
              "signature": "<signature>"
            }
          ],
          "subject_alt_name": {
            "dns_names": [
              "www.acme.example",
              "*.app.acme.example"
            ]
          },
          "subject_key_id": "<public-key>"
        },
        "subject_key_info": {
          "fingerprint": {
            "hash_algorithm": "sha256",
            "value": "c71c00abcdef0123456789c71c00abcdef0123456789c71c00abcdef01234567"
          },
          "key_algorithm": {
            "name": "ECDSA"
          }
        },
        "version": {
          "name": "v3",
          "value": "36"
        },
        "tbs_fingerprint": "fd2800abcdef0123456789fd2800abcdef0123456789fd2800abcdef01234567",
        "certificate": "<certificate>",
        "has_expired": false,
        "fqdn_list": [
          "www.acme.example"
        ]
      },
      "ssl_check_date": "2025-07-31T08:00:00Z",
      "ssl_last_change_date": "2025-07-01T08:00:00Z",
      "ssl_last_change_data": [
        "ssl.validity.end_date",
        "ssl.validity.start_date"
      ],
      "http": {
        "requested_url": "http://acme.example/",
        "requested_domain": "acme.example",
        "requested_fqdn": "acme.example",
        "final_url": "https://www.acme.example/",
        "final_domain": "acme.example",
        "final_fqdn": "www.acme.example",
        "redirection_history": [
          {
            "url": "http://acme.example/",
            "status_code": 301
          },
          {
            "url": "https://www.acme.example/",
            "status_code": 200
          }
        ],
        "external_domain_redirection": false,
        "external_fqdn_redirection": true,
        "first_status_code": 301,
        "final_status_code": 200,
        "headers": {
          "accept": null,
          "accept_encoding": null,
          "accept_language": null,
          "access_control_allow_credentials": null,
          "access_control_allow_headers": null,
          "access_control_allow_methods": null,
          "access_control_allow_origin": "*",
          "access_control_expose_headers": null,
          "access_control_max_age": null,
          "alt_svc": null,
          "authorization": null,
          "cache_control": "<value>",
          "clear_site_data": null,
          "content_disposition": null,
          "content_encoding": "gzip",
          "content_language": null,
          "content_length": null,
          "content_range": null,
          "content_security_policy": "<value>",
          "content_type": "text/html; charset=utf-8",
          "cookie": null,
          "cross_origin_embedder_policy": null,
          "cross_origin_opener_policy": null,
          "cross_origin_resource_policy": null,
          "date": "Thu, 31 Jul 2025 08:00:00 GMT",
          "early_data": null,
          "expect_ct": null,
          "expires": null,
          "feature_policy": null,
          "host": null,
          "if_modified_since": null,
          "if_none_match": null,
          "last_modified": null,
          "origin_isolation": null,
          "others": [
            {
              "name": "connection",
              "value": "keep-alive"
            },
            {
              "name": "report-to",
              "value": "<value>"
            }
          ],
          "permission_policy": null,
          "permissions_policy": "<value>",
          "pragma": null,
          "proxy_authenticate": null,
          "proxy_authorization": null,
          "public_key_pins": null,
          "range": null,
          "referer": null,
          "referrer_policy": "strict-origin-when-cross-origin",
          "sec_fetch_dest": null,
          "sec_fetch_mode": null,
          "sec_fetch_site": null,
          "sec_fetch_user": null,
          "server": "<value>",
          "set_cookie": null,
          "strict_transport_security": "<value>",
          "te": null,
          "transfer_encoding": "chunked",
          "upgrade": null,
          "user_agent": null,
          "vary": "accept-encoding",
          "www_authenticate": null,
          "x_content_type_options": "nosniff",
          "x_download_options": null,
          "x_frame_options": "DENY",
          "x_permitted_cross_domain_policies": null,
          "x_powered_by": null,
          "x_xss_protection": null
        },
        "cookies": [],
        "html": {
          "source_code_hash": "adb600abcdef0123456789adb600abcdef0123456789adb600abcdef01234567"
        }
      },
      "http_check_date": "2025-07-31T08:00:00Z",
      "http_last_change_date": "2025-07-01T08:00:00Z",
      "http_last_change_data": [
        "http.headers.date",
        "http.cookies.value"
      ],
      "webdata": null,
      "webdata_check_date": null,
      "webdata_last_change_date": null,
      "webdata_last_change_data": [],
      "ipwhois": null,
      "ipwhois_check_date": null,
      "ipwhois_last_change_date": null,
      "ipwhois_last_change_data": [],
      "ipdns": null,
      "ipdns_check_date": null,
      "ipdns_last_change_date": null,
      "ipdns_last_change_data": [],
      "subdomain_count": 37,
      "website_count": 11,
      "pointed_fqdn_count": null,
      "redirected_domain_count": 27,
      "redirected_asset_count": 39,
      "average_issue_duration": 86400,
      "average_fix_duration": 86400,
      "is_parked": false,
      "open_port_count": 11,
      "open_ports": [
        443,
        80
      ],
      "issue_state_stats": {
        "newly_detected": 18,
        "reappeared": 14,
        "unresolved": 24,
        "marked_as_resolved": 20,
        "risk_accepted": 29,
        "ignored": 36,
        "marked_as_false_positive": 19,
        "not_applicable": 2,
        "verified_resolved": 1
      },
      "issue_category_stats": [
        {
          "name": "SSL/TLS",
          "count": 16,
          "severity_stats": {
            "critical": 33,
            "high": 6,
            "medium": 9,
            "low": 39,
            "information": 22
          }
        }
      ],
      "issue_count": {
        "total": 120,
        "active": 120,
        "active_by_severity": {
          "critical": 27,
          "high": 21,
          "medium": 29,
          "low": 20,
          "information": 23
        }
      },
      "technology_count": {
        "total": 19,
        "by_category": []
      },
      "vulnerability_count": {
        "total": 136,
        "by_severity": {
          "critical": 28,
          "high": 28,
          "medium": 9,
          "low": 35,
          "none": 31,
          "unknown": 5
        }
      },
      "security_score": 850.5,
      "weight": 100,
      "user_weight": null,
      "system_weight": 100,
      "domain_snapshot": {
        "issue_count": {
          "total": 105,
          "active": 105,
          "active_by_severity": {
            "critical": 38,
            "high": 12,
            "medium": 9,
            "low": 35,
            "information": 11
          }
        },
        "issue_category_stats": [
          {
            "name": "SSL/TLS",
            "count": 8,
            "severity_stats": {
              "critical": 23,
              "high": 13,
              "medium": 34,
              "low": 9,
              "information": 27
            }
          },
          {
            "name": "DNS",
            "count": 9,
            "severity_stats": {
              "critical": 24,
              "high": 14,
              "medium": 35,
              "low": 10,
              "information": 28
            }
          }
        ],
        "issue_state_stats": {
          "newly_detected": 4,
          "reappeared": 11,
          "unresolved": 37,
          "marked_as_resolved": 22,
          "risk_accepted": 38,
          "ignored": 9,
          "marked_as_false_positive": 24,
          "not_applicable": 37,
          "verified_resolved": 34
        },
        "average_issue_duration": 86400,
        "average_fix_duration": 86400,
        "technology_count": {
          "total": 27,
          "by_category": [
            {
              "name": "Web servers",
              "count": 13
            },
            {
              "name": "JavaScript frameworks",
              "count": 14
            }
          ]
        },
        "open_port_count": 16,
        "vulnerability_count": {
          "total": 94,
          "by_severity": {
            "critical": 5,
            "high": 13,
            "medium": 22,
            "low": 17,
            "none": 6,
            "unknown": 31
          }
        },
        "security_score": 850.5
      }
    },
    {
      "id": "000000000000000ea4f90002",
      "asset": "fernhill.example",
      "asset_type": "domain",
      "added_date": "2025-05-25T08:00:00Z",
      "tags": [],
      "creation_method": "manually_added",
      "favicon": null,
      "screenshot": "https://platform-storage.example/screenshots/acme-2.png",
      "thumbnail": "https://platform-storage.example/thumbnails/acme-2.png",
      "latest_scan_date": "2025-07-24T08:00:00Z",
      "is_main_asset": true,
      "seems_inactive": false,
      "seems_inactive_first_seen": null,
      "seems_inactive_last_seen": null,
      "discovery_enabled": true,
      "dns_wildcard_active": false,
      "is_login_page": false,
      "login_page_probability": null,
      "fqdn": {
        "unicode": "fernhill.example",
        "punycode": "fernhill.example",
        "is_idn": false,
        "name": {
          "unicode": "fernhill",
          "contains_confusable": false,
          "latinized": [],
          "contains_hyphen": false,
          "contains_letter": true,
          "contains_number": false,
          "length": 8
        },
        "domain": {
          "unicode": "fernhill.example",
          "punycode": "fernhill.example",
          "is_idn": false,
          "extension": {
            "unicode": "example"
          },
          "extension_root": {
            "unicode": "example"
          },
          "extension_sub": null,
          "extension_type": "gTLD"
        }
      },
      "website": null,
      "whois": {
        "create_date": "2025-05-25T08:00:00Z",
        "update_date": "2025-06-24T08:00:00Z",
        "expiry_date": "2026-05-25T08:00:00Z",
        "domain_status": [
          "clienttransferprohibited"
        ],
        "name_servers": [
          "ns1.acme.example",
          "ns2.acme.example"
        ],
        "registrar": "Fernhill Registrar",
        "registrant": {
          "organization": "REDACTED FOR PRIVACY",
          "name": "REDACTED FOR PRIVACY",
          "country": "US",
          "state": null,
          "city": "Riverton",
          "street": "REDACTED FOR PRIVACY",
          "postal_code": "REDACTED FOR PRIVACY",
          "email": "user@fernhill.example",
          "phone": "+1-555-0100"
        }
      },
      "whois_privacy_enabled": true,
      "whois_registrant_email_historical": [
        "user@acme.example"
      ],
      "whois_create_date_historical": [
        "2025-05-11T08:00:00Z"
      ],
      "whois_normalized": {
        "registrar": "Fernhill Registrar",
        "registrant": {
          "email": "user@fernhill.example",
          "email_real": null,
          "email_domain_apex": "fernhill.example",
          "email_fqdn_apex": "fernhill.example",
          "organization": "REDACTED FOR PRIVACY",
          "phone": null
        }
      },
      "whois_check_date": "2025-07-24T08:00:00Z",
      "whois_last_change_date": "2025-06-24T08:00:00Z",
      "whois_last_change_data": [
        "whois.name_servers"
      ],
      "dns": {
        "a": {
          "value": "fernhill.example. 300 IN A 192.0.2.13",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "ip_addresses": [
            {
              "asn": "64496",
              "asn_cidr": "192.0.2.0/24",
              "asn_description": "ACME-AS",
              "asn_country_code": "US",
              "asn_registry": "arin",
              "entities": [
                "ACME-NET-10"
              ],
              "asn_date": "2025-06-25T08:00:00Z",
              "nir": null,
              "query": "192.0.2.13",
              "raw": null,
              "network": {
                "cidr": "192.0.2.0/24",
                "name": "ACME-NET",
                "country": null,
                "start_address": "192.0.2.0",
                "end_address": "192.0.2.255",
                "handle": "NET-192-0-2-0-2",
                "ip_version": "v4",
                "links": [
                  "https://www.acme.example/",
                  "https://app.kestrel.example/"
                ],
                "parent_handle": "NET-192-0-2-0-1",
                "raw": null,
                "status": [
                  "active"
                ],
                "type": "ALLOCATION",
                "notices": [
                  {
                    "title": "Terms of Service",
                    "description": "A notice from the registry about this registration.",
                    "links": [
                      "https://www.acme.example/"
                    ]
                  },
                  {
                    "title": "Status Codes",
                    "description": "A notice from the registry about this registration.",
                    "links": [
                      "https://www.acme.example/"
                    ]
                  }
                ],
                "remarks": [],
                "events": [
                  {
                    "action": "last changed",
                    "actor": null,
                    "timestamp": "2025-05-29T08:00:00Z"
                  },
                  {
                    "action": "registration",
                    "actor": null,
                    "timestamp": "2025-05-22T08:00:00Z"
                  }
                ]
              },
              "objects": [
                {
                  "uid": "acme-object-10",
                  "contact": {
                    "email": [],
                    "address": [
                      {
                        "type": [],
                        "value": "REDACTED FOR PRIVACY"
                      }
                    ],
                    "phone": [],
                    "kind": "org",
                    "name": "REDACTED FOR PRIVACY",
                    "role": null,
                    "title": null
                  },
                  "entities": [
                    "ACME-NET-28",
                    "ACME-NET-29"
                  ],
                  "events": [
                    {
                      "action": "last changed",
                      "actor": null,
                      "timestamp": "2025-01-23T08:00:00Z"
                    },
                    {
                      "action": "registration",
                      "actor": null,
                      "timestamp": "2025-01-16T08:00:00Z"
                    }
                  ],
                  "events_actor": [],
                  "handle": "ACME-NET-10",
                  "links": [
                    "https://www.acme.example/",
                    "https://app.kestrel.example/"
                  ],
                  "notices": [],
                  "raw": null,
                  "remarks": [
                    {
                      "title": "Terms of Service",
                      "description": "A notice from the registry about this registration.",
                      "links": []
                    }
                  ],
                  "roles": [
                    "registrant"
                  ],
                  "status": []
                },
                {
                  "uid": "acme-object-11",
                  "contact": {
                    "email": [
                      {
                        "type": [],
                        "value": "user@acme.example"
                      }
                    ],
                    "address": [
                      {
                        "type": [],
                        "value": "REDACTED FOR PRIVACY"
                      }
                    ],
                    "phone": [
                      {
                        "type": [
                          "work",
                          "voice"
                        ],
                        "value": "+1-555-0100"
                      }
                    ],
                    "kind": "group",
                    "name": "REDACTED FOR PRIVACY",
                    "role": null,
                    "title": null
                  },
                  "entities": [],
                  "events": [
                    {
                      "action": "last changed",
                      "actor": null,
                      "timestamp": "2025-01-02T08:00:00Z"
                    },
                    {
                      "action": "registration",
                      "actor": null,
                      "timestamp": "2024-12-26T08:00:00Z"
                    }
                  ],
                  "events_actor": [],
                  "handle": "ACME-NET-11",
                  "links": [
                    "https://www.acme.example/",
                    "https://app.kestrel.example/"
                  ],
                  "notices": [
                    {
                      "title": "Inaccuracy Report",
                      "description": "A notice from the registry about this registration.",
                      "links": [
                        "https://www.acme.example/"
                      ]
                    },
                    {
                      "title": "Remarks",
                      "description": "A notice from the registry about this registration.",
                      "links": [
                        "https://www.acme.example/"
                      ]
                    }
                  ],
                  "raw": null,
                  "remarks": [],
                  "roles": [
                    "routing"
                  ],
                  "status": [
                    "validated"
                  ]
                }
              ],
              "ip": "192.0.2.13"
            }
          ],
          "ip_history": [
            "192.0.2.13"
          ]
        },
        "aaaa": null,
        "caa": null,
        "cname": null,
        "dnskey": null,
        "ds": null,
        "ns": {
          "value": "fernhill.example. 86400 IN NS ns1.acme.example.\nfernhill.example. 86400 IN NS ns2.acme.example.",
          "value_previous": "fernhill.example. 86400 IN NS ns1.acme.example.",
          "value_last_change_date": "2025-06-24T08:00:00Z",
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": "2025-06-24T08:00:00Z",
          "name_servers": [
            "ns1.acme.example",
            "ns2.acme.example"
          ],
          "domains": [
            "acme.example"
          ]
        },
        "mx": {
          "value": "fernhill.example. 300 IN MX 10 mail.acme.example.\nfernhill.example. 300 IN MX 20 mx2.acme.example.",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "mail_servers": [
            "mail.acme.example",
            "mx2.acme.example"
          ],
          "domains": [
            "acme.example"
          ]
        },
        "nsec": null,
        "nsec3": null,
        "rrsig": null,
        "soa": {
          "value": "fernhill.example. 3600 IN SOA ns1.acme.example. hostmaster.acme.example. 2 7200 3600 1209600 3600",
          "value_previous": "fernhill.example. 3600 IN SOA ns1.acme.example. hostmaster.acme.example. 1 7200 3600 1209600 3600",
          "value_last_change_date": "2025-06-24T08:00:00Z",
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": "2025-06-24T08:00:00Z",
          "mnames": [
            "ns1.acme.example"
          ],
          "rnames": [
            "hostmaster.acme.example"
          ],
          "rname_emails": [
            "user@acme.example"
          ]
        },
        "srv": null,
        "txt": {
          "value": "fernhill.example. 300 IN TXT \"v=spf1 include:_spf.acme.example ~all\"",
          "value_previous": null,
          "value_last_change_date": null,
          "rcode": "NOERROR",
          "rcode_previous": null,
          "rcode_last_change_date": null,
          "last_change_date": null,
          "values": [
            "\"v=spf1 include:_spf.acme.example ~all\""
          ],
          "spf_list": [
            {
              "value": "\"v=spf1 include:_spf.acme.example ~all\"",
              "allowed_domains": [
                "acme.example"
              ],
              "allowed_ips": []
            }
          ],
          "verifications": []
        }
      },
      "dns_check_date": "2025-07-24T08:00:00Z",
      "dns_last_change_date": "2025-06-24T08:00:00Z",
      "dns_last_change_data": [
        "dns.soa.mnames",
        "dns.soa.rnames"
      ],
      "ssl": null,
      "ssl_check_date": "2025-07-24T08:00:00Z",
      "ssl_last_change_date": null,
      "ssl_last_change_data": [],
      "http": {
        "requested_url": "http://fernhill.example/",
        "requested_domain": "fernhill.example",
        "requested_fqdn": "fernhill.example",
        "final_url": "http://fernhill.example/",
        "final_domain": "fernhill.example",
        "final_fqdn": "fernhill.example",
        "redirection_history": [
          {
            "url": "http://fernhill.example/",
            "status_code": 200
          }
        ],
        "external_domain_redirection": false,
        "external_fqdn_redirection": false,
        "first_status_code": 200,
        "final_status_code": 200,
        "headers": {
          "accept": null,
          "accept_encoding": null,
          "accept_language": null,
          "access_control_allow_credentials": null,
          "access_control_allow_headers": null,
          "access_control_allow_methods": null,
          "access_control_allow_origin": null,
          "access_control_expose_headers": null,
          "access_control_max_age": null,
          "alt_svc": null,
          "authorization": null,
          "cache_control": null,
          "clear_site_data": null,
          "content_disposition": null,
          "content_encoding": "gzip",
          "content_language": null,
          "content_length": "1024",
          "content_range": null,
          "content_security_policy": null,
          "content_type": "text/html",
          "cookie": null,
          "cross_origin_embedder_policy": null,
          "cross_origin_opener_policy": null,
          "cross_origin_resource_policy": null,
          "date": "Thu, 31 Jul 2025 08:00:00 GMT",
          "early_data": null,
          "expect_ct": null,
          "expires": null,
          "feature_policy": null,
          "host": null,
          "if_modified_since": null,
          "if_none_match": null,
          "last_modified": "Thu, 31 Jul 2025 08:00:00 GMT",
          "origin_isolation": null,
          "others": [
            {
              "name": "accept-ranges",
              "value": "bytes"
            },
            {
              "name": "etag",
              "value": "<value>"
            }
          ],
          "permission_policy": null,
          "permissions_policy": null,
          "pragma": null,
          "proxy_authenticate": null,
          "proxy_authorization": null,
          "public_key_pins": null,
          "range": null,
          "referer": null,
          "referrer_policy": null,
          "sec_fetch_dest": null,
          "sec_fetch_mode": null,
          "sec_fetch_site": null,
          "sec_fetch_user": null,
          "server": "<value>",
          "set_cookie": null,
          "strict_transport_security": null,
          "te": null,
          "transfer_encoding": null,
          "upgrade": null,
          "user_agent": null,
          "vary": "Accept-Encoding",
          "www_authenticate": null,
          "x_content_type_options": null,
          "x_download_options": null,
          "x_frame_options": null,
          "x_permitted_cross_domain_policies": null,
          "x_powered_by": "<value>",
          "x_xss_protection": null
        },
        "cookies": [],
        "html": {
          "source_code_hash": "adb601abcdef0123456789adb601abcdef0123456789adb601abcdef01234567"
        }
      },
      "http_check_date": "2025-07-24T08:00:00Z",
      "http_last_change_date": "2025-06-24T08:00:00Z",
      "http_last_change_data": [
        "http.headers.date"
      ],
      "webdata": {
        "requested_url": "http://fernhill.example/",
        "requested_domain": "fernhill.example",
        "requested_fqdn": "fernhill.example",
        "html": {
          "internal_links_fqdns": [
            "www.fernhill.example",
            "app.fernhill.example"
          ],
          "external_links_domains": [],
          "external_links_fqdns": [],
          "external_links": [],
          "script_links": [],
          "iframe_links": [],
          "trackers": [],
          "emails": [],
          "emails_internal": [],
          "inspect_disabled": false,
          "source_code_hash": "8e5f01abcdef01234567898e5f01abcdef01234567898e5f01abcdef01234567",
          "content_hash": "46e101abcdef012345678946e101abcdef012345678946e101abcdef01234567",
          "content_top_keywords": [
            "acme-4",
            "acme-5"
          ],
          "favicon_links": [],
          "html_meta": {
            "name": null,
            "description": null,
            "language": "en",
            "language_alternatives": [],
            "keywords": [],
            "no_index_status": false,
            "encoding": null,
            "canonical_url": null,
            "title": "Sign in to Acme"
          }
        },
        "favicon": [],
        "http": {
          "final_url": "http://fernhill.example/",
          "final_domain": "fernhill.example",
          "final_fqdn": "fernhill.example",
          "redirection_history": [
            {
              "url": "http://fernhill.example/",
              "status_code": 200,
              "method": null
            }
          ],
          "external_domain_redirection": false,
          "external_fqdn_redirection": false,
          "first_status_code": 200,
          "final_status_code": 200,
          "headers": {
            "accept": null,
            "accept_encoding": null,
            "accept_language": null,
            "access_control_allow_credentials": null,
            "access_control_allow_headers": null,
            "access_control_allow_methods": null,
            "access_control_allow_origin": null,
            "access_control_expose_headers": null,
            "access_control_max_age": null,
            "alt_svc": null,
            "authorization": null,
            "cache_control": null,
            "clear_site_data": null,
            "content_disposition": null,
            "content_encoding": "gzip",
            "content_language": null,
            "content_length": "1024",
            "content_range": null,
            "content_security_policy": null,
            "content_type": "text/html",
            "cookie": null,
            "cross_origin_embedder_policy": null,
            "cross_origin_opener_policy": null,
            "cross_origin_resource_policy": null,
            "date": "Thu, 31 Jul 2025 08:00:00 GMT",
            "early_data": null,
            "expect_ct": null,
            "expires": null,
            "feature_policy": null,
            "host": null,
            "if_modified_since": null,
            "if_none_match": null,
            "last_modified": "Thu, 31 Jul 2025 08:00:00 GMT",
            "origin_isolation": null,
            "others": [
              {
                "name": "accept-ranges",
                "value": "bytes"
              },
              {
                "name": "etag",
                "value": "<value>"
              }
            ],
            "permission_policy": null,
            "permissions_policy": null,
            "pragma": null,
            "proxy_authenticate": null,
            "proxy_authorization": null,
            "public_key_pins": null,
            "range": null,
            "referer": null,
            "referrer_policy": null,
            "sec_fetch_dest": null,
            "sec_fetch_mode": null,
            "sec_fetch_site": null,
            "sec_fetch_user": null,
            "server": "<value>",
            "set_cookie": null,
            "strict_transport_security": null,
            "te": null,
            "transfer_encoding": null,
            "upgrade": null,
            "user_agent": null,
            "vary": "Accept-Encoding",
            "www_authenticate": null,
            "x_content_type_options": null,
            "x_download_options": null,
            "x_frame_options": null,
            "x_permitted_cross_domain_policies": null,
            "x_powered_by": "<value>",
            "x_xss_protection": null
          },
          "cookies": []
        },
        "technology": {
          "stacks": [
            {
              "slug": "acme-news-4",
              "name": "Bootstrap",
              "confidence": 100,
              "icon": "acme-4.png",
              "website": "http://www.acme.example/",
              "cpe": "cpe:2.3:a:acme:acme-portal:1.0:*:*:*:*:*:*:*",
              "version": "",
              "categories": [
                "Web servers"
              ],
              "description": "A technology detected on the asset's website.",
              "clean_version": null
            },
            {
              "slug": "acme-news-5",
              "name": "WordPress",
              "confidence": 100,
              "icon": "acme-5.png",
              "website": "https://app.kestrel.example/",
              "cpe": "cpe:2.3:a:acme:acme-portal:1.0:*:*:*:*:*:*:*",
              "version": "",
              "categories": [
                "UI frameworks"
              ],
              "description": "A technology detected on the asset's website.",
              "clean_version": null
            }
          ]
        }
      },
      "webdata_check_date": "2025-07-24T08:00:00Z",
      "webdata_last_change_date": "2025-06-24T08:00:00Z",
      "webdata_last_change_data": [
        "webdata.http.headers.date"
      ],
      "ipwhois": null,
      "ipwhois_check_date": null,
      "ipwhois_last_change_date": null,
      "ipwhois_last_change_data": [],
      "ipdns": null,
      "ipdns_check_date": null,
      "ipdns_last_change_date": null,
      "ipdns_last_change_data": [],
      "subdomain_count": 38,
      "website_count": 12,
      "pointed_fqdn_count": null,
      "redirected_domain_count": 28,
      "redirected_asset_count": 40,
      "average_issue_duration": 172800,
      "average_fix_duration": 172800,
      "is_parked": false,
      "open_port_count": 12,
      "open_ports": [
        22,
        8080
      ],
      "issue_state_stats": {
        "newly_detected": 19,
        "reappeared": 15,
        "unresolved": 25,
        "marked_as_resolved": 21,
        "risk_accepted": 30,
        "ignored": 37,
        "marked_as_false_positive": 20,
        "not_applicable": 3,
        "verified_resolved": 2
      },
      "issue_category_stats": [
        {
          "name": "Web application",
          "count": 19,
          "severity_stats": {
            "critical": 36,
            "high": 9,
            "medium": 12,
            "low": 42,
            "information": 25
          }
        },
        {
          "name": "Open ports",
          "count": 20,
          "severity_stats": {
            "critical": 37,
            "high": 10,
            "medium": 13,
            "low": 43,
            "information": 26
          }
        }
      ],
      "issue_count": {
        "total": 125,
        "active": 125,
        "active_by_severity": {
          "critical": 28,
          "high": 22,
          "medium": 30,
          "low": 21,
          "information": 24
        }
      },
      "technology_count": {
        "total": 20,
        "by_category": [
          {
            "name": "UI frameworks",
            "count": 8
          },
          {
            "name": "CMS",
            "count": 9
          }
        ]
      },
      "vulnerability_count": {
        "total": 142,
        "by_severity": {
          "critical": 29,
          "high": 29,
          "medium": 10,
          "low": 36,
          "none": 32,
          "unknown": 6
        }
      },
      "security_score": 840.5,
      "weight": 100,
      "user_weight": null,
      "system_weight": 100,
      "domain_snapshot": {
        "issue_count": {
          "total": 110,
          "active": 110,
          "active_by_severity": {
            "critical": 39,
            "high": 13,
            "medium": 10,
            "low": 36,
            "information": 12
          }
        },
        "issue_category_stats": [
          {
            "name": "Web application",
            "count": 11,
            "severity_stats": {
              "critical": 26,
              "high": 16,
              "medium": 37,
              "low": 12,
              "information": 30
            }
          },
          {
            "name": "Open ports",
            "count": 12,
            "severity_stats": {
              "critical": 27,
              "high": 17,
              "medium": 38,
              "low": 13,
              "information": 31
            }
          }
        ],
        "issue_state_stats": {
          "newly_detected": 5,
          "reappeared": 12,
          "unresolved": 38,
          "marked_as_resolved": 23,
          "risk_accepted": 39,
          "ignored": 10,
          "marked_as_false_positive": 25,
          "not_applicable": 38,
          "verified_resolved": 35
        },
        "average_issue_duration": 172800,
        "average_fix_duration": 172800,
        "technology_count": {
          "total": 33,
          "by_category": [
            {
              "name": "UI frameworks",
              "count": 16
            },
            {
              "name": "CMS",
              "count": 17
            }
          ]
        },
        "open_port_count": 17,
        "vulnerability_count": {
          "total": 100,
          "by_severity": {
            "critical": 6,
            "high": 14,
            "medium": 23,
            "low": 18,
            "none": 7,
            "unknown": 32
          }
        },
        "security_score": 840.5
      }
    }
  ]
}
```

### 400 · Invalid Parameter (invalid page=0)

```bash
curl -X POST 'https://api.deepinfo.com/v1/easm/assets/search?page=0' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{}'
```

`Content-Type: application/json` · `deepinfo-request-id: 00000000-0000-4000-8000-0000356d0001`

```json
{
  "code": 10400,
  "parameters": [
    {
      "param": "page",
      "details": [
        "Ensure this value is greater than or equal to 1."
      ]
    }
  ],
  "solution": "https://docs.deepinfo.com/reference/"
}
```

### Request Template

The request only: a request template has no response.

```bash
curl -X POST 'https://api.deepinfo.com/v1/easm/assets/search?page_size=25' \
  -H 'apikey: YOUR_API_KEY' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "filters": {
    "must": [
      {
        "name": "asset",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "tags",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.unicode",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.punycode",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.name.unicode",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.name.latinized",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.domain.unicode",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.domain.punycode",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.domain.extension.unicode",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.domain.extension_root.unicode",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "added_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "latest_scan_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "seems_inactive_first_seen",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "seems_inactive_last_seen",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "login_page_probability",
        "type": "eq",
        "value": 0
      },
      {
        "name": "fqdn.name.length",
        "type": "eq",
        "value": 0
      },
      {
        "name": "website.port",
        "type": "eq",
        "value": 0
      },
      {
        "name": "whois.create_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "whois.update_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "whois.expiry_date",
        "type": "eq",
        "value": "<date-time>"
      },
      {
        "name": "is_main_asset",
        "type": "eq",
        "value": true
      },
      {
        "name": "seems_inactive",
        "type": "eq",
        "value": true
      },
      {
        "name": "discovery_enabled",
        "type": "eq",
        "value": true
      },
      {
        "name": "dns_wildcard_active",
        "type": "eq",
        "value": true
      },
      {
        "name": "is_login_page",
        "type": "eq",
        "value": true
      },
      {
        "name": "fqdn.is_idn",
        "type": "eq",
        "value": true
      },
      {
        "name": "fqdn.name.contains_confusable",
        "type": "eq",
        "value": true
      },
      {
        "name": "fqdn.name.contains_hyphen",
        "type": "eq",
        "value": true
      },
      {
        "name": "fqdn.name.contains_letter",
        "type": "eq",
        "value": true
      },
      {
        "name": "fqdn.name.contains_number",
        "type": "eq",
        "value": true
      },
      {
        "name": "asset_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "creation_method",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "fqdn.domain.extension_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "dns.dnskey.records.key_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "dns.dnskey.records.algorithm",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "dns.ds.records.algorithm",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "dns.ds.records.digest_type",
        "type": "eq",
        "value": "<value>"
      },
      {
        "name": "dns.rrsig.algorithm",
        "type": "eq",
        "value": "<value>"
      }
    ]
  },
  "sort": [
    {
      "field": "asset",
      "order": "desc"
    }
  ]
}'
```