---
title: "Live Discovery: Initiate a new scan"
method: POST
path: "/v3/threat-hunting/scans/discovery"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# Live Discovery: Initiate a new scan

`POST /v3/threat-hunting/scans/discovery`

Initiate a scan to look for a currently unobserved service at a specific IP and port (`ip:port`) or hostname and port (`hostname:port`). This is equivalent to the [Live Discovery](https://docs.censys.com/docs/platform-threat-hunting-use-live-scan-and-rescan-to-validate-infrastructure#/) feature available in the UI, but you can also target web properties in addition to hosts.<br><br>The scan may take several minutes to complete. The response will contain a scan ID that you can use to [monitor the scan's status](https://docs.censys.com/reference/v3-threathunting-scans-get#/). After the scan completes, perform a lookup on the target asset to retrieve detailed scan information.<br><br>This endpoint is available to organizations that have access to the Adversary Investigation module. It costs 15 credits to execute this endpoint.

## Query parameters

- `organization_id` string, uuid, required — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Request body

- ScansDiscoveryInputBody
  - `target` union, required
    - object — Discovery scan against IP:PORT
      - `host_port` object, required
        - `ip` string, required — IP address to scan
        - `port` integer, required — Port number to scan
    - object — Discovery scan against hostname:PORT
      - `hostname_port` object, required
        - `hostname` string, required — Hostname to scan
        - `port` integer, required — Port number to scan

## Response `200`

OK

- ResponseEnvelopeTrackedScan
  - `result` TrackedScan
    - `completed` boolean
    - `create_time` string
    - `target` TrackedScanScanTarget
      - `host_port` TrackedScanScanTargetHostPort
        - `ip` string
        - `port` integer
      - `hostname_port` TrackedScanScanTargetHostnamePort
        - `hostname` string
        - `port` integer
      - `service_id` ServiceId
        - `ip` string
        - `port` integer
        - `protocol` string
        - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
      - `web_origin` WebOrigin
        - `hostname` string
        - `port` integer
    - `tasks` TrackedScanTask[], nullable
      - `description` string
      - `status` '' | 'scanning' | 'scanned' | 'rejected' | 'timed_out' | 'completed' | 'ignored'
      - `update_time` string
    - `tracked_scan_id` string

## Other responses

- `400` — Bad request
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `422` — Invalid input
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/revisions/261c916bf05b/schema)