---
title: "CensEye: Create a pivot analysis job"
method: POST
path: "/v3/threat-hunting/censeye/jobs"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# CensEye: Create a pivot analysis job

`POST /v3/threat-hunting/censeye/jobs`

Create an asynchronous CensEye pivot analysis job for a host, web property, or certificate. The job extracts [default pivot fields](https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections#default-pivot-fields) from the target asset and counts matching documents for each field-value pair. Poll the job status endpoint to track progress, then retrieve results when complete.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.<br><br>This endpoint costs 44 credits to execute for a host, 28 credits to execute for a web property, and 7 credits to execute for a certificate.

## Query parameters

- `organization_id` string, uuid, required — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Request body

- CreateCenseyeJobInputBody
  - `target` CenseyeTarget, required
    - `certificate_id` string — SHA-256 fingerprint of the certificate to analyze.
    - `host_id` string — IP address of the host to analyze.
    - `webproperty_id` string — Web property identifier (hostname:port) to analyze.

## Response `200`

OK

- ResponseEnvelopeCenseyeJob
  - `result` CenseyeJob
    - `at_time` string, date-time — The point-in-time the asset data was evaluated at.
    - `create_time` string, date-time — When the job was created.
    - `delete_time` string, date-time — When the job and results will be deleted.
    - `error` string — Error message if the job failed.
    - `job_id` string, required — Unique identifier of the job.
    - `result_count` integer — Total number of result field-value pairs.
    - `state` 'started' | 'completed' | 'failed' | 'unknown', required — Current state of the job.
    - `target` CenseyeTarget, required
      - `certificate_id` string — SHA-256 fingerprint of the certificate to analyze.
      - `host_id` string — IP address of the host to analyze.
      - `webproperty_id` string — Web property identifier (hostname:port) to analyze.
    - `update_time` string, date-time — When the job was last updated.

## Other responses

- `400` — Bad request
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `422` — Invalid input
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/revisions/261c916bf05b/schema)