---
title: "Get endpoint observation history for a host"
method: GET
path: "/v3/threat-hunting/host/{ip}/observations/endpoints"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# Get endpoint observation history for a host

`GET /v3/threat-hunting/host/{ip}/observations/endpoints`

Retrieve historical endpoint-level hash observations for a host. This action returns time frames during which Censys observed host service endpoint body, favicon, and banner hash values. You must provide an `observation_type` and can optionally filter by a specific value using the `observation_value` parameter. You may also filter by port number.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.

## Path parameters

- `ip` string, ip, required — The IP address of a host.

## Query parameters

- `organization_id` string, uuid, required — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `start_time` string — Start of date range (RFC3339 format, e.g., 2024-01-01T00:00:00Z). If not specified, defaults to the maximum query window back from the end time.
- `end_time` string — End of date range (RFC3339 format, e.g., 2024-01-31T23:59:59Z). If not specified, defaults to now. Cannot be in the future.
- `page_size` integer — Number of results per page (max 100)
- `page_token` string — Pagination token from previous response
- `port` integer — Filter by port number
- `observation_value` string — Filter by observation value for the selected observation_type
- `observation_type` 'body_hash_sha1' | 'body_hash_sha256' | 'favicon_hash_md5' | 'favicon_hash_sha256' | 'favicon_hash_shodan' | 'banner_hash_sha256' | 'endpoints_banner_hash_sha256', required — Endpoint observation type to query.
- `order_by` string[], nullable — Order observations by these fields. Multiple values can be provided (e.g., ['port DESC', 'observation_value ASC']).

## Headers

- `X-Organization-ID` string, uuid — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

A list of observation ranges

- ResponseEnvelopeHashObservationsOnHostResponse
  - `result` HashObservationsOnHostResponse
    - `next_page_token` string, required — A token that can be used to retrieve the next page of ranges.
    - `ranges` HashObservationOnHostRange[], nullable, required — The list of observation ranges matching the request.
      - `end_time` string, date-time, required — When the observation was last seen
      - `ip` string, required — IP address of the host
      - `observation_type` string, required — Observation type selected in the request
      - `observation_value` string, required — Observed value for the selected observation type
      - `port` string, required — Port number
      - `start_time` string, date-time, required — When the observation was first seen
      - `transport_protocol` string — Transport protocol when present for the selected timeline

## Other responses

- `400` — Bad request
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `404` — Resource not found
- `409` — Feature not enabled
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/revisions/261c916bf05b/schema)