---
title: "List active threats"
method: GET
path: "/v3/threat-hunting/threats"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# List active threats

`GET /v3/threat-hunting/threats`

Retrieve a list of active threats observed by Censys by aggregating threat IDs across hosts and web properties. Threats are active if their fingerprint has been identified on hosts or web properties by Censys scans. This information is also available on the [Explore Threats page in the Platform web UI](https://platform.censys.io/threats).<br><br>This endpoint is available to organizations that have access to the Adversary Investigation module.

## Query parameters

- `organization_id` string, uuid, required — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `query` string — Optional CenQL filter to constrain threats list

## Headers

- `X-Organization-ID` string, uuid — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

OK

- ResponseEnvelopeThreatsListResponse
  - `result` ThreatsListResponse
    - `threats` ThreatListItem[], nullable, required — List of active threats observed on the platform.
      - `added_at` string, date-time — The date and time when the threat was added.
      - `count` integer, required — Total count of assets affected by this threat.
      - `description` string — Detailed description of the threat.
      - `host_count` integer, required — Number of hosts affected by this threat.
      - `id` string, required — Unique identifier of the threat.
      - `name` string — Human-readable name of the threat.
      - `references` ThreatReference[], nullable — External reference links for the threat.
        - `link` string, required — URL reference link for the threat.
      - `web_count` integer, required — Number of web properties affected by this threat.

## Other responses

- `400` — Bad request
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `422` — Invalid input
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/revisions/261c916bf05b/schema)