---
title: "CensEye: Retrieve value counts to discover pivots"
method: POST
path: "/v3/threat-hunting/value-counts"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# CensEye: Retrieve value counts to discover pivots

`POST /v3/threat-hunting/value-counts`

Get counts of web assets for specific field-value pairs and combinations of field-value pairs. This is similar to the [CensEye functionality](https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections#/) available in the Platform web UI, but it allows you to define specific fields of interest rather than the [default fields](https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections#default-pivot-fields) leveraged by the tool in the UI.<br><br>Each array can only target fields within the same nested object and may contain at most 5 field-value pairs. For example, you can combine `host.services.port=80` and `host.services.protocol=SSH` in the same array, but you cannot combine `host.services.port=80` and `host.location.country="United States"` in the same array. You can input multiple arrays of objects in each API call.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module. This endpoint costs 1 credit per count condition (array of objects) included in the API call.

## Query parameters

- `organization_id` string, uuid, required — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Request body

- SearchValueCountsInputBody
  - `and_count_conditions` CountCondition[], nullable, required — Groups of field-value pairs to count matches for. Each group may contain up to 5 field-value pairs.
    - `field_value_pairs` FieldValuePair[], nullable, required — Field-value pairs to count matches for. Must target fields from the same nested object and may contain at most 5 pairs per group.
      - `field` string, required — The field to match
      - `value` string, required — The value to match
  - `query` string — CenQL query string to filter documents

## Response `200`

OK

- ResponseEnvelopeValueCountsResponse
  - `result` ValueCountsResponse
    - `and_count_results` number[], nullable, required

## Other responses

- `400` — Bad request
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `422` — Invalid input
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/revisions/261c916bf05b/schema)