---
title: "Export Callback IPs"
method: POST
path: "/v1/callback/export-ips"
tags: ["Callback"]
---

# Export Callback IPs

`POST /v1/callback/export-ips`

Export callback IPs matching the given filters as a newline-delimited
plain text list. Supports the same filter parameters as the List
Callback IPs endpoint.

## Request body

- CallbackFilterFields — Common filter fields for callback IP queries.
  - `is_stage_1` boolean — Filter by stage 1 status. true = file downloaded from this IP.
  - `is_stage_2` boolean — Filter by stage 2 status. true = suspected C2 based on VT/sandbox analysis.
  - `first_seen_after` string, date — Only include IPs first seen after this date (YYYY-MM-DD).
  - `first_seen_before` string, date — Only include IPs first seen before this date (YYYY-MM-DD).
  - `last_seen_after` string, date — Only include IPs last seen after this date (YYYY-MM-DD).
  - `last_seen_before` string, date — Only include IPs last seen before this date (YYYY-MM-DD).
  - `has_files` boolean — If true, only include IPs with associated malware files. If false, only IPs without files.
  - `file_type` string — Filter by file MIME type (e.g. "application/x-executable").
  - `file_name` string — Filter by file name substring match.
  - `file_hash` string — Filter by file SHA256 hash.
  - `scanner_ips` string[] — Filter to IPs associated with these scanner IPs.
  - `ips` string[] — Filter to this specific set of callback IPs.

## Response `200`

OK - newline-delimited list of callback IPs.

## Other responses

- `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again.
- `401` — Unauthorized. Please check your API key.
- `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.
- `500` — Unexpected error

---

[API](https://skmtc.net/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.net/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/versions/30942574656d/schema)