---
title: "Assets Discovery"
method: POST
path: "/search-by-domain/discovery"
tags: ["Domain Intelligence"]
---

# Assets Discovery

`POST /search-by-domain/discovery`

Perform a discovery search to identify potential compromises.

## Request body

- object
  - `domains` string[], required — List of domains to perform discovery on. Accepts root domains (example.com) and will match all subdomains. Between 1-500 domains can be specified per request. For large organizations, consider batching domains across multiple requests.
  - `types` string[] — Types of compromises to discover. 'employees' finds corporate email credentials (@company.com), while 'users' finds consumer credentials. Default includes both types for comprehensive discovery.
  - `cursor` string — Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the 'nextCursor' field in the previous response. Essential for processing large discovery results that span multiple pages.
  - `keywords` string[] — Optional keywords to narrow discovery results to specific services or applications. Examples include ['vpn', 'admin', 'portal'] for critical infrastructure or ['salesforce', 'workday', 'office365'] for SaaS applications.
  - `keywords_match` 'any' | 'all' — Determines how multiple keywords are matched during discovery. 'any' returns results matching at least one keyword (broader discovery), while 'all' requires all keywords to match (targeted discovery for specific services).

## Response `200`

Successful discovery

- DiscoveryResponse
  - `data` DiscoveryData[]
    - `_id` string
    - `url` string
    - `domain` string
    - `type` 'employee' | 'user'
    - `last_uploaded_date` string, date-time
    - `occurrence` integer
  - `nextCursor` string — Cursor for the next page of results

## Other responses

- `400` — Validation error - the request or request body was invalid
- `401` — Unauthorized - the server could not authenticate the request
- `403` — Forbidden - the server authenticated the request but refuses to process it because of insufficient permissions
- `404` — Not found - the server could not find the requested resource
- `408` — Timeout - the server timed out while waiting for a response (90 seconds)
- `429` — Rate limit exceeded - the server has received too many requests in a short period of time
- `500` — Internal server error - the server encountered an unexpected condition that prevented it from fulfilling the request

---

[API](https://skmtc.net/hudsonrock/apis/cavalier-api.md) · [All operations](https://skmtc.net/hudsonrock/apis/cavalier-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hudsonrock/cavalier-api/versions/5ba0142eec4d/schema)