v1

latestOpenAPI 3.0.02026-08-065019221.4 KB

Search

The Search API is used to find historical scans performed on the platform. Some data sources and searchable fields are only available on urlscan Pro.

The API search will only indicate an exact count of results up to 10,000 results in the total property. After that the has_more flag will be true. Use the sort value of the last (i.e. oldest) scan result in the current list of results as a parameter for the next Search API call. Supply this value in the search_after query parameter for getting the next (older) batch of results.

API search will find Public scans performed by anyone as well as Unlisted and Private scans performed by you or your teams. For query syntax and searchable fields, refer to https://docs.urlscan.io/pages/search-api-reference

get/api/v1/search

Query parameters

qstring

Search Query (Elasticsearch Query String)

sizeinteger

Number of results to return

search_afterstring

For retrieving the next batch of results, send the value of the sort attribute of the last (oldest) result you received (comma-separated) from the previous call.

datasource'scans' | 'hostnames' | 'incidents' | 'notifications' | 'certificates'

Datasources to search: scans (urlscan.io), hostnames, incidents, notifications, certificates (urlscan Pro)

collapsestring

Field to collapse results on. Only works on current page of results.

Response

totalinteger

Total number of results with an exact count up to 10,000 results.

tookinteger

Search request time in milliseconds.

has_moreboolean

True if there are more than 10,000 results.