---
title: "Get an attack surface"
method: GET
path: "/v1/attacksurfaces/{attack_surface_id}"
tags: ["Exposure Management"]
---

# Get an attack surface

`GET /v1/attacksurfaces/{attack_surface_id}`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v1/attacksurfaces/{attack_surface_id}`
- Auth: HTTP bearer

Retrieve an attack surface for your organization. Use the literal 'default' in place of the attack surface ID to retrieve your organization's attack surface.<br><br>This endpoint does not cost credits to execute.

## Path parameters

- `attack_surface_id` string, required: The ID of the attack surface, or the literal 'default' for your organization's attack surface. Obtain the attack surface ID using the list attack surfaces endpoint.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Attack surface retrieved successfully

- ResponseEnvelopeAttackSurface
  - `result` AttackSurface
    - `created_at` string, date-time: When the attack surface was created.
    - `failed_asset_count` integer, required: The number of added assets that Censys could not apply to the attack surface.
    - `id` string, uuid, required: The unique ID of the attack surface.
    - `pending_asset_count` integer, required: The number of added assets that Censys has accepted but not yet applied to the attack surface.
    - `status` 'active' | 'populating' | 'failed': The state of the attack surface. 'populating' while Censys discovers its assets, 'active' once discovery has completed, and 'failed' if discovery did not complete. Omitted when the state cannot be determined.
    - `updated_at` string, date-time: When the attack surface was last updated.

## Other responses

- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Attack surface not found
- `409`: The Exposure Management API is not enabled, or the operation conflicts with the attack surface's current state.
- `422`: Invalid inputs
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v1/attacksurfaces/:attack_surface_id/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)