---
title: "List attack surfaces"
method: GET
path: "/v1/attacksurfaces"
tags: ["Exposure Management"]
---

# List attack surfaces

`GET /v1/attacksurfaces`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v1/attacksurfaces`
- Auth: HTTP bearer

Retrieve the attack surfaces for your organization. Most organizations will have only one.<br><br>This endpoint does not cost credits to execute.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `page_size` integer: Maximum number of attack surfaces to return per page.
- `page_token` string: Pagination token from a previous response to retrieve the next page of results.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Attack surfaces listed successfully

- ResponseEnvelopeAttackSurfacesList
  - `result` AttackSurfacesList
    - `attack_surfaces` AttackSurface[], nullable, required: The attack surfaces on this page.
      - `created_at` string, date-time: When the attack surface was created.
      - `failed_asset_count` integer, required: The number of added assets that Censys could not apply to the attack surface.
      - `id` string, uuid, required: The unique ID of the attack surface.
      - `pending_asset_count` integer, required: The number of added assets that Censys has accepted but not yet applied to the attack surface.
      - `status` 'active' | 'populating' | 'failed': The state of the attack surface. 'populating' while Censys discovers its assets, 'active' once discovery has completed, and 'failed' if discovery did not complete. Omitted when the state cannot be determined.
      - `updated_at` string, date-time: When the attack surface was last updated.
    - `next_page_token` string: A token to pass as page_token to retrieve the next page. Omitted on the last page.

## Other responses

- `400`: Invalid page token
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `409`: The Exposure Management API is not enabled, or the operation conflicts with the attack surface's current state.
- `422`: Invalid inputs
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v1/attacksurfaces/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)