Collections

Run a search query within a collection

Changed on Nov 3, 2026

Run a search query across a collection's assets. Reference the documentation on Censys Query Language for information about query syntax. Host services that match your search criteria will be returned in a matched_services object.<br><br>In a SOC environment, use this endpoint to search only within the defined scope of a collection, so triage and hunting results stay relevant instead of covering the whole internet.

post/v3/collections/{collection_uid}/search/query

Request

Base URL
https://api.platform.censys.io
URL
https://api.platform.censys.io/v3/collections/{collection_uid}/search/query
Auth
HTTP bearer

Path parameters

collection_uidstring required

The UID for the collection

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Request body

fieldsstring[] nullable

Specify fields to only return in the response. If you provide fields and omit host.services.port, host.services.transport_protocol, and host.services.protocol, then matched_services will not be returned in the response.

page_sizeinteger nullable

Number of results to return to per page. The default and maximum is 100.

page_tokenstring

page token for the requested page of search results

querystring required

CenQL query string to search upon

Example request

{
  "query": "host.services: (protocol=SSH and not port: 22)"
}

Response

Changes

Nov 3, 2026ec1686b0a36a Revision changes
- breaking
  the ///////// response's property format changed from hex to no format for status
- breaking
  the /////// response's property format changed from hex to no format for status
- breaking
  the ///////// response's property format changed from hex to no format for status
- breaking
  the /////// response's property format changed from hex to no format for status
- breaking
  the ///////// response's property format changed from hex to no format for status
- breaking
  the /////// response's property format changed from hex to no format for status
- breaking
  the ///////// response's property format changed from hex to no format for status
- breaking
  the /////// response's property format changed from hex to no format for status
- breaking
  the //////////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////////// response's property format changed from utf8 to no format for status
- breaking
  the ////////// response's property format changed from utf8 to no format for status
- breaking
  the ///////// response's property format changed from utf8 to no format for status
- breaking
  the ///////// response's property format changed from utf8 to no format for status
- breaking
  the //////// response's property format changed from utf8 to no format for status
- breaking
  the ////////// response's property format changed from utf8 to no format for status
- breaking
  the ///////// response's property format changed from hex to no format for status
- breaking
  the //////// response's property format changed from utf8 to no format for status
- breaking
  the ///////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from utf8 to no format for status
- breaking
  the ////////// response's property format changed from utf8 to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from hex to no format for status
- breaking
  the //////// response's property format changed from hex to no format for status
- breaking
  the ////////// response's property format changed from utf8 to no format for status
- breaking
  the //////// response's property format changed from utf8 to no format for status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property ////////// to the response with the status
- info
  added the optional property ////////// to the response with the status
- info
  added the optional property ///////// to the response with the status
- info
  added the optional property ///////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property //////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status

Operation history