---
title: "Get host enrichment"
method: GET
path: "/v3/global/asset/enrichment/host/{host_ip}"
tags: ["Global Data"]
---

# Get host enrichment

`GET /v3/global/asset/enrichment/host/{host_ip}`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/global/asset/enrichment/host/{host_ip}`
- Auth: HTTP bearer

Retrieve enrichment data for a single host. This endpoint is optimized for high-volume SOC enrichment use cases.<br><br>Use this endpoint to add Censys context (location, ASN, labels, reputation, and more) to IPs in your SIEM or SOAR at high volume, without spending standard credits.<br><br>This endpoint does not consume standard Censys credits. Core organizations may perform up to 20,000 enrichment calls per day. Core + Unlimited Enrichment organizations may perform an unlimited amount of enrichment calls per day.<br><br>[Learn more about the enrichment API here](https://docs.censys.com/docs/host-enrichment).

## Path parameters

- `host_ip` string, ip, required: The IP address of a host.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

OK

- ResponseEnvelopeHostEnrichmentAsset
  - `result` HostEnrichmentAsset
    - `extensions` object, required
    - `resource` HostEnrichment, required
      - `autonomous_system` Routing
        - `asn` integer: The ASN (autonomous system number) of the host's autonomous system.
        - `bgp_prefix` string: The autonomous system's CIDR.
        - `country_code` string: The autonomous system's two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
        - `description` string: Brief description of the autonomous system.
        - `name` string: The friendly name of the autonomous system.
        - `organization` string: The name of the organization managning the autonomous system.
      - `dns` HostDns
        - `forward_dns` object
        - `names` string[], nullable
        - `reverse_dns` HostDnsReverseResolution
          - `names` string[], nullable
          - `resolve_time` string
          - `server` string
      - `greynoise` HostEnrichmentGreynoise
        - `actor` string: The actor that was observed.
        - `classification` string: The classification of the IP address.
        - `last_observed_time` string: The last time the IP address was observed.
      - `ip` string
      - `labels` Label[], nullable
        - `confidence` number, double
        - `evidence` Evidence[], nullable
          - `data_path` string
          - `exists` boolean
          - `found_value` string
          - `literal_match` string
          - `negative` boolean
          - `proprietary` boolean
          - `regex` string
          - `semver_expression` string
        - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
        - `value` string
      - `location` Location
        - `city` string: The English name of the detected city.
        - `continent` string: The English name of the detected continent (North America, Europe, Asia, South America, Africa, Oceania, Antarctica).
        - `coordinates` Coordinates
          - `latitude` number, double
          - `longitude` number, double
        - `country` string: The English name of the detected country.
        - `country_code` string: The detected two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
        - `postal_code` string: The postal code (if applicable) of the detected location.
        - `province` string: The state or province name of the detected location.
        - `registered_country` string: The English name of the registered country.
        - `registered_country_code` string: The registered country's two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
        - `timezone` string: The IANA time zone database name of the detected location.
      - `network` NetworkClassification[], nullable: Information about what type of network the host belongs to.
        - `hosting` boolean: Whether the host belongs to an Internet hosting service provider.
        - `mobile` boolean: Whether the host belongs to a mobile network.
        - `mobile_info` NetworkMobileInfo
          - `carrier_name` string: The name of the mobile carrier.
          - `mcc` string: The Mobile Country Code, identifying the country of the mobile network.
          - `mnc` string: The Mobile Network Code, identifying the specific carrier network.
        - `satellite` boolean: Whether the host belongs to a statellite network.
        - `source` string: The source of the data.
      - `privacy` Privacy[], nullable: Information about privacy services used by the IP, such as VPNs, Proxies, or Tor.
        - `anonymous` boolean: Whether the host uses any kind of privacy service.
        - `proxy` boolean: Whether the host is an open web proxy.
        - `relay` boolean: Whether the host is a location-preserving anonymous relay service, like iCloud Private Relay..
        - `service_provider` string[], nullable: The name of the privacy service providers detected.
        - `source` string: The source of the data.
        - `tor` boolean: Whether the host is a Tor exit node.
        - `tor_info` PrivacyTorInfo
          - `relays` PrivacyTorInfoRelay[], nullable
            - `advertised_bandwidth` integer: Bandwidth in bytes per second that this relay is willing and capable to provide. The minimum of bandwidth_rate, bandwidth_burst, and observed_bandwidth.
            - `alleged_family` string[], nullable: Fingerprints of relays that are part of this relay's family but do not consider this relay to be part of their family.
            - `bandwidth_burst` integer: Bandwidth in bytes per second that this relay is willing to sustain in very short intervals.
            - `bandwidth_rate` integer: Average bandwidth in bytes per second that this relay is willing to sustain over long periods.
            - `blocklist` string[], nullable: Country codes where this bridge is not served because it is believed to be blocked.
            - `bridge` boolean: Whether this entry represents a bridge rather than a relay.
            - `bridgedb_distributor` string: BridgeDB distributor that this bridge is currently assigned to.
            - `consensus_weight` integer: Weight assigned to this relay by the directory authorities that clients use in their path selection algorithm.
            - `consensus_weight_fraction` number, double: Fraction of this relay's consensus weight compared to the sum of all consensus weights in the network. A rough approximation of the probability of this relay to be selected by clients.
            - `contact` string: Contact address of the relay operator.
            - `dir_address` string: IPv4 address and TCP port where the relay accepts directory connections.
            - `effective_family` string[], nullable: Fingerprints of relays in an effective, mutual family relationship with this relay. Always contains the relay's own fingerprint.
            - `exit_addresses` string[], nullable: IPv4 addresses that the relay used to exit to the Internet in the past 24 hours.
            - `exit_policy` string[], nullable: Array of exit-policy lines from the relay's router descriptor.
            - `exit_policy_summary` PrivacyTorInfoRelayExitPolicySummary
              - …
            - `exit_policy_v6_summary` PrivacyTorInfoRelayExitPolicySummary
              - …
            - `exit_probability` number, double: Probability of this relay to be selected for the exit position, calculated based on consensus weights, relay flags, and bandwidth weights.
            - `fingerprint` string: Relay fingerprint consisting of 40 upper-case hexadecimal characters.
            - `flags` string[], nullable: Relay flags assigned by the directory authorities.
            - `guard_probability` number, double: Probability of this relay to be selected for the guard position, calculated based on consensus weights, relay flags, and bandwidth weights.
            - `hashed_fingerprint` string: SHA-1 hash of the bridge fingerprint consisting of 40 upper-case hexadecimal characters.
            - `indirect_family` string[], nullable: Fingerprints of relays reachable by following effective, mutual family relationships starting at this relay, but not directly in a mutual family relationship.
            - `measured` boolean: Whether the consensus weight of this relay is based on a threshold of 3 or more measurements by Tor bandwidth authorities.
            - `middle_probability` number, double: Probability of this relay to be selected for the middle position, calculated based on consensus weights, relay flags, and bandwidth weights.
            - `nickname` string: Relay nickname consisting of 1-19 alphanumerical characters.
            - `observed_bandwidth` integer: Bandwidth estimate in bytes per second of the capacity this relay can handle. The lesser of the maximum sustained output and input over any ten second period in the past day.
            - `or_addresses` string[], nullable: IPv4 or IPv6 addresses and TCP ports where the relay accepts onion-routing connections. The first address is the primary onion-routing address.
            - `overload_general_timestamp` integer: Timestamp indicating when the relay reached an overloaded state (e.g., OOM invocation, ntor onionskins dropped, or TCP port exhaustion).
            - `platform` string: Platform string containing operating system and Tor version details.
            - `recommended_version` boolean: Whether the Tor software version of this relay is recommended by the directory authorities.
            - `transports` string[], nullable: Pluggable transport names supported by this bridge.
            - `unreachable_or_addresses` string[], nullable: IPv4 or IPv6 addresses and TCP ports where the relay claims to accept onion-routing connections but that the directory authorities failed to confirm as reachable.
            - `version` string: Tor software version without leading 'Tor' as reported by the directory authorities.
            - `version_status` string: Status of the Tor software version: recommended, experimental, obsolete, new in series, or unrecommended.
        - `vpn` boolean: Whether the host is a VPN service exit node IP address.
      - `reputation` Reputation
        - `class_probabilities` ReputationClassProbability[], nullable
          - `label` string
          - `probability` number, double
        - `evidence` ReputationEvidence[], nullable
          - `additional_fields` ReputationEvidenceFieldValue[], nullable
            - `field` string
            - `value` string
          - `category` string
          - `evidence_score` number, float
          - `external_signals` ReputationEvidenceExternalSignal[], nullable
            - `description` string
            - `source` string
            - `tlp` '' | 'green' | 'amber' | 'red' | 'white'
          - `feature` ReputationEvidenceFeature
            - `category` string
            - `contribution` number, double
            - `id` string
            - `name` string
            - `value` string
          - `threats` ReputationEvidenceThreat[], nullable
            - `last_observed_time` string
            - `threat_id` string
            - `threat_types` string[], nullable
        - `label` string
        - `model_version` string
        - `score` number, float
        - `score_level` '' | 'benign' | 'low_risk' | 'medium_risk' | 'high_risk' | 'malicious'
        - `score_suppressed` boolean
      - `service_count` integer
      - `services` HostEnrichmentService[], nullable
        - `labels` Label[], nullable
          - `confidence` number, double
          - `evidence` Evidence[], nullable
            - `data_path` string
            - `exists` boolean
            - `found_value` string
            - `literal_match` string
            - `negative` boolean
            - `proprietary` boolean
            - `regex` string
            - `semver_expression` string
          - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
          - `value` string
        - `port` integer
        - `protocol` string
        - `scan_time` string
        - `threats` Threat[], nullable
          - `actors` ThreatActor[], nullable
            - `all_names` string[], nullable
            - `id` string
            - `malpedia_group_id` string
            - `mitre_group_id` string
            - `primary_name` string
          - `confidence` number, double
          - `details` ThreatDetails
            - `campaign_id` string
            - `campaign_theme` string
            - `control_servers` string[], nullable
            - `version` string
          - `evidence` Evidence[], nullable
            - `data_path` string
            - `exists` boolean
            - `found_value` string
            - `literal_match` string
            - `negative` boolean
            - `proprietary` boolean
            - `regex` string
            - `semver_expression` string
          - `id` string
          - `malware` ThreatMalware
            - `all_names` string[], nullable
            - `id` string
            - `last_updated_at` string
            - `malpedia_id` string
            - `primary_name` string
          - `name` string
          - `source` '' | 'censys' | 'recog' | 'wappalyzer' | 'third_party' | 'html_meta_extractor'
          - `tactic` string[], nullable
          - `type` string[], nullable
      - `third_party` ThirdParty
        - `mallory` MalloryAI[], nullable: Threat intelligence records from MalloryAI.
          - `created_at` string
          - `first_seen_at` string
          - `last_seen_at` string
          - `observable` MalloryAIObservable
            - `attributes` string
            - `created_at` string
            - `description` string
            - `name` string
            - `type` string
            - `updated_at` string
            - `uuid` string
          - `opinions` MalloryAIOpinion[], nullable
            - `attributes` MalloryAIOpinionAttributes
              - …
            - `confidence` string
            - `created_at` string
            - `description` string
            - `published_at` string
            - `reference_source_slug` string
            - `reference_url` string
            - `reference_uuid` string
            - `source` string
            - `updated_at` string
            - `uuid` string
            - `verdict` string
          - `source_count` integer
          - `updated_at` string
          - `uuid` string
          - `verdict_summary` MalloryAIVerdictSummary
            - `malicious` integer
            - `suspicious` integer
      - `whois` Whois
        - `network` Network
          - `allocation_type` string
          - `cidrs` string[], nullable: A set of CIDRs describing the range.
          - `created` string
          - `handle` string
          - `name` string
          - `updated` string
        - `organization` Organization
          - `abuse_contacts` Contact[], nullable
            - `email` string
            - `handle` string
            - `name` string
          - `address` string
          - `admin_contacts` Contact[], nullable
            - `email` string
            - `handle` string
            - `name` string
          - `city` string
          - `country` string
          - `handle` string
          - `name` string
          - `postal_code` string
          - `state` string
          - `street` string
          - `tech_contacts` Contact[], nullable
            - `email` string
            - `handle` string
            - `name` string

## Other responses

- `400`: Bad request
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Resource not found
- `409`: Feature not enabled
- `429`: Daily request limit reached
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 4 info
  - added the optional property `result/resource/reputation/class_probabilities` to the response with the `200` status
  - added the optional property `result/resource/reputation/evidence/items/feature` to the response with the `200` status
  - added the optional property `result/resource/reputation/label` to the response with the `200` status
  - added the optional property `result/resource/reputation/score_suppressed` to the response with the `200` status

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/global/asset/enrichment/host/:host_ip/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)