---
title: "Get service history for a host"
method: GET
path: "/v3/global/asset/host/{host_id}/observations/services"
tags: ["Global Data"]
---

# Get service history for a host

`GET /v3/global/asset/host/{host_id}/observations/services`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/global/asset/host/{host_id}/observations/services`
- Auth: HTTP bearer

Retrieve historical service observations for a host. This endpoint returns time ranges during which services were detected on the host.<br><br>You can define a specific time frame of interest. If you do not specify a time frame, this endpoint will search the historical dataset that is available to your account.<br><br>You can filter by port number, protocol, and transport protocol.<br><br>In a SOC environment, use this endpoint to see when a specific service was exposed on an IP, so you can check whether it was live during the window of a suspected incident.

## Path parameters

- `host_id` string, ip, required: The IP address of a host.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `start_time` string: Start of date range (RFC3339 format, e.g., 2024-01-01T00:00:00Z). If not specified, defaults to the maximum query window back from the end time.
- `end_time` string: End of date range (RFC3339 format, e.g., 2024-01-31T23:59:59Z). If not specified, defaults to now. Cannot be in the future.
- `page_size` integer: Number of results per page (max 100)
- `page_token` string: Pagination token from previous response
- `port` integer: Filter by port number
- `protocol` string: Filter by application protocol
- `transport_protocol` 'tcp' | 'udp' | 'quic': Filter by transport protocol
- `order_by` string[], nullable: Order observations by these fields. Multiple values can be provided to sort by multiple fields (e.g., ['port DESC', 'protocol ASC']).

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

A list of service observation ranges

- ResponseEnvelopeServicesOnHostResponse
  - `result` ServicesOnHostResponse
    - `next_page_token` string, required: A token that can be used to retrieve the next page of ranges.
    - `ranges` ServiceOnHostRange[], nullable, required: The list of requested services.
      - `end_time` string, date-time, required: When the service was last observed
      - `ip` string, required: IP address where the service was observed
      - `port` string, required: Port number where the service was observed
      - `protocol` string, required: Application protocol (e.g., HTTP, HTTPS)
      - `start_time` string, date-time, required: When the service was first observed
      - `transport_protocol` string, required: Transport protocol (e.g., TCP, UDP, QUIC)

## Other responses

- `400`: Bad request
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Resource not found
- `409`: Feature not enabled
- `500`: Internal server error

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)