Global Data

Get host event history

Changed on Nov 3, 2026

Retrieve event history for a host. A host ID is its IP address.<br><br>Note that when a service protocol changes after a new scan (for example, from UNKNOWN to NETBIOS), this information will be reflected in the scan object.<br><br>In a SOC environment, use this endpoint to see what changed on an IP over time, such as new services, certificate swaps, and software changes, to reconstruct when attacker infrastructure was stood up or modified.

get/v3/global/asset/host/{host_id}/timeline

Request

Base URL
https://api.platform.censys.io
URL
https://api.platform.censys.io/v3/global/asset/host/{host_id}/timeline
Auth
HTTP bearer

Path parameters

host_idstring required

The IP address of a host.

Example:8.8.8.8

Query parameters

organization_idstring uuid

Example:11111111-2222-3333-4444-555555555555

start_timestring date-time required

Start time of the host timeline. Equivalent to the To field in the event history UI. This must be the timestamp closest to the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 2 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.

Example:2025-01-02T00:00:00Z

end_timestring date-time required

End time of the host timeline. Equivalent to the From field in the event history UI. This must be the timestamp furthest from the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 1 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.

Example:2025-01-01T00:00:00Z

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Response

Changes

Nov 3, 2026ec1686b0a36a Revision changes
- breaking
  the ///////// response's property format changed from utf8 to no format for status
- breaking
  the /////// response's property format changed from utf8 to no format for status
- breaking
  the //////// response's property format changed from utf8 to no format for status
- breaking
  the //////// response's property format changed from utf8 to no format for status
- breaking
  the /////// response's property format changed from utf8 to no format for status
- breaking
  the ///////// response's property format changed from utf8 to no format for status
- breaking
  the //////// response's property format changed from hex to no format for status
- breaking
  the /////// response's property format changed from utf8 to no format for status
- breaking
  the //////// response's property format changed from hex to no format for status
- breaking
  the ///////// response's property format changed from utf8 to no format for status
- breaking
  the ///////// response's property format changed from utf8 to no format for status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property /////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status
- info
  added the optional property ////// to the response with the status

Operation history