---
title: "Get host event history"
method: GET
path: "/v3/global/asset/host/{host_id}/timeline"
tags: ["Global Data"]
---

# Get host event history

`GET /v3/global/asset/host/{host_id}/timeline`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/global/asset/host/{host_id}/timeline`
- Auth: HTTP bearer

Retrieve event history for a host. A host ID is its IP address.<br><br>Note that when a service protocol changes after a new scan (for example, from `UNKNOWN` to `NETBIOS`), this information will be reflected in the `scan` object.<br><br>In a SOC environment, use this endpoint to see what changed on an IP over time, such as new services, certificate swaps, and software changes, to reconstruct when attacker infrastructure was stood up or modified.

## Path parameters

- `host_id` string, required: The IP address of a host.

## Query parameters

- `organization_id` string, uuid: The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `start_time` string, date-time, required: Start time of the host timeline. Equivalent to the To field in the event history UI. This must be the timestamp closest to the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 2 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.
- `end_time` string, date-time, required: End time of the host timeline. Equivalent to the From field in the event history UI. This must be the timestamp furthest from the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 1 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

OK

- ResponseEnvelopeHostTimeline
  - `result` HostTimeline
    - `events` HostTimelineEventAsset[], nullable, required
      - `extensions` object, required
      - `resource` HostTimelineEvent, required
        - `endpoint_scanned` EndpointScanned
          - `diff` object
          - `scan` EndpointScan
            - `argocd` Argocd
              - …
            - `banner` string, utf8
            - `banner_hash_sha256` string, hex
            - `chrome_devtools` ChromeDevtools
              - …
            - `clickhouse_http` ClickHouseHttp
              - …
            - `cobalt_strike` CobaltStrike
              - …
            - `elasticsearch` ElasticSearch
              - …
            - `endpoint_type` string
            - `fortigate` Fortigate
              - …
            - `graphql` Graphql
              - …
            - `hostname` string
            - `http` Http
              - …
            - `influxdb` Influxdb
              - …
            - `ip` string
            - `is_success` boolean
            - `ivanti_avalanche` IvantiAvalanche
              - …
            - `jenkins` Jenkins
              - …
            - `jupyter` Jupyter
              - …
            - `keycloak` Keycloak
              - …
            - `kubernetes` Kubernetes
              - …
            - `mcp` Mcp
              - …
            - `netflix_nrdp` NetflixNrdp
              - …
            - `nginx_proxy_manager` NginxProxyManager
              - …
            - `ollama` Ollama
              - …
            - `open_directory` OpenDirectory
              - …
            - `path` string
            - `plex_media_server` PlexMediaServer
              - …
            - `port` integer
            - `pprof` Pprof
              - …
            - `prometheus` Prometheus
              - …
            - `prometheus_target` PrometheusTarget
              - …
            - `proxmox_ve` ProxmoxVe
              - …
            - `redlion_web` RedlionWeb
              - …
            - `scada_view` ScadaView
              - …
            - `scan_time` string
            - `screenshots` Screenshot[], nullable
              - …
            - `synology_dsm` SynologyDsm
              - …
            - `tailscale_derp` TailscaleDerp
              - …
            - `tls` Tls
              - …
            - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
            - `vault` Vault
              - …
            - `wordpress` Wordpress
              - …
        - `event_time` string
        - `forward_dns_resolved` ForwardDnsResolved
          - `name` string
          - `resolve_time` string
        - `jarm_scanned` JarmScanned
          - `diff` object
          - `scan` JarmScan
            - `cipher_and_version_fingerprint` string, hex: The first 30 character portion of the Jarm fingerprint.
            - `fingerprint` string, hex: The 62 character Jarm fingerprint of the service.
            - `hostname` string
            - `ip` string
            - `is_success` boolean
            - `port` integer
            - `scan_time` string: The time the service was fingerprinted
            - `tls_extensions_sha256` string, hex: The second 32 character portion of the Jarm fingerprint
            - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
        - `location_updated` LocationUpdated
          - `location` Location
            - `city` string: The English name of the detected city.
            - `continent` string: The English name of the detected continent (North America, Europe, Asia, South America, Africa, Oceania, Antarctica).
            - `coordinates` Coordinates
              - …
            - `country` string: The English name of the detected country.
            - `country_code` string: The detected two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
            - `postal_code` string: The postal code (if applicable) of the detected location.
            - `province` string: The state or province name of the detected location.
            - `registered_country` string: The English name of the registered country.
            - `registered_country_code` string: The registered country's two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
            - `timezone` string: The IANA time zone database name of the detected location.
        - `reverse_dns_resolved` ReverseDnsResolved
          - `names` string[], nullable
          - `resolve_time` string
        - `route_updated` RouteUpdated
          - `diff` object
          - `route` AutonomousSystem
            - `asn` integer: The ASN (autonomous system number) of the host's autonomous system.
            - `bgp_prefix` string: The autonomous system's CIDR.
            - `country_code` string: The autonomous system's two-letter ISO 3166-1 alpha-2 country code (US, CN, GB, RU, ...).
            - `description` string: Brief description of the autonomous system.
            - `name` string: The friendly name of the autonomous system.
            - `organization` string: The name of the organization managning the autonomous system.
        - `service_scanned` ServiceScanned
          - `diff` object
          - `scan` ServiceScan
            - `activemq` Activemq
              - …
            - `amqp` Amqp
              - …
            - `anerma_cf_forth` AnermaCfForth
              - …
            - `any_connect` AnyConnect
              - …
            - `asterisk_manager_interface` AsteriskManagerInterface
              - …
            - `bacnet` Bacnet
              - …
            - `banner` string, utf8
            - `banner_hash_sha256` string, hex
            - `bluemax_nuttcp` BluemaxNuttcp
              - …
            - `checkpoint_topology` CheckpointTopology
              - …
            - `chromecast` Chromecast
              - …
            - `cisco_ipsla` CiscoIpsla
              - …
            - `cisco_sdwan_vdaemon` CiscoSdwanVdaemon
              - …
            - `clamav` Clamav
              - …
            - `clickhouse_native` ClickHouseNative
              - …
            - `cmore` Cmore
            - `cnord_security_center` CnordSecurityCenter
              - …
            - `coap` Coap
              - …
            - `comelit_icona` ComelitIcona
              - …
            - `cortex_xdr_p2p` CortexXdrP2P
              - …
            - `crestron_cp3` CrestronCp3
              - …
            - `crestron_din_ap2` CrestronDinAp2
              - …
            - `cursor_on_target` CursorOnTarget
              - …
            - `cwmp` Cwmp
              - …
            - `darkcomet` Darkcomet
              - …
            - `darkgate` Darkgate
              - …
            - `dcerpc` Dcerpc
              - …
            - `denon_heos` DenonHeos
              - …
            - `dhcpdiscover` Dhcpdiscover
              - …
            - `dicom` Dicom
              - …
            - `dlt` Dlt
              - …
            - `dnp3` Dnp3
            - `dns` Dns
              - …
            - `dotnet_negotiate_stream` DotnetNegotiateStream
              - …
            - `dtls` Dtls
            - `dubbo` Dubbo
            - `dvr_ip` DvrIp
              - …
            - `eip` Eip
              - …
            - `elasticsearch_transport` ElasticsearchTransport
              - …
            - `elf_file` ElfFile
              - …
            - `epmd` Epmd
              - …
            - `etcd` Etcd
              - …
            - `ethereum` Ethereum
              - …
            - `fins` Fins
              - …
            - `flash_socket_policy` FlashSocketPolicy
              - …
            - `fourd_server` FourdServer
              - …
            - `fox` Fox
              - …
            - `frps` Frps
              - …
            - `ftp` Ftp
              - …
            - `gearman` Gearman
              - …
            - `gemini` Gemini
              - …
            - `geovision_audio` GeovisionAudio
              - …
            - `giop` Giop
              - …
            - `gopher` Gopher
              - …
            - `gril_console` GrilConsole
              - …
            - `hajime` Hajime
              - …
            - `hid_vertx` HidVertx
              - …
            - `hikvision` Hikvision
              - …
            - `hoosat_htnd_grpc` HoosatHtndGrpc
              - …
            - `ibmnje` Ibmnje
              - …
            - `icap` Icap
              - …
            - `iec60870_5_104` Iec608705104
              - …
            - `ike` Ike
              - …
            - `imap` Imap
              - …
            - `iota` Iota
              - …
            - `ip` string
            - `iperf3` Iperf3
              - …
            - `ipmi` Ipmi
              - …
            - `ipp` Ipp
              - …
            - `is_success` boolean
            - `isc_dhcp_omapi` IscDhcpOmapi
              - …
            - `iscsi` Iscsi
              - …
            - `java_rmi` JavaRmi
              - …
            - `kcodes_netusb` KcodesNetusb
              - …
            - `knxip` Knxip
              - …
            - `krpc` Krpc
              - …
            - `l2tp` L2Tp
              - …
            - `ldap` Ldap
              - …
            - `libp2p` Libp2P
              - …
            - `lpd` Lpd
              - …
            - `managesieve` Managesieve
              - …
            - `manticore_sphinxapi` ManticoreSphinxapi
              - …
            - `mavlink` Mavlink
              - …
            - `mdns` Mdns
              - …
            - `melsec` Melsec
              - …
            - `memberlist` Memberlist
              - …
            - `memcached` Memcached
              - …
            - `mikrotik_winbox` MikrotikWinbox
              - …
            - `minecraft` Minecraft
              - …
            - `mms` Mms
              - …
            - `modbus` Modbus
              - …
            - `monero_p2p` MoneroP2P
              - …
            - `mongodb` Mongodb
              - …
            - `mpls_ldp` MplsLdp
              - …
            - `mqtt` Mqtt
              - …
            - `mssql` Mssql
              - …
            - `murmur` Murmur
              - …
            - `mysql` Mysql
              - …
            - `mysqlx` Mysqlx
              - …
            - `nats_io` NatsIo
              - …
            - `nbd` Nbd
              - …
            - `nfs_mountd` NfsMountd
              - …
            - `nmea` Nmea
              - …
            - `nrpe` Nrpe
              - …
            - `ntp` Ntp
              - …
            - `ntrip` Ntrip
              - …
            - `onc` Onc
            - `onvif` Onvif
              - …
            - `opc_ua` OpcUa
              - …
            - `openflow` Openflow
              - …
            - `openvpn` Openvpn
              - …
            - `openvpn_mgmt` OpenvpnMgmt
              - …
            - `opw_fsc3000` OpwFsc3000
              - …
            - `oracle` Oracle
              - …
            - `orenco_atrtu` OrencoAtrtu
              - …
            - `otlp_grpc` OtlpGrpc
              - …
            - `pc_anywhere` PcAnywhere
              - …
            - `perforce_p4d` PerforceP4D
              - …
            - `pgbouncer` Pgbouncer
              - …
            - `pigeonhole` Pigeonhole
              - …
            - `pop3` Pop3
              - …
            - `port` integer
            - `portmap` Portmap
              - …
            - `postgres` Postgres
              - …
            - `pptp` Pptp
              - …
            - `profinet_cm` ProfinetCm
              - …
            - `protocol` string
            - `qdrant_grpc` QdrantGrpc
              - …
            - `r1soft_buagent` R1SoftBuagent
              - …
            - `rdate` Rdate
              - …
            - `rdp` Rdp
              - …
            - `realport` Realport
              - …
            - `redis` Redis
              - …
            - `redline` Redline
              - …
            - `redlion_crimson` RedlionCrimson
              - …
            - `redshift` Redshift
              - …
            - `reolink_baichuan` ReolinkBaichuan
              - …
            - `representative_info` RepresentativeInfo
              - …
            - `rifatron` Rifatron
              - …
            - `ripple` Ripple
              - …
            - `rlogin` Rlogin
              - …
            - `rocketmq` Rocketmq
              - …
            - `routeros_api` RouterosApi
              - …
            - `rtmp` Rtmp
              - …
            - `rtsp` Rtsp
              - …
            - `rustdesk_heartbeat` RustdeskHeartbeat
              - …
            - `rustdesk_relay` RustdeskRelay
              - …
            - `rustdesk_rendezvous` RustdeskRendezvous
              - …
            - `s7` S7
              - …
            - `sap_router` SapRouter
              - …
            - `sapient` Sapient
              - …
            - `scan_time` string
            - `scpi` Scpi
              - …
            - `screenshots` Screenshot[], nullable
              - …
            - `ser2net` Ser2Net
              - …
            - `seven_days_to_die` SevenDaysToDie
              - …
            - `sip` Sip
              - …
            - `skinny` Skinny
              - …
            - `smb` Smb
              - …
            - `smtp` Smtp
              - …
            - `smux` Smux
              - …
            - `snmp` Snmp
              - …
            - `socks` Socks
              - …
            - `spice` Spice
              - …
            - `spotify_connect` SpotifyConnect
              - …
            - `ssdp` Ssdp
              - …
            - `ssh` Ssh
              - …
            - `steam` Steam
              - …
            - `stomp` Stomp
              - …
            - `stun` Stun
              - …
            - `syncthing_bep` SyncthingBep
              - …
            - `synergy` Synergy
              - …
            - `tacacs_plus` TacacsPlus
              - …
            - `tarantool` Tarantool
              - …
            - `taurus_stb` TaurusStb
              - …
            - `team_viewer` TeamViewer
              - …
            - `telexper_tlxp` TelexperTlxp
              - …
            - `telnet` Telnet
              - …
            - `thrulay` Thrulay
              - …
            - `tibia` Tibia
              - …
            - `tls` Tls
              - …
            - `tplink_kasa` TplinkKasa
              - …
            - `transport_protocol` '' | 'tcp' | 'udp' | 'icmp' | 'quic'
            - `tvt_control` TvtControl
              - …
            - `twamp_control` TwampControl
              - …
            - `unitronics_pcom` UnitronicsPcom
              - …
            - `upnp` Upnp
              - …
            - `utilinet_lpp` UtilinetLpp
              - …
            - `vantage_infusion` VantageInfusion
              - …
            - `ventrilo` Ventrilo
              - …
            - `visionhitech_ipcam` VisionhitechIpcam
              - …
            - `vnc` Vnc
              - …
            - `weblogic_t3` WeblogicT3
              - …
            - `wince_cerdisp` WinceCerdisp
              - …
            - `winrm` Winrm
              - …
            - `wow_realmd` WowRealmd
              - …
            - `ws_discovery` WsDiscovery
              - …
            - `x11` X11
              - …
            - `zeromq` Zeromq
              - …
        - `whois_updated` WhoisUpdated
          - `diff` object
          - `whois` Whois
            - `network` Network
              - …
            - `organization` Organization
              - …
    - `scanned_to` string, date-time, required

## Other responses

- `400`: Bad request
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Resource not found
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 11 breaking, 41 info
  - the `result/events/items/resource/endpoint_scanned/scan/http/headers/additionalProperties/headers` response's property format changed from `utf8` to no format for status `200`
  - the `result/events/items/resource/endpoint_scanned/scan/http/html_tags` response's property format changed from `utf8` to no format for status `200`
  - the `result/events/items/resource/service_scanned/scan/ike/v1/vendor_ids` response's property format changed from `utf8` to no format for status `200`
  - the `result/events/items/resource/service_scanned/scan/ike/v2/vendor_ids` response's property format changed from `utf8` to no format for status `200`
  - …48 more

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/global/asset/host/:host_id/timeline/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)