---
title: "CensEye: Create a pivot analysis job"
method: POST
path: "/v3/threat-hunting/censeye/jobs"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# CensEye: Create a pivot analysis job

`POST /v3/threat-hunting/censeye/jobs`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/threat-hunting/censeye/jobs`
- Auth: HTTP bearer

Create an asynchronous CensEye pivot analysis job for a host, web property, or certificate. The job extracts [default pivot fields](https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections#default-pivot-fields) from the target asset and counts matching documents for each field-value pair. Poll the job status endpoint to track progress, then retrieve results when complete.<br><br>Use this endpoint to start an analysis of a suspicious host, web property, or certificate that finds the rare attributes it shares with other assets, so you can uncover related attacker infrastructure.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.<br><br>This endpoint costs 44 credits to execute for a host, 28 credits to execute for a web property, and 7 credits to execute for a certificate.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Request body

- CreateCenseyeJobInputBody
  - `target` CenseyeTarget, required
    - `certificate_id` string: SHA-256 fingerprint of the certificate to analyze.
    - `host_id` string: IP address of the host to analyze.
    - `webproperty_id` string: Web property identifier (hostname:port) to analyze.

## Response `200`

OK

- ResponseEnvelopeCenseyeJob
  - `result` CenseyeJob
    - `at_time` string, date-time: The point-in-time the asset data was evaluated at.
    - `create_time` string, date-time: When the job was created.
    - `delete_time` string, date-time: When the job and results will be deleted.
    - `error` string: Error message if the job failed.
    - `job_id` string, required: Unique identifier of the job.
    - `result_count` integer: Total number of result field-value pairs.
    - `state` 'started' | 'completed' | 'failed' | 'unknown', required: Current state of the job.
    - `target` CenseyeTarget, required
      - `certificate_id` string: SHA-256 fingerprint of the certificate to analyze.
      - `host_id` string: IP address of the host to analyze.
      - `webproperty_id` string: Web property identifier (hostname:port) to analyze.
    - `update_time` string, date-time: When the job was last updated.

## Other responses

- `400`: Bad request
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `422`: Invalid input
- `500`: Internal server error

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)