Threat Hunting
Adversary Investigation

Get host history for a certificate

Retrieve the historical observations of hosts associated with a certificate. Use this endpoint to see every host that has presented a given certificate over time, so you can build a timeline and find other infrastructure using it.<br><br>Certificate history is also visible to Adversary Investigation users in the Platform UI on the certificate timeline.<br><br>You can define a specific time frame of interest. If you do not specify a time frame, this endpoint will search the historical dataset that is available to your account.<br><br>For workspaces with a history limit, the API returns observation ranges that overlap the allowed history window. The window starts at 00:00 UTC the allowed number of days ago and ends at the time of the request. Ranges are returned in full, with their original start and end times, even if they extend outside the window.<br><br>You may also filter results by port and transport protocol.<br><br>This endpoint is available to organizations that have access to the Adversary Investigation module. This endpoint costs one credit per page of results.

get/v3/threat-hunting/certificate/{certificate_id}/observations/hosts

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v3/threat-hunting/certificate/{certificate_id}/observations/hosts
  • Auth
    HTTP bearer

Path parameters

certificate_idstring required

SHA-256 hash of the certificate

Example:55af8a301eb51abdaf7c31bec951638fe5a99d5d92117eca2be493026613fa46

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555
start_timestring

Only show ranges ending at or after this time (ISO 8601)

Example:2023-01-01T00:00:00Z
end_timestring

Only show ranges starting at or before this time (ISO 8601)

Example:2023-12-31T23:59:59Z
portinteger

The port to filter by

Example:443
protocolstring

The application protocol to filter by

Example:RDP
page_tokenstring

Pagination token from previous response to retrieve next page of results

page_sizeinteger

Number of results per page. Maximum 100, defaults to 100 if not specified

Example:50

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Response

A list of host observations for the certificate

Changes

No recorded changes to this operation across all 2 revisions of this API.