CEcensys
Threat Hunting
Adversary Investigation

Get endpoint observation history for a host

Retrieve historical endpoint-level hash observations for a host.<br><br>Use this endpoint to see when an IP served a given page body, favicon, or banner, so you can identify changes on a host or pivot to other hosts serving the same content.<br><br>You must provide an observation_type and can optionally filter by a specific value using the observation_value parameter. You may also filter by port number.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.

get/v3/threat-hunting/host/{ip}/observations/endpoints

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v3/threat-hunting/host/{ip}/observations/endpoints
  • Auth
    HTTP bearer

Path parameters

ipstring ip required

The IP address of a host.

Example:8.8.8.8

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555
start_timestring

Start of date range (RFC3339 format, e.g., 2024-01-01T00:00:00Z). If not specified, defaults to the maximum query window back from the end time.

Example:2024-01-01T00:00:00Z
end_timestring

End of date range (RFC3339 format, e.g., 2024-01-31T23:59:59Z). If not specified, defaults to now. Cannot be in the future.

Example:2024-01-31T23:59:59Z
page_sizeinteger

Number of results per page (max 100)

Example:50
page_tokenstring

Pagination token from previous response

portinteger

Filter by port number

Example:443
observation_valuestring

Filter by observation value for the selected observation_type

observation_type'body_hash_sha1' | 'body_hash_sha256' | 'favicon_hash_md5' | 'favicon_hash_sha256' | 'favicon_hash_shodan' | 'banner_hash_sha256' | 'endpoints_banner_hash_sha256' required

Endpoint observation type to query.

order_bystring[] nullable

Order observations by these fields. Multiple values can be provided (e.g., ['port DESC', 'observation_value ASC']).

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Response

A list of observation ranges

Changes

No recorded changes to this operation across all 2 revisions of this API.