---
title: "Get fingerprint observation history for a host"
method: GET
path: "/v3/threat-hunting/host/{ip}/observations/fingerprints"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# Get fingerprint observation history for a host

`GET /v3/threat-hunting/host/{ip}/observations/fingerprints`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/threat-hunting/host/{ip}/observations/fingerprints`
- Auth: HTTP bearer

Retrieve fingerprint observations for a host.<br><br>Use this endpoint to see which TLS certificate chains an IP has presented, on which ports, and when, so you can spot infrastructure changes, pivot to related hosts, identify certificate swaps, or tie a host to attacker-controlled certificates.<br><br>You may optionally include a time range by using `start_time` and `end_time`. If you do not specify a time frame, this endpoint will search the historical dataset that is available to your account.<br><br>You must provide an `observation_type` and can optionally filter by `port` and `observation_value`.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.

## Path parameters

- `ip` string, ip, required: The IP address of a host.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `start_time` string: Start of date range (RFC3339 format, e.g., 2024-01-01T00:00:00Z). If not specified, defaults to the maximum query window back from the end time.
- `end_time` string: End of date range (RFC3339 format, e.g., 2024-01-31T23:59:59Z). If not specified, defaults to now. Cannot be in the future.
- `page_size` integer: Number of results per page (max 100)
- `page_token` string: Pagination token from previous response
- `port` integer: Filter by port number
- `transport_protocol` 'tcp' | 'udp' | 'icmp' | 'quic': Filter by transport protocol when supported by the selected observation_type
- `observation_value` string: Filter by observation value for the selected observation_type
- `observation_type` 'tls_presented_chain_fingerprint_sha256', required: Fingerprint observation type to query.
- `order_by` string[], nullable: Order observations by these fields. Multiple values can be provided (e.g., ['port DESC', 'observation_value ASC']). transport_protocol ordering is only supported for observation types whose timelines expose that field; see the endpoint description for details.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

A list of observation ranges

- ResponseEnvelopeHashObservationsOnHostResponse
  - `result` HashObservationsOnHostResponse
    - `next_page_token` string, required: A token that can be used to retrieve the next page of ranges.
    - `ranges` HashObservationOnHostRange[], nullable, required: The list of observation ranges matching the request.
      - `end_time` string, date-time, required: When the observation was last seen
      - `ip` string, required: IP address of the host
      - `observation_type` string, required: Observation type selected in the request
      - `observation_value` string, required: Observed value for the selected observation type
      - `port` string, required: Port number
      - `start_time` string, date-time, required: When the observation was first seen
      - `transport_protocol` string: Transport protocol when present for the selected timeline

## Other responses

- `400`: Bad request
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Resource not found
- `409`: Feature not enabled
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/threat-hunting/host/:ip/observations/fingerprints/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)