---
title: "Investigations: Get job status"
method: GET
path: "/v3/threat-hunting/investigations/jobs/{job_id}"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# Investigations: Get job status

`GET /v3/threat-hunting/investigations/jobs/{job_id}`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/threat-hunting/investigations/jobs/{job_id}`
- Auth: HTTP bearer

Retrieve the status of one AI investigation. Poll this endpoint until the investigation is completed, then download its report and evidence.<br><br>An investigation that does not exist, belongs to another user, or has passed its retention window will return a “not found” response.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.<br><br>This endpoint does not cost any credits to execute.

## Path parameters

- `job_id` string, uuid, required: The unique identifier of the investigation.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Investigation retrieved successfully

- ResponseEnvelopeInvestigationJob
  - `result` InvestigationJob
    - `complete_time` string, date-time: When the investigation finished. Omitted while it is still running.
    - `create_time` string, date-time, required: When the investigation was started.
    - `expire_time` string, date-time: When the investigation and its results stop being available for download.
    - `job_id` string, uuid, required: The unique identifier of the investigation.
    - `state` 'started' | 'completed' | 'failed' | 'unknown', required: The current state of the investigation. Completed means the investigation succeeded, not that its results are still available to download, and unknown means only that this API is older than the state the service reported.
    - `title` string: A short description of what the investigation looked into. Omitted when the investigation has no title yet.

## Other responses

- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Resource not found
- `409`: Feature not enabled
- `422`: Invalid input
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/threat-hunting/investigations/jobs/:job_id/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)