---
title: "Investigations: Get job results"
method: GET
path: "/v3/threat-hunting/investigations/jobs/{job_id}/results"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# Investigations: Get job results

`GET /v3/threat-hunting/investigations/jobs/{job_id}/results`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/threat-hunting/investigations/jobs/{job_id}/results`
- Auth: HTTP bearer

Download the ZIP archive that contains a completed AI investigation's report and evidence. You can only retrieve the job results for an investigation you started. The archive is composed when you request it and is never stored.<br><br>Investigations that did not publish any findings or have passed their retention windows will return a “not found” response.<br><br>If an investigation’s ZIP archive is larger than 20 megabytes, you will receive a “payload too large” response. You can only retrieve the results for investigations that exceed this size limit within the Platform UI.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.<br><br>This endpoint does not cost any credits to execute.

## Path parameters

- `job_id` string, uuid, required: The unique identifier of the investigation.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Investigation results archive

## Other responses

- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Resource not found
- `409`: Feature not enabled
- `413`: Investigation results are too large to download
- `422`: Invalid input
- `500`: Internal server error
- `503`: Investigation results could not be packaged right now
- `504`: Packaging the investigation results timed out

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/threat-hunting/investigations/jobs/:job_id/results/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)