---
title: "Investigations: List jobs"
method: GET
path: "/v3/threat-hunting/investigations/jobs"
tags: ["Threat Hunting", "Adversary Investigation"]
---

# Investigations: List jobs

`GET /v3/threat-hunting/investigations/jobs`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/threat-hunting/investigations/jobs`
- Auth: HTTP bearer

List the AI investigations you have started. The most recent investigations are listed first and only investigations that have not passed their retention period are shown. Results are paginated and include investigations started in the Platform UI as well as through the API.<br><br>To use this endpoint, your organization must have access to the Adversary Investigation module.<br><br>This endpoint does not cost any credits to execute.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `page_size` integer: Number of investigations to return per page. Zero or omitted returns at most 50; values above 200 are reduced to 200.
- `page_token` string: Pagination token from the next_page_token of a previous response. Omit it to start from the first page.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Investigations retrieved successfully

- ResponseEnvelopeInvestigationJobsList
  - `result` InvestigationJobsList
    - `jobs` InvestigationJob[], nullable, required: The caller's investigations in this organization, newest first.
      - `complete_time` string, date-time: When the investigation finished. Omitted while it is still running.
      - `create_time` string, date-time, required: When the investigation was started.
      - `expire_time` string, date-time: When the investigation and its results stop being available for download.
      - `job_id` string, uuid, required: The unique identifier of the investigation.
      - `state` 'started' | 'completed' | 'failed' | 'unknown', required: The current state of the investigation. Completed means the investigation succeeded, not that its results are still available to download, and unknown means only that this API is older than the state the service reported.
      - `title` string: A short description of what the investigation looked into. Omitted when the investigation has no title yet.
    - `next_page_token` string: Token to retrieve the next page of investigations. Omitted when there are no more results.

## Other responses

- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `409`: Feature not enabled
- `422`: Invalid input
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/threat-hunting/investigations/jobs/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)