evidence

Collect experimental technical attribution evidence

Collects a bounded attribution-evidence.v1 graph for one public HTTP(S) site, domain, bare public IPv4/IPv6 address, or an explicitly asserted organization name with intent: organization-domain. The graph contains passive technical clues, typed relationships, provenance, module health, and abstaining or uncalibrated decisions.

This operation is experimental. It is isolated from the disclosure lookup pipeline: every successful graph carries mode: "shadow" and routingImpact: "none"; it cannot change owner attribution, reporting contacts, contact order, or the response from POST /api/lookup. Censys, when configured, contributes an exact root-property endpoint served_by relationship. Redirected final-property endpoints remain context on that final property. Certificates, redirects, DNS names, network routing/registration, shared-infrastructure labels, and software remain unscored observations on their actual site/host subjects. None of these records is ownership, a candidate owner, or a reporting route.

intent: product-vendor opts a site/IP request into exact, high-confidence CPE product/vendor observations. It never reinterprets the default asset-owner request, and shared/common/ambiguous detections abstain. intent: organization-domain may use one bounded Censys global search page. Exact normalized full legal-identity certificate matches remain candidate observations unless current, rare, and separately corroborated by an explicit first-party source; then they are labeled corroborated candidate, not ownership/contact verified. A certificate does not prove domain ownership. Any signal that more search results exist disables that stronger label; no second page is fetched.

Production currently enables anonymous CORS access. Self-hosted deployments can disable the operation (404) or require a valid API key (401). Successful responses are never cacheable by clients or indexed. Request objects are closed; unknown fields are rejected with 400.

post/api/evidence

Request

  • Base URL: https://lookup.disclose.io
  • URL: https://lookup.disclose.io/api/evidence
  • Auth: one of:
    • none
    • HTTP bearer
    • API key in header X-API-Key

Headers

X-Request-Idstring

Caller-supplied request identifier. Must match ^[A-Za-z0-9._:-]+$ and be at most 128 characters. Replaced with a server-generated req_<uuid> if absent or malformed. Echoed on every response.

X-Lookup-Sessionstring

Stable opaque browser/client identifier used only to give individual users a fair new-work allowance behind shared NATs. Must be 20–128 characters from A-Z a-z 0-9 . _ : -. Create once and persist; do not rotate per request. Missing or malformed values fall back to IP policy. API-key requests use their key quota instead.

Request body

inputstring required

One public domain, HTTP(S) site, or bare public IPv4/IPv6 address to inspect. With intent: organization-domain, one explicitly asserted organization name is accepted instead. Embedded credentials, non-HTTP(S) schemes, documentation/reserved/special-use names or IP literals, local/private targets, control characters, and invalid URLs are rejected before collection. Under organization-domain, reserved single-label names such as localhost, localdomain, and onion are also rejected before execution.

intent'asset-owner' | 'organization-domain' | 'product-vendor'

Request-only focus for the experimental evidence collector. Omit or use asset-owner for the existing site/IP technical-clue path. organization-domain accepts an organization name and returns only unscored domain-candidate observations. product-vendor accepts a site/IP and enables exact high-confidence CPE observations. This value is not serialized into attribution-evidence.v1 and never changes /api/lookup, attribution, contacts, completion, or route order.

Response

Experimental shadow evidence graph collected or served from the short-lived process cache.

schemaVersion'attribution-evidence.v1' required
mode'shadow' required
routingImpact'none' required
inputstring required
collectedAtstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.