---
title: "List all threat hunts"
method: GET
path: "/threathunting/v1/threathunts"
tags: ["Threat Hunting"]
---

# List all threat hunts

`GET /threathunting/v1/threathunts`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threathunts`
- Auth: API key in header `Authorization`

Displays a list of all the existing threat hunts.

## Query parameters

- `searchName` string
- `scanStatus[]` string[]
- `resourceTypes[]` string[]
- `scanResult[]` string[]
- `pageToken` string

## Response `200`

OK

- ThreatHuntListResponse
  - `nextPageToken` string: The token to access the next page of results. This parameter will be empty for the last page of results.
  - `threathunts` ThreatHunt[]
    - `createdOn` string: The date and time when the threat hunt was created. Format - YYYY-MM-DDTHH:MM:SSZ Example - 2020-01-02T15:04:05Z.
    - `resourceTypes` string[]: The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', and 'ExchangeOnline'.
    - `description` string: The description provided during threat hunt creation.
    - `impactedResources` integer: Count of impacted resources against which threat was identified.
    - `impactedDevices` integer: Count of impacted devices against which threat was identified.
    - `impactedSnapshots` integer: Count of impacted snapshots against which threat was identified among all provided resources.
    - `jobID` integer: Unique Identifier for threat hunt job.
    - `name` string: Name of the threat hunt.
    - `scanStartedTime` string: The date and time when the threat hunt scan was started. Example - Aug 27, 2024 14:13:42.
    - `scanStatus` string: The current status of the threat hunt scan. The status can be 'Running,' 'Queued,' 'Completed,' 'Cancelled,' or 'Failed'.
    - `snapshotRangeEndDate` string: The end date selected while threat hunt creation. Format - YYYY-MM-DDTHH:MM:SSZ Example - 2020-01-02T15:04:05Z.
    - `snapshotRangeStartDate` string: The start date selected while threat hunt creation. Format - YYYY-MM-DDTHH:MM:SSZ Example - 2020-01-02T15:04:05Z.
    - `threatHuntID` integer: The identifier to uniquely identify threat hunt.
    - `totalFilesImpacted` integer: Count of impacted files against which threat was identified among all provided resources.
    - `totalResources` integer: Count of total resources provided during threat hunt creation.
    - `totalDevices` integer: Count of total devices provided during threat hunt creation.
    - `totalSnapshots` integer: Count of total snapshots that were included in the threat hunt scan.
  - `totalItems` integer: Total count of threat hunts created.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)