---
title: "Search Keywords"
method: POST
path: "/search"
tags: ["search"]
---

# Search Keywords

`POST /search`

Fuzzy search for similar malicious domains. Useful for finding
typosquatting and phishing domains targeting a specific brand.
Results are capped at **500 hits** (`total_hits` counts the returned hits,
not the corpus-wide matches).

## Path parameters

- `keywords` string, required

## Response `200`

Search results response (capped at 500 hits)

- SearchResponse — Search response for similar domains (`api/search.rs::SearchResponse`)
  - `hits` string[], required — Matching dataset keys (`domain:…` / `ip:…`), capped at 500
  - `keywords` string, required — Search keywords used
  - `total_hits` integer, required — Number of hits returned (capped at 500 — not the corpus-wide total)

## Other responses

- `400` — Missing keywords parameter
- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-08-31** `9d9ef31d83e5` — 7 breaking
  - the response property `message` became nullable for the status `400`
  - the response property `message` became nullable for the status `401`
  - the response property `message` became nullable for the status `429`
  - the response property `message` became optional for the status `400`
  - …3 more

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/search/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ismalicious/ismalicious-threat-intelligence-api/revisions/9d9ef31d83e5/schema)