--- title: "Poll for Scan Results" method: GET path: "/api/analyze.php" tags: ["Scan"] --- # Poll for Scan Results `GET /api/analyze.php` Poll for scan results using the queue ID returned from the POST request. Returns processing status while the scan is in progress, then complete results when finished. Polling requests don't count against your rate limit, but please poll responsibly. (We recommend at most every 500ms.) ## Query parameters - `key` string - `qid` integer, required - `pretty` 0 | 1 ## Response `200` Successful request. Returns scan status or complete results. - union - ProcessingState — Response while scan is in progress. - `qid` integer — Unique identifier of the associated request. - `status` string — Overall processing state of the request. - `stage` string — Current step of the scanning process. Present when scanning is in progress. - CompletedState — Response when scan is complete. - `qid` integer — Unique identifier of the associated request. - `status` string — Overall processing state of the request. - `data` IndicatorResponse - `qid` integer — Unique identifier of an associated previous submission request, if available. - `iid` integer — Unique identifier of the indicator. - `indicator` string — Value of the indicator being assessed. - `type` 'domain' | 'ip' | 'url' — Type of indicator. - `risk` 'retired' | 'none' | 'unknown' | 'very low' | 'low' | 'medium' | 'high' | 'critical' — Final risk score for the indicator. If a user has manually adjusted the risk score, this value may differ from the recommended risk score. In this case, `manualrisk` is set to `1`. - `risk_recommended` 'retired' | 'none' | 'unknown' | 'very low' | 'low' | 'medium' | 'high' | 'critical' — Recommended risk level based on Pulsedive automated risk scoring. - `manualrisk` 0 | 1 — Indicates whether the risk score has been manually adjusted. When set to `1`, the risk score has been manually adjusted. When set to `0`, the risk score reflects Pulsedive's automated assessment. - `retired` 0 | 1, nullable — Indicates whether this indicator is inactive or obsolete. An indicator is automatically retired if, in the past three months, it has not been: - Reported using the Seen button in the Pulsedive UI - Observed in any source feeds - Submitted through the Analyze section of the Pulsedive UI Pulsedive research can also retire indicators manually. When set to `1`, this indicator is retired. When set to `0`, this indicator is active. - `stamp_added` string, sql-date-time, nullable — Timestamp when the indicator was first added to Pulsedive. 24-hour format, UTC time zone. - `stamp_updated` string, sql-date-time, nullable — Timestamp when the indicator record was last updated in Pulsedive. 24-hour format, UTC time zone. - `stamp_seen` string, sql-date-time, nullable — Timestamp when the indicator was last reported or seen in feeds or user submissions in Pulsedive. 24-hour format, UTC time zone. - `stamp_probed` string, sql-date-time, nullable — Timestamp when the indicator was last actively scanned (probed) by Pulsedive. 24-hour format, UTC time zone. - `stamp_retired` string, sql-date-time, nullable — Timestamp when the indicator was retired in Pulsedive, if applicable. 24-hour format, UTC time zone. - `recent` 0 | 1 — Indicates whether this indicator has had recent activity. Deprecated and non-functional. When set to `1`, the indicator has had recent activity. When set to `0`, the indicator has not had recent activity. - `submissions` integer — Number of times the indicator has been submitted by any user. - `umbrella_rank` integer — Rank of the indicator on Cisco Umbrella's top one million domains list. This list reflects the most frequently queried domains, based on passive DNS data across Cisco's global Umbrella network. - `umbrella_domain` string — Canonical (base) domain as recognized by Cisco Umbrella. Populated when `umbrella_rank` is present. - `riskfactors` object[] — List of risk factors influencing this indicator's score. - `rfid` integer — Unique identifier of the risk factor. - `description` string — Explanation of the risk factor. - `risk` 'retired' | 'none' | 'unknown' | 'very low' | 'low' | 'medium' | 'high' | 'critical' — Risk level associated with the risk factor. - `redirects` object — Redirect relationships involving this indicator. - `from` object[] — Other indicators that redirect to this indicator. - `iid` integer — Unique identifier of other indicator. - `indicator` string — Value for other indicator. May be: - a domain name (e.g., `microsoft.com`) - an IP address (e.g., `8.8.8.8`) - a URL (e.g., `https://pulsedive.com/explore`) - `to` object[] — Other indicators that this indicator redirects to. - `iid` integer — Unique identifier of other indicator. - `indicator` string — Value for other indicator. May be: - a domain name (e.g., `microsoft.com`) - an IP address (e.g., `8.8.8.8`) - a URL (e.g., `https://pulsedive.com/explore`) - `threats` object[] — Known threats associated with this indicator. - `tid` integer — Unique identifier of the threat. - `name` string — Name of the threat. - `category` string — Category assigned to the threat. - `risk` 'retired' | 'none' | 'unknown' | 'very low' | 'low' | 'medium' | 'high' | 'critical' — Risk level associated with the threat. - `stamp_linked` string, sql-date-time — Timestamp when the threat was linked to this indicator. 24-hour format, UTC time zone. - `feeds` object[] — Threat intelligence feeds that reference this indicator. - `fid` integer — Unique identifier for the feed. - `name` string — Name of the feed. - `category` string — Category assigned to the feed. - `organization` string — Organization that provides the feed. - `pricing` string — Pricing tier of the feed. - `stamp_linked` string, sql-date-time — Timestamp when the feed was linked to this indicator. 24-hour format, UTC time zone. - `comments` object[] — Comments submitted by Pulsedive contributors for this indicator. - `cid` integer — Unique identifier for the comment. - `username` string — Username of the comment's author. - `title` string — Job title of the comment's author. - `comment` string — Text content of the comment. - `stamp_added` string, sql-date-time — Timestamp when the comment was created. 24-hour format, UTC time zone. - `stamp_updated` string, sql-date-time — Timestamp when the comment was last modified. 24-hour format, UTC time zone. - `uid` integer — Unique identifier for the user who created the comment. Visible to only the user who submitted the comment. - `attributes` object — Technical metadata observed for this indicator. - `port` string[] — List of ports open/in use. - `protocol` string[] — List of network protocols in use. - `technology` string[] — List of technologies identified. - `properties` object — Detailed sub-properties for this indicator, grouped by type or data source. - `geo` object — Geolocation details linked to this indicator. - `countrycode` string — Two-letter ISO country code. - `region` string — State or region. - `country` string — Full country name. - `address` string — Street address. - `zip` string — Postal or ZIP code. - `city` string — City or municipality. - `org` string — Name of the associated organization. - `whois` object — Collection of data sourced from WHOIS records and registrar-specific extensions to the base WHOIS schema, along with supplemental fields provided by Pulsedive (identified by a `++` prefix). May include details related to the domain, its registrar, and related contacts. Standard WHOIS data appears as key-value pairs, where each key matches a field name from the record and its value contains the corresponding content. Fields with multiple values are represented as arrays of strings. Pulsedive's supplemental fields do not appear in the original source data. These values are derived from raw data or parsed from related sources to provide additional context. - `++abuse` string — Email address to report abuse related to the domain. - `++email` string[] — List of email addresses associated with the domain registration. May include technical, administrative, or contact emails. - `++expires` string, sql-date-time — Timestamp when the domain's registration is set to expire. 24-hour format, UTC time zone. Normalizes the ISO date in `registrar registration expiration date`. - `++gdpr` '0' | '1' — Indicates whether the domain's WHOIS data is restricted under the General Data Protection Regulation (GDPR). When set to `1`, the data is subject to GDPR restrictions. When set to `0`, the data is not restricted by GDPR. - `++phone` string[] — List of phone numbers associated with the domain registration. May include technical, administrative, or contact phone numbers. - `++privacy` '0' | '1' — Indicates whether WHOIS privacy protection is enabled. When set to `1`, privacy protection is enabled. When set to `0`, privacy protect is not enabled. - `++registered` string, sql-date-time — Timestamp when the domain was initially registered. 24-hour format, UTC time zone. Normalizes the ISO date in `creation date`. - `++registrant` string[] — Supplementary list of registrant names. Derived from `registrant name` and `registrant organization`. - `++registrar` string — Name of the registrar managing the domain registration. - `++updated` string, sql-date-time — Timestamp when the domain's WHOIS record was last updated. 24-hour format, UTC time zone. Normalizes the ISO date in `updated date`. - `http` object — Collection of data extracted from the HTTP response and headers, along with supplemental fields provided by Pulsedive (identified by a `++` prefix). May include details related to the result, server, content, caching, security, redirects, timing, or custom headers. Collected during active scanning. Standard HTTP response data appears as key-value pairs, where each key matches a header name and its value contains the corresponding content. Fields with multiple values are represented as arrays of strings. Pulsedive's supplemental fields do not appear in the original source data. These values are derived from raw data or parsed from related sources to provide additional context. - `++code` string — Numeric portion of the HTTP status code, indicating the result of the HTTP request. - `++status` string — Text portion of the HTTP status code, indicating the result of the HTTP request. - `++content-type` string — MIME type of the page, excluding parameters. - `++base` string — Base URL or origin context. - `++target` string — Target URL of the scan. For example, if you scan `google.com`, the target URL will be `http://google.com`. - `++redirect` string — Final URL of the scan, after any redirects or automatic HTTPS upgrades (HSTS). - `ssl` object — Collection of data extracted from the SSL/TLS certificate presented during a handshake. May include information about ownership and identity, issuing authority, certificate lifecycle, and technical fingerprinting. Collected during active scanning. - `subject` string — Entity to which the certificate was issued. - `domain` string[] — Primary domain name associated with the certificate, typically from the Common Name (CN) or Subject Alternative Name (SAN). - `version` string — Version of the X.509 standard used by the certificate. - `org` string — Common Name (CN) of the specific certificate authority that signed the certificate, extracted from the issuer field. - `ip` union — IP address of the server presenting the certificate, if resolved. - string, ipv4 - string, ipv6 - `issuer` string — Full Distinguished Name (DN) of the Certificate Authority (CA) that issued the certificate. Includes components like country (C), organization (O), and common name (CN). - `expires` string, sql-date-time — Timestamp when the certificate expires. After this date, the certificate is no longer valid. 24-hour format, UTC time zone. - `fingerprint` string — Hash of the certificate used to uniquely identify the certificate and detect duplicates or known bad certs. - `valid` string, sql-date-time — Timestamp when the certificate becomes valid. 24-hour format, UTC time zone. - `email` string — Email address listed in the certificate's `subject` or `issuer` fields. - `dns` object — Collection of DNS records gathered from public resolvers. May include details related to domain ownership, mail exchange servers, name servers, and other DNS configurations. Collected during active and passive scanning. Data appears as key-value pairs, where each key represents a DNS record type and its value contains the corresponding data. Fields with multiple values are represented as arrays of strings. - `meta` object — Website metadata extracted from the HTML tag. May include standard WC3 meta tags (e.g., charset), SEO and crawling tags (e.g., description, robots), social media platform meta tags (e.g., twitter:card or og:card), or custom meta tags. Each key represents a meta tag type, and its corresponding value is the value retrieved from that meta tag.Collected during active scanning. - `++title` string — Title of the website collected from the HTML tag in the <head> tag. - `banners` object — Mapping of port numbers to service banner strings, collected during active scanning. Each `{key}` matches a port number. The corresponding value may be a string or an array of strings, depending on how many banners were retrieved for that port. - `cookies` object — Mapping of HTTP cookies set by this indicator, collected during active scanning. Each `{key}` represents the name of a cookie. The corresponding value may be a string or an array of strings, depending on how many pieces of content were retrieved for that cookie. - `dom` object — Data related to the Document Object Model (DOM) of this indicator. Collected during active scanning. - `screenshot` string, url — URL of a screenshot of the loaded page. - `links` object ## Other responses - `400` — Bad request. The request was malformed or missing required parameters. - `401` — Unauthorized. Your API key is missing or invalid. - `404` — Not found. The requested indicator could not be located. - `429` — Rate limit exceeded. Too many requests have been made in a short period of time. - `500` — Server error. An unexpected problem occurred on our end. These errors are automatically reported to our team. --- [API](https://skmtc.dev/pulsedive/apis/pulsedive-api-reference.md) · [All operations](https://skmtc.dev/pulsedive/apis/pulsedive-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pulsedive/pulsedive-api-reference/revisions/d0d40458010b/schema)