---
title: "Search Dataset"
method: GET
path: "/api/explore.php"
tags: ["Explore"]
---

# Search Dataset

`GET /api/explore.php`

Query Pulsedive's dataset using the Explore query language. Search across indicators or threats by value, type, risk, timestamps, feeds, attributes, and properties using boolean logic and wildcards.

The Explore query language provides powerful search capabilities:

- **Boolean operators**: Combine search terms with `and`, `or`, `not`
- **Wildcards**: Use `*` for pattern matching
- **Field-specific queries**: Search by specific fields like `ioc=`, `type=`, `risk=`, `threat=`, `feed=`
- **Complex filters**: Filter by timestamps, attributes, and technical properties

For detailed query syntax and more examples, visit [Query Language](/api/explore/query-language/).

## Query parameters

- `key` string
- `q` string, required
- `type` 'indicators' | 'threats'
- `limit` integer
- `format` 'json' | 'csv' | 'stix'
- `pretty` 0 | 1

## Response `200`

Successful request. Returns search results in the specified format.

- ExploreIndicatorsResponse — Response from an indicator search query. Contains an array of matching indicators and the effective query that was executed.
  - `results` IndicatorSummary[] — Array of indicators matching the search query. Each indicator includes core identification, risk assessment, and summary information. The structure of each indicator object varies based on available data. Common fields include indicator value, type, risk, timestamps, and associated threats/feeds.
    - `iid` integer — Unique identifier of the indicator.
    - `indicator` string — Value of the indicator. May be: - a domain name (e.g., `microsoft.com`) - an IP address (e.g., `8.8.8.8`) - a URL (e.g., `https://pulsedive.com/explore`) - a file hash (e.g., `d41d8cd98f00b204e9800998ecf8427e`)
    - `type` 'domain' | 'ip' | 'ipv6' | 'url' | 'hash' — Type of the indicator.
    - `risk` 'unknown' | 'none' | 'low' | 'medium' | 'high' | 'critical' | 'retired' — Risk level of the indicator.
    - `stamp_added` string, sql-date-time — Timestamp when the indicator was first added to Pulsedive. 24-hour format, UTC time zone.
    - `stamp_updated` string, sql-date-time — Timestamp when the indicator record was last updated in Pulsedive. 24-hour format, UTC time zone.
    - `stamp_seen` string, sql-date-time, nullable — Timestamp when the indicator was last reported or seen in feeds or user submissions in Pulsedive. 24-hour format, UTC time zone.
    - `stamp_retired` string, sql-date-time, nullable — Timestamp when the indicator was retired in Pulsedive, if applicable. 24-hour format, UTC time zone.
    - `summary` object — Dynamically-generated condensed summary of key information about the indicator. The structure varies based on indicator type and available data. May include properties (technical data), threats, feeds, and other contextual information.
  - `query` string — The effective query string that was executed. This reflects the parsed and processed version of your original query. Useful for debugging query syntax and understanding how Pulsedive interpreted your search.

## Other responses

- `400` — Bad request. The request was malformed or missing required parameters.
- `401` — Unauthorized. Your API key is missing or invalid.
- `404` — Not found. The requested indicator could not be located.
- `429` — Rate limit exceeded. Too many requests have been made in a short period of time.
- `500` — Server error. An unexpected problem occurred on our end. These errors are automatically reported to our team.

---

[API](https://skmtc.dev/pulsedive/apis/pulsedive-api-reference.md) · [All operations](https://skmtc.dev/pulsedive/apis/pulsedive-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/pulsedive/pulsedive-api-reference/revisions/d0d40458010b/schema)