---
title: "Attack Surface Intelligence API Search"
method: POST
path: "/asi/search"
tags: ["search"]
---

# Attack Surface Intelligence API Search

`POST /asi/search`

## Request

- Base URL: `https://api.securityscorecard.io`
- URL: `https://api.securityscorecard.io/asi/search`
- Auth: API key in header `Authorization`

## Request body

- AsiSearchRequest
  - `query` string: search query
  - `sort` 'scan_date' | 'max_cvss_score' | 'min_scorecard_grade' | '_score' | 'avd_grade' | 'city' | 'cloud_provider' | 'cloud_region' | 'country_name' | 'has_cve' | 'has_cve_been_exploited' | 'has_infection' | 'has_malhash' | 'has_malrep' | 'has_ransomware' | 'has_scorecard' | 'has_screenshot' | 'has_ssl_cert' | 'has_threatactor' | 'hostname' | 'max_cvss_score' | 'min_scorecard_grade' | 'postal' | 'scan_time' | 'ssl_is_certificate_chain_valid' | 'state' | '_score' | 'has_ransomware': values for ipv4 are:
  - `sortDir` 'asc' | 'desc': asc or desc
  - `page` number: Search result page number
  - `index` string: Search index to query
  - `parser` 'simple' | 'structured' | 'lucence' | 'dismax': Search query parser. Options are: simple, structured, lucence, dismax
  - `size` number: Size of the search resultset page
  - `cursor` string: Cursor identifier (or "initial" for first request) needed to paginate over more than 10K results

## Response `200`

Search results

- AsiSearchResponse
  - `facets` object
    - `countries` object[]
      - `name` string
      - `value` string
    - `threatActors` object[]
      - `name` string
      - `value` string
    - `cves` object[]
      - `name` string
      - `value` string
    - `ports` object[]
      - `name` string
      - `value` string
    - `products` object[]
      - `name` string
      - `value` string
    - `orgs` object[]
      - `name` string
      - `value` string
  - `hits` object
    - `detectedLibraries` string[]: Crawling detected libraries Name
    - `time` string: Scan time
    - `cloud` string: Cloud service
    - `cloudRegion` string: Cloud region
    - `hasMalrep` boolean: has bad reputation
    - `maliciousReputation` string[]: Malicious reputation
    - `hasCVE` boolean: has a CVE
    - `cves` string[]: List of CVEs associated
    - `maxCVSS` number: Max CVSS in the CVEs
    - `cvss` string[]: List of CVSS
    - `deviceType` string[]: Device Type
    - `hasRansomware` boolean: has ransomware
    - `ransomwareVictims` string[]: Ransomware
    - `ransomwareGroups` string[]: Ransomware groups
    - `hasSSLCert` boolean: has a SSL certificate
    - `ports` string[]: Open ports
    - `services` string[]: Services running
    - `minGrade` string: Minimum Scorecard Grade
    - `hostnames` string[]: Hostnames associated with this IP
    - `hasScorecard` boolean: has a Scorecard associated
    - `products` string[]: Products running on this host
    - `country` string: Country
    - `organizations` string[]: Organizations associated to this IP
    - `hasCVEExploited` boolean: has a CVE exploited
    - `ips` string[]: IPs associated to this host
    - `sslValid` boolean: SSL Certificate Chain is Valid
    - `hasThreatActor` boolean: has a Threat Actor Campaign associated
    - `threatActors` string[]: IPs associated to this host
    - `hasInfection` boolean: has a infection
    - `infections` string[]: Active infections
    - `countryCode` string: Country Code
    - `industries` string[]: Industries associated
    - `cpe` string: cpe
    - `dnsRecords` string[]: Crawling DNS Records Types
    - `grade` string: Current Scorecard Grade
    - `mainAttribution` string[]: Primary Attribution details
    - `detectedLibraryVersion` string: Crawling detected library version
    - `domains` string[]: Attributed domains
    - `osTypes` string[]: Types of Operating Systems
    - `id` string: IP
  - `found` number: Amount of documents found
  - `isError` boolean: True if error, false otherwise
  - `errorType` string: Type of error
  - `errorMessage` string: Error message
  - `errorCode` number: HTTP status code of error if error is True
  - `cursor` string: Cursor identifier to paginate over more than 10K results

---

[API](https://skmtc.dev/securityscorecard/apis/asi-internal-service.md) - [All operations](https://skmtc.dev/securityscorecard/apis/asi-internal-service/llms.txt) - [OpenAPI document](https://skmtc.dev/securityscorecard/apis/asi-internal-service/revisions/c4607eb42fa6?raw)