--- title: "Search Assets" method: POST path: "/projects/{project_id}/assets/_search" tags: ["Assets"] --- # Search Assets `POST /projects/{project_id}/assets/_search` Search assets with optional filtering, pagination, and sorting. ## Path parameters - `project_id` string, required ## Request body - AssetSearchRequest - `filter` AssetFilter - `asset_properties` AssetPropertiesFilter - `asset_id` EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - `name` ContainsFilter - `contains` string, required - `static_asset` BooleanFilter - `eq` boolean, required - `apex` union — Filter on the apex domain of the assets. Only makes sense for `domain` asset types. Example: `example.com` - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `added_to_project` DateRangeFilter - `start` string, date, nullable - `end` string, date, nullable - `discovered` DateRangeFilter - `start` string, date, nullable - `end` string, date, nullable - `asset_type` EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - `referenced_ip` union — Filter on an A or CNAME record pointing to the IP address. Use `eq` or `in` for exact IP matching. Use `contains` with a trailing `.` for CIDR range matching, or without for prefix matching. - ContainsFilter - `contains` string, required - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `cname_reference` union — Filter on a domain that is referenced by a CNAME record. Only makes sense for `domain` asset types. Treated as a wildcard, so `example.com` will match `www.example.com`. - ContainsFilter - `contains` string, required - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - `referenced_ip_at` DateRangeFilter - `start` string, date, nullable - `end` string, date, nullable - `valid_record_type` union — Filter for assets that have this DNS record type, e.g. `A`,`CNAME`,`MX`. - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - NeqFilter - `neq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - `dns_resolves` BooleanFilter - `eq` boolean, required - `custom_tags` union — Filter by custom tags placed on your assets. `strict` version will return a validation error if any of the tags have not been defined on your project. By using `*` you can filter for assets that have at least one custom tag applied. By using an empty(`[]`) list you can filter for assets that have no custom tags applied. - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - RequireAllFilter - `in` union[], required - union - … - `custom_tags_strict` union — Filter by custom tags placed on your assets. `strict` version will return a validation error if any of the tags have not been defined on your project. By using `*` you can filter for assets that have at least one custom tag applied. By using an empty(`[]`) list you can filter for assets that have no custom tags applied. - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - RequireAllFilter - `in` union[], required - union - … - `asn` union — Filter for assets which either are, or point to, an IP address announced by the provided ASN (e.g. `16509`). - IntEqFilter - `eq` integer, required - IntInFilter - `in` integer[], required - `ip_geo_country_iso` union — Filter for assets which either are, or point to, an IP address located in the provided ISO country code (e.g. `US`). - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `ip_owner` union — Filter for assets which either are, or point to, an IP address owned by the provided organization. This will often be an ISP or hosting provider or simply the name of the AS owning the IP. - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `registry` union — Filter for assets by their IP registry source (e.g., 'arin', 'ripe', 'apnic'). - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `whois_email_current` union — Filter for assets where the WHOIS email address matches the provided value. For subdomains the parent record will be partially used. The `current` variant will only return results where the email is on the current (rather than historical) versions of the WHOIS. - EmailEqFilter - `eq` string, email, required - EmailInFilter - `in` string[], required - `whois_email` union — Filter for assets where the WHOIS email address matches the provided value. For subdomains the parent record will be partially used. The `current` variant will only return results where the email is on the current (rather than historical) versions of the WHOIS. - EmailEqFilter - `eq` string, email, required - EmailInFilter - `in` string[], required - `certificate_properties` CertificatePropertiesFilter - `certificate_subject` union — Filter where certificate `subject` or `organizationName` matches the provided value - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - ContainsFilter - `contains` string, required - `certificate_subject_alt_name` union — Filter here the certificate Subject Alternate Names section matches the provided value - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - ContainsFilter - `contains` string, required - `certificate_sha256` EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - `certificate_expires_at` DateRangeFilter - `start` string, date, nullable - `end` string, date, nullable - `certificate_issued_at` DateRangeFilter - `start` string, date, nullable - `end` string, date, nullable - `certificate_issuer` union — Filter where the certificate (or in the chain) issuer's common name or organization matches the provided value - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `certificate_covers_domain` union — Filter where the certificate's subject common name domain or one of the Subject Alternate Names exactly matches or is a wildcard covering the provided value - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - ContainsFilter - `contains` string, required - `exposure_properties` ExposurePropertiesFilter - `severity` union — Filter for assets which have an exposure severity matching or higher than the provided value. Acceptable values: unknown, informational, moderate, critical. - InFilter - `in` union[], required - union - … - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - `signature_id` union — Filter for assets which have an exposure with the provided ASI Signature ID. Note that some signatures line up with CVEs, but this should not be relied upon. Examples: `cve-2024-6387`, `cve-OpenSSH`. - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `asset_exposure_score` IntRangeFilter - `start` integer, nullable, required - `end` integer, nullable, required - `last_scanned_at` DateRangeFilter - `start` string, date, nullable - `end` string, date, nullable - `technology_properties` TechnologyPropertiesFilter - `open_port_number` union — Filter for assets which have an open port with the provided number (e.g. `80`). - IntEqFilter - `eq` integer, required - IntInFilter - `in` integer[], required - `open_port_service` union — Filter for assets which have an open port that appears to support the provided protocol (e.g. `http`, `rdp`, `ftp`). - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `open_port_protocol` union — Filter for assets which have an open port on the provided protocol (e.g. `tcp`, `udp`). - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `open_port_technology` union — Filter for assets which have a specific product listening on an open port (e.g. `nginx`, `apache httpd`) - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `waf_detected` BooleanFilter - `eq` boolean, required - `waf_name` union — Filter for assets where a specific WAF is detected. Will attempt to match both vendor and product, e.g. `Cloudflare`. - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `technology_name` union — Filter for the name of a technology found on the asset. Could be directly attached to the port (`nginx`, etc) or a web technology (e.g. 'jQuery', 'Wordpress') - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `web_technology_name` union — Filter for the name of a technology specifically associated with 'web' resources, such as `jQuery` or `Wordpress`). **NOTE**: In some cases where a port has been closed we may still report findings of web technologies that we previously saw on those ports. - EqFilter - `eq` union, required - string - integer - string, ipvanyaddress - string, ipvanynetwork - string, date - InFilter - `in` union[], required - union - … - `is_responsive` BooleanFilter - `eq` boolean, required - `quick_search` QuickSearchFilter - `search` string, required — Search term to match against asset name, IP addresses, and technology fields - `pagination` Pagination - `next_cursor` string, nullable — An opaque value which should be passed as the `cursor` to retrieve the next page of results. If None or not present there are no remaining pages. This value should not be interpreted by the client. - `limit` integer — The number of items to return - `enrichments` AssetEnrichment[] - `sort` union - AssetSortField[] - array[] - unknown[] - unknown ## Response `200` Successful Response - ApiListResponseAsset - `data` Asset[], required - `project_id` string, required — Project ID being displayed - `id` string, required — The asset identifier. Same as `name` currently. In the future this may become a more opaque value. - `name` string, required — The asset identifier. Same as `id` currently. - `type` string, required — Indicates the type of assets. Currently will be one of `domain` or `ip - `discovered_at` string, date-time, nullable, required — Indicates when Recorded Future ASI first identified this asset on the Internet. For IP assets this is a fixed value - `added_to_project_at` string, date-time, required — Indicates when this asset became part of your project, which may be when it was first discovered or when a rule allowed it in - `last_scanned_at` string, date-time, nullable — Indicates the last occurrence of some scanning activity on this asset, which could be port or vulnerability scans. On-Demand scans will 'bump' this date. - `apex_domain` string, nullable — For `domain` assets, the 'top' domain this is a part of. E.g. for `foo.bar.example.com` this would be `example.com` - `exposure_score` integer, nullable — The Recorded Future ASI-calculated score based on the Exposures found on your asset. - `is_static_asset` boolean — Indicates whether this asset was discovered as part of project rules (`false`) or was added manually (`true`). - `custom_tags` string[], nullable — User-defined tags which have been put on this asset. **NOTE**: After calling tagging endpoints, there may be a delay of up to a couple minutes before tags appear. - `resolved_ips` string[], nullable — A convenience list of the IP addresses that A or CNAME records resolve to for this asset, or the aset iself. - `dns_records` DNSRecord[], nullable — List of DNS records we have queried with - `record_type` string, required - `value` DNSValue[], nullable, required - `value` union, required - string - object - `seen_from` string[] - `first_seen_at` string, date-time, nullable - `last_resolved_at` string, date-time, nullable, required - `is_virtual` boolean — Is this a virtual DNS record? - `whois` WHOISRecord — From proposal: contact.email contact.organization contact.name expires created updated registrar - `registrar` string, nullable — Registrar of the domain if known - `expires_at` string, date-time, nullable — Expiration date of the domain - `updated_at` string, date-time, nullable — Last updated date of the domain - `created_at` string, date-time, nullable — Creation date of the domain - `is_private` boolean, nullable — Is the domain registration private? - `is_from_parent` boolean — Is this WHOIS record from the parent domain? - `contacts` WHOISContact[], nullable — Contacts associated with the domain - `email` string, nullable — Email address of the contact - `name` string, nullable — Name of the contact, if available - `organization` string, nullable — Organization of the contact - `is_current` boolean — Is this still a current contact? - `name_servers` string[], nullable — Primary nameservers for the domain - `certificates` CertificateInstance[], nullable — The unique certificates found on this asset (when requested). Includes ports and IPs when available. This information will also be contained in `scanned_ips` when requested - `certificate` Certificate, required - `expires_at` string, date-time, required - `issued_at` string, date-time, required - `sha256` string, required - `subject` CertificateEntity, required - `common_name` string, nullable - `organization_name` string, nullable - `organizational_unit_name` string, nullable - `country_name` string, nullable - `subject_alt_names` string[], nullable - `issuer` CertificateEntity - `common_name` string, nullable - `organization_name` string, nullable - `organizational_unit_name` string, nullable - `country_name` string, nullable - `chain` Certificate[], nullable - `signature_algorithm` string, nullable - `seen_ports` Port[], nullable — When available, indicates 'where' we saw this certificate. An asset may have serviced different certificaes on different ports, at different times - `port` integer, required — The open port number - `protocol` string, required — The protocol of the open port, should be one of UDP or TCP - `instances` PortInstance[] — The specific instances of this port on an IP - `seen_ip` union, required - string, ipvanyaddress - string, ipv6 - `seen_at` string, date-time, required - `service` string, nullable — The service protocol running on the open port - `technology` TechnologyWithInstances - `name` string, required — The name of the technology, sometimes prefixed with the vendor - `vendor` string, nullable — If available, the vendor of the product - `technology_type` string, nullable — If available, the type of technology - `version` string, nullable — If available, the specific version of the product - `instances` TechnologyInstance[] — Specific instances of this technology - … - `web_technologies` TechnologyWithInstances[], nullable — Web technologies detected on this port - `name` string, required — The name of the technology, sometimes prefixed with the vendor - `vendor` string, nullable — If available, the vendor of the product - `technology_type` string, nullable — If available, the type of technology - `version` string, nullable — If available, the specific version of the product - `instances` TechnologyInstance[] — Specific instances of this technology - … - `exposures` Exposure[], nullable — Exposures detected on this port - `id` string, required - `detection_id` string, nullable, required - `severity` 'unknown' | 'informational' | 'moderate' | 'critical', required - `instances` ExposureInstance[], required - … - `details` object, nullable - `supports_evidence` boolean, nullable — Does this exposure support evidence downloads? - `defenses` DefensiveControl[], nullable — Defensive measures in place for the port - `name` string, required — The name of the technology, sometimes prefixed with the vendor - `vendor` string, nullable — If available, the vendor of the product - `technology_type` string, nullable — If available, the type of technology - `version` string, nullable — If available, the specific version of the product - `instances` TechnologyInstance[] — Specific instances of this technology - … - `certificate` Certificate - `expires_at` string, date-time, required - `issued_at` string, date-time, required - `sha256` string, required - `subject` CertificateEntity, required - `common_name` string, nullable - `organization_name` string, nullable - `organizational_unit_name` string, nullable - `country_name` string, nullable - `subject_alt_names` string[], nullable - `issuer` CertificateEntity - `common_name` string, nullable - `organization_name` string, nullable - `organizational_unit_name` string, nullable - `country_name` string, nullable - `chain` Certificate[], nullable - `signature_algorithm` string, nullable - `defenses` DefensiveControl[], nullable — Defensive measures in place for the asset - `name` string, required — The name of the technology, sometimes prefixed with the vendor - `vendor` string, nullable — If available, the vendor of the product - `technology_type` string, nullable — If available, the type of technology - `version` string, nullable — If available, the specific version of the product - `instances` TechnologyInstance[] — Specific instances of this technology - `seen_at` string, date-time, required - `seen_port` integer, required - `seen_url` string, uri, nullable — The URL where this technology was seen, if applicable - `exposures` Exposure[], nullable — Exposures found on this asset. Some information will overlap with tah contained within `scanned_ips` - `id` string, required - `detection_id` string, nullable, required - `severity` 'unknown' | 'informational' | 'moderate' | 'critical', required - `instances` ExposureInstance[], required - `port_number` integer, required - `url` string, nullable - `details` object, nullable - `details` object, nullable - `supports_evidence` boolean, nullable — Does this exposure support evidence downloads? - `scanned_ips` ScannedIP[], nullable — IP addresses that have been scanned for this asset - `ip` string, ipvanyaddress, required - `last_scanned_at` string, date-time, nullable — Datetime when a port scan was run on this IP address - `whois` WHOISRecord — From proposal: contact.email contact.organization contact.name expires created updated registrar - `registrar` string, nullable — Registrar of the domain if known - `expires_at` string, date-time, nullable — Expiration date of the domain - `updated_at` string, date-time, nullable — Last updated date of the domain - `created_at` string, date-time, nullable — Creation date of the domain - `is_private` boolean, nullable — Is the domain registration private? - `is_from_parent` boolean — Is this WHOIS record from the parent domain? - `contacts` WHOISContact[], nullable — Contacts associated with the domain - `email` string, nullable — Email address of the contact - `name` string, nullable — Name of the contact, if available - `organization` string, nullable — Organization of the contact - `is_current` boolean — Is this still a current contact? - `name_servers` string[], nullable — Primary nameservers for the domain - `open_ports` Port[], nullable - `port` integer, required — The open port number - `protocol` string, required — The protocol of the open port, should be one of UDP or TCP - `instances` PortInstance[] — The specific instances of this port on an IP - `seen_ip` union, required - string, ipvanyaddress - string, ipv6 - `seen_at` string, date-time, required - `service` string, nullable — The service protocol running on the open port - `technology` TechnologyWithInstances - `name` string, required — The name of the technology, sometimes prefixed with the vendor - `vendor` string, nullable — If available, the vendor of the product - `technology_type` string, nullable — If available, the type of technology - `version` string, nullable — If available, the specific version of the product - `instances` TechnologyInstance[] — Specific instances of this technology - … - `web_technologies` TechnologyWithInstances[], nullable — Web technologies detected on this port - `name` string, required — The name of the technology, sometimes prefixed with the vendor - `vendor` string, nullable — If available, the vendor of the product - `technology_type` string, nullable — If available, the type of technology - `version` string, nullable — If available, the specific version of the product - `instances` TechnologyInstance[] — Specific instances of this technology - … - `exposures` Exposure[], nullable — Exposures detected on this port - `id` string, required - `detection_id` string, nullable, required - `severity` 'unknown' | 'informational' | 'moderate' | 'critical', required - `instances` ExposureInstance[], required - … - `details` object, nullable - `supports_evidence` boolean, nullable — Does this exposure support evidence downloads? - `defenses` DefensiveControl[], nullable — Defensive measures in place for the port - `name` string, required — The name of the technology, sometimes prefixed with the vendor - `vendor` string, nullable — If available, the vendor of the product - `technology_type` string, nullable — If available, the type of technology - `version` string, nullable — If available, the specific version of the product - `instances` TechnologyInstance[] — Specific instances of this technology - … - `certificate` Certificate - `expires_at` string, date-time, required - `issued_at` string, date-time, required - `sha256` string, required - `subject` CertificateEntity, required - `common_name` string, nullable - `organization_name` string, nullable - `organizational_unit_name` string, nullable - `country_name` string, nullable - `subject_alt_names` string[], nullable - `issuer` CertificateEntity - `common_name` string, nullable - `organization_name` string, nullable - `organizational_unit_name` string, nullable - `country_name` string, nullable - `chain` Certificate[], nullable - `signature_algorithm` string, nullable - `metadata` IPMetadata - `as_number` integer, nullable — Autonomous System Number which IP/block is registered to - `owner_name` string, nullable — AS or Org Name of the IP/block is registered to - `registry` string, nullable — Nearest or top-level RIR - `owner_geo` GeoLocation - `continent` string, nullable — Continent of the IP address - `country` string, nullable — Country of the IP address - `city` string, nullable — City of the IP address - `country_iso` string, nullable — ISO code of the country of the IP address - `is_responsive` boolean, nullable — Indicates whether this IP address is unresponsive over ICMP and no ports were found open - `meta` ApiMeta, required - `params` object, nullable - `counts` ApiCount - `total` integer, nullable - `returned` integer, required - `pagination` PaginationResponse - `next_cursor` string, nullable — An opaque value which should be passed as the `cursor` to retrieve the next page of results. If None or not present there are no remaining pages. This value should not be interpreted by the client. - `limit` integer — The number of items returned - `total` integer, nullable - `sort` array[], nullable — The sort order of the results - unknown[] - unknown - `request_id` string, nullable ## Other responses - `422` — Validation Error --- [API](https://skmtc.dev/securitytrails/apis/securitytrails-api.md) · [All operations](https://skmtc.dev/securitytrails/apis/securitytrails-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/securitytrails/securitytrails-api/revisions/13cd180c20ab/schema)