---
title: "Search endpoints"
method: POST
path: "/api/v2/endpoints/search"
tags: ["Endpoints"]
---

# Search endpoints

`POST /api/v2/endpoints/search`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/endpoints/search`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Semantic search across all detected endpoints and data handlers in an organization to find entry points that match a natural-language query. Endpoints include HTTP route handlers, WebSocket handlers, CLI argument parsers, file processors, and other data entry points detected during SAST scanning. Useful when investigating attack surface (e.g. "endpoints that handle file uploads", "unauthenticated API routes", "payment processing handlers"). Returns ranked results from the latest completed SAST scan of each repository, including HTTP path/methods when available.

## Request body

- EndpointSearchRequest
  - `organizationId` string: Organization to search within. Limits results to repositories the caller can access in this org.
  - `query` string, required: Natural-language search query matched against endpoint descriptions using semantic similarity (e.g. "user login endpoint", "payment processing handler", "file upload API").
  - `limit` integer: Maximum number of results to return. Defaults to 10.

## Response `200`

Search results

- EndpointSearchResult[]
  - `id` string, required: Unique ID of the endpoint handler.
  - `repositoryId` string, required: ID of the repository containing this endpoint.
  - `repositoryName` string, required: Display name of the repository.
  - `applicationName` string, required: Name of the application this endpoint belongs to (e.g. "Payments API", "Auth Service").
  - `name` string, required: Handler function or route name.
  - `description` string, required: Description of what this endpoint does.
  - `authentication` string, nullable, required: How this endpoint authenticates callers (e.g. "JWT bearer token", "API key"). Null if not detected.
  - `authorization` string, nullable, required: How this endpoint enforces access control (e.g. "admin role required"). Null if not detected.
  - `httpPath` string, nullable, required: HTTP route path if this is an HTTP handler (e.g. "/api/users/:id"). Null for non-HTTP handlers.
  - `httpMethods` string[], nullable, required: HTTP methods this handler responds to (e.g. ["GET", "POST"]). Null for non-HTTP handlers.
  - `score` number, required: Semantic similarity score between 0 and 1. Higher means a closer match to the query.

## Other responses

- `400`: Error Response
- `401`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)