# theHarvester - OSINT Email & Subdomain Harvester (`anshumanatrey/theharvester-osint`) Actor Cloud-hosted theHarvester OSINT tool. Harvest emails, subdomains, IPs, URLs and ASNs from 54+ public sources (Shodan, Censys, crt.sh, VirusTotal, SecurityTrails, GitHub, hunter.io). Full CLI feature parity โ€” DNS brute force, subdomain takeover, screenshots. $0.003 per record harvested. - **URL**: https://apify.com/anshumanatrey/theharvester-osint.md - **Developed by:** [Anshuman Atrey](https://apify.com/anshumanatrey) (community) - **Categories:** Developer tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing $3.00 / 1,000 osint records This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## theHarvester OSINT Actor ๐Ÿ“ฆ **Open source ยท MIT:** [github.com/AnshumanAtrey/theharvester-osint](https://github.com/AnshumanAtrey/theharvester-osint) Wraps [laramies/theHarvester](https://github.com/laramies/theHarvester) โ€” the OSINT tool used by penetration testers and red teams to gather **emails, subdomains, IPs, URLs, and ASNs** from public sources. This actor exposes the **full CLI surface** of theHarvester (16 flags, 54 data sources) as a structured Apify input. Results are pushed as individual dataset records (one per host/email/IP/etc) plus a summary row โ€” perfect for tables, CSV export, or downstream pipelines. ### Quick start ```json { "domain": "example.com", "sources": ["crtsh", "hackertarget", "rapiddns", "certspotter"] } ```` These four sources are **free and require no API key**. For a basic domain, expect 100-1000 subdomains in 30-60 seconds. ### Full power (with API keys) ```json { "domain": "example.com", "sources": ["all"], "dnsBrute": true, "takeOver": true, "shodan": true, "shodanApiKey": "YOUR_KEY", "securitytrailsApiKey": "YOUR_KEY", "virustotalApiKey": "YOUR_KEY", "hunterApiKey": "YOUR_KEY" } ``` ### What you get The dataset receives one record per finding, with `recordType` discriminator: | recordType | Fields | When emitted | |---|---|---| | `host` | `host`, `ip`, `domain` | One per discovered subdomain | | `email` | `email`, `domain` | One per discovered email | | `ip` | `ip`, `domain` | One per discovered IP | | `url` | `url`, `domain` | One per discovered "interesting URL" | | `asn` | `asn`, `domain` | One per discovered ASN | | `shodan` | `shodan` (object) | One per host enriched by Shodan | | `person` | `person`, `domain` | One per discovered person/name | | `summary` | `counts`, `sources`, `success`, `cmd` | One per run โ€” always last | ### 54 supported data sources **Free (no API key):** crtsh, hackertarget, rapiddns, certspotter, otx, urlscan, threatcrowd, dnsdumpster, brave, duckduckgo, baidu, yahoo, mojeek, commoncrawl, waybackarchive, robtex, sitedossier, anubis, subdomaincenter, hudsonrock, thc **Paid / API key required:** shodan, censys, virustotal, securityTrails, hunter, hunterhow, intelx, fullhunt, netlas, leakix, leaklookup, zoomeye, criminalip, dehashed, fofa, github-code, gitlab, bitbucket, bevigil, builtwith, chaos, projectdiscovery, onyphe, pentesttools, rocketreach, securityscorecard, subdomainfinderc99, tomba, venacus, whoisxml, windvane, dymo, haveibeenpwned, bufferoverun, shodanInternetDB ### Mapped CLI flags Every theHarvester CLI flag is exposed: | CLI flag | Actor input | Notes | |---|---|---| | `-d` | `domain` | Required | | `-b` | `sources` | Comma-separated or array | | `-l` | `limit` | Per-source result cap | | `-S` | `start` | Pagination offset | | `-n` | `dnsLookup` | Resolve discovered hosts | | `-c` | `dnsBrute` | Brute-force subdomains | | `-r` | `dnsResolve` | Custom resolver list | | `-e` | `dnsServer` | DNS server IP | | `-s` | `shodan` | Enrich via Shodan | | `-t` | `takeOver` | Subdomain takeover check | | `--screenshot` | `screenshot` | Capture subdomain screenshots | | `-a` | `apiScan` | API endpoint scan | | `-w` | `wordlist` | Wordlist path (cloud-limited) | | `-p` | `useProxies` | Use proxies.yaml | | `-q` | `quiet` | Suppress key warnings | | `-f` | (internal) | Output is parsed and pushed automatically | ### Notes for Apify cloud - **Screenshots** write to `/tmp/screenshots` inside the container. They are not yet auto-uploaded to the key-value store โ€” that's planned. - **Wordlist** must reference a file that exists inside the Docker image. Custom wordlists from the input field do not transfer. - **Proxies** require a `proxies.yaml` baked into the image. Skip `useProxies` unless you've forked this actor with a custom image. - **API keys** are isSecret โ€” they are stored encrypted and not logged. ### FAQ #### Do I need API keys? Not for basic recon โ€” the 4 free sources (crtsh, hackertarget, rapiddns, certspotter) work without any keys and return 100-1000 subdomains for most domains. API keys unlock deeper sources like Shodan, Censys, VirusTotal, SecurityTrails, and Hunter. #### Which sources should I pick first? For pure subdomain discovery: `crtsh, certspotter, hackertarget, rapiddns, otx, dnsdumpster, anubis, subdomaincenter` โ€” all free, all complement each other. For emails: add `hunter` (paid) or `intelx` (paid). #### Why are some sources returning 0 results? A few sources require a working API key (you'll see "key not set" warnings in logs). Others rate-limit per-IP โ€” re-running 10 minutes later usually works. CommonCrawl + WaybackArchive can be slow on large domains; bump `limit` if needed. #### Can I combine this with nmap for full recon? Yes โ€” that's the canonical workflow. theHarvester finds subdomains โ†’ feed each into nmap โ†’ nmap returns open ports + services per host. Stitch them into a single recon report via Apify's webhook output. #### How does this differ from running `theHarvester` locally? Same binary, but you skip the install pain (Python deps, system requirements, proxy setup), and outputs are pre-parsed into structured records ready for CSV/Google Sheets/Notion. You also get Apify Residential Proxies built-in. ### Pairs nicely with Bundle for full attack-surface mapping: - **[nmap](https://apify.com/anshumanatrey/nmap-scanner)** โ€” Port-scan every subdomain theHarvester discovers - **[NetIntel](https://apify.com/anshumanatrey/netintel)** โ€” Enrich each discovered IP with WHOIS, GeoIP, SSL, reputation data - **[Bug Bounty Finder](https://apify.com/anshumanatrey/bug-bounty-finder)** โ€” Check whether the target has a public bounty program before reporting - **[Holehe Email OSINT](https://apify.com/anshumanatrey/holehe-email-osint)** โ€” Take the discovered emails and find which sites they're registered on - **[Social Analyzer](https://apify.com/anshumanatrey/social-analyzer)** โ€” Investigate the people behind the discovered emails - **[Zomato Restaurant Scraper](https://apify.com/anshumanatrey/zomato-restaurant-scraper)** โ€” Restaurant lead lists (separate B2B use case) ### Credits Built on top of [theHarvester](https://github.com/laramies/theHarvester) by Christian Martorella (Edge Security). MIT/GPL licensed per upstream. # Actor input Schema ## `domain` (type: `string`): Domain to investigate (e.g., example.com, github.com). Required. ## `sources` (type: `array`): Pick which data sources to query. Defaults (crtsh, hackertarget, rapiddns, certspotter) are FREE and require no API key. Premium sources are marked with ๐Ÿ”‘ โ€” they need API keys (see below). Free public sources are marked with โœ“. ## `limit` (type: `integer`): Maximum number of search results per source ## `start` (type: `integer`): Skip the first N results (for pagination) ## `timeout` (type: `integer`): Hard kill theHarvester after this many seconds. Default 1800 (30 min). ## `dnsLookup` (type: `boolean`): Resolve discovered subdomains to IPs (-n flag) ## `dnsBrute` (type: `boolean`): Brute-force common subdomains (-c flag). Slower but finds hidden subs. ## `dnsResolve` (type: `string`): Path to a custom resolver list (-r flag). Leave empty to use defaults. ## `dnsServer` (type: `string`): Custom DNS server IP for lookups (-e flag, e.g., 8.8.8.8) ## `shodan` (type: `boolean`): Use Shodan to enrich discovered hosts (-s flag). Requires shodanApiKey. ## `takeOver` (type: `boolean`): Probe discovered subdomains for takeover signatures (-t flag). ## `screenshot` (type: `boolean`): Capture screenshots of discovered subdomains (--screenshot flag). Saves to actor key-value store. ## `apiScan` (type: `boolean`): Scan for exposed API endpoints (-a flag). Pair with wordlist for best results. ## `wordlist` (type: `string`): Path to a wordlist for API endpoint scanning (-w flag). Limited on Apify cloud โ€” only files baked into the image work. ## `useProxies` (type: `boolean`): Route requests through proxies (-p flag). Requires proxies.yaml in the image. ## `quiet` (type: `boolean`): Suppress missing-API-key warnings (-q flag) ## `shodanApiKey` (type: `string`): shodan.io account API key โ€” required for the shodan source ## `censysApiId` (type: `string`): censys.io API ID (paired with secret below) ## `censysApiSecret` (type: `string`): censys.io API secret ## `hunterApiKey` (type: `string`): Hunter.io email-finder API key ## `hunterhowApiKey` (type: `string`): hunter.how API key ## `securitytrailsApiKey` (type: `string`): securitytrails.com API key โ€” strong subdomain coverage ## `virustotalApiKey` (type: `string`): virustotal.com API key ## `githubToken` (type: `string`): Required for github-code source (search public code for domain references) ## `intelxApiKey` (type: `string`): intelx.io API key for leaked-data search ## `onypheApiKey` (type: `string`): onyphe.io API key ## `fullhuntApiKey` (type: `string`): fullhunt.io API key ## `netlasApiKey` (type: `string`): netlas.io API key ## `leakixApiKey` (type: `string`): leakix.net API key ## `leaklookupApiKey` (type: `string`): leak-lookup.com API key ## `zoomeyeApiKey` (type: `string`): zoomeye.org API key ## `bevigilApiKey` (type: `string`): bevigil.com API key ## `bitbucketApiKey` (type: `string`): Atlassian Bitbucket API key (for bitbucket source) ## `braveApiKey` (type: `string`): Brave Search API key (free tier available) ## `bufferoverunApiKey` (type: `string`): tls.bufferover.run API key ## `builtwithApiKey` (type: `string`): builtwith.com API key ## `chaosApiKey` (type: `string`): chaos.projectdiscovery.io API key ## `criminalipApiKey` (type: `string`): criminalip.io API key ## `dehashedApiKey` (type: `string`): dehashed.com API key ## `dnsdumpsterApiKey` (type: `string`): dnsdumpster.com API key ## `dymoApiKey` (type: `string`): Dymo source API key ## `fofaKey` (type: `string`): fofa.info API key (paired with email below) ## `fofaEmail` (type: `string`): fofa.info account email ## `hackertargetApiKey` (type: `string`): hackertarget.com paid-tier API key (optional โ€” free tier works without) ## `hibpApiKey` (type: `string`): haveibeenpwned.com API key โ€” required for HIBP source ## `mojeekApiKey` (type: `string`): mojeek.com search API key ## `pentesttoolsApiKey` (type: `string`): pentest-tools.com API key ## `projectdiscoveryApiKey` (type: `string`): ProjectDiscovery API key (separate from chaos) ## `rocketreachApiKey` (type: `string`): rocketreach.co API key (people/email enrichment) ## `securityscorecardApiKey` (type: `string`): securityscorecard.io API key ## `subdomainfinderc99ApiKey` (type: `string`): subdomainfinder.c99.nl API key ## `tombaKey` (type: `string`): tomba.io email-finder API key (paired with secret) ## `tombaSecret` (type: `string`): tomba.io API secret ## `venacusApiKey` (type: `string`): venacus.com API key ## `whoisxmlApiKey` (type: `string`): whoisxmlapi.com API key ## `windvaneApiKey` (type: `string`): Windvane API key ## Actor input object example ```json { "domain": "example.com", "sources": [ "crtsh", "hackertarget", "rapiddns", "certspotter" ], "limit": 500, "start": 0, "timeout": 1800, "dnsLookup": false, "dnsBrute": false, "shodan": false, "takeOver": false, "screenshot": false, "apiScan": false, "useProxies": false, "quiet": true } ``` # Actor output Schema ## `harvestedRecords` (type: `string`): All harvested findings โ€” subdomains (hosts), emails, IPs, URLs, ASNs, shodan entries, and persons. Filter the dataset by `recordType` to view a single category. The final item is always a `summary` record with aggregate counts and the executed command. ## `screenshots` (type: `string`): Browser screenshots of discovered subdomains, captured when the `screenshot` input is enabled. Empty when screenshots were not requested. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domain": "example.com", "sources": [ "crtsh", "hackertarget", "rapiddns", "certspotter" ] }; // Run the Actor and wait for it to finish const run = await client.actor("anshumanatrey/theharvester-osint").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domain": "example.com", "sources": [ "crtsh", "hackertarget", "rapiddns", "certspotter", ], } # Run the Actor and wait for it to finish run = client.actor("anshumanatrey/theharvester-osint").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("๐Ÿ’พ Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # ๐Ÿ“š Want to learn more ๐Ÿ“–? Go to โ†’ https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domain": "example.com", "sources": [ "crtsh", "hackertarget", "rapiddns", "certspotter" ] }' | apify call anshumanatrey/theharvester-osint --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=anshumanatrey/theharvester-osint", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "theHarvester - OSINT Email & Subdomain Harvester", "description": "Cloud-hosted theHarvester OSINT tool. Harvest emails, subdomains, IPs, URLs and ASNs from 54+ public sources (Shodan, Censys, crt.sh, VirusTotal, SecurityTrails, GitHub, hunter.io). Full CLI feature parity โ€” DNS brute force, subdomain takeover, screenshots. $0.003 per record harvested.", "version": "1.1", "x-build-id": "BTlKQ8v8aoT4fnPfu" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/anshumanatrey~theharvester-osint/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-anshumanatrey-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/anshumanatrey~theharvester-osint/runs": { "post": { "operationId": "runs-sync-anshumanatrey-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/anshumanatrey~theharvester-osint/run-sync": { "post": { "operationId": "run-sync-anshumanatrey-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domain" ], "properties": { "domain": { "title": "Target Domain", "type": "string", "description": "Domain to investigate (e.g., example.com, github.com). Required." }, "sources": { "title": "Data Sources", "minItems": 1, "uniqueItems": true, "type": "array", "description": "Pick which data sources to query. Defaults (crtsh, hackertarget, rapiddns, certspotter) are FREE and require no API key. Premium sources are marked with ๐Ÿ”‘ โ€” they need API keys (see below). Free public sources are marked with โœ“.", "items": { "type": "string", "enum": [ "crtsh", "hackertarget", "rapiddns", "certspotter", "otx", "urlscan", "threatcrowd", "dnsdumpster", "duckduckgo", "baidu", "yahoo", "mojeek", "brave", "commoncrawl", "waybackarchive", "robtex", "subdomaincenter", "hudsonrock", "thc", "shodan", "censys", "virustotal", "securityTrails", "hunter", "hunterhow", "intelx", "fullhunt", "netlas", "leakix", "leaklookup", "zoomeye", "criminalip", "dehashed", "fofa", "github-code", "gitlab", "bitbucket", "bevigil", "builtwith", "chaos", "projectdiscovery", "onyphe", "pentesttools", "rocketreach", "securityscorecard", "subdomainfinderc99", "tomba", "venacus", "whoisxml", "windvane", "dymo", "haveibeenpwned", "bufferoverun", "shodanInternetDB" ], "enumTitles": [ "crt.sh โœ“ (TLS cert transparency)", "HackerTarget โœ“", "RapidDNS โœ“", "CertSpotter โœ“", "AlienVault OTX โœ“", "URLScan โœ“", "ThreatCrowd โœ“", "DNSdumpster โœ“", "DuckDuckGo โœ“", "Baidu โœ“", "Yahoo โœ“", "Mojeek โœ“", "Brave Search โœ“", "CommonCrawl โœ“", "Wayback Archive โœ“", "Robtex โœ“", "SubdomainCenter โœ“", "HudsonRock โœ“", "THC โœ“", "Shodan ๐Ÿ”‘", "Censys ๐Ÿ”‘", "VirusTotal ๐Ÿ”‘", "SecurityTrails ๐Ÿ”‘", "Hunter.io ๐Ÿ”‘", "HunterHow ๐Ÿ”‘", "IntelX ๐Ÿ”‘", "FullHunt ๐Ÿ”‘", "Netlas ๐Ÿ”‘", "LeakIX ๐Ÿ”‘", "LeakLookup ๐Ÿ”‘", "ZoomEye ๐Ÿ”‘", "CriminalIP ๐Ÿ”‘", "Dehashed ๐Ÿ”‘", "FOFA ๐Ÿ”‘", "GitHub Code ๐Ÿ”‘", "GitLab ๐Ÿ”‘", "Bitbucket ๐Ÿ”‘", "BeVigil ๐Ÿ”‘", "BuiltWith ๐Ÿ”‘", "ProjectDiscovery Chaos ๐Ÿ”‘", "ProjectDiscovery ๐Ÿ”‘", "Onyphe ๐Ÿ”‘", "PentestTools ๐Ÿ”‘", "RocketReach ๐Ÿ”‘", "SecurityScorecard ๐Ÿ”‘", "SubdomainFinder C99 ๐Ÿ”‘", "Tomba ๐Ÿ”‘", "Venacus ๐Ÿ”‘", "WhoisXML ๐Ÿ”‘", "Windvane ๐Ÿ”‘", "Dymo ๐Ÿ”‘", "HaveIBeenPwned ๐Ÿ”‘", "BufferOverun ๐Ÿ”‘", "Shodan InternetDB ๐Ÿ”‘" ] }, "default": [ "crtsh", "hackertarget", "rapiddns", "certspotter" ] }, "limit": { "title": "Results Limit", "minimum": 1, "maximum": 10000, "type": "integer", "description": "Maximum number of search results per source", "default": 500 }, "start": { "title": "Start Position", "minimum": 0, "type": "integer", "description": "Skip the first N results (for pagination)", "default": 0 }, "timeout": { "title": "Subprocess Timeout (seconds)", "minimum": 60, "maximum": 3600, "type": "integer", "description": "Hard kill theHarvester after this many seconds. Default 1800 (30 min).", "default": 1800 }, "dnsLookup": { "title": "Enable DNS Lookup", "type": "boolean", "description": "Resolve discovered subdomains to IPs (-n flag)", "default": false }, "dnsBrute": { "title": "DNS Brute Force", "type": "boolean", "description": "Brute-force common subdomains (-c flag). Slower but finds hidden subs.", "default": false }, "dnsResolve": { "title": "DNS Resolve (resolver list path)", "type": "string", "description": "Path to a custom resolver list (-r flag). Leave empty to use defaults." }, "dnsServer": { "title": "DNS Server", "type": "string", "description": "Custom DNS server IP for lookups (-e flag, e.g., 8.8.8.8)" }, "shodan": { "title": "Shodan Query", "type": "boolean", "description": "Use Shodan to enrich discovered hosts (-s flag). Requires shodanApiKey.", "default": false }, "takeOver": { "title": "Check Subdomain Takeover", "type": "boolean", "description": "Probe discovered subdomains for takeover signatures (-t flag).", "default": false }, "screenshot": { "title": "Take Screenshots", "type": "boolean", "description": "Capture screenshots of discovered subdomains (--screenshot flag). Saves to actor key-value store.", "default": false }, "apiScan": { "title": "API Endpoint Scan", "type": "boolean", "description": "Scan for exposed API endpoints (-a flag). Pair with wordlist for best results.", "default": false }, "wordlist": { "title": "Wordlist Path (cloud-limited)", "type": "string", "description": "Path to a wordlist for API endpoint scanning (-w flag). Limited on Apify cloud โ€” only files baked into the image work." }, "useProxies": { "title": "Use Proxies", "type": "boolean", "description": "Route requests through proxies (-p flag). Requires proxies.yaml in the image.", "default": false }, "quiet": { "title": "Quiet Mode", "type": "boolean", "description": "Suppress missing-API-key warnings (-q flag)", "default": true }, "shodanApiKey": { "title": "Shodan API Key", "type": "string", "description": "shodan.io account API key โ€” required for the shodan source" }, "censysApiId": { "title": "Censys API ID", "type": "string", "description": "censys.io API ID (paired with secret below)" }, "censysApiSecret": { "title": "Censys API Secret", "type": "string", "description": "censys.io API secret" }, "hunterApiKey": { "title": "Hunter.io API Key", "type": "string", "description": "Hunter.io email-finder API key" }, "hunterhowApiKey": { "title": "HunterHow API Key", "type": "string", "description": "hunter.how API key" }, "securitytrailsApiKey": { "title": "SecurityTrails API Key", "type": "string", "description": "securitytrails.com API key โ€” strong subdomain coverage" }, "virustotalApiKey": { "title": "VirusTotal API Key", "type": "string", "description": "virustotal.com API key" }, "githubToken": { "title": "GitHub Personal Access Token", "type": "string", "description": "Required for github-code source (search public code for domain references)" }, "intelxApiKey": { "title": "IntelX API Key", "type": "string", "description": "intelx.io API key for leaked-data search" }, "onypheApiKey": { "title": "Onyphe API Key", "type": "string", "description": "onyphe.io API key" }, "fullhuntApiKey": { "title": "FullHunt API Key", "type": "string", "description": "fullhunt.io API key" }, "netlasApiKey": { "title": "Netlas API Key", "type": "string", "description": "netlas.io API key" }, "leakixApiKey": { "title": "LeakIX API Key", "type": "string", "description": "leakix.net API key" }, "leaklookupApiKey": { "title": "LeakLookup API Key", "type": "string", "description": "leak-lookup.com API key" }, "zoomeyeApiKey": { "title": "ZoomEye API Key", "type": "string", "description": "zoomeye.org API key" }, "bevigilApiKey": { "title": "BeVigil API Key", "type": "string", "description": "bevigil.com API key" }, "bitbucketApiKey": { "title": "Bitbucket API Key", "type": "string", "description": "Atlassian Bitbucket API key (for bitbucket source)" }, "braveApiKey": { "title": "Brave Search API Key", "type": "string", "description": "Brave Search API key (free tier available)" }, "bufferoverunApiKey": { "title": "BufferOverun API Key", "type": "string", "description": "tls.bufferover.run API key" }, "builtwithApiKey": { "title": "BuiltWith API Key", "type": "string", "description": "builtwith.com API key" }, "chaosApiKey": { "title": "ProjectDiscovery Chaos API Key", "type": "string", "description": "chaos.projectdiscovery.io API key" }, "criminalipApiKey": { "title": "CriminalIP API Key", "type": "string", "description": "criminalip.io API key" }, "dehashedApiKey": { "title": "DeHashed API Key", "type": "string", "description": "dehashed.com API key" }, "dnsdumpsterApiKey": { "title": "DNSDumpster API Key", "type": "string", "description": "dnsdumpster.com API key" }, "dymoApiKey": { "title": "Dymo API Key", "type": "string", "description": "Dymo source API key" }, "fofaKey": { "title": "FOFA API Key", "type": "string", "description": "fofa.info API key (paired with email below)" }, "fofaEmail": { "title": "FOFA Email", "type": "string", "description": "fofa.info account email" }, "hackertargetApiKey": { "title": "HackerTarget API Key", "type": "string", "description": "hackertarget.com paid-tier API key (optional โ€” free tier works without)" }, "hibpApiKey": { "title": "HaveIBeenPwned API Key", "type": "string", "description": "haveibeenpwned.com API key โ€” required for HIBP source" }, "mojeekApiKey": { "title": "Mojeek API Key", "type": "string", "description": "mojeek.com search API key" }, "pentesttoolsApiKey": { "title": "PentestTools API Key", "type": "string", "description": "pentest-tools.com API key" }, "projectdiscoveryApiKey": { "title": "ProjectDiscovery API Key", "type": "string", "description": "ProjectDiscovery API key (separate from chaos)" }, "rocketreachApiKey": { "title": "RocketReach API Key", "type": "string", "description": "rocketreach.co API key (people/email enrichment)" }, "securityscorecardApiKey": { "title": "SecurityScorecard API Key", "type": "string", "description": "securityscorecard.io API key" }, "subdomainfinderc99ApiKey": { "title": "SubdomainFinder C99 API Key", "type": "string", "description": "subdomainfinder.c99.nl API key" }, "tombaKey": { "title": "Tomba API Key", "type": "string", "description": "tomba.io email-finder API key (paired with secret)" }, "tombaSecret": { "title": "Tomba API Secret", "type": "string", "description": "tomba.io API secret" }, "venacusApiKey": { "title": "Venacus API Key", "type": "string", "description": "venacus.com API key" }, "whoisxmlApiKey": { "title": "WhoisXML API Key", "type": "string", "description": "whoisxmlapi.com API key" }, "windvaneApiKey": { "title": "Windvane API Key", "type": "string", "description": "Windvane API key" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```