Internet Asset Search API - Hosts, Ports, Certificates

Query internet-wide scan data the way you would a database: every host running a protocol, every certificate issued to a name, every web property answering on a port, as rows.

What it does

• Searches the whole internet, not a list you supplied. Hosts and the services on them, matched by the provider's query language, with the ports, protocols and software that matched lifted onto each row.
• Keeps your query whole. Whatever you write in the query field is preserved exactly and only extended with and clauses from the filter fields. It is never rewritten, because this query language expresses things no set of dropdowns could.
• Filters for the things you would otherwise have to look up. Port, protocol, country, autonomous system number and software product, each accepting several values.
• Three asset kinds, one dataset. Hosts by IP, certificates by SHA-256 fingerprint, and web properties by hostname and port.
• Aggregation, which is a report as an API call. Count a search by any indexed field, such as port, country or network operator, and get one row per distinct value with its count.
• Rich host rows. IP, city, province, country, latitude and longitude, ASN with name and description, every open port, every protocol, detected software, operating system, the DNS names resolving to it, and when it was last scanned.
• Certificate rows that answer the actual question. Subject and issuer common name and organization, every name on the certificate, the validity window, whether it is self-signed, and the key and signature algorithms.
• An enrichment path for volume. Host lookups can go through the provider's enrichment endpoint, which is built for high-volume use and does not consume standard credits on the plans that carry it.
• Reads your credit balance first. When you give an organization, the run logs the credits available before it starts spending them.
• Keeps the misses. An identifier the provider has no record of still produces a row saying so, and it is not charged for.

Input

Find hosts running SSH on a non-standard port

{
  "mode": "search",
  "query": "host.services: (protocol=SSH and not port: 22)",
  "countries": ["Germany"],
  "maxResults": 500
}

Everything a network operator is exposing on 443

{
  "mode": "search",
  "autonomousSystems": ["15169"],
  "ports": ["443"],
  "software": ["nginx"],
  "maxResults": 1000
}

Look up hosts you already have

{
  "mode": "hosts",
  "assets": ["8.8.8.8", "1.1.1.1"]
}

Count a search by country

{
  "mode": "aggregate",
  "query": "host.services.protocol=POSTGRES",
  "aggregateField": "host.location.country",
  "buckets": 100
}

Certificates by fingerprint

{
  "mode": "certificates",
  "assets": ["a1b2c3d4e5f60718293a4b5c6d7e8f901a2b3c4d5e6f708192a3b4c5d6e7f809"]
}

Example output

A search hit and an aggregation bucket.

{
  "recordType": "searchHit",
  "assetId": "8.8.8.8",
  "ip": "8.8.8.8",
  "country": "United States",
  "countryCode": "US",
  "city": "Mountain View",
  "asn": 15169,
  "asName": "GOOGLE",
  "serviceCount": 3,
  "ports": [53, 443, 853],
  "protocols": ["DNS", "HTTP", "UNKNOWN"],
  "software": ["Google Frontend"],
  "dnsNames": ["dns.google"],
  "matchedPorts": [443],
  "matchedProtocols": ["HTTP"],
  "matchedServiceCount": 1,
  "lastUpdatedAt": "2026-09-01T04:22:11Z",
  "found": true
}

{
  "recordType": "aggregate",
  "field": "host.location.country",
  "key": "United States",
  "count": 184203,
  "found": true
}

Bring your own key

This actor calls an internet asset intelligence API with your own account's personal access token, managed in your provider account settings. Paste it into the personal access token field, or set it as the DATA_API_KEY environment secret. Add your organization id if you want the run to bill a specific organization and report its credit balance. Neither is ever written to the dataset or the log.

Without a token the run ends cleanly and tells you what to add, rather than failing.

Pricing

Pay per result, platform usage included.

Event	Price
Asset returned (host, certificate, web property)	$0.008
Aggregation bucket returned	$0.002

Rows for identifiers the provider has no record of are never charged, and a search that matches nothing is never charged.

FAQ

What is an internet asset search API?

An API over internet-wide scan data. The provider continuously scans the public internet and indexes what answers: which IP addresses have which ports open, what protocol and software is running on each, what TLS certificates they present, and what web properties they serve. Querying it answers questions like "every host in this country running this software version" without scanning anything yourself.

What query language does the search use?

The provider's own, CenQL. A query looks like host.services: (protocol=SSH and not port: 22). Anything you type into the query field is sent as written; the port, protocol, country, ASN and software fields add and clauses onto it rather than replacing it.

Can I search by port and protocol without writing a query?

Yes. Leave the query field empty and fill in the ports, protocols, countries, autonomous systems or software fields. At least one of them, or a query, is required, because the provider will not answer a search for everything.

What comes back for a host?

The IP, city, province, country and coordinates, the autonomous system number with its name, description and country, every open port, every service protocol, detected software products, the operating system, DNS names resolving to the host, and when the provider last scanned it.

How do I look up a TLS certificate?

Use mode: "certificates" with SHA-256 fingerprints, one per line. Each row carries the subject and issuer common name and organization, all names on the certificate, the validity window, whether it is self-signed, and the key and signature algorithms.

What is a web property?

A hostname and port together, such as platform.censys.io:80. Rows carry the endpoints found on it, their paths, page titles, HTTP status codes and detected software.

How does the aggregation mode work?

It counts a search by one indexed field and returns one row per distinct value with its count, most common first. host.services.port, host.location.country and host.autonomous_system.name are the usual choices. It is the API form of the provider's report builder.

Does this scan anything itself?

No. It reads the provider's existing scan data through their API. Nothing in this actor sends traffic to the hosts it returns.

Do I need my own API key?

Yes. This actor is bring-your-own-key: it calls the provider with your account's personal access token, so you keep your own plan, credit balance and terms. There is no shared or bundled key. Some endpoints, including host enrichment and several historical routes, are limited to the provider's higher tiers.

How is the price calculated?

Per row stored. Hosts, certificates and web properties are $0.008, and aggregation buckets are $0.002. Rows saying something was not found cost nothing.

Keyword map

internet asset search API, attack surface data API, host and port scan data API, TLS certificate lookup API, IP intelligence API, internet scanning data, exposed service discovery, ASN lookup API, shodan alternative API, security research data API, web property discovery, CenQL query API, external attack surface management data, port scan dataset