Skip to content
/Search

Search

Request

The Search API is used to find historical scans performed on the platform. Some data sources and searchable fields are only available on urlscan Pro.

The API search will only indicate an exact count of results up to 10,000 results in the total property. After that the has_more flag will be true. Use the sort value of the last (i.e. oldest) scan result in the current list of results as a parameter for the next Search API call. Supply this value in the search_after query parameter for getting the next (older) batch of results.

API search will find Public scans performed by anyone as well as Unlisted and Private scans performed by you or your teams. For query syntax and searchable fields, refer to https://docs.urlscan.io/pages/search-api-reference

Security
apikeyAuth(Required scopes: readwrite)
Query
qstring

Search Query (Elasticsearch Query String)

Example:q=page.domain:example.com
sizeinteger, <= 10000

Number of results to return

Example:size=100
search_afterstring

For retrieving the next batch of results, send the value of the sort attribute of the last (oldest) result you received (comma-separated) from the previous call.

datasourcestring

Datasources to search: scans (urlscan.io), hostnames, incidents, notifications, certificates (urlscan Pro)

Enum:"scans""hostnames""incidents""notifications""certificates"
Example:datasource=scans
collapsestring

Field to collapse results on. Only works on current page of results.

Example:collapse=page.domain.keyword
GET
/api/v1/search
curl -i -X GET \
  'https://urlscan.io/api/v1/search?q=page.domain%3Aexample.com&size=100&search_after=string&datasource=scans&collapse=page.domain.keyword' \
  -H 'api-key: YOUR_API_KEY_HERE'

Responses

OK

Bodyapplication/json
resultsArray of any

Array of search results

totalinteger

Total number of results with an exact count up to 10,000 results.

tookinteger

Search request time in milliseconds.

has_moreboolean

True if there are more than 10,000 results.

Response
{
  "results": [
    { … },
    { … }
  ],
  "total": 10000,
  "took": 23,
  "has_more": true
}