# Search

The Search API is used to find historical scans performed on the
platform. Some data sources and searchable fields are only available on urlscan Pro.

The API search will only indicate an exact count of results up to 10,000 results in the total property. After that the has_more flag will be true. Use the sort value of the last (i.e. oldest) scan result in the current list of results as a parameter for the next Search API call. Supply this value in the search_after query parameter for getting the next (older) batch of results.

API search will find Public scans performed by anyone as well as Unlisted and Private scans performed by you or your teams.
For query syntax and searchable fields, refer to
https://docs.urlscan.io/pages/search-api-reference

Endpoint: GET /api/v1/search
Version: 1.0.0
Security: apikeyAuth

## Query parameters:

  - `q` (string)
    Search Query (Elasticsearch Query String)
    Example: "page.domain:example.com"

  - `size` (integer)
    Number of results to return
    Example: 100

  - `search_after` (string)
    For retrieving the next batch of results, send the value of the sort attribute of the last (oldest) result you received (comma-separated) from the previous call.

  - `datasource` (string)
    Datasources to search: scans (urlscan.io), hostnames, incidents, notifications,
certificates (urlscan Pro)
    Enum: "scans", "hostnames", "incidents", "notifications", "certificates"

  - `collapse` (string)
    Field to collapse results on. Only works on current page of results.
    Example: "page.domain.keyword"

## Response 200 fields (application/json):

  - `results` (array)
    Array of search results

  - `total` (integer)
    Total number of results with an exact count up to 10,000 results.

  - `took` (integer)
    Search request time in milliseconds.

  - `has_more` (boolean)
    True if there are more than 10,000 results.