Web API

GET /config

Returns JavaScript code to set client-side configuration values

Status Codes:
Response JSON Object:
 
  • config (object) – the configuration values
GET /(subdb:re:scans|view)/(action:re:onlyips|ipsports|timeline|coordinates|countopenports|diffcats)

Get special values from Nmap & View databases

Parameters:
  • subdb (str) – database to query (must be “scans” or “view”)
  • action (str) – specific value to get (must be one of “onlyips”, “ipsports”, “timeline”, “coordinates”, “countopenports” or “diffcats”)
Query Parameters:
 
  • q (str) – query (including limit/skip and sort)
  • f (str) – filter
  • callback (str) – callback to use for JSONP results (forces “json” format)
  • ipsasnumbers (bool) – to get IP addresses as numbers rather than as strings
  • datesasstrings (bool) – to get dates as strings rather than as timestamps
  • format (str) – “json” (the default), “ndjson” or “txt”
Status Codes:
Response JSON Array of Objects:
 
  • object – results
GET /(subdb:re:scans|view)/count

Get special values from Nmap & View databases

Parameters:
  • subdb (str) – database to query (must be “scans” or “view”)
Query Parameters:
 
  • q (str) – query (including limit/skip and sort)
  • f (str) – filter
  • callback (str) – callback to use for JSONP results
Status Codes:
Response JSON Object:
 
  • int – count
GET /(subdb:re:scans|view|passive)/top/(field: path)

Get top values from Nmap, View & Passive databases

Parameters:
  • subdb (str) – database to query (must be “scans” or “view”)
  • field (str) – (pseudo-)field to get top values (e.g., “service”)
Query Parameters:
 
  • q (str) – query (including limit/skip and sort)
  • f (str) – filter
  • callback (str) – callback to use for JSONP results
  • ipsasnumbers (bool) – to get IP addresses as numbers rather than as strings
  • datesasstrings (bool) – to get dates as strings rather than as timestamps
  • format (str) – “json” (the default) or “ndjson”
Status Codes:
Response JSON Array of Objects:
 
  • label (str) – field value
  • value (int) – count for this value
GET /(subdb:re:scans|view|passive)/distinct/(field: path)

Get distinct values from Nmap, View & Passive databases

Parameters:
  • subdb (str) – database to query (must be “scans” or “view”)
  • field (str) – (pseudo-)field to get distinct values (e.g., “service”)
Query Parameters:
 
  • q (str) – query (including limit/skip and sort)
  • f (str) – filter
  • callback (str) – callback to use for JSONP results
  • ipsasnumbers (bool) – to get IP addresses as numbers rather than as strings
  • datesasstrings (bool) – to get dates as strings rather than as timestamps
  • format (str) – “json” (the default) or “ndjson”
Status Codes:
Response JSON Array of Objects:
 
  • label (str) – field value
  • value (int) – count for this value
GET /(subdb:re:scans|view)

Get records from Nmap & View databases

Parameters:
  • subdb (str) – database to query (must be “scans” or “view”)
Query Parameters:
 
  • q (str) – query (including limit/skip and sort)
  • f (str) – filter
  • callback (str) – callback to use for JSONP results
  • ipsasnumbers (bool) – to get IP addresses as numbers rather than as strings
  • datesasstrings (bool) – to get dates as strings rather than as timestamps
  • format (str) – “json” (the default) or “ndjson”
Status Codes:
Response JSON Array of Objects:
 
  • object – results
POST /(subdb:re:scans|view)

Add records to Nmap & View databases

Parameters:
  • subdb (str) – database to query (must be “scans” or “view”)
Form Parameters:
 
  • categories – a coma-separated list of categories
  • source – the source of the scan results (mandatory)
  • result – scan results (as XML or JSON files)
Status Codes:
Response JSON Object:
 
  • count (int) – number of inserted results
GET /flows

Get special values from Nmap & View databases

Query Parameters:
 
  • q (str) – query (including limit/skip, orderby, etc.)
  • callback (str) – callback to use for JSONP results
  • action (str) – can be set to “details”
Status Codes:
Response JSON Object:
 
  • object – results
GET /ipdata/(addr)

Returns (estimated) geographical and AS data for a given IP address.

Parameters:
  • addr (str) – IP address to query
Query Parameters:
 
  • callback (str) – callback to use for JSONP results
Status Codes:
Response JSON Object:
 
  • object – the result values
GET /passivedns/(query: path)

Query passive DNS data. This API is compatible with the Common Output Format and implemented in CIRCL’s PyPDNS.

It accepts two extra parameters, not supported (yet?) in PyPDNS:

  • subdomains: if this parameter exists and a domain name is queried, records for any subdomains will also be returned.
  • reverse: if this parameter exists and a domain name is queried, records pointing to the queried domain (CNAME, NS, MX) will be returned.

It also returns additional information:

  • “sensor”: the “sensor” field of the record; this is useful to know where this answer has been seen.
  • “source”: the IP address of the DNS server sending the answer.
Parameters:
  • query (str) – IP address or domains name to query
Query Parameters:
 
  • subdomains (bool) – query subdomains (domain name only)
  • reverse (bool) – use a reverse query (domain name only)
  • type (str) – specify the DNS query type
Status Codes:
Response JSON Object:
 
  • object – the result values (JSONL format: one JSON result per line)
GET /passive

Get records from Passive database

Query Parameters:
 
  • q (str) – query (only used for limit/skip and sort)
  • f (str) – filter
  • callback (str) – callback to use for JSONP results
  • ipsasnumbers (bool) – to get IP addresses as numbers rather than as strings
  • datesasstrings (bool) – to get dates as strings rather than as timestamps
  • format (str) – “json” (the default) or “ndjson”
Status Codes:
Response JSON Array of Objects:
 
  • object – results
GET /passive/count

Get special values from Nmap & View databases

Query Parameters:
 
  • q (str) – query (only used for limit/skip and sort)
  • f (str) – filter
  • callback (str) – callback to use for JSONP results
Status Codes:
Response JSON Object:
 
  • int – count