> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List AI surface assets.

> Lists backend-owned AI surface rows for the authenticated ESI project.



## OpenAPI

````yaml https://api.infrawatch.com/openapi.json?contract=d15375c get /projects/{project_uuid}/esi/ai-surface
openapi: 3.1.0
info:
  description: >-
    Customer-facing Infrawatch APIs. Authenticate with an API key unless an
    operation documents another supported credential.


    ### Infrawatch Public API


    Public API authenticated exclusively with Infrawatch API keys.


    ### Infrawatch Customer Alerting API


    Project alert rules, destinations, silences, inbox state, and delivery
    history.


    ### Infrawatch Remote Browser API


    Project-scoped interactive browser sessions owned by Platform Core.


    Session admission, lifecycle, RBAC, audit, usage, screenshot history, and

    stream tickets are Platform Core resources. The browser master is private

    infrastructure and its identifiers, proxy routes, process options, and

    credentials are never exposed by this API.


    A session and all of its evidence are private to the credential that created

    it. Project managers may list project session metadata, inspect one
    session's

    metadata, and terminate it, but cannot access its live stream, screenshots,

    or network events.


    Terminal session metadata and screenshots are retained indefinitely. A

    creator can replay a terminal session as a new queued resource while

    preserving a durable link to the source session.


    ### Infrawatch ESI API


    Customer-facing External Surface Intelligence API for project-scoped

    product data authenticated by an Infrawatch API key. API keys

    are constrained to their immutable owner's project ceiling and assigned

    ESI scopes; human project-manager fallback never expands an API key.

    Authorised API-key requests are rate-limited and consume monthly quota.


    ### Infrawatch Reports API


    Threat report discovery API authenticated by an Infrawatch API key.


    ### Infrawatch Public Rules API


    Account-aware rule authoring, taxonomy, catalogue, and runtime observations
    for API clients.


    ### Infrawatch Search API


    Search hosts, services, DNS records, and certificates. Complete
    percent-encoded query strings are limited to 65536 bytes.
  title: Infrawatch Customer API
  version: 1.0.0
servers:
  - description: Infrawatch customer API
    url: https://api.infrawatch.com/api/v1
security: []
tags:
  - name: API Usage
  - name: Projects
  - name: Alert destinations
  - name: Alert rules
  - name: Alert silences
  - name: Alerts
  - name: Browser sessions
  - name: Browser evidence
  - name: Browser streaming
  - name: Access
  - name: Inventory
  - name: Dangling DNS
  - name: Findings
  - name: Secrets
  - name: Typosquatting
  - name: Services
  - name: AI Surface
  - description: Search hosts, services, DNS records, certificates, and open directories.
    name: Search
  - name: Dashboard
  - name: Reports
  - name: Rules
  - name: Rule tags
  - name: Rule observations
paths:
  /projects/{project_uuid}/esi/ai-surface:
    servers:
      - url: https://api.infrawatch.com/api/v1
    parameters:
      - $ref: '#/components/parameters/esi_v1_ProjectUUID'
    get:
      tags:
        - AI Surface
      summary: List AI surface assets.
      description: Lists backend-owned AI surface rows for the authenticated ESI project.
      operationId: listAISurfaceAssets
      parameters:
        - explode: true
          in: query
          name: surface_type
          schema:
            items:
              $ref: '#/components/schemas/esi_v1_AISurfaceType'
            type: array
        - explode: true
          in: query
          name: risk
          schema:
            items:
              $ref: '#/components/schemas/esi_v1_AISurfaceRisk'
            type: array
        - explode: true
          in: query
          name: status
          schema:
            items:
              $ref: '#/components/schemas/esi_v1_AISurfaceStatus'
            type: array
        - explode: true
          in: query
          name: provider
          schema:
            items:
              maxLength: 256
              type: string
            type: array
        - explode: true
          in: query
          name: product
          schema:
            items:
              maxLength: 256
              type: string
            type: array
        - explode: true
          in: query
          name: source_kind
          schema:
            items:
              $ref: '#/components/schemas/esi_v1_AssetServiceSourceKind'
            type: array
        - in: query
          name: q
          schema:
            maxLength: 256
            type: string
        - in: query
          name: limit
          schema:
            default: 50
            maximum: 500
            minimum: 1
            type: integer
        - in: query
          name: offset
          schema:
            default: 0
            minimum: 0
            type: integer
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  pagination:
                    $ref: '#/components/schemas/esi_v1_Pagination'
                  surfaces:
                    items:
                      $ref: '#/components/schemas/esi_v1_AISurfaceAsset'
                    type: array
                required:
                  - surfaces
                  - pagination
                type: object
          description: AI surface rows.
        '400':
          $ref: '#/components/responses/esi_v1_BadRequest'
        '401':
          $ref: '#/components/responses/esi_v1_Unauthorized'
        '403':
          $ref: '#/components/responses/esi_v1_Forbidden'
      security:
        - apiKeyAuth: []
components:
  parameters:
    esi_v1_ProjectUUID:
      in: path
      name: project_uuid
      required: true
      schema:
        format: uuid
        type: string
  schemas:
    esi_v1_AISurfaceType:
      enum:
        - mcp_server
        - model_runtime
        - ai_application
        - agent_endpoint
        - llm_gateway
        - unknown
      type: string
    esi_v1_AISurfaceRisk:
      enum:
        - critical
        - high
        - moderate
        - low
        - informational
      type: string
    esi_v1_AISurfaceStatus:
      enum:
        - open
        - accepted
        - resolved
        - ignored
        - false_positive
      type: string
    esi_v1_AssetServiceSourceKind:
      enum:
        - manual
        - auto_discovered
        - import
        - api
        - integration
      type: string
    esi_v1_Pagination:
      properties:
        limit:
          type: integer
        offset:
          type: integer
        total:
          type: integer
      required:
        - limit
        - offset
        - total
      type: object
    esi_v1_AISurfaceAsset:
      properties:
        created_at:
          format: date-time
          type: string
        endpoint:
          type: string
        evidence:
          additionalProperties: true
          type: object
        evidence_schema:
          type: string
        exposure_summary:
          type: string
        first_seen_at:
          format: date-time
          type: string
        hostname:
          type: string
        http_status_code:
          maximum: 599
          minimum: 100
          type: integer
        http_title:
          type: string
        inventory_asset_uuid:
          format: uuid
          type: string
        ip:
          type: string
        last_seen_at:
          format: date-time
          type: string
        model_name:
          type: string
        port:
          maximum: 65535
          minimum: 1
          type: integer
        product:
          type: string
        protocol:
          type: string
        provider:
          type: string
        risk:
          $ref: '#/components/schemas/esi_v1_AISurfaceRisk'
        source_kind:
          $ref: '#/components/schemas/esi_v1_AssetServiceSourceKind'
        source_name:
          type: string
        source_ref:
          type: string
        status:
          $ref: '#/components/schemas/esi_v1_AISurfaceStatus'
        surface_key:
          type: string
        surface_type:
          $ref: '#/components/schemas/esi_v1_AISurfaceType'
        updated_at:
          format: date-time
          type: string
        url:
          type: string
        uuid:
          format: uuid
          type: string
      required:
        - uuid
        - surface_key
        - surface_type
        - risk
        - status
        - evidence
        - evidence_schema
        - source_kind
        - first_seen_at
        - last_seen_at
        - created_at
        - updated_at
      type: object
    esi_v1_ErrorResponse:
      properties:
        error:
          properties:
            code:
              type: string
            field_errors:
              items:
                properties:
                  code:
                    type: string
                  field:
                    type: string
                  message:
                    type: string
                required:
                  - field
                  - code
                  - message
                type: object
              type: array
            message:
              type: string
            request_id:
              type: string
          required:
            - code
            - message
          type: object
      required:
        - error
      type: object
  responses:
    esi_v1_BadRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: Invalid request.
    esi_v1_Unauthorized:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: Authentication required.
    esi_v1_Forbidden:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: Required scope or project access missing.
  securitySchemes:
    apiKeyAuth:
      description: >-
        Infrawatch API key. Supply the complete key directly as the header
        value.
      in: header
      name: X-API-Key
      type: apiKey

````