> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List dangling DNS findings.

> Lists dangling DNS findings visible through the authenticated project.



## OpenAPI

````yaml https://api.infrawatch.com/openapi.json?contract=d15375c get /projects/{project_uuid}/esi/findings/dangling-dns
openapi: 3.1.0
info:
  description: >-
    Customer-facing Infrawatch APIs. Authenticate with an API key unless an
    operation documents another supported credential.


    ### Infrawatch Public API


    Public API authenticated exclusively with Infrawatch API keys.


    ### Infrawatch Customer Alerting API


    Project alert rules, destinations, silences, inbox state, and delivery
    history.


    ### Infrawatch Remote Browser API


    Project-scoped interactive browser sessions owned by Platform Core.


    Session admission, lifecycle, RBAC, audit, usage, screenshot history, and

    stream tickets are Platform Core resources. The browser master is private

    infrastructure and its identifiers, proxy routes, process options, and

    credentials are never exposed by this API.


    A session and all of its evidence are private to the credential that created

    it. Project managers may list project session metadata, inspect one
    session's

    metadata, and terminate it, but cannot access its live stream, screenshots,

    or network events.


    Terminal session metadata and screenshots are retained indefinitely. A

    creator can replay a terminal session as a new queued resource while

    preserving a durable link to the source session.


    ### Infrawatch ESI API


    Customer-facing External Surface Intelligence API for project-scoped

    product data authenticated by an Infrawatch API key. API keys

    are constrained to their immutable owner's project ceiling and assigned

    ESI scopes; human project-manager fallback never expands an API key.

    Authorised API-key requests are rate-limited and consume monthly quota.


    ### Infrawatch Reports API


    Threat report discovery API authenticated by an Infrawatch API key.


    ### Infrawatch Public Rules API


    Account-aware rule authoring, taxonomy, catalogue, and runtime observations
    for API clients.


    ### Infrawatch Search API


    Search hosts, services, DNS records, and certificates. Complete
    percent-encoded query strings are limited to 65536 bytes.
  title: Infrawatch Customer API
  version: 1.0.0
servers:
  - description: Infrawatch customer API
    url: https://api.infrawatch.com/api/v1
security: []
tags:
  - name: API Usage
  - name: Projects
  - name: Alert destinations
  - name: Alert rules
  - name: Alert silences
  - name: Alerts
  - name: Browser sessions
  - name: Browser evidence
  - name: Browser streaming
  - name: Access
  - name: Inventory
  - name: Dangling DNS
  - name: Findings
  - name: Secrets
  - name: Typosquatting
  - name: Services
  - name: AI Surface
  - description: Search hosts, services, DNS records, certificates, and open directories.
    name: Search
  - name: Dashboard
  - name: Reports
  - name: Rules
  - name: Rule tags
  - name: Rule observations
paths:
  /projects/{project_uuid}/esi/findings/dangling-dns:
    servers:
      - url: https://api.infrawatch.com/api/v1
    parameters:
      - $ref: '#/components/parameters/esi_v1_ProjectUUID'
    get:
      tags:
        - Dangling DNS
      summary: List dangling DNS findings.
      description: Lists dangling DNS findings visible through the authenticated project.
      operationId: listDanglingDNSFindings
      parameters:
        - in: query
          name: limit
          schema:
            default: 100
            maximum: 500
            minimum: 1
            type: integer
        - description: Offset plus limit must not exceed the 10,000-finding result window.
          in: query
          name: offset
          schema:
            default: 0
            maximum: 9999
            minimum: 0
            type: integer
        - description: >-
            Select active detector findings, resolved history, or a deduplicated
            union where a current active episode wins.
          in: query
          name: lifecycle
          schema:
            default: active
            enum:
              - active
              - resolved
              - all
            type: string
        - in: query
          name: q
          schema:
            maxLength: 256
            type: string
        - description: >-
            Field to order by. Repeat to order by several, applied left to right
            so a later field breaks ties in an earlier one. An unrecognised
            field is rejected rather than ignored, so a sort either applies or
            fails loudly. Ordering spans the whole result set rather than the
            page returned, and every order ends with a stable tiebreak so paging
            cannot skip a finding. The last three name the findings table's own
            columns and are aliases: finding orders by entry_host, signal by
            confidence, evidence by service.
          explode: true
          in: query
          name: sort
          schema:
            items:
              enum:
                - start
                - last_seen
                - entry_host
                - apex_domain
                - terminal_host
                - provider
                - service
                - type
                - confidence
                - claimable
                - finding
                - signal
                - evidence
              type: string
            type: array
          style: form
        - description: >-
            Direction for the sort field at the same position. Omitted, time and
            severity fields order newest or highest first and the rest order
            A-Z. Confidence orders by severity rather than alphabetically, where
            high would otherwise sit between low and medium.
          explode: true
          in: query
          name: direction
          schema:
            items:
              enum:
                - asc
                - desc
              type: string
            type: array
          style: form
        - description: >-
            Exact normalized finding UUID, used to deep-link to one
            project-scoped record.
          in: query
          name: finding_uuid
          schema:
            format: uuid
            type: string
        - in: query
          name: logical_id
          schema:
            maxLength: 512
            type: string
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: rule_id
          schema:
            items:
              maxLength: 256
              type: string
            maxItems: 25
            type: array
          style: form
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: apex_domain
          schema:
            items:
              maxLength: 256
              type: string
            maxItems: 25
            type: array
          style: form
        - description: >-
            DNS owner name where the exposed path starts. Repeat or
            comma-separate for multi-select filtering.
          explode: true
          in: query
          name: entry_host
          schema:
            items:
              maxLength: 256
              type: string
            maxItems: 25
            type: array
          style: form
        - description: >-
            Record type at the exposed entry point. Repeat or comma-separate for
            multi-select filtering.
          explode: true
          in: query
          name: entry_record_type
          schema:
            items:
              maxLength: 32
              type: string
            maxItems: 25
            type: array
          style: form
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: rcode
          schema:
            items:
              maxLength: 64
              type: string
            maxItems: 25
            type: array
          style: form
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: answer_kind
          schema:
            items:
              maxLength: 64
              type: string
            maxItems: 25
            type: array
          style: form
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: answer_ip
          schema:
            items:
              maxLength: 128
              type: string
            maxItems: 25
            type: array
          style: form
        - description: Case-insensitive substring of the entry record target.
          in: query
          name: entry_target
          schema:
            maxLength: 256
            type: string
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: type
          schema:
            items:
              maxLength: 64
              type: string
            maxItems: 25
            type: array
          style: form
        - description: >-
            Customer-facing state after merging the normalized Postgres
            lifecycle state. Repeat or comma-separate for multi-select
            filtering.
          explode: true
          in: query
          name: state_status
          schema:
            items:
              $ref: '#/components/schemas/esi_v1_DanglingFindingStatus'
            maxItems: 25
            type: array
          style: form
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: confidence
          schema:
            items:
              maxLength: 64
              type: string
            maxItems: 25
            type: array
          style: form
        - description: Repeat or comma-separate for multi-select filtering.
          explode: true
          in: query
          name: domain_available
          schema:
            items:
              maxLength: 64
              type: string
            maxItems: 25
            type: array
          style: form
        - in: query
          name: service
          schema:
            maxLength: 256
            type: string
        - description: >-
            Canonical provider family supplied by the matched rule. Repeat or
            comma-separate for multi-select filtering.
          explode: true
          in: query
          name: provider
          schema:
            items:
              maxLength: 256
              type: string
            maxItems: 25
            type: array
          style: form
        - in: query
          name: terminal_host
          schema:
            maxLength: 256
            type: string
        - description: >-
            Registrable domain at the terminal risk boundary. Repeat or
            comma-separate for multi-select filtering.
          explode: true
          in: query
          name: terminal_domain
          schema:
            items:
              maxLength: 256
              type: string
            maxItems: 25
            type: array
          style: form
        - in: query
          name: claimable
          schema:
            type: boolean
        - in: query
          name: start_from
          schema:
            format: date-time
            type: string
        - in: query
          name: start_to
          schema:
            format: date-time
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  findings:
                    items:
                      $ref: '#/components/schemas/esi_v1_DanglingFinding'
                    type: array
                  pagination:
                    $ref: '#/components/schemas/esi_v1_Pagination'
                required:
                  - findings
                  - pagination
                type: object
          description: Dangling DNS findings.
        '400':
          $ref: '#/components/responses/esi_v1_BadRequest'
        '401':
          $ref: '#/components/responses/esi_v1_Unauthorized'
        '403':
          $ref: '#/components/responses/esi_v1_Forbidden'
        '404':
          $ref: '#/components/responses/esi_v1_NotFound'
        '503':
          $ref: '#/components/responses/esi_v1_ServiceUnavailable'
      security:
        - apiKeyAuth: []
components:
  parameters:
    esi_v1_ProjectUUID:
      in: path
      name: project_uuid
      required: true
      schema:
        format: uuid
        type: string
  schemas:
    esi_v1_DanglingFindingStatus:
      enum:
        - open
        - accepted
        - resolved
        - ignored
        - false_positive
      type: string
    esi_v1_DanglingFinding:
      properties:
        answer_ip:
          type: string
        answer_kind:
          type: string
        apex_domain:
          type: string
        chain:
          description: >-
            Ordered DNS targets after the entry host, including the terminal
            host.
          items:
            $ref: '#/components/schemas/esi_v1_DanglingDNSChainRecord'
          type: array
        claimable:
          type: boolean
        confidence:
          $ref: '#/components/schemas/esi_v1_FindingConfidence'
        domain_available:
          type: string
        entry_host:
          description: Protected DNS owner name where this finding starts.
          type: string
        entry_record_type:
          description: Record type on the entry host.
          type: string
        entry_target:
          description: Target recorded directly on the entry host.
          type: string
        finding_uuid:
          description: >-
            Normalized ESI finding UUID. Use
            `/projects/{project_uuid}/findings/{finding_uuid}` for shared
            lifecycle actions when present.
          format: uuid
          type: string
        last_seen_at:
          format: date-time
          type: string
        lifecycle:
          description: Present only for an archived dangling episode.
          enum:
            - resolved
          type: string
        logical_id:
          maxLength: 512
          type: string
        page_sha256:
          description: SHA-256 of the observed page body from esi.inventory_assets.
          pattern: ^[0-9a-fA-F]{64}$
          type: string
        provider:
          description: >-
            Canonical provider family shared by related service rules, for
            example Amazon Web Services or Microsoft Azure.
          maxLength: 255
          type: string
        rcode:
          type: string
        resolved_at:
          description: Detector close time for an archived dangling episode.
          format: date-time
          type: string
        rule_id:
          description: Stable detector rule identifier.
          type: string
        rule_name:
          description: Customer-facing detector rule name captured with the observation.
          maxLength: 255
          type: string
        service:
          type: string
        start:
          format: date-time
          type: string
        state:
          $ref: '#/components/schemas/esi_v1_DanglingFindingState'
        status:
          type: string
        terminal_domain:
          description: >-
            Registrable domain containing the terminal host; claimable only when
            claimable is true.
          type: string
        terminal_host:
          type: string
        type:
          type: string
      required:
        - logical_id
        - apex_domain
        - entry_host
        - claimable
        - chain
        - start
        - last_seen_at
        - state
      type: object
    esi_v1_Pagination:
      properties:
        limit:
          type: integer
        offset:
          type: integer
        total:
          type: integer
      required:
        - limit
        - offset
        - total
      type: object
    esi_v1_DanglingDNSChainRecord:
      properties:
        host:
          type: string
        position:
          minimum: 0
          type: integer
        record_type:
          type: string
      required:
        - position
        - host
        - record_type
      type: object
    esi_v1_FindingConfidence:
      enum:
        - low
        - medium
        - high
      type: string
    esi_v1_DanglingFindingState:
      properties:
        accepted_at:
          format: date-time
          type: string
        note:
          type: string
        status:
          $ref: '#/components/schemas/esi_v1_DanglingFindingStatus'
        updated_at:
          format: date-time
          type: string
      required:
        - status
      type: object
    esi_v1_ErrorResponse:
      properties:
        error:
          properties:
            code:
              type: string
            field_errors:
              items:
                properties:
                  code:
                    type: string
                  field:
                    type: string
                  message:
                    type: string
                required:
                  - field
                  - code
                  - message
                type: object
              type: array
            message:
              type: string
            request_id:
              type: string
          required:
            - code
            - message
          type: object
      required:
        - error
      type: object
  responses:
    esi_v1_BadRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: Invalid request.
    esi_v1_Unauthorized:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: Authentication required.
    esi_v1_Forbidden:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: Required scope or project access missing.
    esi_v1_NotFound:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: Resource not found.
    esi_v1_ServiceUnavailable:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/esi_v1_ErrorResponse'
      description: >-
        A required upstream view is temporarily unavailable or exceeds its
        bounded safe-read limit.
  securitySchemes:
    apiKeyAuth:
      description: >-
        Infrawatch API key. Supply the complete key directly as the header
        value.
      in: header
      name: X-API-Key
      type: apiKey

````