> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # Search reports. > Results default to publication date, newest first. Reports without a publication date use the UTC date on which they were stored. Human requests require active platform access. Organisation, group, and user API keys require reports.view; individual root keys are allowed. API-key requests consume their owner's monthly request quota. ## OpenAPI ````yaml https://api.infrawatch.com/openapi.json?contract=d15375c get /reports openapi: 3.1.0 info: description: >- Customer-facing Infrawatch APIs. Authenticate with an API key unless an operation documents another supported credential. ### Infrawatch Public API Public API authenticated exclusively with Infrawatch API keys. ### Infrawatch Customer Alerting API Project alert rules, destinations, silences, inbox state, and delivery history. ### Infrawatch Remote Browser API Project-scoped interactive browser sessions owned by Platform Core. Session admission, lifecycle, RBAC, audit, usage, screenshot history, and stream tickets are Platform Core resources. The browser master is private infrastructure and its identifiers, proxy routes, process options, and credentials are never exposed by this API. A session and all of its evidence are private to the credential that created it. Project managers may list project session metadata, inspect one session's metadata, and terminate it, but cannot access its live stream, screenshots, or network events. Terminal session metadata and screenshots are retained indefinitely. A creator can replay a terminal session as a new queued resource while preserving a durable link to the source session. ### Infrawatch ESI API Customer-facing External Surface Intelligence API for project-scoped product data authenticated by an Infrawatch API key. API keys are constrained to their immutable owner's project ceiling and assigned ESI scopes; human project-manager fallback never expands an API key. Authorised API-key requests are rate-limited and consume monthly quota. ### Infrawatch Reports API Threat report discovery API authenticated by an Infrawatch API key. ### Infrawatch Public Rules API Account-aware rule authoring, taxonomy, catalogue, and runtime observations for API clients. ### Infrawatch Search API Search hosts, services, DNS records, and certificates. Complete percent-encoded query strings are limited to 65536 bytes. title: Infrawatch Customer API version: 1.0.0 servers: - description: Infrawatch customer API url: https://api.infrawatch.com/api/v1 security: [] tags: - name: API Usage - name: Projects - name: Alert destinations - name: Alert rules - name: Alert silences - name: Alerts - name: Browser sessions - name: Browser evidence - name: Browser streaming - name: Access - name: Inventory - name: Dangling DNS - name: Findings - name: Secrets - name: Typosquatting - name: Services - name: AI Surface - description: Search hosts, services, DNS records, certificates, and open directories. name: Search - name: Dashboard - name: Reports - name: Rules - name: Rule tags - name: Rule observations paths: /reports: servers: - url: https://api.infrawatch.com/api/v1 get: tags: - Reports summary: Search reports. description: >- Results default to publication date, newest first. Reports without a publication date use the UTC date on which they were stored. Human requests require active platform access. Organisation, group, and user API keys require reports.view; individual root keys are allowed. API-key requests consume their owner's monthly request quota. operationId: searchReports parameters: - description: Report text, publisher, or exact IP indicator to search for. in: query name: q schema: maxLength: 256 type: string - description: Case-insensitive publisher name or source identifier filter. in: query name: source schema: maxLength: 256 type: string - description: >- Inclusive lower bound for the publication date, falling back to the UTC date first stored. in: query name: date_from schema: format: date-time type: string - description: >- Inclusive upper bound for the publication date, falling back to the UTC date first stored. in: query name: date_to schema: format: date-time type: string - description: Restrict results to reports with or without an IP indicator. in: query name: ip_presence schema: enum: - with - without type: string - in: query name: source_kind schema: $ref: '#/components/schemas/reports_v1_ReportSourceKind' - $ref: '#/components/parameters/reports_v1_IndicatorType' - $ref: '#/components/parameters/reports_v1_Indicator' - description: >- Ordered report catalogue fields. Repeat the parameter to add secondary sorts. explode: true in: query name: sort schema: default: - published items: enum: - report - coverage - published type: string maxItems: 3 type: array style: form - description: >- Directions aligned by position with each sort field. Repeat for secondary sorts. explode: true in: query name: direction schema: items: enum: - asc - desc type: string maxItems: 3 type: array style: form - $ref: '#/components/parameters/reports_v1_Limit' - $ref: '#/components/parameters/reports_v1_Offset' responses: '200': content: application/json: schema: $ref: '#/components/schemas/reports_v1_ReportPage' description: Matching reports. '400': $ref: '#/components/responses/reports_v1_BadRequest' '401': $ref: '#/components/responses/reports_v1_Unauthorized' '403': $ref: '#/components/responses/reports_v1_Forbidden' '429': $ref: '#/components/responses/reports_v1_TooManyRequests' '503': $ref: '#/components/responses/reports_v1_ServiceUnavailable' security: - apiKeyAuth: [] components: schemas: reports_v1_ReportSourceKind: enum: - upstream type: string reports_v1_ReportPage: properties: indicator: description: >- Present when the request supplied the paired indicator_type and indicator filters. maxLength: 512 minLength: 1 type: string indicator_type: $ref: '#/components/schemas/reports_v1_IndicatorType' description: >- Present when the request supplied the paired indicator_type and indicator filters. pagination: $ref: '#/components/schemas/reports_v1_Pagination' reports: items: $ref: '#/components/schemas/reports_v1_Report' type: array required: - reports - pagination type: object reports_v1_IndicatorType: enum: - ip - domain - md5 - sha1 - sha256 type: string reports_v1_Pagination: properties: limit: maximum: 500 minimum: 1 type: integer offset: minimum: 0 type: integer total: minimum: 0 type: integer required: - limit - offset - total type: object reports_v1_Report: properties: description: type: string indicator_count: description: Number of IP and domain indicators attached to the report. format: int64 minimum: 0 type: integer link_sha256: pattern: ^[a-f0-9]{64}$ type: string link_url: format: uri pattern: ^https?://[^/@\s]+([/?#].*)?$ type: string report_date: format: date-time type: string source: $ref: '#/components/schemas/reports_v1_ReportSource' stored_at: format: date-time type: string upstream_report_id: type: string upstream_source_id: type: string upstream_updated_at: format: date-time type: string uuid: format: uuid type: string required: - uuid - upstream_source_id - upstream_report_id - link_url - link_sha256 - description - upstream_updated_at - stored_at - source - indicator_count type: object reports_v1_ErrorResponse: properties: error: properties: code: type: string field_errors: items: properties: code: type: string field: type: string message: type: string required: - field - code - message type: object type: array message: type: string request_id: type: string required: - code - message type: object required: - error type: object reports_v1_ReportSource: properties: favicon_media_type: type: string favicon_sha256: pattern: ^[a-f0-9]{64}$ type: string link_url: format: uri pattern: ^https?://[^/@\s]+([/?#].*)?$ type: string name: type: string source_kind: $ref: '#/components/schemas/reports_v1_ReportSourceKind' stored_at: format: date-time type: string upstream_report_source_id: type: string upstream_source_id: type: string upstream_updated_at: format: date-time type: string uuid: format: uuid type: string required: - uuid - source_kind - upstream_source_id - upstream_report_source_id - name - upstream_updated_at - stored_at type: object parameters: reports_v1_IndicatorType: description: >- Indicator type to match. Must be provided together with indicator; combines with all other report filters using intersection semantics. in: query name: indicator_type schema: $ref: '#/components/schemas/reports_v1_IndicatorType' reports_v1_Indicator: description: >- A value matching indicator_type. Must be provided together with indicator_type. Domains and IP addresses may be defanged and are normalized before lookup; hashes must contain the exact number of hexadecimal bytes for their type. in: query name: indicator schema: maxLength: 512 minLength: 1 type: string reports_v1_Limit: in: query name: limit schema: default: 100 maximum: 500 minimum: 1 type: integer reports_v1_Offset: in: query name: offset schema: default: 0 minimum: 0 type: integer responses: reports_v1_BadRequest: content: application/json: schema: $ref: '#/components/schemas/reports_v1_ErrorResponse' description: Invalid request. reports_v1_Unauthorized: content: application/json: schema: $ref: '#/components/schemas/reports_v1_ErrorResponse' description: Authentication required. reports_v1_Forbidden: content: application/json: schema: $ref: '#/components/schemas/reports_v1_ErrorResponse' description: Active platform access required. reports_v1_TooManyRequests: content: application/json: schema: $ref: '#/components/schemas/reports_v1_ErrorResponse' description: API-key rate limit or monthly request quota exceeded. reports_v1_ServiceUnavailable: content: application/json: schema: $ref: '#/components/schemas/reports_v1_ErrorResponse' description: API-key metering is temporarily unavailable. securitySchemes: apiKeyAuth: description: >- Infrawatch API key. Supply the complete key directly as the header value. in: header name: X-API-Key type: apiKey ````