> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # Search ESI findings. > Searches project-scoped findings from `esi.findings`. Inventory, services, host, DNS, and raw query-engine search are out of this surface and will be integrated through the query API later. ## OpenAPI ````yaml https://api.infrawatch.com/openapi.json?contract=d15375c get /projects/{project_uuid}/esi/findings/search openapi: 3.1.0 info: description: >- Customer-facing Infrawatch APIs. Authenticate with an API key unless an operation documents another supported credential. ### Infrawatch Public API Public API authenticated exclusively with Infrawatch API keys. ### Infrawatch Customer Alerting API Project alert rules, destinations, silences, inbox state, and delivery history. ### Infrawatch Remote Browser API Project-scoped interactive browser sessions owned by Platform Core. Session admission, lifecycle, RBAC, audit, usage, screenshot history, and stream tickets are Platform Core resources. The browser master is private infrastructure and its identifiers, proxy routes, process options, and credentials are never exposed by this API. A session and all of its evidence are private to the credential that created it. Project managers may list project session metadata, inspect one session's metadata, and terminate it, but cannot access its live stream, screenshots, or network events. Terminal session metadata and screenshots are retained indefinitely. A creator can replay a terminal session as a new queued resource while preserving a durable link to the source session. ### Infrawatch ESI API Customer-facing External Surface Intelligence API for project-scoped product data authenticated by an Infrawatch API key. API keys are constrained to their immutable owner's project ceiling and assigned ESI scopes; human project-manager fallback never expands an API key. Authorised API-key requests are rate-limited and consume monthly quota. ### Infrawatch Reports API Threat report discovery API authenticated by an Infrawatch API key. ### Infrawatch Public Rules API Account-aware rule authoring, taxonomy, catalogue, and runtime observations for API clients. ### Infrawatch Search API Search hosts, services, DNS records, and certificates. Complete percent-encoded query strings are limited to 65536 bytes. title: Infrawatch Customer API version: 1.0.0 servers: - description: Infrawatch customer API url: https://api.infrawatch.com/api/v1 security: [] tags: - name: API Usage - name: Projects - name: Alert destinations - name: Alert rules - name: Alert silences - name: Alerts - name: Browser sessions - name: Browser evidence - name: Browser streaming - name: Access - name: Inventory - name: Dangling DNS - name: Findings - name: Secrets - name: Typosquatting - name: Services - name: AI Surface - description: Search hosts, services, DNS records, certificates, and open directories. name: Search - name: Dashboard - name: Reports - name: Rules - name: Rule tags - name: Rule observations paths: /projects/{project_uuid}/esi/findings/search: servers: - url: https://api.infrawatch.com/api/v1 parameters: - $ref: '#/components/parameters/esi_v1_ProjectUUID' get: tags: - Search summary: Search ESI findings. description: >- Searches project-scoped findings from `esi.findings`. Inventory, services, host, DNS, and raw query-engine search are out of this surface and will be integrated through the query API later. operationId: searchESIProject parameters: - $ref: '#/components/parameters/esi_v1_ESISearchQuery' - $ref: '#/components/parameters/esi_v1_ESISearchType' - $ref: '#/components/parameters/esi_v1_ESISearchExposureKind' - $ref: '#/components/parameters/esi_v1_ESISearchFindingStatus' - $ref: '#/components/parameters/esi_v1_ESISearchFindingSeverity' - $ref: '#/components/parameters/esi_v1_ESISearchFindingConfidence' - in: query name: limit schema: default: 50 maximum: 250 minimum: 1 type: integer - in: query name: offset schema: default: 0 minimum: 0 type: integer responses: '200': content: application/json: schema: properties: pagination: $ref: '#/components/schemas/esi_v1_Pagination' query_text: type: string results: items: $ref: '#/components/schemas/esi_v1_ESISearchResult' type: array total_relation: enum: - eq type: string required: - results - pagination - query_text - total_relation type: object description: ESI search results. '400': $ref: '#/components/responses/esi_v1_BadRequest' '401': $ref: '#/components/responses/esi_v1_Unauthorized' '403': $ref: '#/components/responses/esi_v1_Forbidden' security: - apiKeyAuth: [] components: parameters: esi_v1_ProjectUUID: in: path name: project_uuid required: true schema: format: uuid type: string esi_v1_ESISearchQuery: description: >- Case-insensitive literal substring search over finding titles, descriptions, types, lifecycle values, and source metadata. Finding evidence JSON is returned as metadata but is not searched. in: query name: q schema: maxLength: 256 type: string esi_v1_ESISearchType: description: Result families to include. Only `finding` is currently supported. explode: true in: query name: type schema: items: $ref: '#/components/schemas/esi_v1_ESISearchResultKind' maxItems: 1 type: array esi_v1_ESISearchExposureKind: description: >- Exact exposure kinds to include. Repeat or comma-separate for multi-select filtering. explode: true in: query name: exposure_kind schema: items: maxLength: 256 type: string maxItems: 25 type: array style: form esi_v1_ESISearchFindingStatus: description: >- Exact finding lifecycle states to include. Repeat or comma-separate for multi-select filtering. explode: true in: query name: finding_status schema: items: $ref: '#/components/schemas/esi_v1_FindingStatus' maxItems: 25 type: array style: form esi_v1_ESISearchFindingSeverity: description: >- Exact finding severities to include. Repeat or comma-separate for multi-select filtering. explode: true in: query name: finding_severity schema: items: $ref: '#/components/schemas/esi_v1_FindingSeverity' maxItems: 25 type: array style: form esi_v1_ESISearchFindingConfidence: description: >- Exact finding confidence levels to include. Repeat or comma-separate for multi-select filtering. explode: true in: query name: finding_confidence schema: items: $ref: '#/components/schemas/esi_v1_FindingConfidence' maxItems: 25 type: array style: form schemas: esi_v1_Pagination: properties: limit: type: integer offset: type: integer total: type: integer required: - limit - offset - total type: object esi_v1_ESISearchResult: properties: confidence: $ref: '#/components/schemas/esi_v1_FindingConfidence' finding_type: description: >- Customer-facing finding classification, such as `domain_for_sale` or `domain_typosquatting`. type: string first_seen_at: format: date-time type: string last_seen_at: format: date-time type: string metadata: additionalProperties: true type: object resource_kind: description: Storage family used to route to the typed finding surface. type: string result_kind: $ref: '#/components/schemas/esi_v1_ESISearchResultKind' severity: type: string status: type: string summary: type: string title: type: string updated_at: format: date-time type: string uuid: format: uuid type: string value: type: string required: - uuid - result_kind - resource_kind - finding_type - title - value - first_seen_at - last_seen_at - updated_at - metadata type: object esi_v1_ESISearchResultKind: enum: - finding type: string esi_v1_FindingStatus: enum: - open - accepted - resolved - ignored - false_positive type: string esi_v1_FindingSeverity: enum: - critical - high - moderate - low - informational type: string esi_v1_FindingConfidence: enum: - low - medium - high type: string esi_v1_ErrorResponse: properties: error: properties: code: type: string field_errors: items: properties: code: type: string field: type: string message: type: string required: - field - code - message type: object type: array message: type: string request_id: type: string required: - code - message type: object required: - error type: object responses: esi_v1_BadRequest: content: application/json: schema: $ref: '#/components/schemas/esi_v1_ErrorResponse' description: Invalid request. esi_v1_Unauthorized: content: application/json: schema: $ref: '#/components/schemas/esi_v1_ErrorResponse' description: Authentication required. esi_v1_Forbidden: content: application/json: schema: $ref: '#/components/schemas/esi_v1_ErrorResponse' description: Required scope or project access missing. securitySchemes: apiKeyAuth: description: >- Infrawatch API key. Supply the complete key directly as the header value. in: header name: X-API-Key type: apiKey ````