Search hosts
Host-only queries are ordered by the overall host last-seen timestamp descending. Queries that match service content are ordered by the latest matching observation scan timestamp descending. Host.last_seen_at is the overall host rollup and is not necessarily the service-query sort key.
Authorizations
Infrawatch API key. Supply the complete key directly as the header value.
Query Parameters
InfraQL expression, limited to 8192 UTF-8 bytes after URL decoding. Omit for the dataset default query. String operators pair positive with negative: : contains and :~ does NOT contain; = is exact and != is not exact. =~ is a regular expression, which must be anchored with ^ and $ and begin with a literal prefix of at least three characters.
8192Page size.
1 <= x <= 200Offset within the first 10,000 results; offset + limit must not exceed 10,000. Cannot be combined with cursor.
0 <= x <= 9999Opaque continuation token that expires 15 minutes after the first page and is bound to the dataset, normalized query, and resolved visibility context. Cannot be combined with offset. If it is invalid or expired, restart pagination without a cursor. Clients must not parse or persist it as a durable bookmark.
1 - 4096Set to true to return host cards without matched service previews. Use preview_host in a follow-up request to fetch those previews directly.
true Repeated IP addresses from one deferred host page. Fetches matching service previews directly without repeating host discovery. The number of unique addresses must equal limit; cannot be combined with offset, cursor, or defer_services.
1 - 200 elements2 - 64Response
Hosts in the query-dependent recency order documented by searchHosts.
Host-only queries are ordered by overall Host.last_seen_at descending. Service-content queries are ordered by the latest matching observation scan timestamp descending; that sort timestamp is not exposed as Host.last_seen_at.