Skip to main content
The Infrawatch API is a JSON REST API for infrastructure search, enrichment, external-surface workflows, browser evidence, rules, and intelligence reports.

Base URL

Endpoint pages show paths relative to this URL.

Authenticate

Create and manage API keys in API access, then send the key in X-API-Key:
Authentication and access are derived from the key. Keep keys in server-side secret storage and never expose them in client-side code.

Authentication

Create a key, choose scopes, set the header, and handle authentication errors.

Complete the quickstart

Create a scoped key, run a host search, and inspect the response.

Choose an API

Search and enrichment

Search hosts, services, DNS, and OSINT; discover subdomains; validate InfraQL; run bulk lookup; count and aggregate results.

External Surface Intelligence

Manage project inventory, services, and the lifecycle of externally visible findings.

Remote Browser

Run isolated browser sessions and collect screenshots, network events, and replay evidence.

Rules

Author detection rules, manage tags, and inspect rule observations and activity.

Reports

Retrieve published intelligence reports, facets, and extracted indicators.

Errors

Errors use a stable JSON envelope:
  • Use code for program logic.
  • Show message to an operator.
  • Retain request_id for support.
  • Back off when the API returns 429 or a retryable 503.

Versioning

Public endpoints are versioned in the URL where applicable. Backward-compatible fields and enum values can be added over time, so clients should ignore values they do not yet recognize.

Data Dictionary

Browse public search fields, types, operators, and meanings.

Analyst workflows

Follow practical IP, service, DNS, bulk-enrichment, and aggregation recipes.