# Infrawatch

> Infrawatch documentation - beat the adversary with 22B+ events a day.

## Docs

- [Infrawatch documentation](https://docs.infrawatch.com/index.md): Investigate internet infrastructure, enrich indicators, and automate security workflows
- [Quickstart](https://docs.infrawatch.com/quickstart.md): Run your first search, investigate a result, and make your first API request
- [InfrAI](https://docs.infrawatch.com/infrai/overview.md): Ask a question in plain language and watch InfrAI map the connected infrastructure
- [Live investigations](https://docs.infrawatch.com/infrai/live-investigations.md): How InfrAI turns a question into parallel pivots, streamed steps, and a pivot graph
- [MCP server](https://docs.infrawatch.com/infrai/mcp.md): Supercharge your SOC by giving your own AI agents the Infrawatch dataset
- [Platform overview](https://docs.infrawatch.com/platform/overview.md): Understand the Infrawatch data platform and choose the right product
- [Scanning](https://docs.infrawatch.com/platform/scanning.md): Search continuously refreshed observations of internet hosts and services
- [DNS](https://docs.infrawatch.com/platform/dns.md): Trace observed relationships between names and internet addresses
- [Residential Proxies & VPNs](https://docs.infrawatch.com/platform/residential-proxies-vpns.md): Identify and attribute proxy and VPN infrastructure
- [Reports](https://docs.infrawatch.com/platform/reports.md): Search published security reporting and pivot through extracted indicators
- [Open Directories](https://docs.infrawatch.com/platform/open-directories.md): Investigate indexed directory listings and exposed files
- [Remote Browser](https://docs.infrawatch.com/platform/remote-browser.md): Open a hostile page in an isolated Chromium session and keep the evidence
- [External Surface Intelligence](https://docs.infrawatch.com/external-surface/overview.md): See what your organisation exposes to the internet, and work the findings raised against it
- [Inventory](https://docs.infrawatch.com/external-surface/inventory.md): Declare what the organisation owns, review what Infrawatch discovers, and keep the surface accurate
- [DNS risks](https://docs.infrawatch.com/external-surface/dns-risks.md): Find names that resolve into infrastructure you no longer control, and see who could claim them
- [Typosquatting](https://docs.infrawatch.com/external-surface/typosquatting.md): Find look-alike domains registered against your brands, and see what they are actually serving
- [Secrets](https://docs.infrawatch.com/external-surface/secrets.md): Find credential material exposed on your external surface, without ever handling the secret
- [AI surface](https://docs.infrawatch.com/external-surface/ai-surface.md): Find the MCP servers, LLM gateways, model runtimes, and agent endpoints your organisation exposes
- [Fingerprinting](https://docs.infrawatch.com/platform/fingerprints.md): Cluster related services using JA4, certificate structure, and content hashes
- [Intelligence taxonomy](https://docs.infrawatch.com/platform/taxonomy.md): Canonical categories, classifications, and tags used across Infrawatch
- [Writing rules](https://docs.infrawatch.com/scanning/rules/writing-rules.md): Turn scan observations into repeatable detections
- [Example rules](https://docs.infrawatch.com/scanning/rules/examples.md): Copyable detections for common internet-exposure patterns
- [Rule protocol fields](https://docs.infrawatch.com/scanning/rules/protocols.md): Reference protocol fields in rule conditions using the Data Dictionary
- [Projects](https://docs.infrawatch.com/platform/projects.md): Keep investigations, indicators, notes, and saved queries together
- [Data Dictionary](https://docs.infrawatch.com/data-dictionary.md): Searchable fields, types, operators, and result grain
- [Host fields](https://docs.infrawatch.com/data-dictionary/hosts.md): Search fields for host context and summarized exposure
- [Service fields](https://docs.infrawatch.com/data-dictionary/services.md): Search fields for observed network services
- [Common service fields](https://docs.infrawatch.com/data-dictionary/services/common.md): Endpoint identity, attribution, observations, promoted evidence, fingerprints, HTTP, TLS, and tags
- [Protocols A–F](https://docs.infrawatch.com/data-dictionary/services/a-f.md): Protocol-specific service search fields in Protocols A–F
- [Protocols G–L](https://docs.infrawatch.com/data-dictionary/services/g-l.md): Protocol-specific service search fields in Protocols G–L
- [Protocols M–R](https://docs.infrawatch.com/data-dictionary/services/m-r.md): Protocol-specific service search fields in Protocols M–R
- [Protocols S–Z](https://docs.infrawatch.com/data-dictionary/services/s-z.md): Protocol-specific service search fields in Protocols S–Z
- [DNS fields](https://docs.infrawatch.com/data-dictionary/dns.md): Search fields for current open passive-DNS segments
- [OSINT fields](https://docs.infrawatch.com/data-dictionary/osint.md): Search fields for public intelligence reports
- [Scanning policy](https://docs.infrawatch.com/scanning/scope.md): How Infrawatch observes public-facing internet infrastructure
- [Opt out](https://docs.infrawatch.com/scanning/opt-out.md): How to request exclusion from Infrawatch scanning
- [InfraQL](https://docs.infrawatch.com/search.md): Search Infrawatch data with a typed, analyst-friendly query language
- [Operators and values](https://docs.infrawatch.com/infraql/operators.md): Combine typed comparisons, boolean logic, collections, and existence checks
- [Time and ranges](https://docs.infrawatch.com/infraql/time.md): Search relative windows, fixed dates, timestamps, and bounded ranges
- [Correlate services](https://docs.infrawatch.com/infraql/correlation.md): Require several conditions to match the same service on a host
- [Patterns and text](https://docs.infrawatch.com/infraql/patterns.md): Use contains, wildcards, regular expressions, phrases, and banner terms
- [Investigation workflows](https://docs.infrawatch.com/use-cases.md): Practical workflows for infrastructure and threat analysis
- [Investigate an IP](https://docs.infrawatch.com/use-cases/investigate-an-ip.md): Build host context, inspect services, trace DNS, and find related reporting
- [Pivot through passive DNS](https://docs.infrawatch.com/use-cases/pivot-through-passive-dns.md): Move between domains and IP addresses using observed DNS relationships
- [Hunt exposed services](https://docs.infrawatch.com/use-cases/hunt-exposed-services.md): Find internet-facing endpoints by protocol, network, technology, fingerprint, or tag
- [Enrich IP lists](https://docs.infrawatch.com/use-cases/enrich-ip-lists.md): Use bulk lookup to add bounded context to up to 100 IP addresses
- [Measure infrastructure](https://docs.infrawatch.com/use-cases/measure-infrastructure.md): Count a search and group matching infrastructure by public fields
- [API overview](https://docs.infrawatch.com/api-reference/introduction.md): Build investigations and security workflows with the Infrawatch public API
- [Authentication](https://docs.infrawatch.com/api-reference/authentication.md): Create an API key and authenticate requests to the Infrawatch API
- [Schema](https://docs.infrawatch.com/api-reference/endpoints/search/schema.md): Returns the hosts, services, DNS, and certificates v1 dataset schemas in deterministic order. Clients should select entries by dataset rather than rely on array position. Existing per-dataset schema endpoints remain available.
- [Search hosts](https://docs.infrawatch.com/api-reference/endpoints/search/search-hosts.md): Host-only queries are ordered by the overall host last-seen timestamp descending. Queries that match service content are ordered by the latest matching observation scan timestamp descending. Host.last_seen_at is the overall host rollup and is not necessarily the service-query sort key.
- [Count matching hosts](https://docs.infrawatch.com/api-reference/endpoints/search/count-matching-hosts.md): Returns an exact count where one can be computed. Queries that filter on service content and match a very large number of hosts return a distinct-host estimate instead; check `total_relation` before presenting the number as exact.
- [Aggregate matching hosts](https://docs.infrawatch.com/api-reference/endpoints/search/aggregate-matching-hosts.md)
- [Bulk lookup hosts](https://docs.infrawatch.com/api-reference/endpoints/search/bulk-lookup-hosts.md): Accepts between 1 and 100 IP addresses, canonicalizes them, deduplicates Query work, and returns one bounded item for every input position in the original order, including duplicates.
- [Get public host search fields](https://docs.infrawatch.com/api-reference/endpoints/search/get-public-host-search-fields.md)
- [Validate a host InfraQL query](https://docs.infrawatch.com/api-reference/endpoints/search/validate-a-host-infraql-query.md): Validates the query with the same public field, operator, and cost rules used by host search, without executing it.
- [Search services](https://docs.infrawatch.com/api-reference/endpoints/search/search-services.md)
- [Count matching services exactly](https://docs.infrawatch.com/api-reference/endpoints/search/count-matching-services-exactly.md)
- [Aggregate matching services](https://docs.infrawatch.com/api-reference/endpoints/search/aggregate-matching-services.md)
- [Bulk lookup services](https://docs.infrawatch.com/api-reference/endpoints/search/bulk-lookup-services.md): Accepts between 1 and 100 IP addresses, canonicalizes them, deduplicates Query work, and returns one bounded item for every input position in the original order, including duplicates.
- [Get public service search fields](https://docs.infrawatch.com/api-reference/endpoints/search/get-public-service-search-fields.md)
- [Validate a service InfraQL query](https://docs.infrawatch.com/api-reference/endpoints/search/validate-a-service-infraql-query.md): Validates the query with the same public field, operator, and cost rules used by service search, without executing it.
- [Search DNS records](https://docs.infrawatch.com/api-reference/endpoints/search/search-dns-records.md)
- [List observed subdomains](https://docs.infrawatch.com/api-reference/endpoints/search/list-observed-subdomains.md): Returns distinct current DNS owner names strictly below the supplied domain. Results are ordered lexicographically. Pagination uses a domain-bound opaque cursor; totals are an honest lower bound until the final page.
- [Count matching DNS records exactly](https://docs.infrawatch.com/api-reference/endpoints/search/count-matching-dns-records-exactly.md)
- [Aggregate matching DNS records](https://docs.infrawatch.com/api-reference/endpoints/search/aggregate-matching-dns-records.md)
- [Bulk lookup DNS records](https://docs.infrawatch.com/api-reference/endpoints/search/bulk-lookup-dns-records.md): Accepts between 1 and 100 IP addresses, canonicalizes them, deduplicates Query work, and returns one bounded item for every input position in the original order, including duplicates.
- [Summarize DNS records and distinct names](https://docs.infrawatch.com/api-reference/endpoints/search/summarize-dns-records-and-distinct-names.md): Returns the exact matching DNS-record total and a labelled distinct-name cardinality. An optional aggregation returns bounded buckets counted by distinct DNS name.
- [Get public DNS search fields](https://docs.infrawatch.com/api-reference/endpoints/search/get-public-dns-search-fields.md)
- [Validate a DNS InfraQL query](https://docs.infrawatch.com/api-reference/endpoints/search/validate-a-dns-infraql-query.md): Validates the query with the same public field, operator, and cost rules used by DNS search, without executing it.
- [Search WHOIS domain records](https://docs.infrawatch.com/api-reference/endpoints/search/search-whois-domain-records.md)
- [Count matching WHOIS domain records exactly](https://docs.infrawatch.com/api-reference/endpoints/search/count-matching-whois-domain-records-exactly.md)
- [Aggregate matching WHOIS domain records](https://docs.infrawatch.com/api-reference/endpoints/search/aggregate-matching-whois-domain-records.md)
- [Get public WHOIS search fields](https://docs.infrawatch.com/api-reference/endpoints/search/get-public-whois-search-fields.md)
- [Validate a WHOIS InfraQL query](https://docs.infrawatch.com/api-reference/endpoints/search/validate-a-whois-infraql-query.md): Validates the query with the same public field, operator, and cost rules used by WHOIS search, without executing it.
- [Search certificates](https://docs.infrawatch.com/api-reference/endpoints/search/search-certificates.md): Search immutable X.509 certificate records. Every query must contain a selective equality, name, text, or bounded range clause. Results use immutable cursor pagination and default to the recent certificate index.
- [Count matching certificates exactly](https://docs.infrawatch.com/api-reference/endpoints/search/count-matching-certificates-exactly.md)
- [Aggregate matching certificates](https://docs.infrawatch.com/api-reference/endpoints/search/aggregate-matching-certificates.md): Runs one bounded aggregation-only certificate query. Domain buckets count distinct certificate documents, not nested names.
- [Get public certificate search fields](https://docs.infrawatch.com/api-reference/endpoints/search/get-public-certificate-search-fields.md)
- [Validate a certificate InfraQL query](https://docs.infrawatch.com/api-reference/endpoints/search/validate-a-certificate-infraql-query.md): Validates the query with the same public field, operator, and cost rules used by certificate search, without executing it.
- [Get effective ESI capabilities for the project.](https://docs.infrawatch.com/api-reference/endpoints/access/get-effective-esi-capabilities-for-the-project.md): Returns the product capabilities granted by the authenticated actor's effective organisation, group, entitlement, credential, and project authorization. Project access is resolved before this projection; individual ESI endpoints remain independently enforced by the API.
- [Get ESI dashboard stats.](https://docs.infrawatch.com/api-reference/endpoints/dashboard/get-esi-dashboard-stats.md): Returns schema-backed inventory, service, generic finding, secret finding, and recent inventory rollup data for the authenticated project. Secret findings share the `esi.findings.view` scope.
- [List inventory assets.](https://docs.infrawatch.com/api-reference/endpoints/inventory/list-inventory-assets.md): Lists current inventory assets visible through the authenticated project.
- [Create an inventory asset.](https://docs.infrawatch.com/api-reference/endpoints/inventory/create-an-inventory-asset.md): Requires esi.inventory.manage or project manager access. Panel-created assets are manual and default to approved; discovered candidate assets are created by backend ingestion.
- [Bulk create inventory assets.](https://docs.infrawatch.com/api-reference/endpoints/inventory/bulk-create-inventory-assets.md): Requires esi.inventory.manage or project manager access. Bulk creates are intended for backend imports and discovery loaders; each asset records source_kind plus source/provider attribution. `on_conflict=fail` is atomic: a conflict or invalid row leaves every row in the request uncommitted.
- [Get an inventory asset.](https://docs.infrawatch.com/api-reference/endpoints/inventory/get-an-inventory-asset.md)
- [Update an inventory asset.](https://docs.infrawatch.com/api-reference/endpoints/inventory/update-an-inventory-asset.md): Requires esi.inventory.manage or project manager access. Use status=approved or status=monitored to accept discovered assets.
- [Ignore an inventory asset.](https://docs.infrawatch.com/api-reference/endpoints/inventory/ignore-an-inventory-asset.md): Ignores a candidate discovered asset. Requires esi.inventory.manage or project manager access.
- [Approve an inventory asset.](https://docs.infrawatch.com/api-reference/endpoints/inventory/approve-an-inventory-asset.md): Accepts a candidate discovered asset by setting status to approved. Requires esi.inventory.manage or project manager access.
- [Monitor an inventory asset.](https://docs.infrawatch.com/api-reference/endpoints/inventory/monitor-an-inventory-asset.md): Accepts a candidate discovered asset and marks it monitored. Requires esi.inventory.manage or project manager access.
- [List brand favicons.](https://docs.infrawatch.com/api-reference/endpoints/inventory/list-brand-favicons.md): Lists active favicon observations attached to a brand_name inventory asset.
- [Create a brand favicon.](https://docs.infrawatch.com/api-reference/endpoints/inventory/create-a-brand-favicon.md): Creates a favicon observation for a brand_name inventory asset. Requires esi.inventory.manage or project manager access.
- [Delete a brand favicon.](https://docs.infrawatch.com/api-reference/endpoints/inventory/delete-a-brand-favicon.md): Soft-deletes a favicon observation. Requires esi.inventory.manage or project manager access.
- [List brand asset links.](https://docs.infrawatch.com/api-reference/endpoints/inventory/list-brand-asset-links.md): Lists active associated_with links from a brand_name asset to other current inventory assets.
- [Create or update a brand asset link.](https://docs.infrawatch.com/api-reference/endpoints/inventory/create-or-update-a-brand-asset-link.md): Creates or refreshes an associated_with link from a brand_name asset to another current inventory asset. Requires esi.inventory.manage or project manager access.
- [Delete a brand asset link.](https://docs.infrawatch.com/api-reference/endpoints/inventory/delete-a-brand-asset-link.md): Deletes an associated_with link from a brand_name asset. Requires esi.inventory.manage or project manager access.
- [List brand terms.](https://docs.infrawatch.com/api-reference/endpoints/inventory/list-brand-terms.md): Lists string terms, aliases, subsidiaries, or brand markers attached to a brand_name inventory asset.
- [Create or update a brand term.](https://docs.infrawatch.com/api-reference/endpoints/inventory/create-or-update-a-brand-term.md): Requires esi.inventory.manage or project manager access. Terms are deduped per brand by normalized string.
- [Delete a brand term.](https://docs.infrawatch.com/api-reference/endpoints/inventory/delete-a-brand-term.md): Soft-deletes the term from the brand asset. Requires esi.inventory.manage or project manager access.
- [Search for a brand to add to inventory.](https://docs.infrawatch.com/api-reference/endpoints/inventory/search-for-a-brand-to-add-to-inventory.md): Searches the configured brand provider through the platform API. Results are curated and icons are exposed only through the authenticated platform image proxy. Requires esi.inventory.manage or project manager access.
- [List inventory filter options.](https://docs.infrawatch.com/api-reference/endpoints/inventory/list-inventory-filter-options.md): Returns project-scoped inventory asset group counts, review-state counts, and hostname facet options derived from current `esi.inventory_assets` rows. This is inventory metadata, not a detector finding source.
- [Import inventory assets from a file.](https://docs.infrawatch.com/api-reference/endpoints/inventory/import-inventory-assets-from-a-file.md): Requires esi.inventory.manage or project manager access. Accepts a bounded file upload, durably queues it in PostgreSQL before returning, rejects files with no supported assets, extracts hostnames, single IPv4/IPv6 addresses, and IPv4/IPv6 CIDRs in the API, then processes the import asynchronously a…
- [Get inventory import status.](https://docs.infrawatch.com/api-reference/endpoints/inventory/get-inventory-import-status.md)
- [List asset services.](https://docs.infrawatch.com/api-reference/endpoints/services/list-asset-services.md): Lists curated exposed services for the authenticated project.
- [Create an asset service.](https://docs.infrawatch.com/api-reference/endpoints/services/create-an-asset-service.md): Requires esi.services.manage or project manager access.
- [Get an asset service.](https://docs.infrawatch.com/api-reference/endpoints/services/get-an-asset-service.md)
- [Update an asset service.](https://docs.infrawatch.com/api-reference/endpoints/services/update-an-asset-service.md): Sparse update. Requires esi.services.manage or project manager access.
- [Delete an asset service.](https://docs.infrawatch.com/api-reference/endpoints/services/delete-an-asset-service.md): Soft-deletes the service. Requires esi.services.manage or project manager access.
- [List services for a host.](https://docs.infrawatch.com/api-reference/endpoints/services/list-services-for-a-host.md): Lists curated exposed services where hostname matches the path host.
- [List successful Open Services schedule counts.](https://docs.infrawatch.com/api-reference/endpoints/services/list-successful-open-services-schedule-counts.md)
- [List retained Open Services schedule runs.](https://docs.infrawatch.com/api-reference/endpoints/services/list-retained-open-services-schedule-runs.md)
- [Get the Open Services recurring schedule.](https://docs.infrawatch.com/api-reference/endpoints/services/get-the-open-services-recurring-schedule.md)
- [Create or replace the Open Services recurring schedule.](https://docs.infrawatch.com/api-reference/endpoints/services/create-or-replace-the-open-services-recurring-schedule.md)
- [Delete the Open Services recurring schedule.](https://docs.infrawatch.com/api-reference/endpoints/services/delete-the-open-services-recurring-schedule.md)
- [Search ESI findings.](https://docs.infrawatch.com/api-reference/endpoints/search/search-esi-findings.md): Searches project-scoped findings from `esi.findings`. Inventory, services, host, DNS, and raw query-engine search are out of this surface and will be integrated through the query API later.
- [Count ESI finding search results.](https://docs.infrawatch.com/api-reference/endpoints/search/count-esi-finding-search-results.md)
- [Facet ESI finding search results.](https://docs.infrawatch.com/api-reference/endpoints/search/facet-esi-finding-search-results.md)
- [Get ESI finding search schema.](https://docs.infrawatch.com/api-reference/endpoints/search/get-esi-finding-search-schema.md): Returns the backend-owned fields and operators supported by project-scoped ESI finding search.
- [Get an ESI finding.](https://docs.infrawatch.com/api-reference/endpoints/findings/get-an-esi-finding.md): Returns the normalized project-scoped finding row used for shared lifecycle actions.
- [Delete an ESI finding.](https://docs.infrawatch.com/api-reference/endpoints/findings/delete-an-esi-finding.md): Soft-deletes the normalized finding. Prefer accept, resolve, or ignore for user-facing lifecycle state. Requires esi.findings.manage or project manager access.
- [Update selected ESI findings.](https://docs.infrawatch.com/api-reference/endpoints/findings/update-selected-esi-findings.md): Atomically applies one lifecycle status to up to 500 selected project-scoped findings. The entire request fails if any UUID is outside the active project. Requires esi.findings.manage or project manager access.
- [Accept an ESI finding.](https://docs.infrawatch.com/api-reference/endpoints/findings/accept-an-esi-finding.md): Shared lifecycle action for any finding type. Requires esi.findings.manage or project manager access.
- [Mark an ESI finding as a false positive.](https://docs.infrawatch.com/api-reference/endpoints/findings/mark-an-esi-finding-as-a-false-positive.md): Shared lifecycle action for any finding type. Requires esi.findings.manage or project manager access.
- [Ignore an ESI finding.](https://docs.infrawatch.com/api-reference/endpoints/findings/ignore-an-esi-finding.md): Shared lifecycle action for any finding type. Requires esi.findings.manage or project manager access.
- [Reopen an ESI finding.](https://docs.infrawatch.com/api-reference/endpoints/findings/reopen-an-esi-finding.md): Shared lifecycle action for any finding type. Sets status back to open and clears resolved metadata. Requires esi.findings.manage or project manager access.
- [Resolve an ESI finding.](https://docs.infrawatch.com/api-reference/endpoints/findings/resolve-an-esi-finding.md): Shared lifecycle action for any finding type. Requires esi.findings.manage or project manager access.
- [List dangling DNS findings.](https://docs.infrawatch.com/api-reference/endpoints/dangling-dns/list-dangling-dns-findings.md): Lists dangling DNS findings visible through the authenticated project.
- [List dangling DNS filter options.](https://docs.infrawatch.com/api-reference/endpoints/dangling-dns/list-dangling-dns-filter-options.md): Returns backend-owned filter metadata and tenant-scoped option counts for building dangling DNS filter widgets.
- [List typosquatting domain findings.](https://docs.infrawatch.com/api-reference/endpoints/typosquatting/list-typosquatting-domain-findings.md): Lists detector-owned domain typosquatting findings for the authenticated project. Users cannot create these findings; lifecycle actions use the generic finding UUID endpoints.
- [List typosquatting filter options.](https://docs.infrawatch.com/api-reference/endpoints/typosquatting/list-typosquatting-filter-options.md): Returns backend-owned filter metadata and tenant-scoped option counts. The `source` facet covers every protected project inventory domain attached to a candidate, while counts remain distinct candidate findings. Pass `facet` and `q` to search a high-cardinality facet without relying on the initial p…
- [List secret findings.](https://docs.infrawatch.com/api-reference/endpoints/secrets/list-secret-findings.md): Lists project-scoped secret exposure findings. The API returns SHA-256 fingerprints and lifecycle metadata only.
- [Get a secret finding.](https://docs.infrawatch.com/api-reference/endpoints/secrets/get-a-secret-finding.md)
- [List successful Secret Exposure schedule counts.](https://docs.infrawatch.com/api-reference/endpoints/secrets/list-successful-secret-exposure-schedule-counts.md)
- [List retained Secret Exposure schedule runs.](https://docs.infrawatch.com/api-reference/endpoints/secrets/list-retained-secret-exposure-schedule-runs.md)
- [Get the Secret Exposure recurring schedule.](https://docs.infrawatch.com/api-reference/endpoints/secrets/get-the-secret-exposure-recurring-schedule.md)
- [Create or replace the Secret Exposure recurring schedule.](https://docs.infrawatch.com/api-reference/endpoints/secrets/create-or-replace-the-secret-exposure-recurring-schedule.md)
- [Delete the Secret Exposure recurring schedule.](https://docs.infrawatch.com/api-reference/endpoints/secrets/delete-the-secret-exposure-recurring-schedule.md)
- [List AI surface assets.](https://docs.infrawatch.com/api-reference/endpoints/ai-surface/list-ai-surface-assets.md): Lists backend-owned AI surface rows for the authenticated ESI project.
- [List AI surface filter options.](https://docs.infrawatch.com/api-reference/endpoints/ai-surface/list-ai-surface-filter-options.md)
- [List alert rules in a project.](https://docs.infrawatch.com/api-reference/endpoints/alert-rules/list-alert-rules-in-a-project.md)
- [Create a saved-query, finding, or certificate alert rule.](https://docs.infrawatch.com/api-reference/endpoints/alert-rules/create-a-saved-query-finding-or-certificate-alert-rule.md): Saved-query rules bind one active schedule and support result-change or run-count triggers. Finding rules use the same filters as project search. Certificate rules bind one enabled, approved certificate rule. ADDED opens or refreshes an alert, REMOVED resolves it, and CHANGED opens or refreshes it w…
- [Get an alert rule.](https://docs.infrawatch.com/api-reference/endpoints/alert-rules/get-an-alert-rule.md)
- [Replace an alert rule.](https://docs.infrawatch.com/api-reference/endpoints/alert-rules/replace-an-alert-rule.md): The source kind and its saved-query, finding-filter, or certificate-rule binding are immutable. Replacing a rule advances its revision so replayed source events do not become new events.
- [Delete an alert rule.](https://docs.infrawatch.com/api-reference/endpoints/alert-rules/delete-an-alert-rule.md)
- [List organisation-owned alert destinations.](https://docs.infrawatch.com/api-reference/endpoints/alert-destinations/list-organisation-owned-alert-destinations.md)
- [Create an alert delivery destination.](https://docs.infrawatch.com/api-reference/endpoints/alert-destinations/create-an-alert-delivery-destination.md): Supports email, signed HTTPS webhook, Slack, Teams, PagerDuty, ThreatConnect, Linear, and Jira. Provider credentials are write-only. A generic webhook signing_secret is returned only in this response. Destinations are organisation-owned and cannot be deleted while an enabled rule uses them.
- [Get an alert destination without secret material.](https://docs.infrawatch.com/api-reference/endpoints/alert-destinations/get-an-alert-destination-without-secret-material.md)
- [Replace an alert destination.](https://docs.infrawatch.com/api-reference/endpoints/alert-destinations/replace-an-alert-destination.md): Destination kind is immutable. Omit credential to preserve the stored provider credential. Replacing a generic webhook target does not rotate its signing secret.
- [Delete an unused alert destination.](https://docs.infrawatch.com/api-reference/endpoints/alert-destinations/delete-an-unused-alert-destination.md)
- [List alert-rule silences.](https://docs.infrawatch.com/api-reference/endpoints/alert-silences/list-alert-rule-silences.md)
- [Silence firing notifications for one alert rule.](https://docs.infrawatch.com/api-reference/endpoints/alert-silences/silence-firing-notifications-for-one-alert-rule.md)
- [Cancel an alert-rule silence.](https://docs.infrawatch.com/api-reference/endpoints/alert-silences/cancel-an-alert-rule-silence.md)
- [List the project alert inbox.](https://docs.infrawatch.com/api-reference/endpoints/alerts/list-the-project-alert-inbox.md)
- [Get an alert with bounded event and delivery history.](https://docs.infrawatch.com/api-reference/endpoints/alerts/get-an-alert-with-bounded-event-and-delivery-history.md)
- [Acknowledge an active alert.](https://docs.infrawatch.com/api-reference/endpoints/alerts/acknowledge-an-active-alert.md)
- [Resolve an active alert.](https://docs.infrawatch.com/api-reference/endpoints/alerts/resolve-an-active-alert.md)
- [Get effective browser capabilities and limits.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/get-effective-browser-capabilities-and-limits.md): Returns the profiles supported by the Platform Core adapter, currently available egress countries, feature availability, and effective default limits. Windows, macOS, and Linux are browser identity profiles; they do not describe the operating system running the private worker.
- [Get immutable completed-session usage.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/get-immutable-completed-session-usage.md): Defaults to the calling credential. `scope=project` requires management permission. Duration is measured exactly once from ready to terminal; the API does not assign pricing.
- [List browser sessions.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/list-browser-sessions.md): Defaults to sessions created by the calling credential. Use `scope=project` to list project session metadata; that scope requires browser session management or project management permission.
- [Queue a browser session.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/queue-a-browser-session.md): Validates the request and atomically admits it against caller and organisation concurrency limits before returning. Platform Core does not contact browser infrastructure in this request; a durable dispatcher provisions valid queued sessions asynchronously.
- [Get browser session metadata.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/get-browser-session-metadata.md)
- [Close a browser session.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/close-a-browser-session.md): Idempotently requests shutdown. Creators may close their own sessions; project managers may terminate any project session. A successful request returns the durable closing or terminal resource while shutdown proceeds.
- [Programmatically navigate a browser session.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/programmatically-navigate-a-browser-session.md): Reserved stable route. The current private browser master does not expose programmatic navigation, so Platform Core returns 501 locally without contacting browser infrastructure. Check `capabilities.features` before presenting this action.
- [Push a live session's idle expiry out from now.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/push-a-live-sessions-idle-expiry-out-from-now.md): Creator-only. Buys the session another full idle window, for when you are reading the page rather than driving it. Captures and stream frames already do this implicitly. It does not raise the hard lifetime, so the session still ends at the expires_at it was given when it started. The session must be…
- [Replay a completed browser session.](https://docs.infrawatch.com/api-reference/endpoints/browser-sessions/replay-a-completed-browser-session.md): Creator-only. Copies the source session's public start URL, browser profile, egress country, and viewport into a new queued session. The source must be closed, failed, or expired. Replay uses the normal authorization, entitlement, idempotency, and active-session limits and does not contact browser i…
- [Issue a one-use live-stream ticket.](https://docs.infrawatch.com/api-reference/endpoints/browser-streaming/issue-a-one-use-live-stream-ticket.md): Creator-only. The random ticket expires after 60 seconds and is consumed atomically by the WebSocket upgrade. Reconnects require a fresh ticket.
- [List transient browser network events.](https://docs.infrawatch.com/api-reference/endpoints/browser-evidence/list-transient-browser-network-events.md): Creator-only cursor view over the browser master's bounded transient ring. URLs exclude credentials, query strings, and fragments. Private targets and addresses are omitted. Headers, request and response bodies, cookies, and credentials are never returned or persisted by Platform Core.
- [List durable screenshots for a session.](https://docs.infrawatch.com/api-reference/endpoints/browser-evidence/list-durable-screenshots-for-a-session.md): Creator-only. Screenshot metadata and objects are retained indefinitely.
- [Capture a PNG screenshot.](https://docs.infrawatch.com/api-reference/endpoints/browser-evidence/capture-a-png-screenshot.md): Creator-only viewport or bounded full-page capture.
- [Read authorized screenshot content.](https://docs.infrawatch.com/api-reference/endpoints/browser-evidence/read-authorized-screenshot-content.md): Creator-only. The object is authorized through the project, session, creator, and screenshot records before Platform Core reads the private SHA-256 object. The global ESI evidence-image route is not used.
- [Upgrade to the controlling browser WebSocket.](https://docs.infrawatch.com/api-reference/endpoints/browser-streaming/upgrade-to-the-controlling-browser-websocket.md): Supply the exact `subprotocol` returned by the stream-ticket endpoint in `Sec-WebSocket-Protocol`. Tickets are one-use, one controlling stream is allowed per session, origins are validated, frames are bounded to 8 MiB, and ownership, permission, entitlement, and session state are rechecked every 30…
- [List rules visible to the caller.](https://docs.infrawatch.com/api-reference/endpoints/rules/list-rules-visible-to-the-caller.md): Human callers receive their personal rules, rules from the selected organisation (or each permitted organisation in personal context), and canonical platform-global rules. API keys receive rules owned by their immutable account plus canonical platform-global rules.
- [Create a rule for the active account.](https://docs.infrawatch.com/api-reference/endpoints/rules/create-a-rule-for-the-active-account.md)
- [Get a rule owned by the active account.](https://docs.infrawatch.com/api-reference/endpoints/rules/get-a-rule-owned-by-the-active-account.md)
- [Update a rule owned by the active account.](https://docs.infrawatch.com/api-reference/endpoints/rules/update-a-rule-owned-by-the-active-account.md)
- [Delete a rule owned by the active account.](https://docs.infrawatch.com/api-reference/endpoints/rules/delete-a-rule-owned-by-the-active-account.md)
- [Get the closed set of fields authorable for a rule input kind.](https://docs.infrawatch.com/api-reference/endpoints/rules/get-the-closed-set-of-fields-authorable-for-a-rule-input-kind.md): The immutable schema is derived from the protobuf descriptors linked into the same binary as the YARA-X runtime. The response is cacheable privately for five minutes and supports If-None-Match.
- [Get counts for the active rule filters.](https://docs.infrawatch.com/api-reference/endpoints/rules/get-counts-for-the-active-rule-filters.md)
- [Canonicalise and format authored rule source without saving it.](https://docs.infrawatch.com/api-reference/endpoints/rules/canonicalise-and-format-authored-rule-source-without-saving-it.md)
- [Validate authored rule source without saving it.](https://docs.infrawatch.com/api-reference/endpoints/rules/validate-authored-rule-source-without-saving-it.md): Canonicalises the public source and compiles the exact worker source in-process against the production YARA-X modules. Compiler diagnostics never expose the private worker rule identifier.
- [List tags visible to the active account.](https://docs.infrawatch.com/api-reference/endpoints/rule-tags/list-tags-visible-to-the-active-account.md)
- [Create a rule tag for the active account.](https://docs.infrawatch.com/api-reference/endpoints/rule-tags/create-a-rule-tag-for-the-active-account.md)
- [Get a visible rule tag.](https://docs.infrawatch.com/api-reference/endpoints/rule-tags/get-a-visible-rule-tag.md)
- [Update a rule tag owned by the active account.](https://docs.infrawatch.com/api-reference/endpoints/rule-tags/update-a-rule-tag-owned-by-the-active-account.md)
- [Delete a rule tag owned by the active account.](https://docs.infrawatch.com/api-reference/endpoints/rule-tags/delete-a-rule-tag-owned-by-the-active-account.md)
- [Browse the live signal catalogue.](https://docs.infrawatch.com/api-reference/endpoints/rule-observations/browse-the-live-signal-catalogue.md)
- [Get the tag and rule observation history for a host.](https://docs.infrawatch.com/api-reference/endpoints/rule-observations/get-the-tag-and-rule-observation-history-for-a-host.md)
- [Get hosts previously matched by a rule.](https://docs.infrawatch.com/api-reference/endpoints/rule-observations/get-hosts-previously-matched-by-a-rule.md)
- [Get filtered match activity for a rule.](https://docs.infrawatch.com/api-reference/endpoints/rule-observations/get-filtered-match-activity-for-a-rule.md)
- [Get a compact hit-count series for several rules at once.](https://docs.infrawatch.com/api-reference/endpoints/rule-observations/get-a-compact-hit-count-series-for-several-rules-at-once.md): Sized for a sparkline per rule in a listing, not the full detail view getRuleStats renders. Rules the caller cannot view, or whose upstream stats could not be fetched, are silently omitted rather than failing the whole request.
- [Search reports.](https://docs.infrawatch.com/api-reference/endpoints/reports/search-reports.md): Results default to publication date, newest first. Reports without a publication date use the UTC date on which they were stored. Human requests require active platform access. Organisation, group, and user API keys require reports.view; individual root keys are allowed. API-key requests consume the…
- [List report filter definitions and option counts.](https://docs.infrawatch.com/api-reference/endpoints/reports/list-report-filter-definitions-and-option-counts.md): Returns backend-owned report filters for publishers, IP-indicator presence, and publication date. Human requests require active platform access. Organisation, group, and user API keys require reports.view; individual root keys are allowed. API-key requests consume their owner's monthly request quota…
- [List infrastructure indicators attached to a report.](https://docs.infrawatch.com/api-reference/endpoints/reports/list-infrastructure-indicators-attached-to-a-report.md): Returns IP and domain indicators in deterministic IP-first order. Human requests require active platform access. Organisation, group, and user API keys require reports.view; individual root keys are allowed. API-key requests consume their owner's monthly request quota.
- [List projects.](https://docs.infrawatch.com/api-reference/endpoints/projects/list-projects.md): Lists the active projects belonging to the authenticated API key's organisation. Use the returned uuid as the project_uuid path parameter on project-scoped endpoints. Archived projects are omitted because they cannot be queried.
- [Get usage for the authenticated API key.](https://docs.infrawatch.com/api-reference/endpoints/api-usage/get-usage-for-the-authenticated-api-key.md): Returns daily request counts for the authenticated API key and the shared quotas that can limit it. This visibility request is operationally rate-limited but does not consume monthly API quota.
- [Changelog](https://docs.infrawatch.com/changelog.md): New features, improvements, and changes to Infrawatch

## OpenAPI Specs

- [openapi](https://api.infrawatch.com/openapi.json?contract=d15375c)