Censys Platform Q&A

Hi all,While working with Censys for some light tracking (exposed services + state changes over time), I started running into a recurring issue: it’s easy to detect changes, but harder to clearly show how they evolved. Instead of static snapshots or side-by-side comparisons, I’ve been experimenting with building a kind of timeline reconstruction of findings:capturing query results at different intervals sequencing them in chronological order highlighting when a service appears/disappears or changes stateI’ve been stitching these snapshots into short timeline-style clips using capcut. Not for presentation, but more as a way to visually scrub through changes over time, almost like replaying the exposure history. It actually made a few patterns easier to notice (especially short-lived exposures that are easy to miss in static data).Now I’m wondering:Is there a more “native”

Hello,I am currently working with the get-files endpoint to fetch the list of files for a snapshot from the universal-internet-dataset-v2-ipv4 dataset, and I would like to clarify how to verify dataset completeness.For context, although I’m posting this from a personal account, I’m using API credentials associated with an organization headed by my research group supervisor, who has research access to data granted to his account.While retrieving the files for the snapshot universal-internet-dataset-v2-ipv4_20260317, I observed the following: Pagination proceeded normally up to page 100 Each page returned exactly 100 file entries In total, I obtained 10,000 files (indexed 0–9999) with no gaps On page 100, the response did not include a nextPage token Repeating the requests yields consi

I recently got research access for the censys platform. I was wondering if that included BigQuery for the universal ipv4 dataset. If not, how would I go about getting it?

Hello,I have a few questions about the behavior of the certificate Timeline view. I would appreciate your clarification on the following points.As an example, while reviewing the Timeline for a particular certificate, I noticed some behaviors that I would like to confirm.Meaning of the "Results" count in the Timeline When checking the Timeline for the certificate, the UI shows Results: 178 (see attached screenshot). I would like to confirm what this number represents. Does this number indicate the total number of host observations (each timeline bar/event) rather than the number of unique hosts that used the certificate?   Timeline filters do not seem to be applied correctly When applying Port and Protocol filters in the Timeline, the results appear to include entries that do not mat

I tried to pay to activate my account on your platform, but my purchase card was not accepted.

I’m trying to leverage the API to fetch all matches without duplicates but I can't seem to identify which documentation covers the pagination. I know responses include next_page_token and previous_page_token but is there any official documentation on how these work?Does the last page have a next_page_token looping to the first page, requiring us to perform loop detection? Are these tokens/pages to be consumed immediately or can we consume these several minutes/hours apart? For example, if Censys gets new hits while we are processing the pages, are new results appended, ignored, or do they get inserted and potentially cause duplicates by shifting the pagination?I was unable to find pagination examples in the Go SDK which would have implied the correct usage, nor could I find other community topics explaining next_page_token beyond mentioning their existence.I would appreciate any insights or

Hello Support Team,I would like to confirm that if Censys Platform API has any rate limits, like 200 requests per minute, because I have got 429 errors when I tried to get hundreds of host information on my scripts.I know there is the Rate Limits about concurrent actions, but how about the number of requests in a minute?Thanks,

I have authority to pay for censys as long as it accommodates our needs. This is _exceptionally_ difficult due to the credit consumption. Get a query wrong or slightly incorrect, more credits. I don’t know about y’all but iterating when developing is EXECEPTIONALLY COMMON. This causes me to blast through all the credits (and budget) I have before I’m able to actually figure out if this is going to work.How can censys accommodate me and my goals??? Will it? Like, I’d be happy to use a “one year old” database (ie: not representative of live data) or be limited to “only” 10 results per request or literally anything along these lines.Can you, will you help me pay for censys? I just need to figure out how much it’ll end up costing me to figure out if I can even afford it.

Hello community,When you search for a host in the Censys WEB UI and open its details page, there is a RAW DATA tab that shows the host's data in JSON format, like this image:I would like to retrieve that exact JSON data via the Censys Platform API.I tried using the search query endpoint(https://docs.censys.com/reference/v3-globaldata-search-query) with the following query:host.ip="<IP Address>" OR web.hostname="<IP Address>"However the API response was different from what appears in the RAW DATA in the WEB UI.Should I use a different endpoint? Or is my query incorrect?Could someone advise on

Hello,While analyzing some hosts in the Censys Platform (Web GUI), we found that the Services section sometimes shows “HTTP [many] / TCP” instead of a specific port number.The detailed view mentions that:“This host has multiple services detected on various TCP ports. Displayed as ‘HTTP [many] / TCP’ to indicate a combination of identified and sampled services.”We can identify the representative port using:"host.services.representative_info.sampled_port"Is there a way to retrieve a list of all TCP ports on which HTTP services were detected, other than the representative sampled port?Thanks in advance!

Hello, This is Takeshi.Does the Censys Platform API provide a way to retrieve credit usage data? If so, which endpoint should be used?

Hello, I’m currently on a Censys Solo plan and use ~250 of my 500 allowed queries monthly. I’m trying to figure out how my current usage would translate to the new Credits system on the platform. My understanding is that with the Solo plan, the queries are deducted from the quota for the initial query and for each “pagination” if a query returns multiple pages. So I can assume that my monthly usage is equivalent to ~250 pages of results. With the new Credits system, it seems to be the same, except that the cost is 5 credits/query (or 5 credits / page). This means that 250 legacy queries == 1250 credits. I must be missing something here since the new credits system seems to be a lot more expensive. Could you please clarify what would be the equivalent of that 500 queries quota with the new credits system? Thank you

Hello,Just to be sure, was there any scheduled maintenance or temporary connectivity issue related to the Censys Search API between 15:00 and 16:00 UTC on November 1st?The reason I ask is that we encountered a “Connection aborted” error when attempting API requests during that time window.Thank you in advance for your support.

Hello,Since the transition to the Censys Platform, it appears that multiple HTTP URIs can now be returned for a single IP and port.However, the API response alone doesn’t seem to indicate which HTTP URI actually matched the query condition.Although the "matched_services" field includes the port number that matched the query, it’s unclear which specific URI within that port satisfied the query.Here’s an example for reference:I’m using the following API endpoint and query with the Censys Platform API: API endpoint: https://api.platform.censys.io/v3/global/search/query Query: host.services.endpoints.http.body:"xxx" (using a specific keyword in practice) In the API response, the "matched_services" field shows the port number that matched the query.However, within the port listed in "matched_service

Is there any way to include the API into subfinder ? i tried everything, but it seems you can no longer do it.I would appreciate any help, since i bought a subscription only to use the API keys with subfinder.Otherwise, i have absolutely no use now .

According to:https://docs.censys.com/docs/censys-credits#censys-credits-for-free-and-starter-users“Every Free and Starter user receives 100 credits per month for free. Unused credits expire at the end of each month. Free accounts provide access to basic protocols and services for search and exploration.” I’ve never received any credits, and have thusly been unable to evaluate the service, is there something wrong with my account or is the documentation incorrect?

Dear Users,I would like to use the free version of censys, but it seems that I have run out of credits.I just checked the last credits usage and it should be ok since I didn’t use censys for several months (I used censys only one time in May).Is there a way to continue to use censys in free mode?Thank you, 

Credit Management says that my credits have run out, but it says that I have only used 35 credits out of the 100 that are provided free of charge per month. It says 0/0 Available.

Hope all is well,Team Censys This is Reyben, thank you for granting the research access, big fan of Censys will be promoting your platform now that you guys have the map :). This will do wonders for CR-ISAC. I’m not sure if it was my personal email or the my SANS .edu email that was granted research access. Also not sure if my SANS .edu email is still active and if that was a factor to the issue. Does the research access take a few days to activate, my dashboard still indicate I have ran out of credits for both personal and .edu account.  Trying to dial down infected SLTT - State, Local, tribal entities infected with CVE-20205-53770/1 via Sharepoint implant  Thanks again!Reyben

So, with the old Censys API, I used the Python SDK search, with pagination.  With the new Censys Platform API Python SDK, I don’t see pagination with the search method. Would the new search method be able to handle very large rows of results, even though it doesn’t allow for pagination?  Do I need to use a different methodology (maybe even using the API without the SDK), to return large amounts of data?As such, what’s considered, “large”. As well, my user is in a Commercial Pro account. I used to be able to email support@censys.io , but now I get an autoresponse saying that I’m not eligable. Thanks!

Hi Censys Team,I'm trying to generate a report in the Report Builder using the host.whois.network.cidrs/whois.network.cidrs (in legacy censys) field to analyze CIDR blocks associated with WHOIS records, but it seems this field is not currently supported. When attempting to build the report, I get the following error in the legacy one:Error 422. Invalid field: Term aggregations are not supported. If you believe this is an error on our part, please contact us. and here's a screenshot for the same in new platform:It appears that term aggregations for host.whois.network.cidrs / whois.network.cidrs are either disabled or not yet implemented in the Report Builder. This field would be extremely useful for understanding IP space distribution across organizations or registrants at a CIDR lev

Hi, I could access research before, but after the platform upgrade, I lost access. How can I get it back?

Beginning May 1, 2025, the number of IPv6 records in Censys host datasets will drop by approximately 492 million. These 492 million records represent data that is identical to data on other records and of very low utility. The records will remain in Censys historical datasets.This drop in IPv6 data records is due to a change that Censys made to our scanning infrastructure in mid-April. The Censys team made this change to ensure that our data remains accurate, representative of the global public internet, and easy to search.Censys scanners continue to scan web properties that resolve to the IPs for which duplicate records are being dropped. IPv4 records are unaffected. This change will not affect domain-based scanning behavior.If you have any questions about this change, feel free to ask in the comments on this

I've requested research access for my account. And I have been set the right value for $CENSYS_API_ID and $CENSYS_API_SECRETHowever, the server sends me “error message” so I seek for help to download data with my api.curl -X "GET" "https://search.censys.io/api/v1/data/universal-internet-dataset-v2-ipv4" -H "Accept: application/json" --user "$CENSYS_API_ID:$CENSYS_API_SECRET"{"status": "error", "error": "This server could not verify that you are authorized to access the document you requested.  Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.", "error_type": "unknown"}

I recently upgraded my account to use the API after the recent platform update.I am using Windows CMD to run queries and successfully download the results as a JSON file.However I noticed that the JSON file only contains the first page of results, while the full query results are available when I run the same query on the website I would like to download the entire set of results as a JSON file. Could you please guide me on how to achieve this uising the API? curl -X "POST" "https://api.platform.censys.io/v3/global/search/query?organization_id=secret" --header "X-Organization-ID: secret" --header "Accept: application/json" --header "Authorization: secret" --header "Content-Type: application/json" -d "{\"query\":\"1.1.0.0\"}" > 1.1.json