Aggregate search
Action ID:tools.censys.aggregate_search
Aggregate search results. Calls POST /v3/global/search/aggregate directly.
Reference: https://docs.censys.com/reference/v3-globaldata-search-aggregate
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
string
required
Field to aggregate by.
integer
required
Number of buckets to split results into, from 1 to 2000.
string
required
CenQL query string to search upon.
string | null
Base URL of the Censys Platform API.Default:
null.string | null
Specifies which document level’s count is returned per term bucket, primarily for nested fields. This is the same functionality available in the Count By dropdown in the Report Builder UI.Default:
null.boolean | null
Controls whether aggregation results are limited to values that match the query. When true, only field values that satisfy the query constraints are included in aggregation counts.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get certificate
Action ID:tools.censys.get_certificate
Get a certificate. Calls GET /v3/global/asset/certificate/{certificate_id} directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-certificate
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
string
required
The SHA-256 certificate fingerprint.
string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get certificate raw
Action ID:tools.censys.get_certificate_raw
Get a raw certificate. Calls GET /v3/global/asset/certificate/{certificate_id}/raw directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-certificate-raw
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
string
required
The SHA-256 certificate fingerprint.
string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get certificates
Action ID:tools.censys.get_certificates
Get multiple certificates. Calls POST /v3/global/asset/certificate directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-certificate-list-post
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
array[string]
required
A list of SHA-256 certificate fingerprints. Up to 1,000 per call.
string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get host
Action ID:tools.censys.get_host
Get a host. Calls GET /v3/global/asset/host/{host_id} directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-host
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
string
required
The IP address of a host.
string | null
RFC3339 Timestamp to view a host at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.Default:
null.string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get host timeline
Action ID:tools.censys.get_host_timeline
Get a host timeline. Calls GET /v3/global/asset/host/{host_id}/timeline directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-host-timeline
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
string
required
End time of the host timeline. Equivalent to the From field in the event history UI. This must be the timestamp furthest from the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 1 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.
string
required
The IP address of a host.
string
required
Start time of the host timeline. Equivalent to the To field in the event history UI. This must be the timestamp closest to the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 2 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.
string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get hosts
Action ID:tools.censys.get_hosts
Get multiple hosts. Calls POST /v3/global/asset/host directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-host-list-post
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
array[string]
required
A list of host IP addresses. Up to 100 per call.
string | null
RFC3339 Timestamp to view all requested hosts at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.Default:
null.string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get web properties
Action ID:tools.censys.get_web_properties
Get multiple web properties. Calls POST /v3/global/asset/webproperty directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-webproperty-list-post
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
array[string]
required
A list of web property identifiers, such as platform.censys.io:80. Up to 100 per call.
string | null
RFC3339 Timestamp to view all requested webproperties at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.Default:
null.string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Get web property
Action ID:tools.censys.get_web_property
Get a web property. Calls GET /v3/global/asset/webproperty/{webproperty_id} directly.
Reference: https://docs.censys.com/reference/v3-globaldata-asset-webproperty
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
string
required
A web property identifier. Web properties are identified using a combination of a hostname and port joined with a colon, such as platform.censys.io:80.
string | null
RFC3339 Timestamp to view a webproperty at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.Default:
null.string | null
Base URL of the Censys Platform API.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.Search assets
Action ID:tools.censys.search_assets
Search assets. Calls POST /v3/global/search/query directly.
Reference: https://docs.censys.com/reference/v3-globaldata-search-query
Secrets
Required secrets:censys: required valuesCENSYS_API_TOKEN.
Input fields
string
required
CenQL query string to search upon.
string | null
Base URL of the Censys Platform API.Default:
null.array[string] | null
Specify fields to only return in the response. If you provide fields and omit host.services.port, host.services.transport_protocol, and host.services.protocol, then matched_services will not be returned in the response.Default:
null.string | null
The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user’s free wallet where applicable.Default:
null.integer | null
Number of results to return per page. The default and maximum is 100.Default:
null.string | null
Page token for the requested page of search results.Default:
null.