> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Censys

> Reference for the Tracecat Censys integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Aggregate search

Action ID: `tools.censys.aggregate_search`

Aggregate search results. Calls POST /v3/global/search/aggregate directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-search-aggregate](https://docs.censys.com/reference/v3-globaldata-search-aggregate)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="field" type="string" required>
  Field to aggregate by.
</ParamField>

<ParamField path="number_of_buckets" type="integer" required>
  Number of buckets to split results into, from 1 to 2000.
</ParamField>

<ParamField path="query" type="string" required>
  CenQL query string to search upon.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="count_by_level" type="string | null">
  Specifies which document level's count is returned per term bucket, primarily for nested fields. This is the same functionality available in the Count By dropdown in the Report Builder UI.

  Default: `null`.
</ParamField>

<ParamField path="filter_by_query" type="boolean | null">
  Controls whether aggregation results are limited to values that match the query. When true, only field values that satisfy the query constraints are included in aggregation counts.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get certificate

Action ID: `tools.censys.get_certificate`

Get a certificate. Calls GET /v3/global/asset/certificate/\{certificate\_id} directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-certificate](https://docs.censys.com/reference/v3-globaldata-asset-certificate)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="certificate_id" type="string" required>
  The SHA-256 certificate fingerprint.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get certificate raw

Action ID: `tools.censys.get_certificate_raw`

Get a raw certificate. Calls GET /v3/global/asset/certificate/\{certificate\_id}/raw directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-certificate-raw](https://docs.censys.com/reference/v3-globaldata-asset-certificate-raw)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="certificate_id" type="string" required>
  The SHA-256 certificate fingerprint.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get certificates

Action ID: `tools.censys.get_certificates`

Get multiple certificates. Calls POST /v3/global/asset/certificate directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-certificate-list-post](https://docs.censys.com/reference/v3-globaldata-asset-certificate-list-post)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="certificate_ids" type="array[string]" required>
  A list of SHA-256 certificate fingerprints. Up to 1,000 per call.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get host

Action ID: `tools.censys.get_host`

Get a host. Calls GET /v3/global/asset/host/\{host\_id} directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-host](https://docs.censys.com/reference/v3-globaldata-asset-host)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="host_id" type="string" required>
  The IP address of a host.
</ParamField>

<ParamField path="at_time" type="string | null">
  RFC3339 Timestamp to view a host at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get host timeline

Action ID: `tools.censys.get_host_timeline`

Get a host timeline. Calls GET /v3/global/asset/host/\{host\_id}/timeline directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-host-timeline](https://docs.censys.com/reference/v3-globaldata-asset-host-timeline)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="end_time" type="string" required>
  End time of the host timeline. Equivalent to the From field in the event history UI. This must be the timestamp furthest from the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 1 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.
</ParamField>

<ParamField path="host_id" type="string" required>
  The IP address of a host.
</ParamField>

<ParamField path="start_time" type="string" required>
  Start time of the host timeline. Equivalent to the To field in the event history UI. This must be the timestamp closest to the current time. For example, if you want events from January 1, 2025 to the start of January 2, 2025, input the January 2 timestamp here. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get hosts

Action ID: `tools.censys.get_hosts`

Get multiple hosts. Calls POST /v3/global/asset/host directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-host-list-post](https://docs.censys.com/reference/v3-globaldata-asset-host-list-post)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="host_ids" type="array[string]" required>
  A list of host IP addresses. Up to 100 per call.
</ParamField>

<ParamField path="at_time" type="string | null">
  RFC3339 Timestamp to view all requested hosts at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get web properties

Action ID: `tools.censys.get_web_properties`

Get multiple web properties. Calls POST /v3/global/asset/webproperty directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-webproperty-list-post](https://docs.censys.com/reference/v3-globaldata-asset-webproperty-list-post)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="webproperty_ids" type="array[string]" required>
  A list of web property identifiers, such as platform.censys.io:80. Up to 100 per call.
</ParamField>

<ParamField path="at_time" type="string | null">
  RFC3339 Timestamp to view all requested webproperties at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Get web property

Action ID: `tools.censys.get_web_property`

Get a web property. Calls GET /v3/global/asset/webproperty/\{webproperty\_id} directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-asset-webproperty](https://docs.censys.com/reference/v3-globaldata-asset-webproperty)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="webproperty_id" type="string" required>
  A web property identifier. Web properties are identified using a combination of a hostname and port joined with a colon, such as platform.censys.io:80.
</ParamField>

<ParamField path="at_time" type="string | null">
  RFC3339 Timestamp to view a webproperty at a specific point in time. Must be a valid RFC3339 string. Ensure that you suffix the date with T00:00:00Z or a specific time.

  Default: `null`.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

## Search assets

Action ID: `tools.censys.search_assets`

Search assets. Calls POST /v3/global/search/query directly.

Reference: [https://docs.censys.com/reference/v3-globaldata-search-query](https://docs.censys.com/reference/v3-globaldata-search-query)

### Secrets

Required secrets:

* `censys`: required values `CENSYS_API_TOKEN`.

### Input fields

<ParamField path="query" type="string" required>
  CenQL query string to search upon.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the Censys Platform API.

  Default: `null`.
</ParamField>

<ParamField path="fields" type="array[string] | null">
  Specify fields to only return in the response. If you provide fields and omit host.services.port, host.services.transport\_protocol, and host.services.protocol, then matched\_services will not be returned in the response.

  Default: `null`.
</ParamField>

<ParamField path="organization_id" type="string | null">
  The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable.

  Default: `null`.
</ParamField>

<ParamField path="page_size" type="integer | null">
  Number of results to return per page. The default and maximum is 100.

  Default: `null`.
</ParamField>

<ParamField path="page_token" type="string | null">
  Page token for the requested page of search results.

  Default: `null`.
</ParamField>