Create enumeration
Action ID:tools.project_discovery.create_enumeration
Create an asset enumeration. Calls POST /v1/asset/enumerate directly.
Reference: https://docs.projectdiscovery.io/api-reference/enumerations/create-enumeration
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
boolean | null
Enable agent auto discovery.Default:
null.string | null
Agent behavior (distribute or mirror). Defaults to distribute.Default:
null.string | null
Agent ID.Default:
null.array[string] | null
Agent networks.Default:
null.array[string] | null
Agent tags.Default:
null.array[string] | null
Alerting config IDs.Default:
null.boolean | null
Enable automatic vulnerability scans.Default:
null.string | null
ProjectDiscovery Cloud API base URL.Default:
null.array[string] | null
Cloudlist config IDs.Default:
null.boolean | null
Disable the global alert config.Default:
null.array[string] | null
Enrichment inputs.Default:
null.object | null
Enumeration config object (documented keys are follow-redirect and ports).Default:
null.string | null
Enumeration ports.Default:
null.array[string] | null
Targets to exclude.Default:
null.array[string] | null
Combined inclusion and exclusion patterns for discovery scope. Exclusion patterns (e.g.
*.staging.company.com) filter out matching targets. Inclusion patterns use a + prefix (e.g. +prod-*.company.com) to restrict discovery to only matching targets (allowlist mode). When inclusion patterns are present, targets must match at least one inclusion pattern and not match any exclusion pattern. Supports exact domains, wildcard patterns, IP addresses, and CIDR ranges.Default: null.string | null
Enumeration name.Default:
null.boolean | null
Enable per-domain enumeration.Default:
null.array[string] | null
Root domains to enumerate.Default:
null.array[string] | null
Enumeration steps to run (dns_resolve, dns_bruteforce, dns_permute, port_scan, http_probe, http_screenshot, endpoint_crawling, dns_passive, tls_scan, uncover_assets, dns_scraping).Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.Create scan
Action ID:tools.project_discovery.create_scan
Create a vulnerability scan. Calls POST /v1/scans directly.
Reference: https://docs.projectdiscovery.io/api-reference/scans/create-scan
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
Agent behavior (distribute or mirror). Defaults to distribute.Default:
null.string | null
Agent ID.Default:
null.array[string] | null
Agent networks.Default:
null.array[string] | null
Agent tags.Default:
null.array[string] | null
Alerting config IDs.Default:
null.boolean | null
Run all templates.Default:
null.object | null
Asset filters object (documented keys are is_tech, is_favicon, is_new, labels, host, port, status_code, content_length, title, domain, cname, technologies, ip, is_screenshot, time, start_date, end_date, custom_filter, search, enumeration_ids, only_dns, only_ip, not_seen_for_days).Default:
null.array[string] | null
Assets to scan.Default:
null.boolean | null
Enable automatic scan.Default:
null.string | null
ProjectDiscovery Cloud API base URL.Default:
null.boolean | null
Disable the global alert config.Default:
null.boolean | null
Disable the global report config.Default:
null.boolean | null
Disable the global scan config.Default:
null.array[string] | null
Early templates to run.Default:
null.array[object] | null
Array of EnumerationIds objects. Each object requires
id (string).Default: null.array[string] | null
Targets to exclude.Default:
null.array[string] | null
Combined inclusion and exclusion patterns for scan scope. Exclusion patterns (e.g.
*.staging.company.com) filter out matching targets. Inclusion patterns use a + prefix (e.g. +prod-*.company.com) to restrict scanning to only matching targets (allowlist mode). When inclusion patterns are present, targets must match at least one inclusion pattern and not match any exclusion pattern. Supports exact domains, wildcard patterns, IP addresses, and CIDR ranges.Default: null.string | null
Scan name.Default:
null.array[object] | null
Array of PrivateTemplates objects. Each object requires
name (string) and contents (string).Default: null.boolean | null
Run recommended templates.Default:
null.array[string] | null
Reporting config IDs.Default:
null.boolean | null
Scan all assets.Default:
null.array[string] | null
Scan config IDs.Default:
null.boolean | null
Only schedule the scan.Default:
null.string | null
SOCKS5 proxy.Default:
null.array[string] | null
Targets to scan.Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.array[string] | null
Templates to run.Default:
null.Get associated domains
Action ID:tools.project_discovery.get_associated_domains
Get associated domains. Calls GET /v1/domain/associated directly.
Reference: https://docs.projectdiscovery.io/api-reference/enumerations/get-associated-domains
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
boolean | null
Filter by liveness (true=alive, false=unreachable).Default:
null.string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
Domain name to fetch associated domains. If omitted, returns associated domains for all your verified domains.Default:
null.integer | null
Maximum results per page (pagination). If omitted, returns all.Default:
null.integer | null
Page number (pagination, starts at 1).Default:
null.boolean | null
If true, returns plain text list (one domain per line).Default:
null.string | null
Sort results (active, domain, source, subdomain_count, update_date).Default:
null.string | null
Comma-separated source filter (acquisition_history, certificate_history, whois_history).Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.Get domain leak stats
Action ID:tools.project_discovery.get_domain_leak_stats
Get public domain leak statistics. Calls GET /v1/leaks/stats/domain directly. No API key is required.
Reference: https://docs.projectdiscovery.io/api-reference/leaks/get-domain-stats
Input fields
string
required
Domain to get leak statistics for.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.boolean | null
Unmask email addresses in the results.Default:
null.Get email leak stats
Action ID:tools.project_discovery.get_email_leak_stats
Get public email leak statistics. Calls GET /v1/leaks/stats/email directly. No API key is required.
Reference: https://docs.projectdiscovery.io/api-reference/leaks/get-email-stats
Input fields
string
required
Email to get stats for.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.boolean | null
Unmask email addresses in the results.Default:
null.Get enumeration
Action ID:tools.project_discovery.get_enumeration
Get an enumeration. Calls GET /v1/asset/enumerate/{enumerate_id} directly.
Reference: https://docs.projectdiscovery.io/api-reference/enumerations/get-enumeration
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
Enumeration ID.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.Get enumeration contents
Action ID:tools.project_discovery.get_enumeration_contents
Get enumeration contents. Calls GET /v1/asset/enumerate/{enumerate_id}/contents directly.
Reference: https://docs.projectdiscovery.io/api-reference/enumerations/get-enumeration-contents
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
Enumeration ID.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
cname to filterDefault:
null.string | null
Filter by comma separated content lengths, e.g-> content_length=p1,p2Default:
null.string | null
custom query to filter. double encode the query string.Default:
null.string | null
Filter by comma separated domain names, e.g-> domain=domain1.com,domain2.comDefault:
null.string | null
time filter end date (YYYY-MM-DD).Default:
null.string | null
Filter by comma separated favicons, e.g-> favicon=p1,p2Default:
null.string | null
Filter by comma separated hosts, e.g-> host=p1,p2Default:
null.string | null
ips to filterDefault:
null.boolean | null
Return the records that have favicon.Default:
null.boolean | null
filter by is_internal (internal vs external hosts)Default:
null.boolean | null
Filter by new content.Default:
null.boolean | null
asset with screenshotsDefault:
null.boolean | null
Return records that have technologies.Default:
null.string | null
Filter by comma separated labels, e.g-> labels=p1,p2Default:
null.integer | null
The numbers of items to return.Default:
null.integer | null
Return assets that haven’t been seen in the last N days. An asset is only included if a scan that covers it has run during that period without rediscovering it, so assets that simply haven’t been rescanned recently are not matched.Default:
null.integer | null
The number of items to skip before starting to collect the result set.Default:
null.boolean | null
Query only dns FQDN records.Default:
null.boolean | null
Query only dns IP records.Default:
null.string | null
Filter by comma separated ports, e.g-> port=p1,p2Default:
null.string | null
Search on the content name.Default:
null.string | null
comma separated ascending sorting e.g sort_asc=created_at,nameDefault:
null.string | null
comma separated descending sorting e.g sort_desc=created_at,nameDefault:
null.string | null
time filter start date (YYYY-MM-DD).Default:
null.string | null
Filter by comma separated status codes, e.g-> status_code=p1,p2Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.string | null
technologies to filterDefault:
null.string | null
time filter to select (last_day, last_week, last_month, last_3_months, last_6_months, last_12_months, all_time). Defaults to all_time.Default:
null.string | null
Filter by comma separated titles, e.g-> title=p1,p2Default:
null.Get leak info
Action ID:tools.project_discovery.get_leak_info
Get leak information. Calls POST /v1/leaks/info directly.
Reference: https://docs.projectdiscovery.io/api-reference/leaks/get-leak-info
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
32-character MD5 hash identifying the leak (from list_leaks).
string | null
ProjectDiscovery Cloud API base URL.Default:
null.Get scan
Action ID:tools.project_discovery.get_scan
Get a scan. Calls GET /v1/scans/{scan_id} directly.
Reference: https://docs.projectdiscovery.io/api-reference/scans/get-scan
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
Scan ID.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.Get vulnerability
Action ID:tools.project_discovery.get_vulnerability
Get a vulnerability finding. Calls GET /v2/vulnerability/{vulnerability_id} directly.
Reference: https://docs.projectdiscovery.io/api-reference/get-vulnerability-by-id
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
Vulnerability ID.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
template data fieldsDefault:
null.Get vulnerability filters
Action ID:tools.project_discovery.get_vulnerability_filters
Get vulnerability filters. Calls GET /v2/vulnerability/filters directly.
Reference: https://docs.projectdiscovery.io/api-reference/get-all-filters-for-vulnerabilities
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
ProjectDiscovery Cloud API base URL.Default:
null.Get vulnerability timeline
Action ID:tools.project_discovery.get_vulnerability_timeline
Get a vulnerability timeline. Calls GET /v2/vulnerability/{vulnerability_id}/timeline directly.
Reference: https://docs.projectdiscovery.io/api-reference/results/get-vulnerability-timeline
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
Vulnerability ID.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
Filter by event types (comma-separated). Supported values are detected, status_change, resolved, reopened, severity_change, template_released, template_updated. If not provided, returns all events.Default:
null.List enumeration contents
Action ID:tools.project_discovery.list_enumeration_contents
List enumeration contents. Calls GET /v1/asset/enumerate/contents directly.
Reference: https://docs.projectdiscovery.io/api-reference/enumerations/get-all-enumeration-contents
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
cname to filterDefault:
null.string | null
Filter by comma separated content lengths, e.g-> content_length=p1,p2Default:
null.string | null
custom query to filter. double encode the query string.Default:
null.string | null
Filter by comma separated domain names, e.g-> domain=domain1.com,domain2.comDefault:
null.string | null
Filter by comma separated favicons, e.g-> favicon=p1,p2Default:
null.string | null
Filter by comma separated hosts, e.g-> host=p1,p2Default:
null.string | null
ips to filterDefault:
null.boolean | null
Return the records that have favicon.Default:
null.boolean | null
filter by is_internal (internal vs external hosts)Default:
null.boolean | null
Filter by new content.Default:
null.boolean | null
asset with screenshotsDefault:
null.boolean | null
Return records that have technologies.Default:
null.string | null
Filter by comma separated labels, e.g-> labels=p1,p2Default:
null.integer | null
The numbers of items to return.Default:
null.integer | null
Return assets that haven’t been seen in the last N days. An asset is only included if a scan that covers it has run during that period without rediscovering it, so assets that simply haven’t been rescanned recently are not matched.Default:
null.integer | null
The number of items to skip before starting to collect the result set.Default:
null.boolean | null
Query only dns FQDN records.Default:
null.boolean | null
Query only dns IP records.Default:
null.string | null
Filter by comma separated ports, e.g-> port=p1,p2Default:
null.string | null
Search on the content name.Default:
null.string | null
comma separated ascending sorting e.g sort_asc=created_at,nameDefault:
null.string | null
comma separated descending sorting e.g sort_desc=created_at,nameDefault:
null.string | null
Filter by comma separated status codes, e.g-> status_code=p1,p2Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.string | null
technologies to filterDefault:
null.string | null
time filter to select (last_day, last_week, last_month, last_3_months, last_6_months, last_12_months, all_time). Defaults to all_time.Default:
null.string | null
Filter by comma separated titles, e.g-> title=p1,p2Default:
null.List enumerations
Action ID:tools.project_discovery.list_enumerations
List asset enumerations. Calls GET /v1/asset/enumerate directly.
Reference: https://docs.projectdiscovery.io/api-reference/enumerations/get-enumeration-list
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
custom query to filter. double encode the query string.Default:
null.string | null
time filter end date (YYYY-MM-DD).Default:
null.string | null
types of enumeration list (comma seperated)Default:
null.boolean | null
filter by internal enumerationsDefault:
null.integer | null
The numbers of items to return.Default:
null.integer | null
The number of items to skip before starting to collect the result set.Default:
null.string | null
search keyword in enumeration listDefault:
null.string | null
comma separated ascending sorting e.g sort_asc=created_at,nameDefault:
null.string | null
comma separated descending sorting e.g sort_desc=created_at,nameDefault:
null.string | null
time filter start date (YYYY-MM-DD).Default:
null.string | null
comma separated filter enumeration result by statusDefault:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.string | null
time range to get enumerations from (last_day, last_week, last_month, last_3_months, last_6_months, last_12_months, all_time). Defaults to all_time.Default:
null.List leaks
Action ID:tools.project_discovery.list_leaks
List leaks. Calls GET /v1/leaks directly.
Reference: https://docs.projectdiscovery.io/api-reference/leaks
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
Filter by specific country (used with group_by for drill-down).Default:
null.string | null
Filter by specific device IP (used with group_by for drill-down).Default:
null.string | null
Filter leaks by specific domain (applies to employee/customer leaks).Default:
null.string | null
Filter leaks by specific email (can be personal, employee, or customer email from user’s authorized results).Default:
null.string | null
time filter end date (YYYY-MM-DD).Default:
null.string | null
Group results by field - returns group summaries when used without field-specific filtering. Supported fields are url, country, device_ip, hostname, email, hardware_id.Default:
null.string | null
Filter by specific hardware ID (used with group_by for drill-down).Default:
null.string | null
Filter by specific hostname (used with group_by for drill-down).Default:
null.integer | null
Number of results per page for pagination.Default:
null.integer | null
Page number for pagination (starts from 1).Default:
null.string | null
Search query to filter results across all fields.Default:
null.string | null
supported sort fields (url, username, log_date, country, device_ip, host_username, hostname, os, hardware_id, malware_path)Default:
null.string | null
supported sort order (asc or desc)Default:
null.string | null
time filter start date (YYYY-MM-DD).Default:
null.string | null
supported status (fixed or open)Default:
null.string | null
Time range (all_time, current_month, last_month, last_3_months, last_6_months, last_12_months). Defaults to all_time.Default:
null.string | null
Filter by specific leak type (single value only). Supported values are all, personal, employee, customer, external_vendor_leaks, organization_leaks.Default:
null.string | null
Filter by specific URL (used with group_by for drill-down).Default:
null.List scan results
Action ID:tools.project_discovery.list_scan_results
List vulnerability scan results. Calls GET /v1/scans/results directly.
Reference: https://docs.projectdiscovery.io/api-reference/results/get-all-results
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
boolean | null
Asset details for the vulnerability.Default:
null.string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
filter by comma separated categories e.g category=cve,xssDefault:
null.string | null
comma separated domain names e.g-> domain=domain1.com,domain2.comDefault:
null.string | null
comma separated host e.g. hosts=https://example.com,https://x.comDefault:
null.boolean | null
filter by is_internal (internal vs external hosts)Default:
null.boolean | null
filter by is_regressionDefault:
null.boolean | null
Return the records that have issue trackers.Default:
null.string | null
filter by comma separated labels e.g labels=p1,p2Default:
null.integer | null
number of results to getDefault:
null.integer | null
number of results to skipDefault:
null.string | null
comma separated ports e.g. ports=80,443Default:
null.string | null
search termDefault:
null.string | null
string separated by comma e.g. info,high. Defaults to unknown,low,medium,high,critical.Default:
null.string | null
comma separated ascending sorting e.g sort_asc=created_at,severityDefault:
null.string | null
comma separated descending sorting e.g sort_desc=created_at,severityDefault:
null.string | null
comma separated tags e.g tags=xss,cveDefault:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.string | null
comma separated templates e.g. templates=tech-detect,azure-takeoverDefault:
null.string | null
filter by time ( last_day, last_week, last_month )Default:
null.string | null
comma separated vuln_status e.g vuln_status=open,fixedDefault:
null.List scans
Action ID:tools.project_discovery.list_scans
List vulnerability scans. Calls GET /v1/scans directly.
Reference: https://docs.projectdiscovery.io/api-reference/scans/get-scan-list
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
ProjectDiscovery Cloud API base URL.Default:
null.boolean | null
filter by internal scansDefault:
null.integer | null
number of scan-status results to fetchDefault:
null.integer | null
number of scan-status results to skipDefault:
null.string | null
search term for running scansDefault:
null.string | null
comma separated ascending sorting e.g sort_asc=created_at,severityDefault:
null.string | null
comma separated descending sorting e.g sort_desc=created_at,severityDefault:
null.string | null
filter by status (failed, finished, queued, running, starting, uploaded, scheduled)Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.List vulnerability changelogs
Action ID:tools.project_discovery.list_vulnerability_changelogs
List vulnerability changelogs. Calls GET /v1/scans/vuln/changelogs directly.
Reference: https://docs.projectdiscovery.io/api-reference/results/get-all-vulnerability-changelogs
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
comma separated event_type e.g. event_type=vul_status,vul_status_changeDefault:
null.integer | null
number of results to getDefault:
null.integer | null
number of results to skipDefault:
null.string | null
comma separated ascending sorting e.g sort_asc=created_at,severityDefault:
null.string | null
comma separated descending sorting e.g sort_desc=created_at,severityDefault:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.string | null
time filter to select (last_day, last_week, last_month, last_3_months, last_6_months, last_12_months, all_time). Defaults to all_time.Default:
null.Rescan enumeration
Action ID:tools.project_discovery.rescan_enumeration
Rescan an enumeration. Calls POST /v1/asset/enumerate/{enumerate_id}/rescan directly.
Reference: https://docs.projectdiscovery.io/api-reference/enumerations/rescan-enumeration
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
Enumeration ID to rescan.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.Rescan scan
Action ID:tools.project_discovery.rescan_scan
Rescan a vulnerability scan. Calls POST /v1/scans/{scan_id}/rescan directly.
Reference: https://docs.projectdiscovery.io/api-reference/scans/rescan-scan
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string
required
Scan ID to rescan.
string | null
ProjectDiscovery Cloud API base URL.Default:
null.string | null
Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/teamDefault:
null.Search vulnerabilities
Action ID:tools.project_discovery.search_vulnerabilities
Search vulnerability findings. Calls GET /v2/vulnerability/search directly.
Reference: https://docs.projectdiscovery.io/api-reference/full-text-search
Secrets
Required secrets:project_discovery: required valuesPDCP_API_KEY.
Input fields
string | null
ProjectDiscovery Cloud API base URL.Default:
null.integer | null
Number of facets to return.Default:
null.string | null
List of fields to return (comma separated).Default:
null.boolean | null
Whether to highlight the search results.Default:
null.integer | null
The numbers of items to return.Default:
null.integer | null
The numbers of items to skip.Default:
null.string | null
Search query.Default:
null.string | null
List of range facet fields (comma separated).Default:
null.string | null
Sort results in ascending order (CSV field names).Default:
null.string | null
Sort results in descending order (CSV field names).Default:
null.string | null
List of term facet fields (comma separated).Default:
null.