FullHunt API

Name: FullHunt API API
Brand: FullHunt API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey4 EndpointsREST

For Agents

Look up a domain's exposed assets, enumerate subdomains, and search FullHunt's index of Internet-connected hosts.

Connect the FullHunt API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the FullHunt API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with FullHunt API API.

Pull a domain summary including the count and class of subdomains discovered

Enumerate every known subdomain of a target domain

Retrieve host-level intelligence including open ports, services, and tech stack

Run a global search across FullHunt's index for arbitrary IOCs or terms

GET STARTED

Start building with FullHunt API API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for FullHunt API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for FullHunt API, keeping it validated and agent-ready. FullHunt is an attack-surface management platform that indexes Internet-connected assets across the public web. The API exposes 4 endpoints to query domain details, enumerate subdomains, retrieve host intelligence, and run a global search across the FullHunt database. Authentication uses an X-API-KEY header.

Use Cases

Patterns agents use FullHunt API API for, with concrete tasks.

★ External Attack Surface Discovery

Security teams launching an external attack surface programme call GET /domain/{domain}/subdomains for each in-scope domain to enumerate every subdomain FullHunt has observed. Combined with /domain/{domain}/details this produces a starter list of public assets that the team can then hand off to vulnerability scanners.

Call GET /domain/example.com/subdomains and write the results to a CSV for downstream scanning

Acquisition Due Diligence

Before completing a corporate acquisition, an information-security team wants a quick view of the target company's external footprint. A script iterates the target's domains and pulls /domain/{domain}/details and /domain/{domain}/subdomains, then resolves each subdomain via /host/{host} to flag exposed services and outdated software.

For acquired-company.com call GET /domain details, then enumerate subdomains and resolve each via GET /host/{host}

Global IOC Search

When a threat advisory references a hostname or IP indicator, an analyst posts to /global/search to see whether FullHunt has any record of the indicator in its index. This gives a quick yes-or-no signal that determines whether the indicator touches infrastructure observed on the public Internet.

POST /global/search with the suspicious hostname and return any matching FullHunt records

Agent-Driven Surface Monitoring

An AI agent runs daily against a list of in-scope domains, pulls subdomain counts, and alerts when the count changes meaningfully against yesterday's baseline. Because Jentic vaults the X-API-KEY, the agent never carries the credential and can be deployed as a scheduled task against many tenants safely.

Search Jentic for 'list subdomains for a domain', load GET /domain/{domain}/subdomains, execute for the in-scope domain, and diff against yesterday

Key Endpoints

4 endpoints — jentic publishes the only available openapi specification for fullhunt api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/domain/{domain}/details

Summary intelligence for a target domain

GET

/domain/{domain}/subdomains

Enumerate subdomains of a target domain

GET

/host/{host}

Per-host intelligence including ports and services

POST

/global/search

Free-form search across FullHunt's index

GET

/domain/{domain}/details

Summary intelligence for a target domain

GET

/domain/{domain}/subdomains

Enumerate subdomains of a target domain

GET

/host/{host}

Per-host intelligence including ports and services

POST

/global/search

Free-form search across FullHunt's index

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

FullHunt X-API-KEY values are stored encrypted in the Jentic MAXsystem vault. Agents call FullHunt operations via scoped execution tokens, and the raw API key is injected into the X-API-KEY header only at call time.

Intent-based discovery

Agents search Jentic for intents like 'list subdomains for a domain' or 'search fullhunt for an indicator' and Jentic returns the matching GET /domain/{domain}/subdomains or POST /global/search operation with its parameter schema, so the agent calls the right resource on the first try.

Time to first call

Direct FullHunt integration: half a day to handle pagination, throttling, and JSON normalisation. Through Jentic: under an hour — search, load, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Shodan

Search engine for Internet-connected devices and services

Choose Shodan when the workflow needs banner-level service intelligence and IoT device fingerprints rather than domain-centric ASM

Alternative

Censys

Internet asset and certificate intelligence

Choose Censys when the workflow leans heavily on certificate and protocol-level analytics across IPv4/IPv6

Complementary

Shadowserver

Threat intelligence feed for compromised and exposed assets

Pair Shadowserver with FullHunt to add compromise telemetry on top of FullHunt's asset enumeration

Alternative

Spyse

Internet asset search engine with deep WHOIS and DNS coverage

Choose Spyse when the workflow needs detailed WHOIS, DNS history, and SSL certificate coverage on top of asset discovery

FAQs

Specific to using FullHunt API API through Jentic.

Why is there no official OpenAPI spec for FullHunt API?

FullHunt does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call FullHunt API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the FullHunt API use?

FullHunt uses an X-API-KEY header carrying an account-level API key. The key is issued from the FullHunt dashboard. Through Jentic the key is stored encrypted in the MAXsystem vault and injected into the X-API-KEY header at execution time.

Can I enumerate every subdomain of a target domain?

Yes. GET /domain/{domain}/subdomains returns FullHunt's observed subdomains for a target. The response is paged on large estates, so iterate until the next-page token is empty for full coverage.

What are the rate limits for the FullHunt API?

FullHunt's rate limits depend on plan tier. Free tiers are heavily throttled, while paid plans allow sustained calls. Cache subdomain results for a target domain for at least an hour to avoid burning quota on enumeration tasks.

How do I run a global IOC search through Jentic?

Search Jentic for 'search fullhunt for an indicator', load the POST /global/search schema, and execute with the hostname or IP indicator. The response indicates whether FullHunt has observed the indicator on its index.

Is the FullHunt API free?

FullHunt offers a free community tier with limited daily quota and paid tiers for larger volumes. Calling /domain/{domain}/subdomains on large estates is the most quota-intensive operation, so plan accordingly.