FullHunt API
Agent-ready OpenAPI document · curated by JenticSecurityThreat DetectionapiKey4 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Look up a domain's exposed assets, enumerate subdomains, and search FullHunt's index of Internet-connected hosts.
Use for: List every subdomain of a target domain, Get the open ports and services on a specific host, Search the FullHunt index for a leaked hostname, Pull a domain summary for asset-discovery reporting
Not supported: Does not handle vulnerability scanning, exploit execution, or active probing - use for passive attack-surface intelligence and asset enumeration only.
Jentic publishes the only available OpenAPI specification for FullHunt API, keeping it validated and agent-ready. FullHunt is an attack-surface management platform that indexes Internet-connected assets across the public web. The API exposes 4 endpoints to query domain details, enumerate subdomains, retrieve host intelligence, and run a global search across the FullHunt database. Authentication uses an X-API-KEY header.
Install Jentic One Beta
Connect the FullHunt API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the FullHunt API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ffullhunt.io%2Ffullhunt" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ffullhunt.io%2Ffullhunt" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with FullHunt API.
Pull a domain summary including the count and class of subdomains discovered
Enumerate every known subdomain of a target domain
Retrieve host-level intelligence including open ports, services, and tech stack
Run a global search across FullHunt's index for arbitrary IOCs or terms
Use this data to power external attack surface monitoring workflows
Use Cases
Patterns agents use FullHunt API for, with concrete tasks.
★ External Attack Surface Discovery
Security teams launching an external attack surface programme call GET /domain/{domain}/subdomains for each in-scope domain to enumerate every subdomain FullHunt has observed. Combined with /domain/{domain}/details this produces a starter list of public assets that the team can then hand off to vulnerability scanners.
Call GET /domain/example.com/subdomains and write the results to a CSV for downstream scanning
Acquisition Due Diligence
Before completing a corporate acquisition, an information-security team wants a quick view of the target company's external footprint. A script iterates the target's domains and pulls /domain/{domain}/details and /domain/{domain}/subdomains, then resolves each subdomain via /host/{host} to flag exposed services and outdated software.
For acquired-company.com call GET /domain details, then enumerate subdomains and resolve each via GET /host/{host}
Global IOC Search
When a threat advisory references a hostname or IP indicator, an analyst posts to /global/search to see whether FullHunt has any record of the indicator in its index. This gives a quick yes-or-no signal that determines whether the indicator touches infrastructure observed on the public Internet.
POST /global/search with the suspicious hostname and return any matching FullHunt records
Agent-Driven Surface Monitoring
An AI agent runs daily against a list of in-scope domains, pulls subdomain counts, and alerts when the count changes meaningfully against yesterday's baseline. Because Jentic securely stores the X-API-KEY, the agent never carries the credential and can be deployed as a scheduled task against many tenants safely.
Search Jentic for 'list subdomains for a domain', load GET /domain/{domain}/subdomains, execute for the in-scope domain, and diff against yesterday
Key Endpoints
4 endpoints — jentic publishes the only available openapi specification for fullhunt api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/domain/{domain}/details
Summary intelligence for a target domain
GET
/domain/{domain}/subdomains
Enumerate subdomains of a target domain
GET
/host/{host}
Per-host intelligence including ports and services
POST
/global/search
Free-form search across FullHunt's index
GET
/domain/{domain}/details
Summary intelligence for a target domain
GET
/domain/{domain}/subdomains
Enumerate subdomains of a target domain
GET
/host/{host}
Per-host intelligence including ports and services
POST
/global/search
Free-form search across FullHunt's index
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring FullHunt by hand means sending an X-API-KEY header on every call to fullhunt.io and stitching the domain, subdomain, and host routes together yourself. Through Jentic you install once, import FullHunt from the API Directory, store the key once, and your agent calls it.
Permission scoping
FullHunt puts the domain in the URL path (/domain/{domain}/...), so a rule can pin your agent to one domain: it can read that domain's details and subdomains and nothing else. FullHunt here is passive read and search only, so no active or destructive operation is available to add.
Credential isolation
Your FullHunt API key is stored once, encrypted, by your own Jentic One instance and injected into the X-API-KEY header at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'list subdomains for a domain' or 'search FullHunt for an indicator', and Jentic returns the matching GET /domain/{domain}/subdomains or POST /global/search operation with its parameter schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using FullHunt API through Jentic.
Why is there no official OpenAPI spec for FullHunt API?
FullHunt does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call FullHunt API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the FullHunt API use?
FullHunt uses an X-API-KEY header carrying an account-level API key. The key is issued from the FullHunt dashboard. Through Jentic the key is stored encrypted in your Jentic One instance and injected into the X-API-KEY header at execution time.
Can I enumerate every subdomain of a target domain?
Yes. GET /domain/{domain}/subdomains returns FullHunt's observed subdomains for a target. The response is paged on large estates, so iterate until the next-page token is empty for full coverage.
What are the rate limits for the FullHunt API?
FullHunt's rate limits depend on plan tier. Free tiers are heavily throttled, while paid plans allow sustained calls. Cache subdomain results for a target domain for at least an hour to avoid burning quota on enumeration tasks.
How do I run a global IOC search through Jentic?
Search Jentic for 'search fullhunt for an indicator', load the POST /global/search schema, and execute with the hostname or IP indicator. The response indicates whether FullHunt has observed the indicator on its index.
Is the FullHunt API free?
FullHunt offers a free community tier with limited daily quota and paid tiers for larger volumes. Calling /domain/{domain}/subdomains on large estates is the most quota-intensive operation, so plan accordingly.
Can I limit what my agent is allowed to do with the FullHunt API?
Yes. Because you run Jentic One yourself, your own rules decide which FullHunt operations and credentials the agent may use, and FullHunt puts the target domain in the URL path (/domain/{domain}/details and /domain/{domain}/subdomains), so a rule can pin the agent to a single domain and let it read only that domain's details and subdomains. You can also scope the agent to specific operations, for example allowing GET /host/{host} lookups while withholding the POST /global/search endpoint. Every FullHunt operation here is passive read and search, so there is no active or destructive call for the agent to make.
GET STARTED