canonical: https://jentic.com/apis/fullhunt.io/fullhunt

# FullHunt API

Jentic publishes the only available OpenAPI specification for FullHunt API, keeping it validated and agent-ready. FullHunt is an attack-surface management platform that indexes Internet-connected assets across the public web. The API exposes 4 endpoints to query domain details, enumerate subdomains, retrieve host intelligence, and run a global search across the FullHunt database. Authentication uses an X-API-KEY header.

## For AI agents

Look up a domain's exposed assets, enumerate subdomains, and search FullHunt's index of Internet-connected hosts.

## Scope

Does not handle vulnerability scanning, exploit execution, or active probing - use for passive attack-surface intelligence and asset enumeration only.

## Capabilities

- Pull a domain summary including the count and class of subdomains discovered
- Enumerate every known subdomain of a target domain
- Retrieve host-level intelligence including open ports, services, and tech stack
- Run a global search across FullHunt's index for arbitrary IOCs or terms
- Use this data to power external attack surface monitoring workflows

## Use cases

### External Attack Surface Discovery

Security teams launching an external attack surface programme call GET `/domain/{domain}/subdomains` for each in-scope domain to enumerate every subdomain FullHunt has observed. Combined with `/domain/{domain}/details` this produces a starter list of public assets that the team can then hand off to vulnerability scanners.

Example prompt: Call GET `/domain/example.com/subdomains` and write the results to a CSV for downstream scanning

### Acquisition Due Diligence

Before completing a corporate acquisition, an information-security team wants a quick view of the target company's external footprint. A script iterates the target's domains and pulls `/domain/{domain}/details` and `/domain/{domain}/subdomains`, then resolves each subdomain via `/host/{host}` to flag exposed services and outdated software.

Example prompt: For acquired-company.com call GET /domain details, then enumerate subdomains and resolve each via GET `/host/{host}`

### Global IOC Search

When a threat advisory references a hostname or IP indicator, an analyst posts to `/global/search` to see whether FullHunt has any record of the indicator in its index. This gives a quick yes-or-no signal that determines whether the indicator touches infrastructure observed on the public Internet.

Example prompt: POST `/global/search` with the suspicious hostname and return any matching FullHunt records

### Agent-Driven Surface Monitoring

An AI agent runs daily against a list of in-scope domains, pulls subdomain counts, and alerts when the count changes meaningfully against yesterday's baseline. Because Jentic securely stores the X-API-KEY, the agent never carries the credential and can be deployed as a scheduled task against many tenants safely.

Example prompt: Search Jentic for 'list subdomains for a domain', load GET `/domain/{domain}/subdomains`, execute for the in-scope domain, and diff against yesterday

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/domain/{domain}/details` | Summary intelligence for a target domain |
| GET | `/domain/{domain}/subdomains` | Enumerate subdomains of a target domain |
| GET | `/host/{host}` | Per-host intelligence including ports and services |
| POST | `/global/search` | Free-form search across FullHunt's index |

## Key resources

- **Domain Details** — Summary intelligence for a target domain including subdomain counts
- **Subdomains** — Enumerate observed subdomains of a target domain
- **Host** — Per-host intelligence including open ports, services, and tech stack
- **Global Search** — Free-form search across the FullHunt asset index

## Why Jentic

- **Setup:** Wiring FullHunt by hand means sending an X-API-KEY header on every call to fullhunt.io and stitching the domain, subdomain, and host routes together yourself. Through Jentic you install once, import FullHunt from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** FullHunt puts the domain in the URL path (`/domain/{domain}/...`), so a rule can pin your agent to one domain: it can read that domain's details and subdomains and nothing else. FullHunt here is passive read and search only, so no active or destructive operation is available to add.
- **Credential handling:** Your FullHunt API key is stored once, encrypted, by your own Jentic One instance and injected into the X-API-KEY header at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list subdomains for a domain' or 'search FullHunt for an indicator', and Jentic returns the matching GET `/domain/{domain}/subdomains` or POST `/global/search` operation with its parameter schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Shodan** — Search engine for Internet-connected devices and services
- **Censys** — Internet asset and certificate intelligence
- **Shadowserver** — Threat intelligence feed for compromised and exposed assets
- **Spyse** — Internet asset search engine with deep WHOIS and DNS coverage

## FAQ

### Why is there no official OpenAPI spec for FullHunt API?

FullHunt does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call FullHunt API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the FullHunt API use?

FullHunt uses an X-API-KEY header carrying an account-level API key. The key is issued from the FullHunt dashboard. Through Jentic the key is stored encrypted in your Jentic One instance and injected into the X-API-KEY header at execution time.

### Can I enumerate every subdomain of a target domain?

Yes. GET `/domain/{domain}/subdomains` returns FullHunt's observed subdomains for a target. The response is paged on large estates, so iterate until the next-page token is empty for full coverage.

### What are the rate limits for the FullHunt API?

FullHunt's rate limits depend on plan tier. Free tiers are heavily throttled, while paid plans allow sustained calls. Cache subdomain results for a target domain for at least an hour to avoid burning quota on enumeration tasks.

### How do I run a global IOC search through Jentic?

Search Jentic for 'search fullhunt for an indicator', load the POST `/global/search` schema, and execute with the hostname or IP indicator. The response indicates whether FullHunt has observed the indicator on its index.

### Is the FullHunt API free?

FullHunt offers a free community tier with limited daily quota and paid tiers for larger volumes. Calling `/domain/{domain}/subdomains` on large estates is the most quota-intensive operation, so plan accordingly.

### Can I limit what my agent is allowed to do with the FullHunt API?

Yes. Because you run Jentic One yourself, your own rules decide which FullHunt operations and credentials the agent may use, and FullHunt puts the target domain in the URL path (`/domain/{domain}/details` and `/domain/{domain}/subdomains`), so a rule can pin the agent to a single domain and let it read only that domain's details and subdomains. You can also scope the agent to specific operations, for example allowing GET `/host/{host}` lookups while withholding the POST `/global/search` endpoint. Every FullHunt operation here is passive read and search, so there is no active or destructive call for the agent to make.