canonical: https://jentic.com/apis/onyphe.io/onyphe

# ONYPHE API

Jentic publishes the only available OpenAPI specification for ONYPHE API, keeping it validated and agent-ready. ONYPHE is a cyber-defense search engine that indexes the public internet for attack-surface discovery, attack-surface management, and cyber-threat intelligence. The v2 API exposes a query-based search across the indexed dataset, plus dedicated endpoints for export, discovery, summary, simple lookups, and alert management. Agents typically use ONYPHE to enrich an IP address, domain, or organisation with exposure data - open ports, certificates, banners, geolocation, and observed threats.

## For AI agents

Search ONYPHE's internet-wide scan dataset for an IP, domain, or organisation to surface open ports, exposed services, and threat signals. Useful for agents performing attack-surface enrichment.

## Scope

Does not perform active scanning, vulnerability exploitation, or remediation - use for passive attack-surface and threat-intelligence lookups only.

## Capabilities

- Search the ONYPHE dataset with a query string covering IPs, domains, certificates, and banners
- Export bulk search results for offline analysis or downstream pipelines
- Run discovery queries to map the attack surface of a target organisation or netblock
- Generate per-target summaries that aggregate exposure findings into a single response
- Issue simple category lookups (geoloc, threats, vulnscan) against a single IP or domain
- List configured ONYPHE alerts to monitor a saved query for new matches

## Use cases

### IP Attack-Surface Enrichment

Enrich an IP address observed in logs with the ports, services, certificates, and threat signals ONYPHE has indexed for it. The simple and summary endpoints return a structured response in a single call, so a SOC agent can decide whether the address warrants deeper investigation without scripting multiple lookups.

Example prompt: Call GET `/summary/ip`:8.8.8.8 and return the list of open ports and any threat categories ONYPHE has tagged for that address.

### Attack-Surface Discovery for an Organisation

Map the externally visible footprint of an organisation by combining the discovery endpoint with a domain or organisation query. The result lists hostnames, IPs, certificates, and exposed services which the agent can hand off to a vulnerability scanner or a triage queue.

Example prompt: Call GET `/discovery/organization`:"ExampleCorp" and return the unique hostnames and the count of exposed TCP services per host.

### Certificate and Domain Threat Hunting

Pivot from a suspect certificate or domain to all related infrastructure ONYPHE has observed. The search endpoint accepts a structured query language, so a threat-hunting agent can chain queries (e.g. CN, SAN, fingerprint) and export the result set for downstream analysis.

Example prompt: Call GET `/search/category`:resolver+domain:example.com and return all distinct IPs that have served a certificate for the domain in the last 30 days.

### AI Agent SOC Triage

Let a Jentic-orchestrated SOC agent enrich an alert with ONYPHE data without holding the API key. The agent searches Jentic for an enrichment intent, Jentic injects the apikey header at execution time, and the response is returned to the agent for decisioning.

Example prompt: Search Jentic for 'enrich an IP with attack-surface data', load the ONYPHE summary schema, and execute it for IP 1.2.3.4 returning open ports and any threat tags.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/search/{query}` | Search the ONYPHE dataset with a QL query |
| GET | `/summary/{query}` | Get an aggregated summary for a target |
| GET | `/simple/{category}/{query}` | Per-category single-target lookup |
| GET | `/discovery/{query}` | Discover assets for an organisation or netblock |
| GET | `/export/{query}` | Stream bulk results for a query |
| POST | `/bulk/summary/{query}` | Bulk summary for multiple targets |
| GET | `/alert/list` | List alerts configured on the account |
| GET | `/user` | Get account info and remaining quota |

## Key resources

- **Search** — Run query-based searches across the ONYPHE indexed dataset.
- **Export** — Pull bulk result sets for downstream pipelines.
- **Discovery** — Map the attack surface of an organisation, domain, or netblock.
- **Summary** — Aggregate exposure findings into a single response per target.
- **Simple** — Per-category lookups (geoloc, threats, resolver) against an IP or domain.
- **Alert** — List configured alerts on saved queries.

## Why Jentic

- **Setup:** Wiring the ONYPHE API by hand means setting the Authorization header with your API key and handling its query-language and paging conventions yourself. Through Jentic you install once, import the ONYPHE API from the API Directory, store the API key once, and your agent calls it.
- **Permission scoping:** ONYPHE puts the query and category in the URL path (`/simple/{category}/{query}`), so a rule can pin your agent to specific lookup operations over that path. You choose the operations it may call, so bulk export or discovery are not included unless you add them.
- **Credential handling:** Your ONYPHE API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'look up exposed services for an IP' or 'get a threat-intelligence summary', and Jentic returns the matching ONYPHE operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Shodan API** — Internet-wide scan search engine with similar IP-and-banner enrichment.
- **Censys Search API** — Internet-wide host and certificate dataset oriented around structured queries.
- **Abstract IP Geolocation API** — Lightweight IP geolocation lookup focused on country, city, and ASN.

## FAQ

### Why is there no official OpenAPI spec for ONYPHE API?

ONYPHE does not publish an OpenAPI specification on its documentation site. Jentic generates and maintains this spec from the v2 API documentation so AI agents and developers can call ONYPHE via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the ONYPHE API use?

ONYPHE uses an API key passed in the Authorization header in the form 'apikey <YOUR_KEY>'. Through Jentic the key is held in the vault and the Authorization header is built at execution time, so the agent calling GET `/summary/{query}` never sees the raw key.

### Can I run bulk exports against ONYPHE through this API?

Yes. GET `/export/{query}` streams full result sets for a search query, and POST `/bulk/summary/{query}` returns aggregated summaries for multiple targets in one call. These are the right endpoints for batch enrichment rather than the single-target /simple/ family.

### What are the rate limits for the ONYPHE API?

Rate limits and result quotas depend on the ONYPHE subscription tier and are not declared in the spec. The /user endpoint returns the current credit balance and quota state, so an agent should call it at the start of a run and back off on any 429 response.

### How do I enrich an IP address through Jentic?

Run pip install jentic and search for 'enrich an IP address with attack-surface data'. Jentic returns the GET `/summary/{query}` operation; load the schema and execute it with query like 'ip:8.8.8.8' to receive open ports, certificates, and threat tags in one response.

### Does ONYPHE provide active scanning?

No. ONYPHE serves data from its own continuous internet-wide scans through these endpoints - the API does not initiate a scan against a target on demand. For active scanning use a vulnerability scanner alongside ONYPHE's passive results.

### Can I limit what my agent is allowed to do with the ONYPHE API?

Yes. Because you run Jentic One yourself, your own rules decide which ONYPHE operations and credentials the agent may use. Since ONYPHE puts the query and category in the URL path, such as `/simple/{category}/{query}`, you can pin the agent to specific single-target lookups like a geoloc or threats check on one IP or domain. Heavier operations such as GET `/export/{query}`, GET `/discovery/{query}`, and POST `/bulk/summary/{query}` stay out of reach unless you explicitly add them, and the API key is injected at execution time so the agent never handles it.