Skip to main content
API docs by Redocly

HoundER API (1.0)

Download OpenAPI specification:Download

HoundER Support: [email protected]

The HoundER public API lets you programmatically read and triage findings discovered by HoundER: credentials, hosts, services, vulnerabilities, and websites. It's served at api.hounder.io and is currently scoped to findings — asset, project, and agent management are done through the platform and aren't yet part of the public API.

Filtering

In addition to the filter parameters listed per endpoint below, list endpoints accept filters on most other fields of the returned resource (for example hostname, geoIP.asn, or classification.cve on vulnerabilities). Filters support:

  • Negation, by prefixing the value with ! (e.g. status=!closed)
  • Matching multiple values, by repeating the parameter or passing a comma-separated list (e.g. severity=critical,high)
  • Comparison operators on numeric and date fields: >, <, >=, <= (e.g. classification.cvssScore=>=7)

Credentials

List credentials

Authorizations:
ApiKeyAuth
query Parameters
q
string

Free-text search.

status
string
Enum: "open" "closed" "fp"

Filter by status. Prefix with ! to negate. Repeat the parameter to match multiple values.

ip
string

Filter by IP address.

hostname
string

Filter by hostname.

type
string
Enum: "client" "employee" "third_party" "user"

Filter by credential type. Prefix with ! to negate. Repeat the parameter to match multiple values.

username
string

Filter by username.

url
string

Filter by URL.

os
string

Filter by the infected host's operating system.

stealer
string

Filter by infostealer malware name.

stealerFamily
string

Filter by infostealer malware family.

malwarePath
string

Filter by the malware's file path on the infected host.

page
integer >= 1
Default: 1
limit
integer [ 0 .. 100 ]
Default: 10
createdAt
string <date-time>

Filter by creation date. Supports comparison prefixes: >, <, >=, <=.

detectedAt
string <date-time>

Filter by detection date. Supports comparison prefixes: >, <, >=, <=.

infectedAt
string <date-time>

Filter by infection date. Supports comparison prefixes: >, <, >=, <=.

updatedAt
string <date-time>

Filter by last-updated date. Supports comparison prefixes: >, <, >=, <=.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Get a credential

Authorizations:
ApiKeyAuth
path Parameters
credentialId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Update a credential's status

Requires a read-write API key. Redacted credentials cannot be updated.

Authorizations:
ApiKeyAuth
path Parameters
credentialId
required
string
Request Body schema: application/json
status
string
Enum: "open" "fp" "closed"

Responses

Request samples

Content type
application/json
{
  • "status": "open"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Hosts

List hosts

Authorizations:
ApiKeyAuth
query Parameters
q
string

Free-text search.

ip
string

Filter by IP address.

hostname
string

Filter by hostname.

geoIP.asn
integer

Filter by autonomous system number.

geoIP.cityName
string

Filter by city name.

geoIP.countryName
string

Filter by country name.

geoIP.organization
string

Filter by the network organization (from GeoIP data).

source
string

Filter by discovery source.

page
integer >= 1
Default: 1
limit
integer [ 0 .. 100 ]
Default: 10
createdAt
string <date-time>

Filter by creation date. Supports comparison prefixes: >, <, >=, <=.

updatedAt
string <date-time>

Filter by last-updated date. Supports comparison prefixes: >, <, >=, <=.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Get a host

Authorizations:
ApiKeyAuth
path Parameters
hostId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Services

List services

Authorizations:
ApiKeyAuth
query Parameters
q
string

Free-text search.

ip
string

Filter by IP address.

hostname
string

Filter by hostname.

port
string

Filter by port number.

geoIP.asn
integer

Filter by autonomous system number.

geoIP.cityName
string

Filter by city name.

geoIP.countryName
string

Filter by country name.

geoIP.organization
string

Filter by the network organization (from GeoIP data).

source
string

Filter by discovery source.

tasks
string

Filter by the ID of the scan that discovered the finding.

page
integer >= 1
Default: 1
limit
integer [ 0 .. 100 ]
Default: 10
createdAt
string <date-time>

Filter by creation date. Supports comparison prefixes: >, <, >=, <=.

updatedAt
string <date-time>

Filter by last-updated date. Supports comparison prefixes: >, <, >=, <=.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Get a service

Authorizations:
ApiKeyAuth
path Parameters
serviceId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Vulnerabilities

List vulnerabilities

Authorizations:
ApiKeyAuth
query Parameters
q
string

Free-text search.

status
string
Enum: "open" "closed" "fp"

Filter by status. Prefix with ! to negate. Repeat the parameter to match multiple values.

severity
string
Enum: "critical" "high" "medium" "low" "info" "unknown"

Filter by severity. Prefix with ! to negate. Repeat the parameter to match multiple values.

ip
string

Filter by IP address.

host
string

Filter by hostname.

port
string

Filter by port number.

geoIP.asn
integer

Filter by autonomous system number.

geoIP.cityName
string

Filter by city name.

geoIP.countryName
string

Filter by country name.

geoIP.organization
string

Filter by the network organization (from GeoIP data).

engine
string

Filter by detection engine. Use hagent for agent-detected findings, or !hagent for externally-detected findings.

tasks
string

Filter by the ID of the scan that discovered the finding.

name
string

Filter by vulnerability name.

tags
string

Filter by vulnerability tag. Repeat the parameter to match multiple values.

templateID
string

Filter by the ID of the detection template/check that raised the finding.

classification.cve
string

Filter by CVE identifier.

classification.cwe
string

Filter by CWE identifier.

classification.cpe
string

Filter by CPE.

classification.cvssScore
number

Filter by CVSS score. Supports comparison prefixes: >, <, >=, <=.

classification.epssScore
number

Filter by EPSS score. Supports comparison prefixes: >, <, >=, <=.

classification.epssPercentile
number

Filter by EPSS percentile. Supports comparison prefixes: >, <, >=, <=.

page
integer >= 1
Default: 1
limit
integer [ 0 .. 100 ]
Default: 10
createdAt
string <date-time>

Filter by creation date. Supports comparison prefixes: >, <, >=, <=.

updatedAt
string <date-time>

Filter by last-updated date. Supports comparison prefixes: >, <, >=, <=.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Get a vulnerability

Authorizations:
ApiKeyAuth
path Parameters
vulnId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Update a vulnerability's severity or status

Requires a read-write API key.

Authorizations:
ApiKeyAuth
path Parameters
vulnId
required
string
Request Body schema: application/json
severity
string
Enum: "critical" "high" "medium" "low" "info" "unknown"
status
string
Enum: "open" "fp" "closed"

Responses

Request samples

Content type
application/json
{
  • "severity": "critical",
  • "status": "open"
}

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Websites

List websites

Authorizations:
ApiKeyAuth
query Parameters
q
string

Free-text search.

ip
string

Filter by IP address.

hostname
string

Filter by hostname.

port
string

Filter by port number.

url
string

Filter by URL.

geoIP.asn
integer

Filter by autonomous system number.

geoIP.cityName
string

Filter by city name.

geoIP.countryName
string

Filter by country name.

geoIP.organization
string

Filter by the network organization (from GeoIP data).

htmlTitle
string

Filter by the page's HTML title.

httpResponseStatusCode
integer

Filter by HTTP response status code. Supports comparison prefixes: >, <, >=, <=.

webServer
string

Filter by the web server header value.

webTechnologies
string

Filter by detected web technology.

tlsInfo.sni
string

Filter by the TLS certificate's server name indication.

tlsInfo.subjectDistinguishedName
string

Filter by the TLS certificate's subject distinguished name.

tlsInfo.issuerDistinguishedName
string

Filter by the TLS certificate's issuer distinguished name.

tlsInfo.subjectAlternativeNames
string

Filter by one of the TLS certificate's subject alternative names.

page
integer >= 1
Default: 1
limit
integer [ 0 .. 100 ]
Default: 10
createdAt
string <date-time>

Filter by creation date. Supports comparison prefixes: >, <, >=, <=.

updatedAt
string <date-time>

Filter by last-updated date. Supports comparison prefixes: >, <, >=, <=.

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}

Get a website

Authorizations:
ApiKeyAuth
path Parameters
websiteId
required
string

Responses

Response samples

Content type
application/json
{
  • "status": "success",
  • "data": {
    }
}