FullHunt API

The FullHunt API gives security teams and platform builders programmatic access to external attack surface intelligence. Use it to discover assets, enrich domains and hosts, monitor exposures, search threat intelligence datasets, and connect FullHunt data to internal workflows.

Start with authentication

Send your first authenticated request with the X-API-KEY header and confirm your plan, credit balance, and request limits.

Explore the core APIs

Query domains, hosts, subdomains, technologies, exposures, and on-demand scan results from one API surface.

Search intelligence datasets

Run global search, organization database search, vulnerability intelligence, and data intelligence queries.

Automate with MCP

Connect FullHunt to agentic workflows through the hosted Model Context Protocol integration.

Base URL

All API requests are made to one of two hosts:

Host	Purpose
`https://fullhunt.io/api/v1/`	Standard API access
`https://enterprise-api.fullhunt.io/api/v1/`	Dedicated enterprise infrastructure

Both hosts serve identical endpoints. Enterprise customers should use the dedicated host for improved performance and higher rate limits.

Versioning

The current API version is v1. All endpoints are prefixed with /api/v1/. Breaking changes will be introduced under a new version prefix.

Quick Start

Get an API key

Create or sign in to your FullHunt account, then copy your key from profile settings.

Verify authentication

Send a request to /auth/status with the X-API-KEY header.

curl "https://fullhunt.io/api/v1/auth/status" \
  -H "X-API-KEY: xxxx-xxxx-xxxx-xxxxxx"

import requests

response = requests.get(
    "https://fullhunt.io/api/v1/auth/status",
    headers={"X-API-KEY": "xxxx-xxxx-xxxx-xxxxxx"},
    timeout=30,
)
print(response.json())

const response = await fetch("https://fullhunt.io/api/v1/auth/status", {
  headers: { "X-API-KEY": "xxxx-xxxx-xxxx-xxxxxx" },
});

console.log(await response.json());

Run your first lookup

Query a domain or host, then use the response metadata to understand result limits and account context.

cURL

curl "https://fullhunt.io/api/v1/domain/example.com/details" \
  -H "X-API-KEY: xxxx-xxxx-xxxx-xxxxxx"

Handle operational limits

Review rate limits, error responses, and endpoint-specific credit behavior before moving traffic into production.

Keep API keys on your server. Browser applications should proxy authenticated FullHunt API calls through a backend service instead of exposing keys in client-side code.

API Coverage

Core Attack Surface

Domain intelligence, host details, discovered assets, technologies, exposures, and on-demand scans.

Search & Intelligence

Global search, organization search, vulnerability intelligence, and broader data intelligence APIs.

Enterprise APIs

Organization management, alerts, vulnerabilities, entities, certificates, suggested domains, and dark web monitoring.

Nexus APIs

Tor lookup, passive DNS, cloud certificates, domain collection, IP intelligence, and WHOIS lookup.

OEM APIs

Partner-oriented attack surface, vulnerability, dark web, phishing, scan, and account-management workflows.

Public APIs

Public browser-safe resources such as logos, technology icons, and selected archive search routes.

Response Format

Most successful responses return JSON with a consistent envelope:

Response envelope

{
  "status": 200,
  "message": "",
  "metadata": {
    "domain": "example.com",
    "all_results_count": 150,
    "available_results_for_user": 100,
    "max_results_for_user": 100,
    "timestamp": 1634004417,
    "user_plan": "enterprise"
  }
}

Field	Description
`status`	HTTP status code mirrored in the body
`message`	Empty on success, error description on failure
`metadata`	Pagination, plan limits, timestamps, and query context

Error responses follow the same general structure. See API Error Codes for status codes and recovery guidance.

Browser and CORS Access

Most FullHunt API endpoints are intended for server-to-server use. The API does not expose blanket CORS access for every route. CORS headers are intentionally limited to selected public browser-safe routes, such as search suggestions and public 0day.today archive search. The hosted MCP endpoint handles its own CORS preflight and streaming requirements for MCP clients. When building browser applications, proxy authenticated FullHunt API calls through your backend and keep API keys out of client-side code.

Production Checklist

Store API keys in server-side secrets management.
Set request timeouts and retry transient failures with backoff.
Use rate-limit headers when present, and fall back to documented per-route limits.
Cache stable enrichment data when your freshness requirements allow it.
Monitor credit usage and result limits from response metadata.

Need Help?

Sign up for a FullHunt API key
Contact support for enterprise or OEM inquiries
Check Rate Limiting and API Error Codes before production rollout

Get Started

Integration Foundations

Core Attack Surface

Search & Intelligence

Enterprise APIs

Nexus APIs

OEM APIs

Public APIs

Generated API Reference

Agentic AI (MCP)

Start with authentication

Explore the core APIs

Search intelligence datasets

Automate with MCP

Base URL

Versioning

Quick Start

API Coverage

Core Attack Surface

Search & Intelligence

Enterprise APIs

Nexus APIs

OEM APIs

Public APIs

Response Format

Browser and CORS Access

Production Checklist

Need Help?

Start with authentication

Explore the core APIs

Search intelligence datasets

Automate with MCP

​Base URL

​Versioning

​Quick Start

​API Coverage

Core Attack Surface

Search & Intelligence

Enterprise APIs

Nexus APIs

OEM APIs

Public APIs

​Response Format

​Browser and CORS Access

​Production Checklist

​Need Help?

Base URL

Versioning

Quick Start

API Coverage

Response Format

Browser and CORS Access

Production Checklist

Need Help?