Data Provenance and Freshness - FullHunt API Documentation

FullHunt combines indexed attack-surface observations with vulnerability, exploit, advisory, DNS, certificate, registration, Tor, organization, and dark-web datasets. Collection timing and coverage differ by source.

Freshness model

Data type	Interpretation
Domain and host details	Indexed observations collected before the request; not a live scan
Enterprise alerts	Recorded changes or events associated with monitored account assets
Enterprise vulnerabilities	Findings observed against monitored assets
On-demand scan	Asynchronous request that can update platform datasets after processing
OEM historical hosts	Previously collected host records
Vulnerability intelligence	Source records with publication, modification, feed cutoff, or ingestion times
Passive DNS and WHOIS	Source-specific historical or registration observations
Tor lookup	Presence or absence in the queried Tor dataset at its collection time
Dark-web records	Source-specific observations requiring retention and privacy controls

Fields to preserve

Store the query, endpoint, response status, source identifiers, and every returned collection or modification timestamp. Common fields include:

timestamp
cutoff_epoch
first_seen and last_seen
date_added
created_at, updated_at, and completed_at
Vulnerability publication and modification fields

Missing and stale data

An empty response means the API returned no matching records under the current query, access, result limit, and dataset state. It does not prove that an asset, vulnerability, or relationship does not exist. When making a decision:

Record the query and cutoff time.
Check pagination and result limits.
Corroborate high-impact ownership or attribution conclusions.
Re-query according to the decision’s freshness requirement.
Distinguish not observed, not returned, and verified absent.