Verify Post-Deployment Exposure

This workflow separates three states: scan completion, indexed-data freshness, and exposure-policy evaluation. A completed scan is not enough if the host lookup still returns an older observation.

Requirements

OEM access for scan queueing and status
API access for host details
A specific hostname you own or are authorized to scan
An approved expected-port and prohibited-port policy
Python 3.10 or later with requests

Step 1: complete the scan lifecycle

Run Orchestrate an OEM Scan Lifecycle with FULLHUNT_SCAN_TYPE=host. Keep the completed state file.

export FULLHUNT_SCAN_TYPE="host"
export FULLHUNT_SCAN_TARGET="api.your-owned-domain.example"
export FULLHUNT_SCAN_STATE="deployment-scan.json"
python oem_scan_lifecycle.py

Step 2: evaluate a fresh host observation

export FULLHUNT_API_KEY="YOUR_API_KEY"
export FULLHUNT_DEPLOYMENT_HOST="api.your-owned-domain.example"
export FULLHUNT_SCAN_STATE="deployment-scan.json"
export FULLHUNT_EXPECTED_PORTS="443"
export FULLHUNT_PROHIBITED_PORTS="22,2375,9200"
python verify_deployment_exposure.py

verify_deployment_exposure.py

import json
import os
import sys
import time
from pathlib import Path

import requests

API_KEY = os.environ["FULLHUNT_API_KEY"]
HOST = os.environ["FULLHUNT_DEPLOYMENT_HOST"]
SCAN_STATE = Path(os.environ["FULLHUNT_SCAN_STATE"])
EXPECTED = {int(value) for value in os.environ.get("FULLHUNT_EXPECTED_PORTS", "").split(",") if value}
PROHIBITED = {int(value) for value in os.environ.get("FULLHUNT_PROHIBITED_PORTS", "").split(",") if value}
MAX_POLLS = int(os.environ.get("FULLHUNT_RESULT_POLLS", "5"))
HEADERS = {"X-API-KEY": API_KEY}


def load_completed_scan():
    state = json.loads(SCAN_STATE.read_text(encoding="utf-8"))
    if state.get("type") != "host" or state.get("target") != HOST:
        raise ValueError("Scan state does not match the deployment host")
    if state.get("status") != "scan_completed":
        raise ValueError("OEM scan has not completed")
    completed_at = state.get("scan_info", {}).get("completed_at")
    if not isinstance(completed_at, (int, float)):
        raise ValueError("Completed scan has no usable completed_at timestamp")
    return int(completed_at)


def get_fresh_host(completed_at):
    url = f"https://fullhunt.io/api/v1/host/{HOST}"
    with requests.Session() as session:
        for attempt in range(MAX_POLLS):
            response = session.get(url, headers=HEADERS, timeout=60)
            if response.status_code == 404:
                observation = None
            else:
                response.raise_for_status()
                observation = response.json()
                if int(observation.get("last_seen") or 0) >= completed_at:
                    return observation
            if attempt + 1 < MAX_POLLS:
                time.sleep(60)
    return None


def main():
    completed_at = load_completed_scan()
    observation = get_fresh_host(completed_at)
    if observation is None:
        print(json.dumps({"decision": "unknown", "reason": "fresh indexed observation unavailable"}))
        return 2

    observed = {int(port) for port in observation.get("network_ports") or []}
    missing = sorted(EXPECTED - observed)
    prohibited = sorted(PROHIBITED & observed)
    decision = "pass" if not missing and not prohibited else "fail"
    print(
        json.dumps(
            {
                "decision": decision,
                "host": HOST,
                "scan_completed_at": completed_at,
                "observation_last_seen": observation.get("last_seen"),
                "observed_ports": sorted(observed),
                "missing_expected_ports": missing,
                "observed_prohibited_ports": prohibited,
            },
            indent=2,
        )
    )
    return 0 if decision == "pass" else 1


if __name__ == "__main__":
    sys.exit(main())

Each host lookup can consume a regular API credit. Keep FULLHUNT_RESULT_POLLS bounded and wait between attempts.

Deployment decision

Pass: The observation is fresh enough, every expected port is present, and no prohibited port is present.
Fail: The observation is fresh enough but violates the explicit port policy.
Unknown: The scan completed, but no indexed host record at or after completed_at became available within the polling budget.

Do not convert unknown into pass. Decide whether the deployment system should wait, stop, or require manual review. This verifies externally observed network exposure. It does not validate application health, authentication, authorization, request routing, or source-code configuration. Run those checks in the deployment platform.

Knowledge Base

Guides

Requirements

Step 1: complete the scan lifecycle

Step 2: evaluate a fresh host observation

Deployment decision

​Requirements

​Step 1: complete the scan lifecycle

​Step 2: evaluate a fresh host observation

​Deployment decision

Requirements

Step 1: complete the scan lifecycle

Step 2: evaluate a fresh host observation

Deployment decision