Vulnerabilities Search API

The OEM Vulnerabilities Search API allows partners to query platform-discovered vulnerabilities for a specific host, domain, or IP range. Results are sorted by most recently seen first.

OEM API requires special partner access. Contact FullHunt sales to enable OEM capabilities on your account.

Search Vulnerabilities

Search for vulnerabilities discovered by the FullHunt platform for a host, domain, or IP range. HTTP Request

POST https://fullhunt.io/api/v1/oem/vulnerabilities/search

Request Body Parameters

Parameter	Required	Type	Description
type	Yes	string	Type of query. Supported values: `host`, `domain`, `ip_range`
query	Yes	string	The host, IP address, domain, or IP range (CIDR) to search for
query_tags	No	object	Key-value pairs for client-specific tracking

Example Request - By Domain

curl -X POST "https://fullhunt.io/api/v1/oem/vulnerabilities/search" \
  -H "X-API-KEY: xxxx-xxxx-xxxx-xxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "domain",
    "query": "acme.com",
    "query_tags": {
      "client_name": "ACMECorp",
      "workspace": "production"
    }
  }'

Example Request - By Host

curl -X POST "https://fullhunt.io/api/v1/oem/vulnerabilities/search" \
  -H "X-API-KEY: xxxx-xxxx-xxxx-xxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "host",
    "query": "mail.acme.com"
  }'

Example Request - By IP Range

curl -X POST "https://fullhunt.io/api/v1/oem/vulnerabilities/search" \
  -H "X-API-KEY: xxxx-xxxx-xxxx-xxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "ip_range",
    "query": "203.0.113.0/24",
    "query_tags": {
      "client_name": "ACMECorp",
      "workspace": "production"
    }
  }'

Example Response

{
  "query": {
    "type": "domain",
    "value": "acme.com"
  },
  "total_results": 1,
  "results": [
    {
      "host": "mail.acme.com",
      "domain": "acme.com",
      "tld": "com",
      "affected_location": "https://mail.acme.com:443",
      "vulnerability_id": "aws-bucket-takeover",
      "category": "Domain Takeover",
      "cve_id": "",
      "cwe_id": "CWE-200",
      "cvss_score": 8.5,
      "epss_score": 0.0,
      "is_cve": false,
      "is_kev": false,
      "is_public_exploit": false,
      "name": "AWS Bucket Takeover Detection",
      "description": "AWS Bucket takeover was detected.",
      "impact": "The impact of this vulnerability can be severe, as it can result in unauthorized access to resources and potential data exposure.",
      "remedy": "Ensure that cloud buckets are properly configured with appropriate access controls. Verify that all referenced buckets exist and are not publicly accessible.",
      "severity": "high",
      "tags": ["takeover", "aws", "bucket"],
      "references": [
        "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"
      ],
      "date_added": "2026-04-28 22:26:08",
      "last_seen": "2026-05-14 13:57:27"
    }
  ]
}

Response Fields

Field	Type	Description
`query`	object	The query parameters used
`query.type`	string	Query type (`host`, `domain`, or `ip_range`)
`query.value`	string	The queried value. For `ip_range`, the normalized CIDR (a bare IP is echoed back as `/32`)
`total_results`	integer	Number of vulnerabilities returned
`results`	array	Array of vulnerability objects
`results[].host`	string	Affected host
`results[].domain`	string	Parent domain of the affected host
`results[].affected_location`	string	Specific URL or endpoint where the issue was detected
`results[].vulnerability_id`	string	FullHunt detection template identifier
`results[].cve_id`	string	CVE identifier
`results[].cwe_id`	string	CWE identifier
`results[].category`	string	Vulnerability category
`results[].severity`	string	Severity level (critical, high, medium, low, info)
`results[].cvss_score`	number	CVSS score (0.0–10.0)
`results[].epss_score`	number	EPSS probability score (0.0–1.0)
`results[].name`	string	Vulnerability title
`results[].description`	string	Vulnerability description
`results[].impact`	string	Description of the potential impact
`results[].remedy`	string	Recommended remediation
`results[].tags`	array	Classification tags
`results[].references`	array	Reference URLs
`results[].is_cve`	boolean	Whether this finding maps to a published CVE
`results[].is_kev`	boolean	Whether the CVE is in the CISA KEV catalog
`results[].is_public_exploit`	boolean	Whether a public exploit is known
`results[].date_added`	string	First detection date
`results[].last_seen`	string	Most recent detection date

Searching by IP Range

ip_range takes CIDR notation. A bare IP address is accepted and treated as a /32, so "query": "203.0.113.10" and "query": "203.0.113.10/32" are equivalent. The query.value in the response echoes the normalized CIDR. A range may cover at most 4096 addresses (a /20 for IPv4). Larger ranges are rejected with a 400 - split them into smaller blocks and issue one request per block.

Which findings an IP-range search returns An ip_range search matches vulnerabilities recorded against bare IP addresses inside the range.Findings discovered on a DNS hostname are recorded against that hostname, even when it resolves to an address inside the range. If a range returns fewer results than expected, the assets are most likely tracked by hostname - search those with type: "domain" (all findings under a registered domain) or type: "host" (one specific hostname).

Use Cases

Client Risk Reporting: Generate vulnerability reports for managed clients
Attack Surface Monitoring: Track newly discovered vulnerabilities per domain
Infrastructure Sweeps: Check an owned netblock for exposed findings with ip_range
Prioritization: Sort by severity or CVSS score to drive remediation
Compliance: Document exposure for audit and compliance purposes

Query Tags for Tracking

Use query_tags to track per-client usage in audit logs:

{
  "query_tags": {
    "client_id": "client_123",
    "client_name": "ACME Corporation",
    "workspace": "production"
  }
}

Error Handling

Status Code	Description
200	Success
400	Bad Request - missing or invalid parameters, malformed CIDR, or an `ip_range` larger than 4096 addresses
401	Unauthorized - invalid API key
403	Forbidden - OEM access not enabled or credits exhausted
429	Rate limit exceeded (60 requests/minute)
500	Internal server error

Get Started

Integration Foundations

Core Attack Surface

Search & Intelligence

Enterprise APIs

Nexus APIs

OEM APIs

Public APIs

Generated API Reference

Agentic AI (MCP)

Search Vulnerabilities

Searching by IP Range

Use Cases

Query Tags for Tracking

Error Handling

​Search Vulnerabilities

​Searching by IP Range

​Use Cases

​Query Tags for Tracking

​Error Handling

Search Vulnerabilities

Searching by IP Range

Use Cases

Query Tags for Tracking

Error Handling