Host Profile API

The public v2 Host Profile API profiles observed FQDNs and IPs, finds hosts sharing exact facts, and traverses directional relationships captured in urlquery reports.

For what a host profile contains, how to read it, and how to use it in an investigation, see Host Profile.

All routes are on https://api.urlquery.net and require x-apikey. Every route is under /public/v2/hosts.

Method	Path	Quota class	Result
GET	/public/v2/hosts/{host}	host_lookup	Profile of one FQDN or IP.
GET	/public/v2/hosts?{fact}={value}	host_collection	Hosts that share one observed fact.
GET	/public/v2/hosts/{host}/relations	host_collection	Relations to and from one host.
GET	/public/v2/hosts/relations	host_collection	Relations across all hosts.
GET	/public/v2/hosts/search	host_search	Hosts by observation time and relation metrics.

Every call also consumes the account's overall v2 quota. search and relations are reserved words under /hosts, so a host with one of those names cannot be profiled by path.

Interpretation

Host Profile data is an observation corpus, not passive DNS or proof of ownership.

• It is a shared corpus and is not filtered by the visibility of the source report. Derived host facts and relations can originate from public, restricted, or private analyses.
• times_seen counts deduplicated processed reports containing an exact host, fact, or relation. It is not traffic volume.
• first_seen and last_seen are report-derived bounds, not proof of continuous activity.
• IP associations come from captured HTTP transactions and are not passive DNS history.
• Cookie values and response-header values are not stored.
• Relations and shared facts do not establish ownership, campaign membership, or maliciousness.

Get a host profile

GET /public/v2/hosts/{host}

host must be an exact FQDN or IP literal, not a URL. The optional limit parameter controls facts returned per category; it accepts 1 through 1000 and defaults to 100.

curl --fail-with-body \
  --header "x-apikey: ${URLQUERY_API_KEY}" \
  "https://api.urlquery.net/public/v2/hosts/example.com?limit=10"

A profile contains the host record, observed IPs, technologies, certificate hashes and metadata, value-free cookie fingerprints, response-header names, MIME types, and relation totals.

Pivot on an exact fact

GET /public/v2/hosts?{fact}={value}

Send exactly one of these parameters. Two pivots, or none, return 400 BAD_REQUEST.

Parameter	Fact	Example
domain	Registrable domain; lists the hosts under it.	domain=example.com
ip	IPv4 or IPv6 address the hosts were reached at.	ip=192.0.2.10
asn	Autonomous system number of the hosts' IP addresses.	asn=64500
country	ISO 3166-1 alpha-2 country of the hosts' IP addresses.	country=NO
technology	Fingerprinted technology.	technology=nginx
certificate	TLS certificate SHA-256 as 64 hex characters, or an exact issuer or subject organization or common name, case-insensitive.	certificate=<SHA256>
cookie	Cookie name.	cookie=sessionid
header	Response-header name.	header=x-powered-by
mime	MIME type as type/subtype.	mime=application/javascript

Common collection parameters are:

Parameter	Values
limit	1 through 1000; defaults to 100.
sort	first_seen or last_seen, of the matched fact or relation rather than the host; defaults to last_seen.
order	asc or desc; defaults to desc.
cursor	Opaque continuation token from the prior page.

Two pivots take extra filters, and only those pivots accept them:

• domain accepts include_apex=true|false, which defaults to true.
• cookie accepts secure, http_only, partitioned, host_only, and persistent (booleans), same_site (strict, lax, none, or unspecified), and path.

curl --fail-with-body --get \
  --header "x-apikey: ${URLQUERY_API_KEY}" \
  --data-urlencode "certificate=${CERT_SHA256}" \
  --data-urlencode 'limit=25' \
  https://api.urlquery.net/public/v2/hosts

curl --fail-with-body --get \
  --header "x-apikey: ${URLQUERY_API_KEY}" \
  --data-urlencode 'cookie=sessionid' \
  --data-urlencode 'secure=false' \
  --data-urlencode 'http_only=false' \
  https://api.urlquery.net/public/v2/hosts

Distinctive certificate hashes or cookie attribute combinations are usually stronger pivots than common technologies, headers, MIME types, or shared hosting IPs.

Traverse relations

GET /public/v2/hosts/{host}/relations
GET /public/v2/hosts/relations

Relation types are:

Type	Meaning
redirects_to	The source returned an HTTP redirect to the target.
loads_from	The source loaded a passive resource from the target.
calls	The source made an active browser request to the target.
embeds	The source framed or embedded the target.

Host-relative relation queries accept direction=incoming|outgoing|both (default both) and an optional type. Global relation queries accept source, target, and type filters.

curl --fail-with-body --get \
  --header "x-apikey: ${URLQUERY_API_KEY}" \
  --data-urlencode 'direction=outgoing' \
  --data-urlencode 'type=redirects_to' \
  --data-urlencode 'limit=25' \
  "https://api.urlquery.net/public/v2/hosts/example.com/relations"

Search host cohorts

GET /public/v2/hosts/search

Search supports inclusive RFC3339 bounds for first_seen and last_seen, plus incoming and outgoing relation metrics.

Filter family	Parameters
Observation time	first_seen_after, first_seen_before, last_seen_after, last_seen_before
Incoming relation	incoming_relation_type, min_incoming_total, max_incoming_total, min_incoming_relation_count, max_incoming_relation_count, min_incoming_relation_ratio, max_incoming_relation_ratio
Outgoing relation	Corresponding outgoing_* parameters

Relation types are redirects_to, loads_from, calls, and embeds. Counts must be non-negative and ratios must be from 0 through 1. Relation count and ratio filters require the corresponding relation type.

Search also accepts limit, order, and cursor like other collections. sort can be first_seen, last_seen (default), incoming_total, incoming_relation_count, incoming_relation_ratio, outgoing_total, outgoing_relation_count, or outgoing_relation_ratio. Sorting by a relation count or ratio also requires the corresponding relation type.

curl --fail-with-body --get \
  --header "x-apikey: ${URLQUERY_API_KEY}" \
  --data-urlencode 'last_seen_after=2026-08-01T00:00:00Z' \
  --data-urlencode 'last_seen_before=2026-08-30T23:59:59Z' \
  --data-urlencode 'incoming_relation_type=calls' \
  --data-urlencode 'min_incoming_relation_count=10' \
  --data-urlencode 'min_incoming_relation_ratio=0.8' \
  --data-urlencode 'sort=incoming_relation_ratio' \
  --data-urlencode 'order=desc' \
  https://api.urlquery.net/public/v2/hosts/search

This generates investigation candidates; it does not identify an operator or campaign by itself.

Pagination

V2 collections place items and page under data:

{
  "success": true,
  "data": {
    "items": [],
    "page": {
      "limit": 25,
      "sort": "last_seen",
      "order": "desc",
      "next_cursor": "<OPAQUE_CURSOR>",
      "has_more": true
    }
  }
}

Reuse next_cursor with exactly the same endpoint, filters, sort, and order. Do not parse or modify it. An empty collection returns 200 OK with items: [].

V2 errors

{
  "success": false,
  "error": {
    "http_code": 400,
    "error": "BAD_REQUEST",
    "message": "invalid host"
  }
}

Stable error codes include BAD_REQUEST (400), MISSING_API_KEY (401), INVALID_API_KEY (403), NOT_FOUND (404), METHOD_NOT_ALLOWED (405), RATE_LIMIT_EXCEEDED (429), INTERNAL_ERROR (500), BAD_GATEWAY (502), RATE_LIMIT_UNAVAILABLE (503), and GATEWAY_TIMEOUT (504). ASN pivots require a positive ASN. See the API overview for what to do about each.