Report visibility
Visibility controls who can access a report. Choose it before submitting a URL.
| Value | Intended use |
|---|---|
public | Visible to every account. Use it for shareable research that contains no confidential or personal data. This is the default. |
restricted | Hidden from the public. Visible to you, your team, and accounts whose plan includes restricted report access. |
private | Visible only to you and your team. |
A report is always visible to the account that submitted it and to that account's team.
Visibility is not sanitization
Restricted or private access does not make a sensitive URL safe to submit. The analysis environment still has to request the URL, and operational processing may retain evidence needed to deliver the service.
Remove secrets before submission. Avoid URLs containing authentication tokens, personal information, internal hostnames, or confidential object names.
Search, MCP, and Host Profile results
Report search and report-focused MCP tools operate on reports visible to the authenticated API key. Counts and trends therefore describe the caller's visible report population, not all urlquery data or global threat prevalence.
Some lists are narrower than what you can open:
- Related-report lists by domain or ASN contain public reports only. Lists by IP address add restricted reports for accounts with restricted access.
- Search covers reports from the last year.
- Recent reports with
scope=allcontain your own reports and reports open to your plan; usescope=teamfor your team's restricted and private reports.
Host Profile data is different: it comes from a shared observation corpus built from processed analyses and is not filtered by the source report's visibility. It exposes bounded infrastructure facts and relationships rather than full reports, but those observations can be derived from public, restricted, or private submissions. Do not submit sensitive internal hosts or URLs on the assumption that report visibility prevents derived infrastructure observations.
Team access
Members of a team can see each other's restricted and private reports. Your plan decides whether you can also see other accounts' restricted reports. Do not share an API key as a substitute for adding someone to your team.