>_ API DOCUMENTATION

The OpenEASM API provides programmatic access to our attack surface intelligence database. All endpoints return JSON.

Base URL: https://openeasm.com/api

Authentication

API requests require authentication via API key or JWT token. Include your credentials in the request header:

# Using API Key (recommended)
curl -H "X-API-Key: cw_your_api_key" https://openeasm.com/api/search?q=example.com

# Using JWT Token
curl -H "Authorization: Bearer your_jwt_token" https://openeasm.com/api/search?q=example.com
Note: API access requires a Pro plan or higher. Generate API keys in your account dashboard.

Rate Limits

Rate limits depend on your plan:

Community free No API access
Pro $29/mo 10,000 requests/day, 1,000 searches/day
Enterprise $199/mo Unlimited

When rate limited, the API returns 429 Too Many Requests with details in the response body.

GET /search

Search SSL certificates, domains, and related assets.

Parameters

q* string Search query. Supports wildcards: %.example.com
limit integer Max results (default: 50, max depends on plan)

Example Request

curl -H "X-API-Key: cw_xxx" \
  "https://openeasm.com/api/search?q=%.hackerone.com"

Example Response

[
  {
    "common_name": "api.hackerone.com",
    "entry_time": "2026-01-28T12:00:00Z",
    "issuer_org": "Let's Encrypt",
    "not_before": "2026-01-01",
    "not_after": "2026-04-01",
    "sha1_certificate": "abc123...",
    "dns_a_records": ["104.16.99.52"],
    "h1_bounty": 1,
    "h1_program": "hackerone"
  }
]

Asset Graph

GET /graph

Get related assets for graph visualization. Returns nodes and edges for domains, IPs, emails, and ports.

Parameters

type* string Node type: domain, ip, email
value* string The domain, IP, or email to pivot from

Example

curl "https://openeasm.com/api/graph?type=domain&value=example.com"

Platform Stats

GET /stats

Get current database statistics. No authentication required.

Example Response

{
  "total": 2284789684,
  "dns_total": 98205702,
  "ports_total": 215007,
  "whois_total": 8450
}

Export Results

POST /export

Export search results as CSV or JSON. Requires Pro plan.

Request Body

query* string Search query
format string csv or json (default: json)

Managing API Keys

GET /auth/api-keys

List your API keys. Requires JWT authentication.

POST /auth/api-keys

Create a new API key. The full key is only shown once upon creation.

DELETE /auth/api-keys/:id

Delete an API key.