Upcoming Changes to Legacy Search Data and APIs
As part of the plan to decommission Legacy Search (search.censys.io) in 2026, Censys will update its host data backend on March 28, 2026. In Legacy Search, this will result in changes to virtual host behavior, data freshness, select API fields, and other minor adjustments. These changes are described in detail below.
These changes do not remove host coverage from Legacy Search. Additionally, this change does not affect Platform (platform.censys.io) data or functionality.
Overall host coverage, scan cadence, historical data retention, existing functionality, query syntax, UI workflows, and entitlements in Legacy Search are not impacted.
Virtual hosts
The table below summarizes key changes to virtual host data after the change.
| Area | Before | After | Impact |
|---|---|---|---|
| Virtual host definition | One per each hostname and IP address | Based on latest scanned IP per port | Increased historical view of data |
| Service persistence | Up to 45 days | Removed on next negative scan | 14-day expiry, yielding less stale data |
| IP association | Services persisted across IPs | Services move scan IPs | Data “may” move between IPs |
| Duplication | Common | Reduced | More accurate representation of web assets |
Data freshness
- Expiration is changing to 14 days (previously 45 days).
- Index updates will occur only when a scan for that IP is received.
- The "See Latest" UI indication may appear more often.
- In general, there will be less long-lived stale data.
API and service lifecycle changes
- Timeline API: Forward pagination will be removed. API users must set
reversed=true. - Service lifecycle: Services pending removal will be immediately removed from assets when a scan indicates they are no longer visible, instead of being marked as pending.
Removed fields
The following fields will be removed from Legacy Search:
services.parsed.rocketmq.version(RocketMQ)services.ipp.response(IPP)services.ipp.cups_response(IPP)services.elasticsearch.http_info(Elasticsearch)services.tls.server_key_exchange(TLS)services.prometheus.http_info(Prometheus)services.transport_fingerprint.*(Transport)
DNS records
dns.records.record_typewill no longer return CNAME.- Record types will be limited to A and AAAA only.
Certificate API update frequency
The update frequency for the following APIs will change from realtime to every six hours:
/v2/hosts/{ip}/certificates/v2/certificates/{fingerprint}/observations
We encourage you to review your workflows and integrations to prepare for these upcoming changes. If you have any questions or concerns about this transition, please reach out to our team at [email protected].