Host Enrichment API

The host enrichment API is a lightweight API purpose-built to help security teams operationalize external internet data without the friction of traditional credit consumption.

It provides a curated, fixed subset of host IPv4 or IPv6 data designed specifically for high-volume, automated lookups in SOC environments, such as SIEM and SOAR integrations.

The get host enrichment API is available to customers on the Censys Core plan.

Key benefits

Operationalize at scale: Perform automated lookups without consuming your standard API credit balance.
Optimized for triage: Receive a standardized, compact response that minimizes ingestion costs and speeds up the triage process for analysts.
Seamless integration: The API uses the same authentication as your existing Censys tools, making it a drop-in replacement for automated workflows.

Host enrichment API consumption costs

The enrichment API endpoint does not consume standard Censys credits.

Core organizations are limited to 20,000 enrichment API calls per day. Use best practices like prioritizing enrichment of high-severity alerts, excluding internal IP ranges, and caching lookups to avoid hitting the 20,000-per-day limit.

Organizations on the Censys Core + Unlimited Enrichment and Censys Security Operations plans can perform an unlimited number of enrichment API calls per day.

Get host enrichment API vs get host API

The get host enrichment API complements the get host API but is not intended to replace it. The enrichment API provides a quick glance at important host data, while the get host API can be used for deep dives.

Use the enrichment API for automated SOAR playbook triage, high-volume alert enrichment, and determining whether an IP address warrants further investigation.

Use the standard get host API (credit based) for manual analyst investigations, deep-dive incident response where the full host profile is required, and complex querying. Use of the get host API consumes credits.

Get host enrichment data fields

The enrichment API returns a fixed set of fields.

The returned fields are not customizable and the response does not show any historical data. Data returned contains the latest scan data only.

The response is intentionally compact to minimize SIEM ingestion costs and speed up triage.

Fields returned by the get host enrichment endpoint include those shown in the table below.

Field Category	Field Name
Geographic location	`host.location.city` `host.location.country` `host.location.country_code`
WHOIS	`host.whois.network.handle` `host.whois.network.name` `host.whois.organization.name` `host.whois.organization.address`
Autonomous System (ASN)	`host.autonomous_system.asn` `host.autonomous_system.description` `host.autonomous_system.bgp_prefix` `host.autonomous_system.name` `host.autonomous_system.country_code`
Forward DNS	`host.dns.names`
Reverse DNS	`host.dns.reverse_dns.names`
Services	`host.service_count` `host.services.port` `host.services.protocol`
Labels	`host.services.labels.value` `host.labels.value`
Reputation Score	`host.reputation.score` `host.reputation.score_level` `host.reputation.evidence.category` `host.reputation.evidence.evidence_score`
Threat	`host.services.threats.type` `host.services.threats.tactic` `host.services.threats.id` `host.services.threats.name`
GreyNoise Data	`host.greynoise.actor` `host.greynoise.classification` `host.greynoise.last_observed_time`
IPinfo Network Data	`host.network.hosting` `host.network.mobile` `host.network.satellite`
IPinfo Privacy Data	`host.privacy.anonymous` `host.privacy.tor` `host.privacy.proxy` `host.privacy.relay` `host.privacy.vpn`
Mallory Data	Mallory data, including threat descriptions, whether Mallory has evaluated a host to be suspicious or malicious, and info sources, is contained in the `third_party` data object in API responses.