% Generated by roxygen2: do not edit by hand
% Please edit documentation in R/urlscan.R
\name{urlscan_search}
\alias{urlscan_search}
\title{Perform a urlscan.io query}
\usage{
urlscan_search(query, size = 100, offset = 0, sort = NULL)
}
\arguments{
\item{query}{query to run}

\item{size}{number of results to return (default is \code{100})}

\item{offset}{offset of first result (for pagination) (default is \code{0})}

\item{sort}{sorting, specified via \code{$sort_field:$sort_order}. Default: \code{_score}}
}
\description{
urlscan.io uses an Elasticsearch back-end and enables querying by a number
of fields, including:
}
\details{
\itemize{
\item \code{domain}: Domain (or a subdomain of it) is contacted in one of the requests
\item \code{page.domain}: Domain (or a subdomain of it) is the first domain to be contacted
\item \code{ip}: The IP or subnet are contacted in one request
\item \code{asn}: The autonomous system (AS) was contacted (\emph{must} use \code{AS} prefix!) (comma-separated for more than one)
\item \code{asname}: The autonomous system with this name was contacted (comma-separated for more than one)
\item \code{filename}: This filename was requested
\item \code{hash}: A resource with this SHA256 hash was downloaded
\item \code{server}: The page contact a host running this web server
\item \code{task.method}: one of "\code{manual}" or "\code{api}"; show manual (user) or API submissions
}

The fields \code{ip}, \code{domain}, \code{url}, \code{asn}, \code{asnname}, \code{country} and \code{server} can also be prefixed with \code{page.}
to only match the value for the first request/response (e.g. \code{page.server:nginx AND page.domain:de}).
Furthermore, you can concatenate search-terms with \code{AND}, \code{OR}, etc.
}
\note{
Search can only find \strong{public} scans, there is no way to search for private scans.
}
\references{
\url{https://urlscan.io/about-api/#search}
}