HYPERION — API Docs

Overview

The Hyperion API provides programmatic access to a continuously updated index of internet hosts, open ports, service banners, TLS certificates, web intelligence, and identity data. All endpoints are read-only.

Base URL: https://api.hyperionosint.com

All responses are JSON. All requests must use HTTPS. The API only accepts GET requests.

Authentication

The Hyperion website is fully public — no key needed to search or browse.

If you want programmatic access in your own application, you need an API key. Sign in with GitHub at hyperionosint.com/account — a key is generated automatically and shown in your dashboard.

Request Header (external / programmatic use)

X-Hyperion-Key: hk_your_key_here

Example — curl

curl https://api.hyperionosint.com/api/stats \
  -H "X-Hyperion-Key: hk_your_key_here"

Example — JavaScript

const res = await fetch('https://api.hyperionosint.com/api/search?q=port:22', {
  headers: { 'X-Hyperion-Key': 'hk_your_key_here' }
});
const data = await res.json();

Keep your API key private. Regenerate it any time from your account dashboard.

Rate Limits

Two rolling window rate limits are enforced. Exceeding either returns a 429 response with no body. The window resets automatically — wait and retry.

Limit	Window	Scope	Response on exceed
60 requests	60 seconds	Per API key	HTTP 429
120 requests	60 seconds	Per IP address	HTTP 429

GET /api/search

GET

/api/search

The primary search endpoint. Accepts a query string and auto-detects the query type — IP, domain, email, CVE, ASN, prefix search, or freetext. Returns a paginated list of result cards.

Parameter	Type	Default	Description
q	string	required	Search query. Max 120 chars. Supports plain values, prefixed queries (e.g. `port:22`), IPs, domains, emails, CVEs, and ASNs.
page	integer	1	Page number, 1-based.
limit	integer	50	Results per page. Max 100.
sort	string	last_seen	Sort field. See Sorting.
order	string	desc	`asc` or `desc`.
country	string	—	Filter by country code (e.g. `US`) or country name.
org	string	—	Filter by organisation or ISP name (partial match).
tag	string	—	Filter by host tag (e.g. `redis-noauth`).
port	integer	—	Filter to hosts with this port open (1–65535).
has_vulns	boolean	—	If `true`, only return hosts with known CVEs.
has_http	boolean	—	If `true`, only return hosts with HTTP intelligence data.
has_ssh	boolean	—	If `true`, only return hosts with port 22 open.
tls_version	string	—	Filter by TLS version (e.g. `TLSv1.1`).

Example Requests

# All hosts with Redis exposed
GET /api/search?q=port:6379

# WordPress sites in Germany with known vulns
GET /api/search?q=cms:WordPress&country=DE&has_vulns=true

# Full details on a single IP
GET /api/search?q=1.2.3.4

# CVE lookup
GET /api/search?q=CVE-2021-44228

# Email intelligence
GET /api/search?q=user@example.com

# People search
GET /api/search?q=name:John+Smith

GET /api/stats

GET

/api/stats

Returns platform-wide counters updated continuously by the scanner.

Response

{
  "ips":        4820000000,
  "ports":      1240000000,
  "people":     2841000,
  "vehicles":   980000,
  "updated_at": "2025-03-13T12:00:00Z"
}

GET /api/worldview

GET

/api/worldview

Returns pre-aggregated geo-bucketed data for map visualisation layers.

Parameter	Type	Default	Description
types	string	ipheat,identity, breach,scannode, camera,tor	Comma-separated layer types. Valid: `ipheat` `identity` `breach` `scannode` `camera` `tor` `cable` `isp`

Response

{
  "buckets": [
    { "type": "ipheat", "lat": 51.5, "lon": -0.1, "value": 4200, "label": "London" }
  ]
}

GET /api/worldview/heatmap

GET

/api/worldview/heatmap

Computes a live IP density heatmap from the hosts collection. Heavy query on large datasets — cache results where possible.

Parameter	Type	Default	Description
resolution	float	2.0	Grid cell size in degrees (0.5–10.0). `2.0` ≈ 200km cells.

Response

{
  "buckets": [ { "lat": 50.0, "lon": -0.0, "value": 8420 } ],
  "resolution": 5.0
}

GET /api/worldview/live

GET

/api/worldview/live

Returns recently enriched hosts with geo coordinates. Poll every few seconds to flash live scan activity on the map. Use the since parameter to fetch only new enrichments since your last poll.

Parameter	Type	Default	Description
limit	integer	200	Number of hosts to return (1–500).
since	string	—	ISO 8601 datetime. Only return hosts enriched after this timestamp.

Response

{
  "hosts": [
    { "lat": 51.5, "lon": -0.1, "enriched_at": "2025-03-13T12:00:01.000Z" }
  ]
}

GET /api/worldview/stats

GET

/api/worldview/stats

Returns aggregated counts per worldview layer type.

Response

{
  "ipheat": 4820000, "identity": 284100,
  "breach": 19200,  "camera": 8840, "tor": 3210
}

Query Prefixes

Prefix your query with a field name followed by a colon to search a specific field. The API auto-detects bare IPs, emails, domains, CVEs, and ASNs without a prefix.

port:port:22 / port:80,443

cve:cve:CVE-2021-44228

asn:asn:AS15169

org:org:Amazon

isp:isp:Cloudflare

tag:tag:redis-noauth

country:country:US / country:Germany

city:city:Berlin

cms:cms:WordPress

tech:tech:Nginx

title:title:Dashboard

hostname:hostname:example.com

keyword:keyword:admin

tls:tls:TLSv1.1

ssh:ssh:OpenSSH / ssh:Dropbear

version:version:7.4

hash:hash:<favicon_hash>

body:body:<md5_fingerprint>

phone:phone:+1234567890

username:username:johndoe

name:name:John Smith / name:

Auto-detected without prefix: IP addresses, email addresses, domain names, CVE IDs, and ASNs.

name: with no value returns a browse index of all identities. name:John Smith returns a full profile with linked IPs, accounts, and breach records.

Filters

Filters are applied as additional constraints on top of the main query and can be combined freely.

Examples

# WordPress in the US with vulns, port 443 open
GET /api/search?q=cms:WordPress&country=US&has_vulns=true&port=443

# Redis in Google's ASN, sorted by most ports
GET /api/search?q=port:6379&org=Google&sort=port_count

# Hosts with port 8443 AND SSH open
GET /api/search?q=port:8443&has_ssh=true

Sorting

Value	Description
last_seen	Most recently scanned first (default)
first_seen	Oldest indexed hosts first
country	Alphabetical by country name
org	Alphabetical by organisation
ip	Numerical by IP address
port_count	Hosts with most open ports first

Combine with order=asc or order=desc (default: desc).

Pagination

All list endpoints return pagination metadata alongside results.

Pagination fields in every response

{
  "total":    4820,   // total matching documents
  "page":     1,      // current page
  "pages":    97,     // total pages
  "limit":    50,     // results per page
  "has_more": true,   // whether another page exists
  "cards":    [...]
}

Single-record lookups (IP, email, phone, username, name) always return page 1 of 1 and do not support pagination.

Host Result

IP lookups return cards covering network intelligence, open ports, service banners, web intelligence, TLS details, vulnerabilities, and tags.

Key fields

{
  "ip":           "1.2.3.4",
  "hostname":     "mail.example.com",
  "asn":          "AS15169",
  "org":          "Google LLC",
  "country_name": "United States",
  "ports":        [22, 80, 443],
  "vulns":        ["CVE-2021-44228"],
  "tags":         ["self-signed-cert"],
  "http": { "title": "Example Corp", "cms": "WordPress 6.2" },
  "ssl":  { "subject": "example.com", "tls_version": "TLSv1.3", "valid": true },
  "last_seen":    "2025-03-10T14:22:00Z"
}

Identity Result

Email, phone, username, and name lookups cross-reference the identity collection against the host index. Results include breach records, linked accounts, associated IPs, and sites exposing the identifier.

Key fields

{
  "name":      "John Doe",
  "emails":    ["john@example.com"],
  "usernames": ["jdoe92"],
  "ips":       ["1.2.3.4"],
  "breaches": [{ "source": "LinkedIn", "year": 2021 }],
  "accounts": [{ "platform": "github", "handle": "jdoe92" }]
}

Errors

Status	Meaning
400	Bad request — invalid query format or parameter value
403	Forbidden — missing or invalid API key
429	Rate limit exceeded — wait and retry
500	Internal server error

403 and 429 responses return no body. 400 responses include a detail field.