curl --request GET \
--url https://api.periphery.exposed/v1/apps/{hostname} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.periphery.exposed/v1/apps/{hostname}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.periphery.exposed/v1/apps/{hostname}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"hostname": "acme-dashboard.vercel.app",
"provider": "vercel",
"status": 200,
"title": "Acme dashboard",
"firstSeen": "2026-08-02T10:15:40Z",
"lastSeen": "2026-10-30T14:03:11Z",
"scanned": true,
"faviconHash": -247388890,
"faviconUrl": "https://s3.gra.io.cloud.ovh.net/periphery/favicons/acme-dashboard.vercel.app.ico?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
"screenshotUrl": "https://s3.gra.io.cloud.ovh.net/periphery/screenshots/acme-dashboard.vercel.app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
"emails": [
"ops@acme.com"
],
"hasVerifiedCreds": true,
"verifiedDetectors": [
"Stripe"
],
"text": "Acme dashboard Sign in Forgot your password? Contact ops@acme.com",
"credentials": [
{
"detector": "Stripe",
"verified": true,
"masked": "sk_live_••••••••0000"
},
{
"detector": "Github",
"verified": false,
"masked": "ghp_8Kz2••••••••Qw1f"
}
]
}Get an app
Returns the full record for one hostname: its summary (the same
fields and values a search hit carries), the visible page text
and, on Plus, the masked credentials. The record is read live, so
it can be newer than a cached search page; when they differ, the
record wins.
It does not use a search from the monthly allowance, but shares the one request per second budget. Use it to refresh an app’s signed URLs, which expire after one hour.
Only hosts a search can return have a record: a host Periphery has
never visited, or one it proved dead, answers 404 app_not_found.
HEAD is allowed and answers like GET without a body; any other
method is answered 405 before the key is checked.
curl --request GET \
--url https://api.periphery.exposed/v1/apps/{hostname} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.periphery.exposed/v1/apps/{hostname}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.periphery.exposed/v1/apps/{hostname}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"hostname": "acme-dashboard.vercel.app",
"provider": "vercel",
"status": 200,
"title": "Acme dashboard",
"firstSeen": "2026-08-02T10:15:40Z",
"lastSeen": "2026-10-30T14:03:11Z",
"scanned": true,
"faviconHash": -247388890,
"faviconUrl": "https://s3.gra.io.cloud.ovh.net/periphery/favicons/acme-dashboard.vercel.app.ico?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
"screenshotUrl": "https://s3.gra.io.cloud.ovh.net/periphery/screenshots/acme-dashboard.vercel.app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
"emails": [
"ops@acme.com"
],
"hasVerifiedCreds": true,
"verifiedDetectors": [
"Stripe"
],
"text": "Acme dashboard Sign in Forgot your password? Contact ops@acme.com",
"credentials": [
{
"detector": "Stripe",
"verified": true,
"masked": "sk_live_••••••••0000"
},
{
"detector": "Github",
"verified": false,
"masked": "ghp_8Kz2••••••••Qw1f"
}
]
}Authorizations
Authorization: Bearer <key>. Used when both headers are present.
Path Parameters
The app's hostname, as returned by search. It is matched case-insensitively; a trailing dot is ignored; Unicode IDNs are accepted. The response carries the canonical lower-case ASCII form. A value that cannot be a hostname answers 404 app_not_found.
Response
The app record.
An app record: the app's summary (the same fields and values a search hit carries) plus text and, on Plus, credentials.
The app's hostname, lower-case ASCII, its stable identifier.
"acme-dashboard.vercel.app"
Provider slug, the value the provider: filter takes, such as vercel, netlify, railway or cloudflare_pages. An open enum: new providers are added over time, see the providers page.
"vercel"
HTTP status from the last render or fallback request that got an answer; 0 when none was recorded. A bot-wall page does not update it.
200
Page title at the last capture; "" when the page had none or was never rendered.
Time of Periphery's last visit that did not prove the host dead, whether or not the host answered. Not the capture time. RFC 3339 in UTC; always present.
True when Periphery captured the page and stored a snapshot (text, emails and credential scans). False for a host it only probed for liveness: then emails, verifiedDetectors and the snapshot URLs are absent.
True when at least one credential finding was verified, so verifiedDetectors is non-empty.
Visible text extracted at the last capture, up to 2,048 bytes; "" when none. It shows the page as captured and can contain a secret in full.
Time of the first visit that got any answer from the host, RFC 3339 in UTC. It never changes once set. For apps indexed before October 2026, the time Periphery indexed them. Omitted when the host has never answered.
Shodan-compatible favicon hash (mmh3). Present whenever a favicon was stored, even when the hash is 0; omitted otherwise.
Signed URL of the stored favicon, valid for one hour; GET /v1/apps/{hostname} returns a fresh one without using a search. An SVG favicon downloads as an attachment when opened directly. Omitted when no favicon was stored.
Signed URL of the stored screenshot, valid for one hour; GET /v1/apps/{hostname} returns a fresh one without using a search. It shows the page as captured and can show a secret in full. Omitted when there is no screenshot.
Email addresses found on the page, lower-cased and deduplicated, up to 100. [] when the page was scanned and had none; omitted when it was never scanned.
Names of the detectors with a verified finding, deduplicated case-insensitively and sorted. Each works as creds:<name>. [] when the credential scan found nothing verified; omitted when no credential scan was stored.
Plus only. Every credential finding, verified or not, up to 20 per host, verified first, each masked. [] when the credential scan found nothing; omitted when no scan was stored. Only this list is masked: text and screenshotUrl show what the page displayed.
Show child attributes
Show child attributes