> ## Documentation Index
> Fetch the complete documentation index at: https://docs.periphery.exposed/llms.txt
> Use this file to discover all available pages before exploring further.

# Filter reference

> Every key:value filter the Periphery search bar and API accept, with examples.

Filters are `key:value` tokens in the search bar. They work the same in the console and in the API's `q` parameter. The [query syntax](/search/query-syntax) page explains how tokens combine.

| Filter         | Values                                  | Matches                                                                                                 |
| -------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| `domain:`      | one or more registrable domains         | Apps tied to the domain by hostname, email address, or mention. Comma-separated domains must all match. |
| `provider:`    | provider slugs                          | Apps hosted on any of the providers.                                                                    |
| `status:`      | HTTP status codes                       | Apps whose last observed status is any of the codes.                                                    |
| `has:creds`    | only `creds`                            | Apps with at least one verified credential. Plus and Pro plans.                                         |
| `email:`       | addresses or domains                    | Apps showing the exact address, or any address on the domain.                                           |
| `faviconHash:` | signed 32-bit integers                  | Apps whose favicon has any of the hashes.                                                               |
| `seen:`        | `<N` or `>N` with unit `h`, `d`, or `w` | Apps last seen within N (`<`) or more than N ago (`>`).                                                 |

Values are lower-cased before matching. A value the filter cannot read (a non-numeric status, a `seen:` without `<` or `>`) is ignored or searched as text; it never errors.

## domain:

`domain:acme.com` finds every app tied to `acme.com`. A bare `acme.com` does the same. See [Domain search](/search/domain-search) for what "tied to" means and why comma-separated domains must all match.

```text theme={null}
domain:acme.com
acme.com provider:vercel
```

## provider:

`provider:<slug>` restricts results to one hosting platform; `provider:vercel,netlify` to either. Slugs are lower-case and listed on the [providers page](/coverage/providers). An unknown slug matches nothing.

```text theme={null}
provider:vercel
provider:railway,fly status:200
```

## status:

`status:<code>` matches the HTTP status recorded at the last snapshot. Comma-separate to accept several.

```text theme={null}
status:200
status:401,403
status:500,502,503
```

## has:creds

`has:creds` keeps only apps with at least one verified credential, one the scanner confirmed as live with its issuer. It is the only value `has:` accepts.

<Warning>
  `has:creds` is a Plus and Pro filter. On Free the search still runs, but without the filter, and the console shows a notice; it does not return an error. The API never drops it, since API access is itself a Plus and Pro feature.
</Warning>

```text theme={null}
has:creds provider:vercel
```

## email:

`email:<value>` matches on the email addresses found on the page. A value with an `@` is an exact address; a value without one is a domain, and matches any address on it.

```text theme={null}
email:admin@acme.com
email:acme.com
email:acme.com,acme.io
```

## faviconHash:

`faviconHash:<hash>` matches apps serving a favicon with that hash. The hash is the same one Shodan, Censys, and FOFA use, so a value from those tools works here. Clicking a favicon in the console runs this search for you. See [Finding clones](/search/finding-clones).

```text theme={null}
faviconHash:-247388890
```

## seen:

`seen:` filters on the last seen time, the last visit that found the app alive (see [Reading an app page](/apps/app-page)). `seen:<7d` keeps apps seen within the last 7 days; `seen:>2w` keeps apps not seen for more than 2 weeks. Units are `h` (hours), `d` (days), and `w` (weeks). You can give one lower and one upper bound; a second bound of the same kind replaces the first.

```text theme={null}
seen:<24h
seen:>30d
seen:<7d seen:>1d status:200
```

## Putting it together

Vercel apps answering 200 with a verified credential:

```text theme={null}
provider:vercel status:200 has:creds
```

Everything on Netlify with an address on the domain, seen this week:

```text theme={null}
email:acme.com provider:netlify seen:<1w
```