Get an app

Returns the full record for one hostname: its summary (the same fields and values a search hit carries), the visible page text and, on Plus, the masked credentials. The record is read live, so it can be newer than a cached search page; when they differ, the record wins.

It does not use a search from the monthly allowance, but shares the one request per second budget. Use it to refresh an app’s signed URLs, which expire after one hour.

Only hosts a search can return have a record: a host Periphery has never visited, or one it proved dead, answers 404 app_not_found. HEAD is allowed and answers like GET without a body; any other method is answered 405 before the key is checked.

GET /v1/apps/{hostname}

Get an app

cURL

curl --request GET \
  --url https://api.periphery.exposed/v1/apps/{hostname} \
  --header 'Authorization: Bearer <token>'

200

withFindings

{
  "hostname": "acme-dashboard.vercel.app",
  "provider": "vercel",
  "status": 200,
  "title": "Acme dashboard",
  "firstSeen": "2026-08-02T10:15:40Z",
  "lastSeen": "2026-10-30T14:03:11Z",
  "scanned": true,
  "faviconHash": -247388890,
  "faviconUrl": "https://s3.gra.io.cloud.ovh.net/periphery/favicons/acme-dashboard.vercel.app.ico?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
  "screenshotUrl": "https://s3.gra.io.cloud.ovh.net/periphery/screenshots/acme-dashboard.vercel.app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
  "emails": [
    "[e-mail]"
  ],
  "hasVerifiedCreds": true,
  "verifiedDetectors": [
    "Stripe"
  ],
  "text": "Acme dashboard Sign in Forgot your password? Contact [e-mail]",
  "credentials": [
    {
      "detector": "Stripe",
      "verified": true,
      "masked": "sk_live_••••••••0000"
    },
    {
      "detector": "Github",
      "verified": false,
      "masked": "ghp_8Kz2••••••••Qw1f"
    }
  ]
}

Authorizations

bearerAuthapiKeyHeader

Authorization · string · header · required

Authorization: Bearer <key>. Used when both headers are present.

Path Parameters

hostname · string · required

The app's hostname, as returned by search. It is matched case-insensitively; a trailing dot is ignored; Unicode IDNs are accepted. The response carries the canonical lower-case ASCII form. A value that cannot be a hostname answers 404 app_not_found.

Response

200

application/json

The app record.

An app record: the app's summary (the same fields and values a search hit carries) plus text and, on Plus, credentials.

hostname · string · required

The app's hostname, lower-case ASCII, its stable identifier.

Example:

"acme-dashboard.vercel.app"

provider · string · required

Provider slug, the value the provider: filter takes, such as vercel, netlify, railway or cloudflare_pages. An open enum: new providers are added over time, see the providers page.

Example:

"vercel"

status · integer · required

HTTP status from the last render or fallback request that got an answer; 0 when none was recorded. A bot-wall page does not update it.

Example:

200

title · string · required

Page title at the last capture; "" when the page had none or was never rendered.

lastSeen · string<date-time> · required

Time of Periphery's last visit that did not prove the host dead, whether or not the host answered. Not the capture time. RFC 3339 in UTC; always present.

scanned · boolean · required

True when Periphery captured the page and stored a snapshot (text, emails and credential scans). False for a host it only probed for liveness: then emails, verifiedDetectors and the snapshot URLs are absent.

hasVerifiedCreds · boolean · required

True when at least one credential finding was verified, so verifiedDetectors is non-empty.

text · string · required

Visible text extracted at the last capture, up to 2,048 bytes; "" when none. It shows the page as captured and can contain a secret in full.

firstSeen · string<date-time>

Time of the first visit that got any answer from the host, RFC 3339 in UTC. It never changes once set. For apps indexed before October 2026, the time Periphery indexed them. Omitted when the host has never answered.

faviconHash · integer<int32>

Shodan-compatible favicon hash (mmh3). Present whenever a favicon was stored, even when the hash is 0; omitted otherwise.

faviconUrl · string<uri>

Signed URL of the stored favicon, valid for one hour; GET /v1/apps/{hostname} returns a fresh one without using a search. An SVG favicon downloads as an attachment when opened directly. Omitted when no favicon was stored.

screenshotUrl · string<uri>

Signed URL of the stored screenshot, valid for one hour; GET /v1/apps/{hostname} returns a fresh one without using a search. It shows the page as captured and can show a secret in full. Omitted when there is no screenshot.

emails · string[]

Email addresses found on the page, lower-cased and deduplicated, up to 100. [] when the page was scanned and had none; omitted when it was never scanned.

verifiedDetectors · string[]

Names of the detectors with a verified finding, deduplicated case-insensitively and sorted. Each works as creds:<name>. [] when the credential scan found nothing verified; omitted when no credential scan was stored.

credentials · object[]

Plus only. Every credential finding, verified or not, up to 20 per host, verified first, each masked. [] when the credential scan found nothing; omitted when no scan was stored. Only this list is masked: text and screenshotUrl show what the page displayed.

Show child attributes