Search apps

Runs a query in the console’s syntax and returns one page of up to 50 hits. Free text, bare domains, and key:value filters work exactly as in the search bar; see the filter reference in the guides.

q is required: a missing or blank q is answered 400 query_required. A q that parses to nothing (say, only a filter whose value cannot be read, like status:2oo) returns an empty page whose query is "", showing the filter was dropped. Neither is counted.

Each request counts as one search against the account’s monthly allowance, page by page, and the per-second rate limit applies. Requests refused before the quota check (400, 401, 403, 405, 429) never count a search; a 502, 503 or 504 after it does. has:creds always applies, since API access and the filter are both Plus features.

Hits are ordered by relevance when the query has free text, and otherwise by firstSeen, newest first, then lastSeen, newest first. Pages are offsets over live data, so an app can move between pages while you page: deduplicate by hostname. Stop when hasMore is false. Only GET is allowed; any other method, HEAD included, is answered 405 before the key is checked and never runs a search.

GET /v1/apps

Search apps

cURL

curl --request GET \
  --url https://api.periphery.exposed/v1/apps \
  --header 'Authorization: Bearer <token>'

200

page

{
  "query": "provider:vercel domain:acme.com",
  "page": 1,
  "pageSize": 50,
  "hasMore": false,
  "total": 3,
  "totalCapped": false,
  "hits": [
    {
      "hostname": "acme-com-preview.vercel.app",
      "provider": "vercel",
      "status": 0,
      "title": "",
      "firstSeen": "2026-10-12T03:22:48Z",
      "lastSeen": "2026-10-28T19:10:05Z",
      "scanned": false,
      "hasVerifiedCreds": false
    },
    {
      "hostname": "acme-com-staging.vercel.app",
      "provider": "vercel",
      "status": 401,
      "title": "Acme (staging)",
      "firstSeen": "2026-09-17T22:05:19Z",
      "lastSeen": "2026-10-29T08:41:02Z",
      "scanned": true,
      "emails": [],
      "hasVerifiedCreds": false,
      "verifiedDetectors": []
    },
    {
      "hostname": "acme-dashboard.vercel.app",
      "provider": "vercel",
      "status": 200,
      "title": "Acme dashboard",
      "firstSeen": "2026-08-02T10:15:40Z",
      "lastSeen": "2026-10-30T14:03:11Z",
      "scanned": true,
      "faviconHash": -247388890,
      "faviconUrl": "https://s3.gra.io.cloud.ovh.net/periphery/favicons/acme-dashboard.vercel.app.ico?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
      "screenshotUrl": "https://s3.gra.io.cloud.ovh.net/periphery/screenshots/acme-dashboard.vercel.app.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…&X-Amz-Date=20261105T091500Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&x-id=GetObject&X-Amz-Signature=…",
      "emails": [
        "[e-mail]"
      ],
      "hasVerifiedCreds": true,
      "verifiedDetectors": [
        "Stripe"
      ]
    }
  ]
}

Authorizations

bearerAuthapiKeyHeader

Authorization · string · header · required

Authorization: Bearer <key>. Used when both headers are present.

Query Parameters

q · string · required

The query, in the console's search syntax. Up to 256 characters (Unicode code points, not bytes) and 10 terms, where each free-text word and each filter value counts as one term. A missing or blank q is answered 400 query_required and is not counted.

Required string length: 1 - 256

Pattern: \S

page · integer · default: 1

Page number, from 1 to 20000. Each page holds 50 hits. A page past the end returns an empty hits array. Values below 1 or that are not numbers are treated as 1. A larger page, including numbers too large to read, is answered 400 page_out_of_range. Unlike the console, which stops at page 20, the API pages through the full result set, but every page costs one search from the monthly allowance.

Required range: 1 <= x <= 20000

Response

200

application/json

One page of results.

query · string · required

The canonical form of the query Periphery ran. Filter values it could not read are dropped or searched as text, so this shows what actually ran. "" when q parsed to nothing (a missing or blank q is answered 400 query_required instead).

page · integer · required

The page returned, starting at 1.

pageSize · integer · required

Hits per page, 50.

hasMore · boolean · required

True when the next page holds at least one hit. Exact; always false on page 20000. Stop paging when it is false.

total · integer · required

Number of apps matching the query, across all pages, from a count cached up to 10 minutes and raised to at least what this page proves. Counting stops at 1,000,000; see totalCapped.

totalCapped · boolean · required

True when counting stopped at 1,000,000, so at least total apps match.

hits · object[] · required

Up to 50 hits for this page; [] when none.

Show child attributes