> ## Documentation Index > Fetch the complete documentation index at: https://docs.periphery.exposed/llms.txt > Use this file to discover all available pages before exploring further. # Filter reference > Every key:value filter the Periphery search bar and API accept, with examples. Filters are `key:value` tokens in the search bar. They work the same in the console and in the API's `q` parameter. The [query syntax](https://docs.periphery.exposed/search/query-syntax.md) page explains how tokens combine. In the console you can also use the filter buttons under the search box (Provider, Status code, First seen, Email, Favicon hash, Exposed keys). Each opens a list of options: clicking one adds it to the query or removes it, and a typed value is added with **Apply** or Enter. Your choices show as chips in the search bar that you can remove one by one. The search runs when you press **Search** or Enter, so setting several filters costs one search. Status code offers the four classes and a field for codes, such as `451, 522`. On Plus, Exposed keys offers any key type and a field for key types, which suggests the ones found so far; on Free the button is greyed, since filtering by keys is a Plus feature. The buttons write the same tokens you could type, so a search built either way can be shared as a link. | Filter | Values | Matches | | - | - | - | | `domain:` | one or more registrable domains | Apps tied to the domain by hostname, email address, or mention. Comma-separated domains must all match. | | `provider:` | provider slugs | Apps hosted on any of the providers. | | `status:` | HTTP status codes or classes (`4xx`) | Apps whose last recorded status is any of the codes, or in any of the classes. | | `has:` | `creds`, `emails` | `creds`: apps with at least one verified credential (Plus plan). `emails`: apps showing at least one email address. | | `creds:` | credential detector names | Apps with a verified credential from any of the detectors, such as `creds:anthropic`. Plus plan. | | `email:` | addresses or domains | Apps showing the exact address, or any address on the domain. | | `faviconHash:` | signed 32-bit integers | Apps whose favicon has any of the hashes. | | `lastSeen:` | `N` with unit `h`, `d`, or `w` | Apps last seen within N (`<`) or more than N ago (`>`). | | `firstSeen:` | `N` with unit `h`, `d`, or `w` | Apps first seen within N (`<`) or more than N ago (`>`). | Values are lower-cased before matching. A value the filter cannot read (a non-numeric status, a `lastSeen:` or `firstSeen:` without `<` or `>`, or with a window too large to represent) is ignored or searched as text; it never errors. In the API's `query` field an ignored value is gone, and a value searched as text comes back as you sent it, with the free text at the start of `query`, so it can read like a filter. A window that applies always comes last in `query`, after every other filter, with `<` or `>`, a whole number of at least 1 and a unit of `h`, `d` or `w`, and is at most 15,250 weeks (about 292 years): `q=acme lastSeen:7d` echoes `acme lastSeen:7d` (text, no `<` or `>`), and `q=lastSeen:<30501w` echoes `lastSeen:<30501w` (text, too large). ## domain: `domain:acme.com` finds every app tied to `acme.com`. A bare `acme.com` does the same. See [Domain search](https://docs.periphery.exposed/search/domain-search.md) for what "tied to" means and why comma-separated domains must all match. ```text theme={null} domain:acme.com acme.com provider:vercel ``` ## provider: `provider:` restricts results to one hosting platform; `provider:vercel,netlify` to either. Slugs are lower-case and listed on the [providers page](https://docs.periphery.exposed/coverage/providers.md). An unknown slug matches nothing. ```text theme={null} provider:vercel provider:railway,fly status:200 ``` ## status: `status:` matches the HTTP status from the last render or fallback request that got an answer; a bot-wall page shown to the scanner does not change it. Comma-separate to accept several. A class, `2xx` to `5xx`, matches every code in it, and mixes with codes: `status:4xx,503` is any 4xx or 503. A class counts as one term toward the [query limit](https://docs.periphery.exposed/search/query-syntax.md#limits). ```text theme={null} status:200 status:401,403 status:4xx status:500,502,503 ``` ## has:creds `has:creds` keeps only apps with at least one verified credential, one the scanner confirmed as live with its issuer. `has:emails` keeps only apps showing at least one email address. `has:creds,emails` asks for both. > [!WARNING] > > `has:creds` is a Plus filter. On Free the console runs no search and shows no results: it offers an upgrade, and a link to the same query without `has:creds`. The API never drops it, since API access is itself a Plus feature. ```text theme={null} has:creds provider:vercel has:emails firstSeen:<7d ``` ## creds: `creds:` narrows `has:creds` to verified credentials from specific detectors, such as `creds:anthropic` or `creds:anthropic,groq`. Detector names are case-insensitive. The Exposed keys button lists every detector found in the index with its count. Like `has:creds`, it is a Plus filter. ```text theme={null} creds:anthropic creds:telegrambottoken provider:lovable ``` ## email: `email:` matches on the email addresses found on the page. A value with an `@` is an exact address; a value without one is a domain, and matches any address on it. ```text theme={null} email:admin@acme.com email:acme.com email:acme.com,acme.io ``` ## faviconHash: `faviconHash:` matches apps serving a favicon with that hash. The hash is the same one Shodan, Censys, and FOFA use, so a value from those tools works here. Clicking a favicon in the console runs this search for you. See [Finding clones](https://docs.periphery.exposed/search/finding-clones.md). ```text theme={null} faviconHash:-247388890 ``` ## lastSeen: `lastSeen:` filters on the last seen time, Periphery's last visit that did not prove the host dead, whether or not the host answered (see [Reading an app page](https://docs.periphery.exposed/apps/app-page.md#what-last-seen-means)). It is not the time the snapshot was captured. `lastSeen:<7d` keeps apps seen within the last 7 days; `lastSeen:>2w` keeps apps not seen for more than 2 weeks. Units are `h` (hours), `d` (days), and `w` (weeks). You can give one lower and one upper bound; a second bound of the same kind replaces the first. A window over about 292 years (15,250 weeks), such as `lastSeen:<30501w`, is too large to represent and is searched as text. ```text theme={null} lastSeen:<24h lastSeen:>30d lastSeen:<7d lastSeen:>1d status:200 ``` ## firstSeen: `firstSeen:` filters on the first seen time, the first visit that got an answer from the host, even an error status. Use it to see what is new: `acme.com firstSeen:<1w` lists the apps tied to `acme.com` that Periphery saw for the first time this week. It takes the same `N` values and units as `lastSeen:`. ```text theme={null} firstSeen:<7d acme.com firstSeen:<1w email:acme.com firstSeen:<24h status:200 ``` First seen means new to Periphery, not newly launched. An app that has run for years but that Periphery has only just reached, through a new source or its first visit, counts as new: you could not have found it before. Apps indexed before October 2026 have their first seen set to the time Periphery indexed them. ## Putting it together Vercel apps answering 200 with a verified credential: ```text theme={null} provider:vercel status:200 has:creds ``` Everything on Netlify with an address on the domain, seen this week: ```text theme={null} email:acme.com provider:netlify lastSeen:<1w ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.