> ## Documentation Index
> Fetch the complete documentation index at: https://docs.periphery.exposed/llms.txt
> Use this file to discover all available pages before exploring further.

# Query syntax

> How the Periphery search bar parses what you type: free text, domains, and key:value filters.

A query is a list of tokens separated by spaces. There is no quoting: a phrase with a space is two tokens. Each token is one of three things.

| Token | Example | What it does |
| - | - | - |
| A domain or URL | `acme.com`, `https://app.acme.com/login` | A [domain search](https://docs.periphery.exposed/search/domain-search.md) on the registrable domain, `acme.com`. |
| A `key:value` filter | `provider:vercel`, `status:200,301` | Restricts results to apps matching the filter. The keys are listed in the [filter reference](https://docs.periphery.exposed/search/filters.md). |
| Anything else | `netflix`, `dashboard`, `admin:panel` | Free text. Unknown keys are not an error; they are searched as text. |

## Free text

Every free-text token must match at least one of three fields: the hostname, the page title, or the page text. Two tokens must both match, though not necessarily in the same field.

Results are ranked by relevance. A match in the hostname counts more than a match in the title, which counts more than a match in the text.

## Combining filters

* **Different keys are AND-ed.** `provider:vercel status:200` returns Vercel apps that answered 200.
* **Comma-separated values are OR-ed**, except for `domain:`. `status:200,301` returns apps that answered 200 or 301.
* **Free text is AND-ed with filters.** `netflix provider:vercel` returns Vercel apps that mention netflix.
* **Repeating a key merges its values.** `provider:vercel provider:netlify` is the same as `provider:vercel,netlify`.
* **Domains always AND.** `domain:acme.com,acme.io`, like `acme.com acme.io`, returns apps tied to both. See [Domain search](https://docs.periphery.exposed/search/domain-search.md).

## Limits

A query holds up to 256 characters and 10 terms. Characters are counted as Unicode characters, not bytes: `é` counts as one. Each free-text word counts as one term, and so does each filter value: `status:200,301` is two, `status:4xx` is one, `has:emails` is one, and each `creds:` detector is one. A longer query is rejected with a message rather than cut short. The console's filter buttons stop adding values once a query is full.

The console shows up to 20 pages of 50 results, so the first 1,000. The result count above them is the full total up to 1,000,000, and reads 1,000,000+ past that; narrow the query to reach the rest. The [API](https://docs.periphery.exposed/api/overview.md) accepts pages up to 20,000, but every page is one search: the 3,000 searches of Plus read at most 3,000 pages a month.

## Ordering without free text

A query made only of filters has nothing to rank by. Its results are ordered newest first, by when Periphery first saw each app, then by when it last saw it, whatever the filters, including `domain:` and `email:` with a domain value. Apps with no first-seen date come last. Queries with free text are ordered by relevance instead.

## What never appears

Only apps Periphery has visited are searchable, so a hostname that has been discovered but not yet visited is invisible, in search and on its app page, until its first visit. A visited app can be searchable before Periphery has captured its page: it then has no screenshot, text or findings yet. Hosts that stop resolving, or that their provider reports as no longer deployed, are marked dead and drop out of every search.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.