# Rapid7 Search API

**Canonical:** https://apis.io/apis/rapid7/rapid7-search-api/  
**Provider:** Rapid7 — https://apis.io/providers/rapid7/  
**Base URL:** https://us.api.insight.rapid7.com/vm/v4  
**Documentation:** https://help.rapid7.com/insightvm/en-us/api/api.html

Rapid7 Search API is one of 50 APIs that [Rapid7](https://apis.io/providers/rapid7/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Search. The published artifact set on APIs.io includes an OpenAPI specification.

A global Search API is exposed to facilitate the execution of user-defined queries that can perform a Search across the supported resource types exposed via the API. Each Search Request must specify both the resource type and the query to be executed. Below details the specific catalog of properties for each resource type that can be used as atoms of the Search query, and the operators that can be used with them.<h3>Search Catalog</h3><table><thead><tr><th>Resource Type</th><th>Properties</th></tr></thead><tbody><tr><td><code>APP</code></td><td><ul><li>app.id</li><li>app.name</li><li>app.description</li></ul></td></tr><tr><td><code>SCAN_CONFIG</code></td><td><ul><li>scanconfig.id</li><li>scanconfig.name</li><li>scanconfig.description</li><li>scanconfig.app.id</li><li>scanconfig.attack_template.id</li></ul></td></tr><tr><td><code>SCAN</code></td><td><ul><li>scan.id</li><li>scan.status</li><li>scan.failure_reason</li><li>scan.submit_time</li><li>scan.completion_time</li><li>scan.app.id</li><li>scan.scan_config.id</li><li>scan.submitter.id</li><li>scan.submitter.type</li></ul></td></tr><tr><td><code>VULNERABILITY</code></td><td><ul><li>vulnerability.id</li><li>vulnerability.severity</li><li>vulnerability.status</li><li>vulnerability.scans.id</li><li>vulnerability.app.id</li><li>vulnerability.root_cause.url</li><li>vulnerability.root_cause.parameter</li><li>vulnerability.root_cause.method</li><li>vulnerability.discoveries.discovered</li><li>vulnerability.first_discovered</li><li>vulnerability.last_discovered</li><li>vulnerability.newly_discovered</li></ul></td></tr><tr><td><code>ATTACK_TEMPLATE</code></td><td><ul><li>attacktemplate.id</li><li>attacktemplate.name</li><li>attacktemplate.description</li><li>attacktemplate.system_defined</li></ul></td></tr><tr><td><code>TARGET</code></td><td><ul><li>target.id</li><li>target.domain</li><li>target.enabled</li></ul></td><tr><td><code>ENGINE</code></td><td><ul><li>engine.id</li><li>engine.name</li><li>engine.status</li><li>engine.engine_group.id</li><li>engine.engine_group.name</li></ul></td><tr><td><code>ENGINE_GROUP</code></td><td><ul><li>enginegroup.id</li><li>enginegroup.name</li><li>enginegroup.description</li></ul></td></tr><tr><td><code>SCHEDULE</code></td><td><ul><li>schedule.id</li><li>schedule.name</li><li>schedule.enabled</li><li>schedule.app.id</li><li>schedule.scan_config.id</li></ul></td></tr><tr><td><code>BLACKOUT</code></td><td><ul><li>blackout.id</li><li>blackout.name</li><li>blackout.enabled</li><li>blackout.app.id</li><li>blackout.scope</li></ul></td></tr><tr><td><code>FILE</code></td><td><ul><li>file.id</li><li>file.name</li><li>file.description</li><li>file.type</li><li>file.locked</li><li>file.apps.id</li><li>file.owner.id</li></ul></td></tr><tr><td><code>TAG</code></td><td><ul><li>tag.id</li><li>tag.name</li><li>tag.creator.id</li><li>tag.created</li></ul></td></tr><tr><td><code>REPORT</code></td><td><ul><li>report.id</li><li>report.name</li><li>report.type</li><li>report.format</li><li>report.owner.id</li><li>report.generatedDate</li><li>report.app.id</li></ul></td></tr></tbody></table><h3>Search Operators</h3><table><thead><tr><th>Operator</th><th>Description</th></tr></thead><tbody><tr><td><p>=</p></td><td><p>Equal To. Returns all records that equal the specified value.</p></td></tr><tr><td><p>!=</p></td><td><p>Not Equal To. Returns all records that are not equal to the specified value.</p></td></tr><tr><td><p>&gt;</p></td><td><p>Greater Than. Returns all records that are greater than the specified value.</p></td></tr><tr><td><p>&gt;=</p></td><td><p>Greater Than or Equal To. Returns all records that are greater than or equal to the specified value.</p></td></tr><tr><td><p>&lt;</p></td><td><p>Less Than. Returns all records that are less than the specified value.</p></td></tr><tr><td><p>&lt;=</p></td><td><p>Less Than or Equal To. Returns all records that are less than or equal to the specified value.</p></td></tr><tr><td><p>CONTAINS</p></td><td><p>Returns all records that contain the specified string.</p></td></tr><tr><td><p>STARTS WITH</p></td><td><p>Returns all records that start with the specified string.</p></td></tr><tr><td><p>ENDS WITH</p></td><td><p>Returns all records that end with the specified string.</p></td></tr><tr><td><p>LIKE</p></td><td><p>Works as a normal regular expression as opposed to SQL regular expression.</p></td></tr><tr><td><p>IS NULL</p></td><td><p>Returns all records whose specified value is NULL (contains the NULL value).</p></td></tr><tr><td><p>IS NOT NULL</p></td><td><p>Returns all records whose specified value is not NULL (does not contain the NULL value).</p></td></tr><tr><td><p>&&</p></td><td><p>The 'logical AND' operator returns values when both conditions are true.</p></td></tr><tr><td><p>||</p></td><td><p>The 'logical OR' operator returns values when one of the conditions is true.</p></td></tr><tr><td><p>BETWEEN</p></td><td><p>An operator to allow range checking for date types.</p></td></tr></tbody></table><h3>Useful Examples</h3><table><thead><tr><th>Query</th><th>Description</th></tr></thead><tbody><tr><td><p>app.name CONTAINS 'production' && app.description LIKE '.&ast;(South|North) America.&ast;'</p></td><td><p>Find all Apps where the name contains the text 'production' and the description contains the text 'South America' or 'North America'</p></td></tr><tr><td><p>scanconfig.name = 'Weekly Scan' && scanconfig.app.id = '12345678-1234-1234-1234-123456789012'</p></td><td><p>Find all Scan Configs where the name is exactly the text 'Weekly Scan' and the App that owns it has a ID of value '12345678-1234-1234-1234-123456789012'</p></td></tr><tr><td><p>scan.status = 'COMPLETE' || scan.status = 'FAILED' && scan.completion_time BETWEEN '2018-11-01T00:00:00' AND '2018-12-1T00:00:00'</p></td><td><p>Find all Scans that ran to a terminal state in November 2018</p></td></tr><tr><td><p>vulnerability.severity = 'HIGH' && vulnerability.app.id = '12345678-1234-1234-1234-123456789012'</p></td><td><p>Find all Vulnerabilities where the severity is HIGH and the App that owns it has a ID of value '12345678-1234-1234-1234-123456789012'</p></td></tr><tr><td><p>attacktemplate.system_defined = 'true' && attacktemplate.name = 'Crawl Only'</p></td><td><p>Find the system-defined Crawl-Only Attack Template</p></td></tr><tr><td><p>target.enabled = 'false'</p></td><td><p>Find all disabled Targets</p></td></tr></tbody></table><h3>Notes</h3><p>Please note that the search DSL is <i>case-sensitive</i> and as such all resource properties and search operators should be checked for correct casing in the result of a query validation error response. </p>

## Machine-readable artifacts (1)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/rapid7/refs/heads/main/openapi/rapid7-search-api-openapi.yml

## Other Rapid7 APIs (12)

- [Rapid7 InsightVM Cloud API](https://apis.io/apis/rapid7/insightvm-api/)
- [Rapid7 Insight Platform API](https://apis.io/apis/rapid7/insight-platform-api/)
- [Rapid7 InsightIDR API](https://apis.io/apis/rapid7/insightidr-api/)
- [Rapid7 Accounts API](https://apis.io/apis/rapid7/rapid7-accounts-api/)
- [Rapid7 Administration API](https://apis.io/apis/rapid7/rapid7-administration-api/)
- [Rapid7 Apps API](https://apis.io/apis/rapid7/rapid7-apps-api/)
- [Rapid7 Asset API](https://apis.io/apis/rapid7/rapid7-asset-api/)
- [Rapid7 Asset Discovery API](https://apis.io/apis/rapid7/rapid7-asset-discovery-api/)
- [Rapid7 Asset Group API](https://apis.io/apis/rapid7/rapid7-asset-group-api/)
- [Rapid7 Assets API](https://apis.io/apis/rapid7/rapid7-assets-api/)
- [Rapid7 Attachments API](https://apis.io/apis/rapid7/rapid7-attachments-api/)
- [Rapid7 Attack Templates API](https://apis.io/apis/rapid7/rapid7-attack-templates-api/)

## Tags

Search

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/rapid7/rapid7-search-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/rapid7/.