Search Scans
urlscan.search
ActionBusiness appsconnection required
Calls the urlscan.io API with the connection's credentials.
Find existing scans by domain, IP, ASN, hash or any indexed field.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- API key
- Providers
- urlscan.io
- Secret shape
- the API key, or {"api_key": "…"}
- Resolved by
- config.connection_id, else node.connection_id
Configuration
3 fields, 1 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
query An ElasticSearch query string, the same syntax the urlscan.io search page uses. | string | Yes | — | — | domain:example.com |
size How many scans to return in this page; urlscan.io defaults to 100. | number | No | — | 1–10000 | — |
search_after The next_search_after value from a previous call, to fetch older results. | string | No | — | — | — |
Example configuration
Every value below is the contract’s own example or default — nothing invented.
{
"query": "domain:example.com"
}Output
One shape.
result
| Field | Type | Example |
|---|---|---|
results The matching scans, each with _id, sort, task, page and stats. | array | — |
count How many scans this page carried. | number | — |
total How many scans matched; exact up to 10,000, then has_more is true. | number | — |
has_more True when more results exist beyond this page. | boolean | — |
next_search_after Pass this back as search_after to fetch the next, older page. | string | — |
{
"count": 0,
"has_more": false,
"next_search_after": "",
"results": [],
"total": 0
}Related urlscan.io nodes
See Search Scans run in a workflow.
In a technical demo we add the urlscan.io connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.