Skip to main content
Maps a domain’s externally-relevant attack surface by listing every distinct URL found in credential records harvested from machines that had saved logins for that domain — internal tools, admin panels, VPN portals, SaaS apps, and more.

​
Request

POST /v1/domain/assets · Required scope: search:domain (all tiers) · Aggregation (counts toward agg_per_min) · Not paginated
ParameterTypeRequiredDefaultDescription
domainsstring[]Yes—Domains to enumerate, min 1 item
typeemployees | users | bothNobothSee Overview
start_datestring (date-time) | nullNo—Inclusive start filter, clamped by query_window_days
end_datestring (date-time) | nullNo—Inclusive end filter
limitintegerNo301–30 — this endpoint is capped lower than list endpoints

​
Example request

curl -X POST https://api.vantaprism.me/v1/domain/assets \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "domains": ["acme-corp.com"], "type": "employees", "limit": 30 }'

​
Response

200 OK — array of DomainAssetResult, ordered by occurrences descending. Not paginated — limit (max 30) bounds the result directly. 
{
  "data": [
    {
      "url": "https://vpn.acme-corp.com/***",
      "domain": "acme-corp.com",
      "occurrences": 87,
      "unique_victims": 64,
      "employee_occurrences": 87,
      "user_occurrences": 0,
      "type": "employee",
      "last_seen": "2026-06-10T03:14:00Z"
    },
    {
      "url": "https://acme-corp.atlassian.net/***",
      "domain": "acme-corp.com",
      "occurrences": 53,
      "unique_victims": 41,
      "employee_occurrences": 50,
      "user_occurrences": 3,
      "type": "both",
      "last_seen": "2026-06-08T17:02:00Z"
    }
  ],
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 64.7,
    "tier": "pro",
    "masked_fields": ["url"]
  }
}
FieldDescription
urlMasked to scheme://host/*** on free tier via domain_only_url
domainRegistrable domain extracted from url
occurrencesTotal times this URL was seen across all matching infections
unique_victimsDistinct infected machines that had this URL
employee_occurrences / user_occurrencesBreakdown by classification
typeemployee | user | both
last_seenMost recent infection date this URL was observed in

​
Errors

StatuscodeCause
400VALIDATION_ERRORdomains empty, or limit > 30
403FORBIDDEN_SCOPEKey lacks search:domain
429RATE_LIMIT_EXCEEDEDExceeded agg_per_min
See Errors for the full catalog.

​
Tier notes

url is masked to scheme://host/*** on the free tier — the full path (which can reveal internal tool names/IDs) requires pro or ultra.