{ "openapi": "3.0.1", "info": { "title": "Email & Subdomain Finder - theHarvester OSINT | 54 Sources", "description": "Cloud-hosted theHarvester OSINT tool. Harvest emails, subdomains, IPs, URLs and ASNs from 54+ public sources (Shodan, Censys, crt.sh, VirusTotal, SecurityTrails, GitHub, hunter.io). Full CLI feature parity — DNS brute force, subdomain takeover, screenshots. $0.003 per record harvested.", "version": "1.1", "x-build-id": "vhmUEg7nYhdtjHcmg" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/anshumanatrey~theharvester-osint/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-anshumanatrey-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/anshumanatrey~theharvester-osint/runs": { "post": { "operationId": "runs-sync-anshumanatrey-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/anshumanatrey~theharvester-osint/run-sync": { "post": { "operationId": "run-sync-anshumanatrey-theharvester-osint", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "domain" ], "properties": { "domain": { "title": "Website to research (domain)", "type": "string", "description": "Enter the website to research, like itm.edu. A full link, www., an email or a port is cleaned to the bare domain, and an IP address also works. One per run; if you paste several, the first is used. Same as -d in theHarvester." }, "sources": { "title": "Where to search (sources)", "uniqueItems": true, "type": "array", "description": "Pick where to search. Default: crt.sh, HackerTarget, RapidDNS and CertSpotter, all free. Also free: AlienVault OTX, URLScan, ThreatCrowd, DuckDuckGo, Baidu, Yahoo, Common Crawl, Wayback Machine, Robtex, Subdomain Center, Hudson Rock, THC, Shodan InternetDB. Sources marked \"needs key\" return nothing without your key in Your own keys. Names like \"crt.sh\" or \"VirusTotal\" are accepted; unknown names are skipped with a note. Same as -b in theHarvester.", "items": { "type": "string", "enumSuggestedValues": [ "crtsh", "hackertarget", "rapiddns", "certspotter", "otx", "urlscan", "threatcrowd", "duckduckgo", "baidu", "yahoo", "commoncrawl", "waybackarchive", "robtex", "subdomaincenter", "hudsonrock", "thc", "shodanInternetDB", "shodan", "censys", "virustotal", "securityTrails", "hunter", "hunterhow", "intelx", "fullhunt", "netlas", "leakix", "leaklookup", "zoomeye", "criminalip", "dehashed", "fofa", "github-code", "gitlab", "bitbucket", "bevigil", "builtwith", "brave", "dnsdumpster", "mojeek", "chaos", "projectdiscovery", "onyphe", "pentesttools", "rocketreach", "securityscorecard", "subdomainfinderc99", "tomba", "venacus", "whoisxml", "windvane", "dymo", "haveibeenpwned", "bufferoverun", "sherlockeye" ], "enumTitles": [ "crt.sh certificates (crtsh)", "HackerTarget", "RapidDNS", "CertSpotter", "AlienVault OTX (otx)", "URLScan", "ThreatCrowd", "DuckDuckGo", "Baidu", "Yahoo", "Common Crawl", "Wayback Machine (waybackarchive)", "Robtex", "Subdomain Center", "Hudson Rock", "THC", "Shodan InternetDB", "Shodan, needs key", "Censys, needs key", "VirusTotal, needs key", "SecurityTrails, needs key", "Hunter.io, needs key (hunter)", "Hunter.how, needs key (hunterhow)", "IntelX, needs key", "FullHunt, needs key", "Netlas, needs key", "LeakIX, needs key", "LeakLookup, needs key", "ZoomEye, needs key", "Criminal IP, needs key (criminalip)", "DeHashed, needs key", "FOFA, needs key", "GitHub code, needs key (github-code)", "GitLab, needs key", "Bitbucket, needs key", "BeVigil, needs key", "BuiltWith, needs key", "Brave Search, needs key (brave)", "DNSDumpster, needs key", "Mojeek, needs key", "Chaos, needs key", "ProjectDiscovery, needs key", "Onyphe, needs key", "Pentest-Tools, needs key (pentesttools)", "RocketReach, needs key", "SecurityScorecard, needs key", "C99, needs key (subdomainfinderc99)", "Tomba, needs key", "Venacus, needs key", "WhoisXML, needs key", "Windvane, needs key", "Dymo, needs key", "HIBP, needs key (haveibeenpwned)", "BufferOverun, needs key", "SherlockEye, needs key" ] }, "default": [ "crtsh", "hackertarget", "rapiddns", "certspotter" ] }, "limit": { "title": "Results per source (limit)", "type": "integer", "description": "Enter how many results to pull from each source, 1 to 10000. Default 500. Lower is faster; higher digs deeper. Out-of-range values are brought into range with a note. Same as -l in theHarvester.", "default": 500 }, "dnsLookup": { "title": "Find IP addresses (dnsLookup)", "type": "boolean", "description": "Turn on to find the IP address of each subdomain found. Slower. Off by default. Every subdomain already gets a live yes/no check. Same as -n (DNS lookup) in theHarvester.", "default": false }, "dnsBrute": { "title": "Hidden subdomains (dnsBrute)", "type": "boolean", "description": "Turn on to find hidden subdomains by trying common names like mail, dev, vpn and staging. Finds names missing from public records, but is much slower. Off by default. Same as -c (DNS brute force) in theHarvester.", "default": false }, "takeOver": { "title": "Takeover risk check (takeOver)", "type": "boolean", "description": "Turn on to check for takeover risk: subdomains still pointing at an unclaimed outside service that anyone could claim. Off by default. Same as -t (subdomain takeover) in theHarvester.", "default": false }, "screenshot": { "title": "Page screenshots (screenshot)", "type": "boolean", "description": "Turn on to take page screenshots of each subdomain's home page. Saved to the run's key-value store. Slower. Works best with Find IP addresses off. Off by default. Same as --screenshot in theHarvester.", "default": false }, "shodan": { "title": "Add Shodan details (shodan)", "type": "boolean", "description": "Turn on to add Shodan details (open ports, services) for each host found. Needs your Shodan key below; without it this is switched off with a note. Off by default. Same as -s in theHarvester.", "default": false }, "apiScan": { "title": "Find exposed endpoints (apiScan)", "type": "boolean", "description": "Turn on to find exposed endpoints: API paths left open on the website. Slow: it tries about 900 paths and can take 10+ minutes, so raise Time limit; if it runs out of time, everything found before the scan is still returned. Off by default. Same as -a (API scan) in theHarvester.", "default": false }, "shodanApiKey": { "title": "Shodan key (shodanApiKey)", "type": "string", "description": "Enter your Shodan key from shodan.io, for the Shodan source and Shodan details. Leave blank otherwise." }, "censysApiId": { "title": "Censys ID (censysApiId)", "type": "string", "description": "Enter your Censys ID from censys.io. Used together with the Censys secret." }, "censysApiSecret": { "title": "Censys secret (censysApiSecret)", "type": "string", "description": "Enter your Censys secret from censys.io. Used together with the Censys ID." }, "securitytrailsApiKey": { "title": "SecTrails key (securitytrailsApiKey)", "type": "string", "description": "Enter your SecurityTrails key from securitytrails.com. Adds strong subdomain coverage." }, "hunterApiKey": { "title": "Hunter key (hunterApiKey)", "type": "string", "description": "Enter your Hunter.io key from hunter.io. Adds email discovery." }, "virustotalApiKey": { "title": "VirusTotal key (virustotalApiKey)", "type": "string", "description": "Enter your VirusTotal key from virustotal.com." }, "githubToken": { "title": "GitHub key (githubToken)", "type": "string", "description": "Enter your GitHub key (a personal access token), for searching public code that mentions the website." }, "braveApiKey": { "title": "Brave Search key (braveApiKey)", "type": "string", "description": "Enter your Brave Search key from brave.com/search/api. A free tier is available." }, "extraApiKeys": { "title": "Other keys (extraApiKeys)", "type": "object", "description": "Enter other keys for the remaining sources as one object, e.g. {\"netlasApiKey\": \"...\", \"fofaKey\": \"...\", \"fofaEmail\": \"you@example.com\"}. Unknown names are ignored with a note. Names: hunterhowApiKey, intelxApiKey, onypheApiKey, fullhuntApiKey, netlasApiKey, leakixApiKey, leaklookupApiKey, zoomeyeApiKey, bevigilApiKey, bitbucketApiKey, bufferoverunApiKey, builtwithApiKey, chaosApiKey, criminalipApiKey, dehashedApiKey, dnsdumpsterApiKey, dymoApiKey, fofaKey, fofaEmail, hackertargetApiKey, hibpApiKey, mojeekApiKey, pentesttoolsApiKey, projectdiscoveryApiKey, rocketreachApiKey, securityscorecardApiKey, sherlockeyeApiKey, subdomainfinderc99ApiKey, tombaKey, tombaSecret, venacusApiKey, whoisxmlApiKey, windvaneApiKey." }, "timeout": { "title": "Time limit (timeout)", "type": "integer", "description": "Enter the time limit for the search, 60 to 3600 seconds. Default 1800. It is also kept inside the run's own time limit, so the run always finishes and reports back. Out-of-range values are brought into range with a note.", "default": 1800 }, "start": { "title": "Skip first results (start)", "type": "integer", "description": "Enter how many results to skip from each source, for paging through very large result sets. Default 0 (skip none). Negative values are read as 0 with a note. Same as -S in theHarvester.", "default": 0 }, "dnsServer": { "title": "Lookup server (dnsServer)", "type": "string", "description": "Enter a lookup server (DNS server) IP address, like 8.8.8.8. Leave blank for the default. An invalid address is ignored with a note. Same as -e in theHarvester." }, "dnsResolve": { "title": "Own lookup servers (dnsResolve)", "type": "string", "description": "Enter your own lookup servers (DNS resolvers) as comma-separated IPs, like 1.1.1.1,8.8.8.8, or a file path inside the image. Leave blank for the default. Invalid values are ignored with a note. Same as -r in theHarvester." }, "wordlist": { "title": "Word list file (wordlist)", "type": "string", "description": "Enter a word list file path inside the image, used by Find exposed endpoints and Hidden subdomains. Leave blank for the built-in list. A path that does not exist is ignored with a note. Same as -w in theHarvester." }, "useProxies": { "title": "Relay requests (useProxies)", "type": "boolean", "description": "Turn on to relay requests through proxies listed in the image's proxies.yaml. Most users leave this off. Off by default. Same as -p in theHarvester.", "default": false }, "quiet": { "title": "Shorter log (quiet)", "type": "boolean", "description": "Keep the log shorter by hiding missing-key warnings from theHarvester. On by default. Same as -q in theHarvester.", "default": true } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }