---
updatedAt: 2026-08-21T14:19:02.000Z
agentTools:
  projectIndex: https://docs.greynoise.io/llms.txt
---

# GNQL V3 Count

Return the total number of IPs matching a GNQL query, without
returning the IPs themselves. Use this to size a result set before
paging through it with `GET /v3/gnql` or exporting it with
`GET /v3/gnql/ips`.

Entitlement, data-reach, and restricted-field handling match the
search endpoint: if your plan reduces the query's reach or restricts a
field it references, the query is rewritten before it runs, the
response is a `206`, and `adjusted_query` reports the query that was
actually executed.


# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "info": {
    "description": "GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.",
    "version": "3.0.0",
    "title": "GreyNoise API",
    "contact": {
      "email": "hello@greynoise.io"
    },
    "license": {
      "name": "Proprietary",
      "url": "https://www.greynoise.io/terms"
    }
  },
  "tags": [
    {
      "name": "GNQL",
      "description": "Calls to interface with GNQL (GreyNoise Query Language)."
    }
  ],
  "security": [
    {
      "APIKeyHeaderAuth": []
    }
  ],
  "paths": {
    "/v3/gnql/count": {
      "get": {
        "tags": [
          "GNQL"
        ],
        "summary": "GNQL V3 Count",
        "operationId": "gnqlV3Count",
        "description": "Return the total number of IPs matching a GNQL query, without\nreturning the IPs themselves. Use this to size a result set before\npaging through it with `GET /v3/gnql` or exporting it with\n`GET /v3/gnql/ips`.\n\nEntitlement, data-reach, and restricted-field handling match the\nsearch endpoint: if your plan reduces the query's reach or restricts a\nfield it references, the query is rewritten before it runs, the\nresponse is a `206`, and `adjusted_query` reports the query that was\nactually executed.\n",
        "parameters": [
          {
            "$ref": "#/components/parameters/query"
          }
        ],
        "responses": {
          "200": {
            "description": "OK - request successful.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GNQLCountResponse"
                }
              }
            }
          },
          "206": {
            "description": "Partial content - request partially successful.\nDue to plan limitations, the submitted query was rewritten before\nit was counted. The `adjusted_query` field in the response\nindicates how the original query was modified. Contact\nsales@greynoise.io to upgrade your plan and unlock full results.\n",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GNQLCountResponse"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "$ref": "#/components/responses/Forbidden"
          },
          "429": {
            "$ref": "#/components/responses/QueryEngineAtCapacity"
          },
          "500": {
            "$ref": "#/components/responses/UnexpectedError"
          },
          "504": {
            "$ref": "#/components/responses/QueryTimeout"
          }
        }
      }
    }
  },
  "servers": [
    {
      "url": "https://api.greynoise.io"
    },
    {
      "url": "http://api.greynoise.io"
    }
  ],
  "components": {
    "securitySchemes": {
      "APIKeyHeaderAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "key"
      }
    },
    "responses": {
      "BadRequest": {
        "description": "Bad request - request syntax is invalid for the specified endpoint.\nVerify request syntax and try again.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Invalid parameter"
            }
          }
        }
      },
      "Unauthorized": {
        "description": "Unauthorized. Please check your API key.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Unauthorized"
            }
          }
        }
      },
      "Forbidden": {
        "description": "Forbidden - request is not authorized due to an invalid API key or plan limitations.\nIf due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Forbidden"
            }
          }
        }
      },
      "QueryEngineAtCapacity": {
        "description": "Too many requests - the query engine is shedding load. This is\nretryable: a `Retry-After` header carries the suggested delay when the\nengine supplies one.\n",
        "headers": {
          "Retry-After": {
            "description": "Seconds to wait before retrying, when supplied by the query engine.",
            "schema": {
              "type": "string"
            }
          }
        },
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "The query engine is at capacity. Please retry shortly."
            }
          }
        }
      },
      "QueryTimeout": {
        "description": "Gateway timeout - the query took too long to execute and was\ncancelled. Narrow the query (a shorter data reach, a more selective\nfield) and retry.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "The query took too long to execute. Narrow the query and retry."
            }
          }
        }
      },
      "UnexpectedError": {
        "description": "Unexpected error",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Encountered error while performing request"
            }
          }
        }
      }
    },
    "parameters": {
      "query": {
        "name": "query",
        "in": "query",
        "description": "GNQL query string",
        "required": true,
        "schema": {
          "type": "string"
        }
      }
    },
    "schemas": {
      "ErrorMessage": {
        "type": "object",
        "properties": {
          "message": {
            "type": "string"
          }
        },
        "required": [
          "message"
        ]
      },
      "GNQLCountResponse": {
        "type": "object",
        "properties": {
          "count": {
            "type": "integer",
            "format": "int64",
            "description": "The number of IPs matching the query",
            "example": 50000
          },
          "query": {
            "type": "string",
            "description": "The GNQL query string the requester submitted",
            "example": "classification:malicious last_seen:1d"
          },
          "adjusted_query": {
            "type": "string",
            "description": "The query that was actually executed, when plan limitations\nrewrote the submitted query. Absent when the query ran unchanged.\n",
            "example": "classification:malicious last_seen:1d last_seen:7d"
          },
          "message": {
            "type": "string",
            "description": "A status message indicating if there were issues with the request",
            "example": "The requested data reach exceeds your plan."
          },
          "restricted_fields": {
            "type": "array",
            "description": "The fields that were restricted due to plan limitations",
            "items": {
              "type": "string"
            },
            "example": [
              "metadata.organization",
              "raw_data.ja3"
            ]
          }
        },
        "required": [
          "count",
          "query"
        ]
      }
    }
  }
}
```