GNQL V3 IP Export

Stream every IP address matching a GNQL query as a single JSON
document: {"ips": [...], "request_metadata": {...}}. Unlike
GET /v3/gnql, this endpoint returns IP addresses only — no metadata,
tags, or raw data — and is not paginated: the full result set is
streamed in one response, so no scroll token is involved.

Because a large export can take a while to produce its first bytes,
the response is kept alive with whitespace between chunks. Whitespace
between JSON tokens is insignificant, so any standard JSON parser
handles it; a parser reading the body incrementally should expect it.

Entitlement, data-reach, and restricted-field handling match the
search endpoint. When plan limitations rewrite the query, the response
is a 206 if nothing has been written yet; on an export that has
already begun streaming the status is committed as 200, so treat a
non-empty request_metadata.adjusted_query as the authoritative
signal that the query was modified.

Query Params
string
required

GNQL query string

boolean
Defaults to false

When true, omit Business Service Intelligence (BSI, formerly
RIOT) IPs at trust levels 1 and 2 — the tiers a blocklist should
never emit. Requires the BSI Module; without it the parameter is
accepted and the result set is returned unfiltered.
request_metadata.count then reports the number of IPs actually
returned rather than the pre-filter total.

Responses

Language
Credentials
Header
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json