---
updatedAt: 2026-08-21T14:19:02.000Z
agentTools:
  projectIndex: https://docs.greynoise.io/llms.txt
---

# GNQL V3 IP Export

Stream every IP address matching a GNQL query as a single JSON
document: `{"ips": [...], "request_metadata": {...}}`. Unlike
`GET /v3/gnql`, this endpoint returns IP addresses only — no metadata,
tags, or raw data — and is not paginated: the full result set is
streamed in one response, so no `scroll` token is involved.

IPs are ordered most recently seen first (by `last_seen` descending,
ties broken by ascending IP address). A client that reads only the
beginning of the stream therefore receives the most recently observed
IPs rather than an arbitrary slice of the match set.

Because a large export can take a while to produce its first bytes,
the response is kept alive with whitespace between chunks. Whitespace
between JSON tokens is insignificant, so any standard JSON parser
handles it; a parser reading the body incrementally should expect it.

Requires the `feature-search-ips-bulk-export` entitlement, in addition
to the search entitlement. A caller without it receives a `403` before
any query runs.

Data-reach and restricted-field handling match the search endpoint.
When plan limitations rewrite the query, the response is a `206` if
nothing has been written yet; on an export that has
already begun streaming the status is committed as `200`, so treat a
non-empty `request_metadata.adjusted_query` as the authoritative
signal that the query was modified.


# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "info": {
    "description": "GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.",
    "version": "3.0.0",
    "title": "GreyNoise API",
    "contact": {
      "email": "hello@greynoise.io"
    },
    "license": {
      "name": "Proprietary",
      "url": "https://www.greynoise.io/terms"
    }
  },
  "tags": [
    {
      "name": "GNQL",
      "description": "Calls to interface with GNQL (GreyNoise Query Language)."
    }
  ],
  "security": [
    {
      "APIKeyHeaderAuth": []
    }
  ],
  "paths": {
    "/v3/gnql/ips": {
      "get": {
        "tags": [
          "GNQL"
        ],
        "summary": "GNQL V3 IP Export",
        "operationId": "gnqlV3ExportIPs",
        "description": "Stream every IP address matching a GNQL query as a single JSON\ndocument: `{\"ips\": [...], \"request_metadata\": {...}}`. Unlike\n`GET /v3/gnql`, this endpoint returns IP addresses only — no metadata,\ntags, or raw data — and is not paginated: the full result set is\nstreamed in one response, so no `scroll` token is involved.\n\nIPs are ordered most recently seen first (by `last_seen` descending,\nties broken by ascending IP address). A client that reads only the\nbeginning of the stream therefore receives the most recently observed\nIPs rather than an arbitrary slice of the match set.\n\nBecause a large export can take a while to produce its first bytes,\nthe response is kept alive with whitespace between chunks. Whitespace\nbetween JSON tokens is insignificant, so any standard JSON parser\nhandles it; a parser reading the body incrementally should expect it.\n\nRequires the `feature-search-ips-bulk-export` entitlement, in addition\nto the search entitlement. A caller without it receives a `403` before\nany query runs.\n\nData-reach and restricted-field handling match the search endpoint.\nWhen plan limitations rewrite the query, the response is a `206` if\nnothing has been written yet; on an export that has\nalready begun streaming the status is committed as `200`, so treat a\nnon-empty `request_metadata.adjusted_query` as the authoritative\nsignal that the query was modified.\n",
        "parameters": [
          {
            "$ref": "#/components/parameters/query"
          },
          {
            "in": "query",
            "name": "exclude_riot",
            "description": "When `true`, omit Business Service Intelligence (BSI, formerly\nRIOT) IPs at trust levels 1 and 2 — the tiers a blocklist should\nnever emit. Requires the BSI Module; without it the parameter is\naccepted and the result set is returned unfiltered.\n`request_metadata.count` then reports the number of IPs actually\nreturned rather than the pre-filter total.\n",
            "required": false,
            "schema": {
              "type": "boolean",
              "default": false
            }
          }
        ],
        "responses": {
          "200": {
            "description": "OK - request successful.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GNQLIPExportResponse"
                }
              }
            }
          },
          "206": {
            "description": "Partial content - request partially successful.\nDue to plan limitations, the submitted query was rewritten before\nit was executed. The `adjusted_query` field in\n`request_metadata` indicates how the original query was modified.\nContact sales@greynoise.io to upgrade your plan and unlock full\nresults.\n",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GNQLIPExportResponse"
                }
              }
            }
          },
          "400": {
            "$ref": "#/components/responses/BadRequest"
          },
          "401": {
            "$ref": "#/components/responses/Unauthorized"
          },
          "403": {
            "description": "Forbidden - the caller lacks the search entitlement or the\n`feature-search-ips-bulk-export` entitlement, or the query names a\nworkspace label the caller is not entitled to. Contact\nsales@greynoise.io to discuss access.\n",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/GNQLV3Response"
                },
                "example": {
                  "request_metadata": {
                    "query": "classification:malicious last_seen:1d",
                    "message": "You are not entitled to use the IP export feature. Reach out to your business representative to discuss access.",
                    "complete": true,
                    "count": 0,
                    "restricted_fields": []
                  },
                  "data": []
                }
              }
            }
          },
          "429": {
            "$ref": "#/components/responses/QueryEngineAtCapacity"
          },
          "500": {
            "$ref": "#/components/responses/UnexpectedError"
          },
          "504": {
            "$ref": "#/components/responses/QueryTimeout"
          }
        }
      }
    }
  },
  "servers": [
    {
      "url": "https://api.greynoise.io"
    },
    {
      "url": "http://api.greynoise.io"
    }
  ],
  "components": {
    "securitySchemes": {
      "APIKeyHeaderAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "key"
      }
    },
    "responses": {
      "BadRequest": {
        "description": "Bad request - request syntax is invalid for the specified endpoint.\nVerify request syntax and try again.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Invalid parameter"
            }
          }
        }
      },
      "Unauthorized": {
        "description": "Unauthorized. Please check your API key.",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Unauthorized"
            }
          }
        }
      },
      "QueryEngineAtCapacity": {
        "description": "Too many requests - the query engine is shedding load. This is\nretryable: a `Retry-After` header carries the suggested delay when the\nengine supplies one.\n",
        "headers": {
          "Retry-After": {
            "description": "Seconds to wait before retrying, when supplied by the query engine.",
            "schema": {
              "type": "string"
            }
          }
        },
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "The query engine is at capacity. Please retry shortly."
            }
          }
        }
      },
      "QueryTimeout": {
        "description": "Gateway timeout - the query took too long to execute and was\ncancelled. Narrow the query (a shorter data reach, a more selective\nfield) and retry.\n",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "The query took too long to execute. Narrow the query and retry."
            }
          }
        }
      },
      "UnexpectedError": {
        "description": "Unexpected error",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Encountered error while performing request"
            }
          }
        }
      }
    },
    "parameters": {
      "query": {
        "name": "query",
        "in": "query",
        "description": "GNQL query string",
        "required": true,
        "schema": {
          "type": "string"
        }
      }
    },
    "schemas": {
      "ErrorMessage": {
        "type": "object",
        "properties": {
          "message": {
            "type": "string"
          }
        },
        "required": [
          "message"
        ]
      },
      "MetadataV3": {
        "properties": {
          "mobile": {
            "type": "boolean",
            "description": "Defines if the IP is part of a known cellular network.",
            "example": false
          },
          "source_country": {
            "type": "string",
            "description": "Country where the IP address is registered or operates.",
            "example": "United States"
          },
          "source_country_code": {
            "type": "string",
            "description": "Country code of the IP address based on ISO 3166-1 alpha-2.",
            "example": "US"
          },
          "source_city": {
            "type": "string",
            "description": "The city where the device is geographically located.",
            "example": "Seattle"
          },
          "region": {
            "type": "string",
            "description": "The region where the device is geographically located.",
            "example": "Seattle"
          },
          "organization": {
            "type": "string",
            "description": "The name of organization that owns the IP address.",
            "example": "DigitalOcean, LLC"
          },
          "rdns": {
            "type": "string",
            "description": "The reverse DNS pointer.",
            "example": "crawl-66-249-79-17.googlebot.com"
          },
          "asn": {
            "type": "string",
            "description": "The autonomous system identification number.",
            "example": "AS521"
          },
          "asn_subnet": {
            "type": "string",
            "description": "The latest-observed ASN subnet for the IP in GreyNoise scan data, not authoritative current BGP state.",
            "example": "203.0.113.0/24"
          },
          "category": {
            "type": "string",
            "description": "The subset of network types the IP address belongs to.",
            "enum": [
              "isp",
              "business",
              "hosting",
              "mobile",
              "education"
            ],
            "example": "education"
          },
          "os": {
            "type": "string",
            "description": "An approximate guess of the operating system of the device, based on the TCP stack fingerprint.",
            "example": "Windows 7/8"
          },
          "destination_countries": {
            "type": "array",
            "items": {
              "type": "string",
              "description": "The full name or country code where GreyNoise sensor\nis physically located.\n",
              "example": "Germany"
            }
          },
          "destination_country_codes": {
            "type": "array",
            "items": {
              "type": "string",
              "description": "The country codes where GreyNoise sensor is\nphysically located.\n",
              "example": "Germany"
            }
          },
          "destination_cities": {
            "type": "array",
            "items": {
              "type": "string",
              "description": "The city where the GreyNoise sensor is geographically located.\n",
              "example": "Berlin"
            }
          },
          "destination_asns": {
            "type": "array",
            "items": {
              "type": "string",
              "description": "The ASN associated with the destination IP address.\n",
              "example": "AS1234"
            }
          },
          "single_destination": {
            "type": "boolean",
            "description": "A Boolean parameter indicating whether the source IP address\nhas only been observed in a single destination country.\n",
            "example": true
          },
          "carrier": {
            "type": "string",
            "description": "The Internet Service Provider (ISP) or telecommunications\ncarrier associated with the source IP address.\n",
            "example": "AIS"
          },
          "datacenter": {
            "type": "string",
            "description": "The datacenter or hosting provider from which the activity originates.\nThis could indicate the use of cloud services,\nmanaged hosting, or enterprise datacenter infrastructure.\n",
            "example": "us-west-1"
          },
          "domain": {
            "type": "string",
            "description": "The domain name associated with the source IP address.\n",
            "example": "example.com"
          },
          "rdns_parent": {
            "type": "string",
            "description": "The parent domain retrieved through reverse DNS (RDNS)\nlookup of the source IP address.\n",
            "example": "example.com"
          },
          "rdns_validated": {
            "type": "boolean",
            "description": "A validation status that confirms whether the reverse DNS (RDNS)\nrecord correctly maps to the source domain.\n",
            "example": true
          },
          "latitude": {
            "type": "number",
            "description": "The geographic latitude of the source IP address.\n",
            "example": 37.7749
          },
          "longitude": {
            "type": "number",
            "description": "The geographic longitude of the source IP address.\n",
            "example": -122.4194
          },
          "sensor_count": {
            "type": "integer",
            "description": "Number of sensors with events observed.\n",
            "example": 10
          },
          "sensor_hits": {
            "type": "integer",
            "description": "Number of scanning events observed.\n",
            "example": 10
          }
        }
      },
      "GNQLIPContextV3": {
        "properties": {
          "ip": {
            "type": "string",
            "description": "IP address that the information is about.",
            "example": "71.6.135.131"
          },
          "internet_scanner_intelligence": {
            "$ref": "#/components/schemas/InternetScannerIntelligence"
          },
          "business_service_intelligence": {
            "$ref": "#/components/schemas/BusinessServiceIntelligence"
          }
        }
      },
      "InternetScannerIntelligence": {
        "properties": {
          "classification": {
            "type": "string",
            "description": "The classification of the IP address, either \"benign\", \"malicious\", or \"unknown\", based on the activity observed by GreyNoise.",
            "enum": [
              "benign",
              "malicious",
              "unknown"
            ],
            "example": "benign"
          },
          "first_seen": {
            "type": "string",
            "description": "The earliest date GreyNoise observed any activity from this IP.",
            "format": "date",
            "example": "2018-01-28"
          },
          "last_seen": {
            "type": "string",
            "description": "The most recent date GreyNoise observed any activity from this IP.",
            "format": "date",
            "example": "2018-02-28"
          },
          "last_seen_timestamp": {
            "type": "string",
            "description": "The timestamp of the last observed activity from this IP.",
            "format": "date-time",
            "example": "2025-01-15T12:30:45Z"
          },
          "last_seen_malicious": {
            "type": "string",
            "format": "date-time",
            "description": "Timestamp of the most recent activity classified as malicious. Empty if never observed.",
            "example": "2026-08-14T18:45:30Z"
          },
          "last_seen_suspicious": {
            "type": "string",
            "format": "date-time",
            "description": "Timestamp of the most recent activity classified as suspicious. Empty if never observed.",
            "example": "2026-08-14T19:23:31Z"
          },
          "last_seen_benign": {
            "type": "string",
            "format": "date-time",
            "description": "Timestamp of the most recent activity classified as benign. Empty if never observed.",
            "example": "2026-08-14T19:24:57Z"
          },
          "found": {
            "type": "boolean",
            "description": "Indicates if the IP was observed scanning the GreyNoise sensor network. Also referred to as 'noise'.",
            "example": true
          },
          "actor": {
            "type": "string",
            "description": "The overt actor this IP is associated with.",
            "example": "Shodan.io"
          },
          "spoofable": {
            "type": "boolean",
            "description": "This IP address has been opportunistically scanning the Internet, however has failed to complete a full TCP connection. Any reported activity could be spoofed.",
            "example": true
          },
          "cves": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "A list of CVEs associate with this IP.",
            "example": [
              "CVE-2020-1234",
              "CVE-2021-2345"
            ]
          },
          "callback_ips": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "IPs observed as callback destinations for this IP's activity."
          },
          "source_workspaces": {
            "type": "array",
            "items": {
              "type": "string",
              "enum": [
                "greynoise",
                "community",
                "personal"
              ]
            },
            "description": "Which datasets this IP was found in, matching the workspace_labels selected on the request. Omitted when no workspace_labels were selected.",
            "example": [
              "greynoise",
              "community"
            ]
          },
          "tor": {
            "type": "boolean",
            "description": "Whether or not the device is a known Tor exit node.",
            "example": false
          },
          "vpn": {
            "type": "boolean",
            "description": "This IP is associated with a VPN service. Activity, malicious or otherwise, should not be attributed to the VPN service provider.",
            "example": true
          },
          "vpn_service": {
            "type": "string",
            "description": "Name of associated VPN Service.",
            "example": "IPVANISH_VPN"
          },
          "metadata": {
            "$ref": "#/components/schemas/MetadataV3"
          },
          "tags": {
            "type": "array",
            "description": "Activity tags associated with this IP.",
            "items": {
              "$ref": "#/components/schemas/IPResponseV3Tags"
            }
          },
          "tag_volumes": {
            "type": "array",
            "description": "Per-tag session counts observed for this IP. Omitted when no tag activity has been recorded.",
            "items": {
              "type": "object",
              "properties": {
                "tag_id": {
                  "type": "string",
                  "format": "uuid",
                  "description": "The ID of the tag."
                },
                "session_count": {
                  "type": "integer",
                  "format": "int64",
                  "description": "Number of sessions associated with this tag for this IP."
                }
              }
            }
          },
          "raw_data": {
            "type": "object",
            "description": "Raw data observed directly by GreyNoise.",
            "properties": {
              "scan": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "port": {
                      "type": "integer",
                      "description": "Port number",
                      "example": 80
                    },
                    "protocol": {
                      "type": "string",
                      "description": "Protocol",
                      "example": "TCP"
                    }
                  }
                }
              },
              "ja3": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "fingerprint": {
                      "type": "string",
                      "example": "c3a6cf0bf2e690ac8e1ecf6081f17a50",
                      "description": "JA3 hash fingerprint string"
                    },
                    "port": {
                      "type": "integer",
                      "example": 443,
                      "description": "TCP port connection that the SSL/TLS communication occurred over"
                    }
                  }
                }
              },
              "hassh": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "fingerprint": {
                      "type": "string",
                      "example": "51cba57125523ce4b9db67714a90bf6e",
                      "description": "HASSH hash fingerprint string"
                    },
                    "port": {
                      "type": "integer",
                      "example": 2222,
                      "description": "TCP port connection where the HASSH hash was identified\n"
                    }
                  }
                }
              },
              "http": {
                "type": "object",
                "properties": {
                  "md5": {
                    "type": "string",
                    "description": "An MD5 hash of the body content. This compact,\nunique representation of the data allows for quick\ncomparisons and deduplication of payloads without\nstoring the raw content.\n",
                    "example": "9764955b67107eeb9edfae76f429e783"
                  },
                  "cookie_keys": {
                    "type": "array",
                    "description": "The keys or names of cookies exchanged in the communication.\nThese can reveal session identifiers, tracking mechanisms,\nor other metadata used in web interactions,\nproviding clues about application behavior or vulnerabilities.\n",
                    "example": [
                      "expremotekey"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "request_authorization": {
                    "type": "array",
                    "description": "The contents of the Authorization header in a request,\nwhich can include credentials, tokens, or other authentication\ninformation.\n",
                    "example": [
                      "Bearer exampletoken",
                      "Basic username:password"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "request_cookies": {
                    "type": "array",
                    "description": "Key-value pairs stored in cookies sent with an HTTP request.\nThese cookies often contain session identifiers, user preferences,\nor tracking data, which can be analyzed to detect unauthorized\naccess or manipulation.\n",
                    "example": [
                      "session_id=1234567890"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "request_header": {
                    "type": "array",
                    "description": "Request Headers are the keys (names) of HTTP headers\nthat a client sends to a server.\n",
                    "example": [
                      "Content-Type: application/json",
                      "Accept: application/json"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "method": {
                    "type": "array",
                    "description": "The HTTP method used in the request, such as GET, POST, PUT, or DELETE.\nAnalyzing methods can reveal the intent of the request,\nsuch as retrieving or modifying resources,\nand identify unexpected or suspicious activity.\n",
                    "example": [
                      "GET",
                      "POST",
                      "PUT",
                      "DELETE"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "request_origin": {
                    "type": "array",
                    "description": "Indicates the origin of the request,\ntypically used in cross-origin resource sharing (CORS)\nto specify where the request originated.\nThis helps identify unauthorized or potentially\nmalicious cross-origin requests.\n",
                    "example": [
                      "111.111.1.1"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "host": {
                    "type": "array",
                    "description": "The host of the request, which can include the domain name\nand port number. These values can provide insight into the services or\nendpoints the actor may have been attempting to interact with.\n",
                    "example": [
                      "example.com",
                      "example.com:8080"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "uri": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "description": "The URI of the request, which can include the path and query parameters.\nThis can provide insight into the specific resource or data being requested.\n"
                    }
                  },
                  "path": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "description": "Observed scanning activity traversed this web path.",
                      "example": "/robots.txt"
                    }
                  },
                  "useragent": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "description": "Observed scanning activity used these user agents.",
                      "example": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\n"
                    }
                  },
                  "ja4h": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "description": "List of JA4H HTTP client fingerprints observed in network traffic from the IP.\nJA4H captures characteristics of HTTP client behavior including method,\nheaders, and cookie fields, useful for identifying and tracking HTTP clients.\n"
                    },
                    "example": [
                      "ge11cn060000_4e59edc1297a_4da5efaf0cbd"
                    ]
                  }
                }
              },
              "tls": {
                "type": "object",
                "properties": {
                  "cipher": {
                    "type": "string",
                    "description": "The encryption algorithm or cipher suite used during the\nsecure communication. Identifying the cipher helps assess\nthe security of the connection, particularly in TLS/SSL traffic.\n",
                    "example": "TLS_AES_128_GCM_SHA256"
                  },
                  "ja4": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "description": "List of JA4 TLS fingerprints observed in network traffic from the IP.\nJA4 is a modern fingerprinting method that captures distinctive\ncharacteristics of TLS client behavior,\nuseful for identifying and clustering malicious or anomalous clients.\n"
                    },
                    "example": [
                      "t13d1516h2_8daaf6152771_02713d6af862"
                    ]
                  }
                }
              },
              "ssh": {
                "type": "object",
                "properties": {
                  "key": {
                    "type": "array",
                    "description": "This is the SSH key used.\n",
                    "example": [
                      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1234567890"
                    ],
                    "items": {
                      "type": "string"
                    }
                  },
                  "ja4ssh": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "description": "List of JA4SSH fingerprints observed in network traffic from the IP.\nJA4SSH captures SSH traffic patterns including packet lengths and\ndirections, useful for identifying SSH client behavior and detecting\nanomalous sessions.\n"
                    },
                    "example": [
                      "c76s76_c71s59_c0s0"
                    ]
                  }
                }
              },
              "tcp": {
                "type": "object",
                "properties": {
                  "ja4t": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "description": "List of JA4T TCP fingerprints observed in network traffic from the IP.\nJA4T captures TCP connection characteristics such as window size,\noptions, and MSS, useful for OS fingerprinting and identifying\nnetwork stacks.\n"
                    },
                    "example": [
                      "64240_2-1-3-1-1-4_1460_8"
                    ]
                  },
                  "ja4l": {
                    "type": "string",
                    "description": "JA4L light distance/latency fingerprint observed in network traffic\nfrom the IP. Captures TCP TTL and window size characteristics, useful\nfor estimating client-server distance and identifying proxied\nconnections.\n",
                    "example": "1460_64"
                  }
                }
              },
              "source": {
                "properties": {
                  "bytes": {
                    "type": "integer",
                    "description": "The total amount of data transferred (in bytes) during the observed session or connection.\n",
                    "example": 1024
                  }
                }
              }
            }
          }
        }
      },
      "BusinessServiceIntelligence": {
        "properties": {
          "found": {
            "type": "boolean",
            "description": "Indicates if an IP is part of the RIOT dataset or not.\n",
            "example": true
          },
          "category": {
            "type": "string",
            "description": "RIOT category the provider belongs to, identifying the type of service provided.\n",
            "example": "hosting"
          },
          "name": {
            "type": "string",
            "description": "The name of the provider and/or service.\n",
            "example": "example.com"
          },
          "description": {
            "type": "string",
            "description": "A description of the provider and what they do.\n",
            "example": "example.com"
          },
          "explanation": {
            "type": "string",
            "description": "An explanation of the category type and what may be expected from this provider and category.\n"
          },
          "last_updated": {
            "type": "string",
            "description": "Date and time when this record was last updated from its source (format: YYYY-MM-DDTHH:MM:SSZ).\n",
            "example": "2025-01-15T12:30:45Z"
          },
          "reference": {
            "type": "string",
            "description": "Reference URL for information about this provider and/or service.\n",
            "example": "https://example.com"
          },
          "trust_level": {
            "type": "string",
            "description": "Trust level assigned to this IP/provider. One of:\n  - \"1\" — high trust; broadly used legitimate provider where end-user attribution is high.\n  - \"2\" — moderate trust; common business service infrastructure where end-user attribution is limited.\n  - \"3\" — label only; cloud compute or bulk hosting provider with no inherent trust signal.\n",
            "example": "1"
          }
        }
      },
      "IPResponseV3Tags": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "example": "ef0cc90d-d80c-436f-92c5-3d8f8665c9ac",
            "description": "The unique identifier for the tag.\n"
          },
          "slug": {
            "type": "string",
            "example": "mirai",
            "description": "The slugified version of the tag name.\n"
          },
          "name": {
            "type": "string",
            "example": "Mirai",
            "description": "The human-readable name for the tag.\n"
          },
          "category": {
            "type": "string",
            "example": "worm",
            "description": "Category of the IP address such as hosting or ISP.\n"
          },
          "intention": {
            "type": "string",
            "example": "malicious",
            "description": "The intent of the tag, either suspicious, malicious, benign, or unknown.\n"
          },
          "description": {
            "type": "string",
            "example": "This IP address exhibits behavior that indicates it is infected with Mirai or a Mirai-like variant of malware.",
            "description": "A detailed description of the tag, including the observed activity\nand any relevant context or details.\n"
          },
          "references": {
            "type": "array",
            "items": {
              "type": "string",
              "example": "https://en.wikipedia.org/wiki/Mirai_(malware)",
              "description": "A list of URLs or references that provide additional information\nabout the tag and its associated activity.\n"
            }
          },
          "recommend_block": {
            "type": "boolean",
            "example": false,
            "description": "A boolean value indicating whether the tag should be recommended\nfor blocking or filtering purposes.\n"
          },
          "cves": {
            "type": "array",
            "items": {
              "type": "string",
              "example": "CVE-2020-1234",
              "description": "A list of CVEs associated with the tag.\n"
            }
          },
          "created": {
            "type": "string",
            "example": "2020-04-07",
            "description": "The date the tag was created. May be empty.\n"
          },
          "updated_at": {
            "type": "string",
            "format": "date-time",
            "example": "2026-02-10T15:59:49Z",
            "description": "The timestamp when the tag was last updated.\n"
          }
        }
      },
      "GNQLV3Response": {
        "type": "object",
        "properties": {
          "request_metadata": {
            "$ref": "#/components/schemas/GNQLV3ResponseMetadata"
          },
          "data": {
            "type": "array",
            "description": "The relevant IP records requested by the user",
            "items": {
              "$ref": "#/components/schemas/GNQLIPContextV3"
            }
          }
        }
      },
      "GNQLV3ResponseMetadata": {
        "type": "object",
        "properties": {
          "complete": {
            "type": "boolean",
            "example": false,
            "description": "Whether all records have been delivered or not. `false` means there's another page"
          },
          "scroll": {
            "type": "string",
            "example": "DnF1ZXJ5VGhlbkZldGNoBQAAAAAAeygtFkFKSExEdUc4VEtta2syaGg2R3kzNGcAAAAAAH soLhZBSkhMRHVHOFRLbWtrMmhoNkd5MzRnAAAAAAB7KC8WQUpITER1RzhUS21razJoaDZH eTM0ZwAAAAAAeygxFkFKSExEdUc4VEtta2syaGg2R3kzNGcAAAAAAHsoMBZBSkhMRHVHOF RLbWtrMmhoNkd5MzRn\n",
            "description": "Scroll token to use for pagination"
          },
          "query": {
            "type": "string",
            "example": "last_seen:2019-07-28 classification:malicious",
            "description": "The GNQL query string the requester queried"
          },
          "adjusted_query": {
            "type": "string",
            "example": "last_seen:2019-07-28 classification:malicious",
            "description": "When certain query parameters are not specified or incompatible\nwith your current plan, GreyNoise automatically adjusts params on your\nquery prior to execution.\n"
          },
          "count": {
            "type": "integer",
            "example": 1,
            "description": "The number of total results for the given GNQL query"
          },
          "message": {
            "type": "string",
            "example": "ok",
            "description": "A status message indicating if there were issues with the request"
          },
          "restricted_fields": {
            "type": "array",
            "description": "The fields that were restricted due to plan limitations",
            "example": [
              "ip",
              "asn",
              "organization",
              "country",
              "city",
              "region"
            ],
            "items": {
              "type": "string"
            }
          }
        }
      },
      "GNQLIPExportResponse": {
        "type": "object",
        "properties": {
          "ips": {
            "type": "array",
            "description": "Every IP address matching the query, ordered most recently seen\nfirst (`last_seen` descending, ties broken by ascending IP address).\n",
            "items": {
              "type": "string"
            },
            "example": [
              "1.2.3.4",
              "5.6.7.8"
            ]
          },
          "request_metadata": {
            "$ref": "#/components/schemas/GNQLIPExportMetadata"
          }
        },
        "required": [
          "ips",
          "request_metadata"
        ]
      },
      "GNQLIPExportMetadata": {
        "type": "object",
        "properties": {
          "count": {
            "type": "integer",
            "format": "int64",
            "description": "The number of IPs matching the query. When `exclude_riot=true`\nthis is the number of IPs actually returned, after the BSI\nexclusion, rather than the pre-filter total.\n",
            "example": 50000
          },
          "query": {
            "type": "string",
            "description": "The GNQL query string the requester submitted",
            "example": "classification:malicious last_seen:1d"
          },
          "adjusted_query": {
            "type": "string",
            "description": "The query that was actually executed, when plan limitations\nrewrote the submitted query. Absent when the query ran unchanged.\n",
            "example": "classification:malicious last_seen:1d last_seen:7d"
          },
          "message": {
            "type": "string",
            "description": "A status message indicating if there were issues with the request",
            "example": "No results found."
          },
          "restricted_fields": {
            "type": "array",
            "description": "The fields that were restricted due to plan limitations",
            "items": {
              "type": "string"
            },
            "example": [
              "metadata.organization"
            ]
          }
        },
        "required": [
          "count",
          "query"
        ]
      }
    }
  }
}
```