List Tactics Detection Destination IPs

get

https://api.greynoise.io/v3/workspaces/{workspace_id}/tactics/{detection_id}/dest-ips

List the unique remote IP addresses a detection's session contacted,
sorted for stable pagination.

Internet-routable addresses are returned by default; this includes
link-local (cloud instance metadata, 169.254.0.0/16) and multicast
addresses, which are deliberately kept visible. Set
include_lateral=true to additionally return RFC 1918 and loopback
addresses — traffic aimed at the sensor's own neighborhood rather than
the internet.

Responses

200OK - destination IP page returned.

400Bad request - a path parameter, query parameter, or request body was invalid. Validation errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.

401Unauthorized. Please check your API key.

403Forbidden - the workspace is not entitled to Tactics (or, for the host artifact content endpoint, not entitled to file contents), or the authenticated user does not have access to the requested workspace. Contact [email protected] to enable Tactics for your workspace.

500Unexpected error while serving the request. Errors raised by the Tactics backend are returned as a plain-text message; errors raised by the API gateway use the JSON {"message": ...} shape.