Search retained feed events

post

https://api.greynoise.io/v3/feeds/events/search

Search the authenticated workspace's retained feed-event history without
reading or changing any pull-consumer checkpoint. Results are ordered
newest first.

The simplest request is an empty JSON object. It returns events from all
currently enabled, non-session feeds over the previous hour. Set from
to a relative duration such as 6h or 7d, a UTC date, or an RFC 3339
timestamp. to accepts a UTC date or RFC 3339 timestamp and defaults to
the time the request is received.

For narrower searches, use feed_ids and the advanced exact-match fields
event_types, ip, cve, tag, and classification. Explicitly named
disabled feeds remain searchable while their events are retained.

This endpoint uses stateless keyset pagination. When has_more is true,
send a new request containing only the returned cursor and, optionally,
limit. The signed cursor restores the original workspace, feed scope,
filters, and absolute time window. It is unrelated to the cursor returned
by the pull endpoint for acknowledgement.

Retained history is approximately 90 days. Session events are not stored
and cannot be searched.

Body Params

For the first page, omit cursor and provide any search criteria. An
empty object searches all enabled feeds over the previous hour.

For each subsequent page, send cursor and optional limit only. Search
criteria cannot be combined with a cursor because the cursor already
contains the original normalized scope and absolute time window.

feed_ids

array of uuids

length ≤ 100

Feed UUIDs to include. Omit to search all currently enabled,
non-session feeds in the workspace. Explicit IDs may refer to disabled
feeds, but deleted feeds return 404 and session feeds return 400.

feed_ids

event_types

array of objects

length ≤ 8

Advanced filter for exact retained event types.

event_types

string

length ≤ 45

Advanced filter for an exact IP in the indexed event dimensions.

cve

string

length ≤ 128

Advanced filter for an exact CVE in the indexed event dimensions.

tag

string

length ≤ 256

Advanced filter for an exact tag in the indexed event dimensions.

classification

string

length ≤ 128

Advanced filter for an exact classification in the indexed event dimensions.

from

^[1-9][0-9]*(h|d)$

Inclusive lower event-time bound. Accepts a positive whole-number
duration in hours or days relative to to (for example 1h, 6h,
1d, or 7d), a UTC date (YYYY-MM-DD), or an RFC 3339 timestamp.
Defaults to one hour before to.

^[0-9]{4}-[0-9]{2}-[0-9]{2}$

Exclusive upper event-time bound as a UTC date (YYYY-MM-DD) or RFC
3339 timestamp. Defaults to the time the request is received and must
be later than the resolved from value.

cursor

string

length ≤ 8192

Opaque signed cursor returned by the preceding search page. A
continuation request may contain only this field and optional limit.

limit

integer

1 to 1000

Defaults to 100

Maximum number of events to return.

Responses

200A newest-first page of matching retained events.

400A path parameter, query parameter, request body, filter, or cursor is invalid.

401The API key or authenticated user is missing or invalid.

403The caller cannot access the workspace or the required entitlement is not enabled.

404The workspace-scoped feed or consumer was not found.

408The request was canceled before it completed.

410The cursor points outside the retained event window. Follow the returned recovery action to fetch from the current retention boundary.

500An unexpected error occurred while processing the request.

502The Event Feed service was unavailable or returned an invalid response.

504The Event Feed service did not complete the request before its deadline.