Shodan is the world's first search engine for internet-connected devices and services. The API lets you search for exposed services (web servers, databases, cameras, industrial control systems), look up detailed information for any IP address (open ports, SSL certificates, software versions, CVEs), monitor your attack surface, query for known vulnerabilities, and receive alerts when new devices appear in your specified IP ranges. Essential for security researchers, penetration testers, and attack surface management teams.
https://api.shodan.io
Auth type
API Key Header
Auth header
?key=YOUR_API_KEY
Rate limit
1 request/sec (free) · Higher on paid
Pricing
Free tier available
Free quota
Free: limited to 1 query credit/scan
Documentation
https://developer.shodan.io/api
Endpoint status
Server online — HTTP 404 — server is online but path returned an error (may require auth)776ms
(checked Mar 29, 2026)
Builder score
B
73%
builder-friendly
Pass your API key as the key query parameter on every request. Get a free key at account.shodan.io.
?key=YOUR_API_KEY
Free: basic lookups, limited search results. Membership (one-time $49): 100 query credits, 1M scan credits, download results. Small Business $299/mo: 10k query credits. API plans for enterprise use.
| Method | Path | Description |
|---|---|---|
| GET | /shodan/host/{ip} |
Get all information Shodan has on a given IP |
| GET | /shodan/host/search |
Search Shodan (e.g., apache country:US port:80) |
| GET | /shodan/host/count |
Count results for a query without consuming credits |
| GET | /shodan/services |
List all services Shodan crawls |
| GET | /dns/resolve |
Resolve hostnames to IP addresses |
| GET | /api-info |
Get API key plan info, query credits remaining |
curl "https://api.shodan.io/shodan/host/count?query=apache+country%3AUS&key=$SHODAN_API_KEY"
{
"matches": [],
"facets": {
"country": [{"count": 1243891, "value": "US"}]
},
"total": 4829123
}
Data sourced from API Map. Always verify pricing and rate limits against the official Shodan documentation.