◊ Open data

Data & access

The observations behind this study are open. Query them live or export a snapshot for offline analysis, with original Observatory metadata licensed separately from third-party material.

How to get the data

  • Export API. GET /api/v2/export?format=json|csv returns records with the same filters as search (q, network, time_range, product, port, status, secured, has_vulns, tag, verdict, limit, offset, sort). Sort values are newest, relevance, vulns, ip. Requests are rate-limited. Pagination is manual: request 1–2,000 records at a time with limit, then increase offset until an export contains fewer records than requested. Export responses do not include a total or next-page link. The response headers X-RWO-Schema-Version and X-RWO-Generated-At identify the contract and export time.
  • Live JSON API. The read endpoints under /api/v2/ (gallery, search, map, stats, per-service detail, enrichment) power this site and are documented in the repository. Machine-readable contracts are available as OpenAPI and JSON Schema.
  • Snapshots. Dated archival dumps are planned but are not published yet. Until then, record the export time and query parameters when citing a live export.

Examples

curl 'https://observatory.verdantprotocol.com/api/v2/search?q=nginx&sort=relevance&limit=24'
curl -OJ 'https://observatory.verdantprotocol.com/api/v2/export?format=csv&secured=false&limit=1000'

Record schema

Each record describes one observed service. The JSON export uses the same summary-record shape as gallery and search, including capture URLs and metadata when available. Its core fields are:

FieldMeaning
ip / portThe observed service endpoint.
banner / productService banner and the parsed product/version, when present.
http_statusHTTP status returned by the capture.
securedtrue = captured over TLS (HTTPS); false = cleartext HTTP.
cert_cnTLS certificate common name, when HTTPS.
geoCoarse IP-based geolocation (country, region, city, lat/lon, and accuracy radius).
whoisNetwork / organization from WHOIS, when available.
vuln_countNumber of CVEs Shodan InternetDB associates with the host, not necessarily this service.
verdictA derived summary of third-party reputation evidence; not an independently verified finding.
sourcesWhich enrichment feeds contributed to this record.
enriched_atWhen enrichment was last refreshed (RFC 3339).
updated_atWhen the service was last observed (RFC 3339).

The flat CSV export is intentionally smaller. Its columns are ip, port, secured, http_status, product, product_version, banner, cert_cn, whois, country_iso, city, lat, lon, vuln_count, verdict, sources, enriched_at, updated_at. In particular, CSV includes only country code, city, and coordinates from the richer JSON geo object.

Individual records are public and can include exact addresses, screenshots, page source, service metadata, coarse geolocation, and host-level third-party enrichment. CVE and reputation fields are third-party associations, not verified findings — see limitations. Host-level fields such as CVEs, CPEs, hostnames, and additional ports are not necessarily attributable to the particular web service in the record. Exports contain summary records: they do not embed screenshot files or captured page source. JSON records can link to a screenshot and indicate whether captured text exists; retrieve available detail through the per-service API.

License

Original Observatory metadata, annotations, and applicable database rights are released under Creative Commons Attribution 4.0 (CC-BY-4.0) — free to use, share, and build on with attribution. That license does not grant rights the Observatory does not hold. Captured screenshots and page content, provider-supplied data, trademarks, privacy or publicity rights, and other third-party material remain subject to their respective owners' rights and provider terms.

The source code has a separate rights status. Publication of the Go reimplementation was authorized by elixx, creator of the private Python system behind What's on HTTP, but an open-source license for portions based on that system has not yet been documented. No new source-code license is currently offered. See the repository's licensing and provenance records before reusing source code.

How to cite

Walters, J. (2026). Reachable Web Observatory: a continuous random sample of the public-IPv4 web. Verdant Protocol. https://observatory.verdantprotocol.com/

Please cite the dataset and note the snapshot date when using it in published work.