Create asset policy

Create a new asset policy that automatically takes action on assets matching defined conditions. Supported actions: alert (send notifications), delete (remove assets), set_label (add labels), and remove_label (remove labels).

POST /v1/asset/policy

Create asset policy

cURL

curl --request POST \
  --url https://api.projectdiscovery.io/v1/asset/policy \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "policies": {
    "is_tech": true,
    "is_favicon": true,
    "is_new": true,
    "labels": "<string>",
    "host": "<string>",
    "port": "<string>",
    "status_code": "<string>",
    "content_length": "<string>",
    "title": "<string>",
    "domain": [
      "<string>"
    ],
    "cname": "<string>",
    "technologies": "<string>",
    "ip": "<string>",
    "is_screenshot": true,
    "start_date": "2023-12-25",
    "end_date": "2023-12-25",
    "custom_filter": "<string>",
    "search": "<string>",
    "enumeration_ids": [
      "<string>"
    ],
    "only_dns": true,
    "only_ip": true,
    "not_seen_for_days": 2
  },
  "name": "<string>",
  "alerting_config_ids": [
    "<string>"
  ],
  "labels": [
    "<string>"
  ],
  "enumeration_ids": [
    "<string>"
  ],
  "apply_to_existing": false
}
'

import requests

url = "https://api.projectdiscovery.io/v1/asset/policy"

payload = {
    "policies": {
        "is_tech": True,
        "is_favicon": True,
        "is_new": True,
        "labels": "<string>",
        "host": "<string>",
        "port": "<string>",
        "status_code": "<string>",
        "content_length": "<string>",
        "title": "<string>",
        "domain": ["<string>"],
        "cname": "<string>",
        "technologies": "<string>",
        "ip": "<string>",
        "is_screenshot": True,
        "start_date": "2023-12-25",
        "end_date": "2023-12-25",
        "custom_filter": "<string>",
        "search": "<string>",
        "enumeration_ids": ["<string>"],
        "only_dns": True,
        "only_ip": True,
        "not_seen_for_days": 2
    },
    "name": "<string>",
    "alerting_config_ids": ["<string>"],
    "labels": ["<string>"],
    "enumeration_ids": ["<string>"],
    "apply_to_existing": False
}
headers = {
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    policies: {
      is_tech: true,
      is_favicon: true,
      is_new: true,
      labels: '<string>',
      host: '<string>',
      port: '<string>',
      status_code: '<string>',
      content_length: '<string>',
      title: '<string>',
      domain: ['<string>'],
      cname: '<string>',
      technologies: '<string>',
      ip: '<string>',
      is_screenshot: true,
      start_date: '2023-12-25',
      end_date: '2023-12-25',
      custom_filter: '<string>',
      search: '<string>',
      enumeration_ids: ['<string>'],
      only_dns: true,
      only_ip: true,
      not_seen_for_days: 2
    },
    name: '<string>',
    alerting_config_ids: ['<string>'],
    labels: ['<string>'],
    enumeration_ids: ['<string>'],
    apply_to_existing: false
  })
};

fetch('https://api.projectdiscovery.io/v1/asset/policy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.projectdiscovery.io/v1/asset/policy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'policies' => [
        'is_tech' => true,
        'is_favicon' => true,
        'is_new' => true,
        'labels' => '<string>',
        'host' => '<string>',
        'port' => '<string>',
        'status_code' => '<string>',
        'content_length' => '<string>',
        'title' => '<string>',
        'domain' => [
                '<string>'
        ],
        'cname' => '<string>',
        'technologies' => '<string>',
        'ip' => '<string>',
        'is_screenshot' => true,
        'start_date' => '2023-12-25',
        'end_date' => '2023-12-25',
        'custom_filter' => '<string>',
        'search' => '<string>',
        'enumeration_ids' => [
                '<string>'
        ],
        'only_dns' => true,
        'only_ip' => true,
        'not_seen_for_days' => 2
    ],
    'name' => '<string>',
    'alerting_config_ids' => [
        '<string>'
    ],
    'labels' => [
        '<string>'
    ],
    'enumeration_ids' => [
        '<string>'
    ],
    'apply_to_existing' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.projectdiscovery.io/v1/asset/policy"

	payload := strings.NewReader("{\n  \"policies\": {\n    \"is_tech\": true,\n    \"is_favicon\": true,\n    \"is_new\": true,\n    \"labels\": \"<string>\",\n    \"host\": \"<string>\",\n    \"port\": \"<string>\",\n    \"status_code\": \"<string>\",\n    \"content_length\": \"<string>\",\n    \"title\": \"<string>\",\n    \"domain\": [\n      \"<string>\"\n    ],\n    \"cname\": \"<string>\",\n    \"technologies\": \"<string>\",\n    \"ip\": \"<string>\",\n    \"is_screenshot\": true,\n    \"start_date\": \"2023-12-25\",\n    \"end_date\": \"2023-12-25\",\n    \"custom_filter\": \"<string>\",\n    \"search\": \"<string>\",\n    \"enumeration_ids\": [\n      \"<string>\"\n    ],\n    \"only_dns\": true,\n    \"only_ip\": true,\n    \"not_seen_for_days\": 2\n  },\n  \"name\": \"<string>\",\n  \"alerting_config_ids\": [\n    \"<string>\"\n  ],\n  \"labels\": [\n    \"<string>\"\n  ],\n  \"enumeration_ids\": [\n    \"<string>\"\n  ],\n  \"apply_to_existing\": false\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.projectdiscovery.io/v1/asset/policy")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"policies\": {\n    \"is_tech\": true,\n    \"is_favicon\": true,\n    \"is_new\": true,\n    \"labels\": \"<string>\",\n    \"host\": \"<string>\",\n    \"port\": \"<string>\",\n    \"status_code\": \"<string>\",\n    \"content_length\": \"<string>\",\n    \"title\": \"<string>\",\n    \"domain\": [\n      \"<string>\"\n    ],\n    \"cname\": \"<string>\",\n    \"technologies\": \"<string>\",\n    \"ip\": \"<string>\",\n    \"is_screenshot\": true,\n    \"start_date\": \"2023-12-25\",\n    \"end_date\": \"2023-12-25\",\n    \"custom_filter\": \"<string>\",\n    \"search\": \"<string>\",\n    \"enumeration_ids\": [\n      \"<string>\"\n    ],\n    \"only_dns\": true,\n    \"only_ip\": true,\n    \"not_seen_for_days\": 2\n  },\n  \"name\": \"<string>\",\n  \"alerting_config_ids\": [\n    \"<string>\"\n  ],\n  \"labels\": [\n    \"<string>\"\n  ],\n  \"enumeration_ids\": [\n    \"<string>\"\n  ],\n  \"apply_to_existing\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.projectdiscovery.io/v1/asset/policy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"policies\": {\n    \"is_tech\": true,\n    \"is_favicon\": true,\n    \"is_new\": true,\n    \"labels\": \"<string>\",\n    \"host\": \"<string>\",\n    \"port\": \"<string>\",\n    \"status_code\": \"<string>\",\n    \"content_length\": \"<string>\",\n    \"title\": \"<string>\",\n    \"domain\": [\n      \"<string>\"\n    ],\n    \"cname\": \"<string>\",\n    \"technologies\": \"<string>\",\n    \"ip\": \"<string>\",\n    \"is_screenshot\": true,\n    \"start_date\": \"2023-12-25\",\n    \"end_date\": \"2023-12-25\",\n    \"custom_filter\": \"<string>\",\n    \"search\": \"<string>\",\n    \"enumeration_ids\": [\n      \"<string>\"\n    ],\n    \"only_dns\": true,\n    \"only_ip\": true,\n    \"not_seen_for_days\": 2\n  },\n  \"name\": \"<string>\",\n  \"alerting_config_ids\": [\n    \"<string>\"\n  ],\n  \"labels\": [\n    \"<string>\"\n  ],\n  \"enumeration_ids\": [\n    \"<string>\"\n  ],\n  \"apply_to_existing\": false\n}"

response = http.request(request)
puts response.read_body

200

{
  "message": "<string>",
  "id": "<string>"
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

The policy_type determines which fields are required:

Policy Type	Required Fields
alert (default)	alerting_config_ids
delete	—
set_label	labels
remove_label	labels

Conditions: Multiple filters in the policies object use AND logic — all conditions must match for the policy to apply.

Scope: Set apply_to_existing to true to apply the policy to existing matching assets immediately. When false (default), the policy only acts on newly discovered assets.

Example Requests

Create a delete policy for noisy assets

curl -X POST "https://api.projectdiscovery.io/v1/asset/policy" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Remove 401 webhooks",
    "policy_type": "delete",
    "policies": {
      "host": "www.webhook.office.com",
      "status_code": "401"
    },
    "apply_to_existing": true
  }'

Create an alert policy for sensitive ports

curl -X POST "https://api.projectdiscovery.io/v1/asset/policy" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Alert on sensitive ports",
    "policy_type": "alert",
    "policies": {
      "port": "22,3306,5432,6379"
    },
    "alerting_config_ids": ["your-alerting-config-id"],
    "apply_to_existing": false
  }'

Create a labeling policy

curl -X POST "https://api.projectdiscovery.io/v1/asset/policy" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Tag WordPress sites",
    "policy_type": "set_label",
    "policies": {
      "technologies": "WordPress"
    },
    "labels": ["cms", "wordpress"],
    "apply_to_existing": true
  }'

Related Resources

• Asset Policies Guide - Feature overview with walkthrough

Authorizations

X-API-Key · string · header · required

Body

application/json

policies · AssetFilters · object · required

Show child attributes

name · string

Display name for the policy. Auto-generated if not provided.

policy_type · enum<string>

Type of action to perform when policy matches assets

Available options: alert, delete, set_label, remove_label

alerting_config_ids · string[]

List of alerting configuration IDs (required when policy_type is 'alert')

labels · string[]

List of labels to apply/remove (required when policy_type is 'set_label' or 'remove_label')

enumeration_ids · string[]

Optional list of enumeration IDs to scope this policy to specific enumerations

apply_to_existing · boolean · default: false

When true, the policy action is applied to existing assets that match the conditions in addition to future assets. When false (default), the policy only applies to newly discovered assets.

Response

200

application/json

OK

message · string

id · string

Unique identifier of the created policy