openapi: 3.1.0
info:
  title: Shodan Streaming API
  description: >-
    The Shodan Streaming API delivers a real-time firehose of banner data
    collected by Shodan. Filtered streams are available by ASN, country,
    port, and CVE. Output is delivered either as newline-separated JSON or
    Server-Sent Events.
  version: '1.0'
  contact:
    name: Shodan Support
    email: support@shodan.io
    url: https://developer.shodan.io/api/stream
  license:
    name: Shodan API Terms of Service
    url: https://www.shodan.io/legal/tos
servers:
  - url: https://stream.shodan.io
    description: Production streaming endpoint
security:
  - apiKey: []
tags:
  - name: Streaming
paths:
  /shodan/banners:
    get:
      tags: [Streaming]
      summary: Stream All Banners
      operationId: streamBanners
      description: Stream every banner Shodan collects in real time. Intended for accounts that need the full firehose to build a local Shodan database.
      parameters:
        - $ref: '#/components/parameters/Format'
        - $ref: '#/components/parameters/Debug'
      responses:
        '200':
          description: Newline-separated JSON or SSE stream.
          content:
            application/x-ndjson:
              schema: { $ref: '#/components/schemas/Banner' }
            text/event-stream:
              schema: { $ref: '#/components/schemas/Banner' }
  /shodan/asn/{asn}:
    get:
      tags: [Streaming]
      summary: Stream Banners By ASN
      operationId: streamBannersByAsn
      description: Stream banners limited to one or more Autonomous System Numbers.
      parameters:
        - name: asn
          in: path
          required: true
          schema: { type: string }
          description: Comma-separated ASN list (e.g. `3303,32475`).
        - $ref: '#/components/parameters/Format'
      responses:
        '200':
          description: Filtered banner stream.
          content:
            application/x-ndjson:
              schema: { $ref: '#/components/schemas/Banner' }
  /shodan/countries/{countries}:
    get:
      tags: [Streaming]
      summary: Stream Banners By Country
      operationId: streamBannersByCountry
      description: Stream banners limited to one or more two-letter country codes.
      parameters:
        - name: countries
          in: path
          required: true
          schema: { type: string }
          description: Comma-separated ISO 3166-1 alpha-2 codes (e.g. `DE,US`).
        - $ref: '#/components/parameters/Format'
      responses:
        '200':
          description: Filtered banner stream.
          content:
            application/x-ndjson:
              schema: { $ref: '#/components/schemas/Banner' }
  /shodan/ports/{ports}:
    get:
      tags: [Streaming]
      summary: Stream Banners By Port
      operationId: streamBannersByPort
      description: Stream banners limited to one or more ports.
      parameters:
        - name: ports
          in: path
          required: true
          schema: { type: string }
          description: Comma-separated list of ports (e.g. `22,443`).
        - $ref: '#/components/parameters/Format'
      responses:
        '200':
          description: Filtered banner stream.
          content:
            application/x-ndjson:
              schema: { $ref: '#/components/schemas/Banner' }
  /shodan/vulns/{vulns}:
    get:
      tags: [Streaming]
      summary: Stream Banners By Vulnerability
      operationId: streamBannersByVuln
      description: Stream banners limited to one or more CVE identifiers.
      parameters:
        - name: vulns
          in: path
          required: true
          schema: { type: string }
          description: Comma-separated CVE identifiers (e.g. `CVE-2017-7679`).
        - $ref: '#/components/parameters/Format'
      responses:
        '200':
          description: Filtered banner stream.
          content:
            application/x-ndjson:
              schema: { $ref: '#/components/schemas/Banner' }
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: query
      name: key
  parameters:
    Format:
      name: t
      in: query
      schema: { type: string, enum: [json, sse] }
      description: Output format. `json` returns newline-separated JSON; `sse` returns Server-Sent Events.
    Debug:
      name: debug
      in: query
      schema: { type: integer, enum: [0, 1] }
      description: Set to 1 to include discarded message counts.
  schemas:
    Banner:
      type: object
      properties:
        ip_str: { type: string }
        port: { type: integer }
        transport: { type: string, enum: [tcp, udp] }
        product: { type: string }
        version: { type: string }
        data: { type: string }
        timestamp: { type: string, format: date-time }
        hash: { type: integer }
        org: { type: string }
        isp: { type: string }
        asn: { type: string }
        hostnames:
          type: array
          items: { type: string }
        domains:
          type: array
          items: { type: string }
        location:
          type: object
          properties:
            city: { type: string }
            country_code: { type: string }
            country_name: { type: string }
            latitude: { type: number }
            longitude: { type: number }
        ssl:
          type: object
          additionalProperties: true
        http:
          type: object
          additionalProperties: true
        cpe23:
          type: array
          items: { type: string }
        vulns:
          type: object
          additionalProperties: true