FullHunt Getting Started: Account Setup and First API Call 2026

Getting started overview

Getting started with FullHunt involves a sequence of steps designed to quickly enable external attack surface management. The primary goal is to establish an authenticated connection to the FullHunt API to begin discovering and monitoring digital assets. This process typically includes account registration, API key generation, and the execution of a basic API request to confirm connectivity and authentication. FullHunt's platform provides tools for asset discovery, vulnerability intelligence, and overall security posture management, which all rely on a correctly configured API access.

The following table provides a quick reference for the essential steps to get started with FullHunt:

Create an account and get keys

To begin using FullHunt, you must first create an account. FullHunt offers a Free Community Account which provides access to core features, alongside paid tiers like the Team plan, starting at $199/month. The registration process typically requires an email address and password, followed by email verification.

1. Navigate to the FullHunt website: Open your web browser and go to the FullHunt homepage.
2. Sign Up: Locate the 'Sign Up' or 'Get Started' button, usually prominent on the homepage or pricing page.
3. Choose an Account Type: Select the 'Free Community Account' option to start without immediate cost, or choose a paid tier if your requirements necessitate it.
4. Complete Registration: Provide the requested information, such as your email address and a strong password. You may need to confirm your email address through a verification link sent to your inbox.
5. Log In: Once registered and verified, log in to your new FullHunt account.

After successfully logging in, the next critical step is to generate your API key. This key serves as your authentication credential for all API interactions with the FullHunt platform. Without it, you cannot programmatically access FullHunt's features.

1. Access API Settings: In your FullHunt user dashboard, look for a section related to 'API Keys', 'Settings', or 'Developer Access'. The exact location may vary but is typically found under your profile or account management menu. Consult the FullHunt documentation for API key management if you cannot locate it.
2. Generate New Key: Within the API Key section, there should be an option to generate a new API key. Click this button.
3. Secure Your Key: Once generated, your API key will be displayed. It is crucial to copy this key immediately and store it securely. Treat your API key like a password; do not expose it in public repositories, client-side code, or insecure environments. FullHunt API keys are typically long alphanumeric strings. For example, a key might resemble fh_sk_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.
4. Understand Key Usage: FullHunt's API uses API keys for authentication, typically passed in the Authorization header as a Bearer token or as a query parameter. The FullHunt API reference provides specific details on how to include your key in requests.

Your first request

With your account created and API key secured, you can now make your first API request to FullHunt. This initial request serves to verify your setup and authentication. A common first step is to query an endpoint that provides basic account information or a simple asset search.

For this example, we will use a common tool for making HTTP requests, curl, which is available on most Unix-like systems and can be installed on Windows. We will attempt to list your discovered assets, which is a fundamental operation in external attack surface management.

Example: Listing Assets (using curl)

The FullHunt API typically requires the API key in the Authorization header with a Bearer prefix. Replace YOUR_API_KEY with the actual API key you generated.

curl -X GET \
  'https://api.fullhunt.io/assets' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Accept: application/json'

Explanation of the curl command:

• -X GET: Specifies the HTTP method as GET, which is used to retrieve data.
• 'https://api.fullhunt.io/assets': This is the FullHunt API endpoint for retrieving a list of your discovered assets. Always refer to the FullHunt API reference documentation for the most current endpoints and parameters.
• -H 'Authorization: Bearer YOUR_API_KEY': This header carries your API key. The Bearer prefix is a standard authentication scheme as defined in RFC 6750 for OAuth 2.0 Bearer Token Usage, though FullHunt uses it for API key authentication.
• -H 'Accept: application/json': This header indicates that you prefer the response to be in JSON format.

Expected Successful Response:

A successful response will typically return a JSON object containing a list of assets, possibly empty if you haven't added any targets yet, along with metadata such as pagination information. For example:

{
  "status": "success",
  "data": [],
  "meta": {
    "total": 0,
    "offset": 0,
    "limit": 10
  }
}

This indicates that the API call was successful, even if no assets are currently associated with your account. If you encounter an error, consult the Troubleshooting the first call section.

Using a Python HTTP Client (requests library):

For programmatic interaction, Python's requests library is a common choice. Ensure you have it installed (pip install requests).

import requests
import os

# It's recommended to store API keys as environment variables
FULLHUNT_API_KEY = os.environ.get('FULLHUNT_API_KEY', 'YOUR_API_KEY_HERE')

url = 'https://api.fullhunt.io/assets'
headers = {
    'Authorization': f'Bearer {FULLHUNT_API_KEY}',
    'Accept': 'application/json'
}

try:
    response = requests.get(url, headers=headers)
    response.raise_for_status() # Raise an exception for HTTP errors (4xx or 5xx)
    print(response.json())
except requests.exceptions.HTTPError as http_err:
    print(f'HTTP error occurred: {http_err}')
    print(f'Response content: {response.text}')
except requests.exceptions.ConnectionError as conn_err:
    print(f'Connection error occurred: {conn_err}')
except requests.exceptions.Timeout as timeout_err:
    print(f'Timeout error occurred: {timeout_err}')
except requests.exceptions.RequestException as req_err:
    print(f'An unexpected error occurred: {req_err}')

This Python script performs the same GET request, demonstrating how to handle potential network and HTTP errors for a more robust integration.

Common next steps

After successfully making your first API call, you can proceed to integrate FullHunt more deeply into your security workflows. Common next steps include:

• Adding Targets: To begin monitoring, you need to add your organization's domains, IP ranges, or other digital assets to FullHunt. This is often done via specific API endpoints or through the FullHunt web interface. Refer to the FullHunt asset management documentation for details on adding and managing targets.
• Configuring Webhooks: For real-time notifications about new assets, vulnerabilities, or changes in your attack surface, configure webhooks. This allows FullHunt to push updates to your chosen endpoints, integrating with incident response systems or SIEM platforms. Information on setting up webhooks is available in the FullHunt webhooks guide.
• Exploring Advanced Queries: FullHunt's API supports complex queries to filter and search for specific assets, vulnerabilities, or historical data. Familiarize yourself with the query language and available filters outlined in the FullHunt API reference.
• Integrating with Security Tools: Integrate FullHunt with other security tools in your stack, such as vulnerability scanners, SIEMs (Security Information and Event Management), or SOAR (Security Orchestration, Automation, and Response) platforms. This often involves using FullHunt's API to feed discovered assets or vulnerability data into these systems. The FullHunt blog often features integration examples.
• Setting Up Continuous Monitoring: Automate regular API calls to FullHunt to continuously discover new assets and monitor for changes or newly identified vulnerabilities. This proactive approach is central to effective external attack surface management.

Troubleshooting the first call

Encountering issues during your first API call is common. Here are some typical problems and their solutions:

• 401 Unauthorized Error:
  • Issue: This usually means your API key is missing, incorrect, or expired.
  • Solution: Double-check that you have included the Authorization: Bearer YOUR_API_KEY header correctly. Ensure there are no typos in the key itself. Generate a new API key from your FullHunt dashboard if you suspect the existing one is compromised or invalid.
• 403 Forbidden Error:
  • Issue: Your account may not have the necessary permissions to access the requested resource, or your IP address might be blocked.
  • Solution: Verify your account's subscription tier and its associated permissions. Some endpoints might be restricted to higher-tier plans. If you are on a Free Community Account, some advanced features may be inaccessible. Contact FullHunt support if you believe this is an error.
• 404 Not Found Error:
  • Issue: The API endpoint URL you are trying to reach is incorrect or does not exist.
  • Solution: Carefully review the endpoint URL against the FullHunt API reference documentation. Ensure correct spelling, case sensitivity, and that you are using the correct base URL (e.g., https://api.fullhunt.io).
• Network Connection Issues:
  • Issue: You might be unable to connect to the FullHunt API servers due to local network problems, firewall restrictions, or DNS issues.
  • Solution: Check your internet connection. If you are behind a corporate firewall, ensure that outbound connections to api.fullhunt.io on port 443 (HTTPS) are permitted. Try pinging api.fullhunt.io to confirm basic network reachability.
• Incorrect Request Body/Parameters:
  • Issue: For POST or PUT requests (less common for a first GET, but relevant for subsequent calls), incorrect JSON formatting or missing required parameters can cause errors.
  • Solution: Always refer to the FullHunt API documentation for the exact structure and requirements of request bodies and query parameters for each endpoint. Use a JSON validator if constructing complex payloads.
• Rate Limiting (429 Too Many Requests):
  • Issue: You have sent too many requests in a given timeframe.
  • Solution: FullHunt, like many API providers, implements rate limiting to ensure service stability. If you encounter a 429 error, wait for the duration specified in the Retry-After header (if provided) before making further requests. Implement exponential backoff in your client code for automated retries.

If you continue to experience issues after attempting these troubleshooting steps, gather relevant information such as the exact error message, HTTP status code, and the request you sent, and then contact FullHunt support for assistance.