---
title: "Context Graph Search API"
slug: "context-graph-search-api"
description: "SPQL is not currently supported within the Silent Push UI, in the Query Builder section. It is only possible to use SPQL in a POST request using tools such as curl or Postman."
tags: ["API", "API Endpoint", "Silent Push API", "spql", "SPQL Queries"]
updated: 2026-05-20T17:55:29Z
published: 2026-05-20T17:18:53Z
canonical: "help.silentpush.com/context-graph-search-api"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.silentpush.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Context Graph Search API

Silent Push Query Language (SPQL) queries can be executed via the Silent Push API’s **Xperimental Scandata Search** endpoint. This article explains how to structure API calls. Refer to [SPQL Syntax Rules](/v1/docs/syntax) for query construction and [SPQL Query Examples](/v1/docs/query-examples) for sample queries.

## API Endpoint

- **URL**: `https://api.silentpush.com/api/v1/merge-api/explore/spql/search`
- **Method**: POST

> **Note**: SPQL is not supported in the Silent Push UI Query Builder; use tools like `curl` or Postman.

## Request Structure

- Body: JSON object with:
  - `query`: SPQL query string (JSON-encoded, escape double quotes).
  - `fields` (optional): List of field names to return (e.g., `["domain", "ip"]`). If omitted, all fields are returned. See [Field Names](/v1/docs/advanced-techniques-web-search-data-analysis).
  - `sort` (optional): List of fields and sort order (e.g., `["domain/asc", "scan_date/desc"]`). Defaults to `["scan_date/desc", "domain/asc"]` if omitted.

## URL Parameters

- `limit=<n>`: Maximum results (e.g., `100`).
- `skip=<n>`: Results to skip (e.g., `0`).
- `with_metadata=1`: Returns metadata, including a `job_id` to recall results for 30 days.

### Recall Results

Use `job_id` at `https://api.silentpush.com/api/v1/merge-api/explore/job/<job_id>`.

### Example 1: Query for DDoS with all fields

```plaintext
curl -ks -X POST -H 'content-type:application/json' -H 'x-api-key:<api_key>' \
  'https://api.silentpush.com/api/v1/merge-api/explore/spql/search/limit=100' \
  -d '{"query": "htmltitle = \"DDoS* not configured\" AND response > 200 AND header.server = ddos*"}'
```

### Example 2: Query with specific fields

```plaintext
curl -ks -X POST -H 'content-type:application/json' -H 'x-api-key:<api_key>' \
  'https://api.silentpush.com/api/v1/merge-api/explore/spql/search/limit=100' \
  -d '{"query": "htmltitle = \"DDoS* not configured\" AND response = 200 AND header.server = ddos*", "fields": ["domain", "scan_date", "ip", "htmltitle"]}'
```

### Example 3: Regular expression query with nested sorting

```plaintext
curl -ks -X POST -H 'content-type:application/json' -H 'x-api-key:<api_key>' \
  'https://api.silentpush.com/api/v1/merge-api/explore/spql/search/limit=100' \
  -d '{"query": "scan_date > now-30d AND ssl.sans ~= /^silent[a-z].+\\.io$/ AND domain !~= /silent.*/ AND domain ~= /.+/ AND ip = [13.249.0.0/16, 52.84.0.0/16]", "sort": ["domain/asc", "hostname/asc", "scan_date/desc"]}'
```

> **Note**: Use the [SPQL API](/v1/docs/spql-api#api-endpoint) instead of direct API calls. Ensure JSON encoding of regular expressions (double backslash for literal `\`).