---
title: Link Changes Endpoint
slug: asm/link-changes-endpoint
docTags: 
createdAt: 2025-09-11T12:54:05.408Z
---

The **Link Changes** endpoint returns the same underlying data you see on the **Changes** page in the Hexiosec ASM app. You can use it to export or automate change detection between scan iterations (new and removed risks, domains, and services).

***

# Relationship to the App

The endpoint uses the same comparison logic and data source as the **Changes** page in the app, so the `added`/`removed` results will match what you see there for the same iteration window and filters.

::Image[]{src="https://app.archbee.com/api/optimize/yj0ZJrE_bSZKt7cz1M7v7-ufeqf3DnNYlSP4y7OFsHF-20250911-125832.png" size="50" width="1539" height="934" darkWidth="1539" darkHeight="934" position="center" caption="Changes Page" alt="Hexiosec ASM App – Changes page showing a table of detected changes between scan iterations, with columns for change type, description, affected service or asset, and timestamp." showCaption="true"}

***

# API Reference

Full request/response details, query parameters, and schemas are available in the [API Reference](https://asm.hexiosec.com/api/ui#get-/v1/scan_data/-scan_id-/link_changes).

***

# Understanding What This Endpoint Shows

The **Link Changes** API reports when *relationships* between assets change. In the data model, assets are represented as nodes and the connections (or relationships) between them as links. For example:

- A new risk was detected on a service
- A domain started pointing to a new IP address
- A component appeared on a website

This makes it excellent for tracking **risk changes**, but it is not a direct feed of “new assets vs removed assets.”

***

# Getting Risk Changes

If you want counts such as *“4850 new risks, 257 risks removed”*:

1. Query the endpoint filtered to risks (`link_type=RISK`).
2. Count:
   - **New risks** = entries with `change_type: added`
   - **Removed risks** = entries with `change_type: removed`

This mirrors the “Risk” rows in the app Changes page.

***

# Getting Asset Changes (Domains, IPs, Websites)

If you want the **numbers of new and removed assets** for each scan iteration, you don’t need to calculate these yourself. The `/v1/scans/{id}/iterations` endpoint already provides `stats.nodes` and `stats.nodesByLabel`, which include counts of added and removed items grouped by label (e.g. Domain, IPv4, Service).

Example snippet from an iteration response:

```json
"stats": {
  "nodes": {
    "added": 0,
    "removed": 4
  },
  "nodesByLabel": [
    {
      "label": "Domain",
      "added": 0,
      "inScope": 13,
      "removed": 0
    },
    {
      "label": "IPv4",
      "added": 0,
      "removed": 0
    },
    {
      "label": "Service",
      "added": 0,
      "removed": 1
    }
  ]
}
```

This matches the “Overview” counts you see in the app — for example:

- **New domains** → nodesByLabel\[label="Domain"].added
- **Removed IPv4s** → nodesByLabel\[label="IPv4"].removed

If you want the *detailed records* of what changed (not just counts), use the **Link Changes** endpoint.

***

# Mapping App Terms to API Filters

When you see “Change type: Domain” or “Change type: IPv4” in the app, that maps to node types in the API:

- `to_type=Domain` → changes involving domains
- `to_type=IPv4` or `IPv6` → changes involving IPs
- `link_type=RISK` → changes involving risks

Remember: these filters still return relationship changes, not a pure list of new assets.

***

# Summary

- Use **Link Changes** for:
  – New/removed risks
  – Relationship changes (DNS mappings, components appearing)
- Use **Scan Iteration endpoint** for:
  – New vs removed assets (domains, IPs, websites)

Together, these give you the full picture of what changed in your attack surface between two scans or over time.