Outline is a team knowledge base built around collections, documents, groups, guests, and API access. A count of internet-visible Outline interfaces does not reveal which workspaces have strong identity controls or overbroad personal keys. It does give an asset owner a starting point for asking a more useful question: who can create a key, and what can that key reach?
What the count-only queries showed
On 2026-11-06 08:46:04 +08:00, three count-only ZoomEye queries used sub_type=all, page 1, and pagesize 1. app="Outline" returned 2 matches, title="Outline" returned 11,588, and http.body="Outline" returned 54,367,997. The large body count is a broad text match, not a count of Outline deployments. The title query is the more useful population signal in this small comparison, while the sparse application fingerprint shows why one field should not be treated as a complete inventory.
The key inherits a user's reach
Outline's API documentation says personal API keys authenticate requests on behalf of a user. Unscoped keys have the same permissions and access as the user who created them. Scoped keys can be limited with a space-separated endpoint list and wildcards, and keys can also have an expiration date.
That makes key inventory an authorization review. Look for long-lived unscoped keys issued by administrators, keys owned by former employees, and integrations whose need is narrower than the creator's normal workspace access. A key that can read all visible collections is more consequential than a key limited to documents.info.
Use the count as a lead
The ZoomEye result is an external observation. It cannot identify the key owner, prove that a key is exposed, or establish that a listed address belongs to a specific organization. Before contacting an owner, verify the asset through DNS, certificate, and internal inventory records. Do not send credentials or probing requests to a third-party instance.
For an owned self-hosted workspace, review Settings API keys, workspace identity providers, default roles, guest access, and public sharing. Suspend a user when access must stop. Outline's user guidance states that suspension blocks login, logs out existing sessions, and removes the billed seat while retaining related data. That is a better operational control than deleting a record and losing the audit trail.
Build a repeatable inventory
Record the search time, dork, scope, total, and the organization's attribution evidence. A practical review then joins four internal views: workspace owners, active API keys, key scopes and expiry, and the documents or collections those keys can reach. Include integrations that use a key on behalf of a person rather than a dedicated service identity.
The low application count does not make the issue unimportant. A small number of knowledge bases can still contain sensitive runbooks, customer notes, and incident records. Measure the service, verify ownership, and review the permissions that matter.