DOdomaintools
Iris Detect

Provide recently changed or escalated domains for active monitors in an account.

get/v1/iris-detect/domains/watched/

Request

Query parameters

app_namestring

A short identifier, code, or handle.

Appliance, module, or playbook, or any combination of these.

app_partnerstring

A short identifier, code, or handle.

Your product name.

app_versionstring

A short identifier, code, or handle.

Version of your integration/connector.

integer

Relative offset in seconds before the current UTC time.

Must be between -1 (1 second ago) and -432000 (5 days ago).

OR
string date-time

ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: YYYY-MM-DDTHH:MM:SSZ.

The timestamp must represent a point between 1 second ago and 5 days ago, relative to the current UTC time.

Most relevant for the /watched endpoint to control the timeframe for changes to DNS or WHOIS fields for watched domains.

integer

Relative offset in seconds before the current UTC time.

Must be between -1 (1 second ago) and -432000 (5 days ago).

OR
string date-time

ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: YYYY-MM-DDTHH:MM:SSZ.

The timestamp must represent a point between 1 second ago and 5 days ago, relative to the current UTC time.

Most relevant for the /new endpoint to control the timeframe for when a new domain was discovered. Returns domains discovered before provided date/time. Use with discovered_since to return domains discovered in a specific time window. Example: 2022-02-10T00:00:00Z (ISO-8601)

integer

Relative offset in seconds before the current UTC time.

Must be between -1 (1 second ago) and -432000 (5 days ago).

OR
string date-time

ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: YYYY-MM-DDTHH:MM:SSZ.

The timestamp must represent a point between 1 second ago and 5 days ago, relative to the current UTC time.

Most relevant for the /new endpoint to control the timeframe for when a new domain was discovered. Example: 2022-02-10T00:00:00Z (ISO-8601)

integer

Relative offset in seconds before the current UTC time.

Must be between -1 (1 second ago) and -432000 (5 days ago).

OR
string date-time

ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: YYYY-MM-DDTHH:MM:SSZ.

The timestamp must represent a point between 1 second ago and 5 days ago, relative to the current UTC time.

Most relevant for the /watched endpoint to control the timeframe for when a domain was most recently escalated. Example: 2022-02-10T00:00:00Z (ISO-8601)

escalation_types[]'blocked' | 'google_safe'

The type of escalation action.

Filters domains based on specific escalation types. Multiple types can be provided.

include_domain_databoolean

An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.

If set to true, includes additional DNS and WHOIS details in the response.

searchstring

A non-empty string with a standard length limit.

Performs a contains search.

limitinteger

Specify the maximum number of records to retrieve in an API query. The maximum value is 100, but this is reduced to 50 if include_domain_data=true.

monitor_idstring

Monitor ID from the monitors response - only used when requesting domains for specific monitors.

mx_existsboolean

Whether domain currently has an MX record in DNS.

offsetinteger

Specifies the starting point for the result set, used for paginating when the number of results exceeds the 'limit'. An offset of 0 starts from the first result.

order'asc' | 'desc'

Specifies the sort order for the results, either ascending or descending. Used in conjunction with the 'sort' parameter. Defaults to desc.

previewboolean

An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.

Use during API implementation and testing. Will limit results to 2 but not be limited by hourly restrictions. Use for development and testing only. Sustained usage violates Terms of Service and can result in service suspension.

risk_score_ranges[]string[]

Filters domains based on their risk score. Multiple ranges can be selected to broaden the filter. Consult Domain Risk Scores for help interpreting scores.

sort[]string[]

Sorts the domain list response. Valid fields to sort by are 'discovered_date', 'changed_date', and 'risk_score'.

tlds[]string[]

Filters on specific TLDs

Response

OK

total_countinteger
countinteger
offsetinteger
limitinteger

Changes

No recorded changes to this operation across all 1 revision of this API.