Returns data from a GET request. Parameters are identified in descriptions as either base or filter. Search with base parameters and filter down base results with filter parameters.
Consider using POST for complex requests.
Request
- Base URLhttps://api.domaintools.com
- Auth
- API key in header X-Api-Key
- or HTTP basic
- or API key in query parameter signature
- TypeScriptA function with typed inputs. Its response is checked against the schema.
Query parameters
A short identifier, code, or handle.
Base search parameter. Domains with a Google AdSense tracking code.
A short identifier, code, or handle.
Base search parameter. Baidu Analytics code.
A generic and unconstrained string value.
Base search parameter. Contact name from domain registration data. Supports WHOIS/RDAP Fields Search.
A generic and unconstrained string value.
Base search parameter. Contact phone number from domain registration data. Supports WHOIS/RDAP Fields Search.
A generic and unconstrained string value.
Base search parameter. Contact street address from domain registration data. Supports WHOIS/RDAP Fields Search.
A standard IPv4 address.
Base search parameter. IPv4 address the registered domain was last known to point to during an active DNS check.
A comma-separated list of one or more apex domains to investigate.
Base search parameter. One or more domains (comma-separated) to be investigated. Example: example.com,domaintools.com.
A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts.
Base search parameter. Email address from the most recently available WHOIS record, DNS SOA record or SSL certificate.
A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts.
Base search parameter. DNS SOA email.
A base (apex) domain like example.com, excluding subdomains.
Only the domain portion of a WHOIS or DNS SOA email address.
A short identifier, code, or handle.
Facebook/Meta tracking code.
A short identifier, code, or handle.
Base search parameter. Domains with a Google Analytics tracking code.
A short identifier, code, or handle.
Base search parameter. Domains with a Google Analytics tracking code.
A short identifier, code, or handle.
Base search parameter. Google Tag Manager tracking code.
A short identifier, code, or handle.
Base search parameter. Hotjar tracking code.
A short identifier, code, or handle.
Base search parameter. Registrar IANA code from most recent RDAP record for a domain.
A base (apex) domain like example.com, excluding subdomains.
Base search parameter. Only the registered domain portion of the mail server (e.g., domaintools.net).
A Fully Qualified Domain Name (FQDN), including subdomains (e.g., www.example.com). Must be a valid DNS hostname per RFC 1123, excluding trailing dot.
Base search parameter. Fully-qualified mail server hostname (e.g., mx.domaintools.net). Performs a Reverse MX lookup to identify domains using this mail server.
A standard IPv4 address.
Base search parameter. IP address of the mail server.
A short identifier, code, or handle.
Base search parameter. Matomo tracking code.
A valid, fully-qualified domain name (FQDN).
Base search parameter. The registered domain name of the nameserver (e.g., example.com).
A valid, fully-qualified domain name (FQDN).
Base search parameter. Fully-qualified domain name (FQDN) of the name server.
A standard IPv4 address.
Base search parameter. The IPv4 address of the name server.
A generic and unconstrained string value.
Base search parameter. Domains observed to redirect to another domain name.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
Base search parameter. Exact match to the WHOIS registrant field.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
Base search parameter. Registrant names from historical WHOIS records.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
Base search parameter. Exact match to the WHOIS registrant organization field
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
Base search parameter. Exact match to the WHOIS registrar field.
Opaque token representing a saved search from the Iris Investigate UI. Exported via “Search → Export” in the Iris UI. Example: aGVsbG93b3yY2hfaGFzaF9jb2RlJsZF9zZWFcw==
Base search parameter. Token returned by the Iris Investigate UI when exporting a search. Use this value to import and continue an existing search via the API.
A non-empty string with a standard length limit.
Base search parameter. Domains hosted on a specific server type (e.g., from the 'Server' HTTP header). Must be an exact match.
A generic and unconstrained string value.
Base search parameter. Domains with a matching Subject Alternative Name (SAN) in their SSL certificate.
A generic and unconstrained string value.
Base search parameter. Domains with a matching Common Name (CN) in their SSL certificate's subject.
Base search parameter. Domains with an SSL certificate valid for a specific number of days.
A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts.
Base search parameter. Email address extracted from the SSL certificate associated with a domain.
A 40-character hexadecimal SHA-1 hash string, typically used to identify SSL certificates or digital signatures.
Base search parameter. The SHA-1 hash of an SSL certificate, used to filter for domains associated with a specific certificate.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
Base search parameter. Organization name from the SSL certificate. Must be an exact string match.
A distinguished name (DN) string representing the Subject field of an SSL certificate. Typically includes components like CN, O, C, ST, and L in a comma-separated format. Example: C=US, ST=California, L=San Francisco, O=Example Corp, CN=example.com
Base search parameter. Exact match to the Subject distinguished name (DN) string from the SSL certificate.
A generic and unconstrained string value.
Base search parameter. Certificate issuer Common Name.
A short identifier, code, or handle.
Base search parameter. Statcounter Project tracker code.
A short identifier, code, or handle.
Base search parameter. Statcounter Security tracker code.
A generic and unconstrained string value.
Search filter parameter. Comma-separated list of tags. Only returns domains tagged with the full list of tags.
A generic and unconstrained string value.
Search filter parameter. Comma-separated list of Iris Investigate tags. Returns domains tagged with any of the tags in a list.
The exact value of the <title> tag from a website's HTML.
Base search parameter. The value of the website’s <title> HTML tag. Must be an exact match.
A generic and unconstrained string value.
Base search parameter. Free text search of a domain's most recent WHOIS record.
A generic and unconstrained string value.
Base search parameter. Free text search of a domain's historical WHOIS records.
A short identifier, code, or handle.
Base search parameter. Yandex Metrica tracker code.
Search filter parameter. Set to true to only return domains that have either an entry in the global Domain Name System, OR are listed as registered by the registry. Set to false to only return domains that do not have an entry in the global DNS, AND are not listed as registered by the registry.
A date in YYYY-MM-DD format, optionally prefixed with an operator (>, >=, <, <=) for comparison. Example: <=2025-01-01
Search filter parameter. Filters domains based on the create_date field. Supports [>, >=, <, <=] operators, or no operator for exact matches.
A positive integer representing the maximum number of days.
Search filter parameter. Filter domains based on the create_date field: the maximum number of days since a domain was first discovered.
A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone.
Search filter parameter. Only include domains expiring on a specific date.
Search filter parameter. Filter domains based on the first_seen timestamp. Returns domains whose current_lifecycle_first_seen value is after the given datetime.
A positive integer representing a time window, in seconds. Used to filter results based on how recently an event occurred.
Search filter parameter. Filter domains based on the first_seen field. Returns only those domains first discovered within the last N seconds.
Two-letter ISO country code (uppercase)
Search filter parameter. Country code for IP A-record.
A comma-separated list of tag names. Tags are matched exactly and compared case-insensitively unless otherwise specified.
Search filter parameter. Exclude all domains that are tagged with all of the specified tags in the Iris Investigation platform. This parameter accepts a comma-separated list of tag names.
A comma-separated list of tag names. Tags are matched exactly and compared case-insensitively unless otherwise specified.
Search filter parameter. Exclude all domains that are tagged with any of the specified tags in the Iris Investigation platform. Accepts a comma-separated list of tags.
Search filter parameter. Popularity rank (replaces Alexa ranking).
Search filter parameter. Returns domains with a Domain Risk Score greater than this value. See Domain Risk Scores.
A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone.
Search filter parameter. Validity end date for a certificate (YYYY-MM-DD).
A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone.
Search filter parameter. Validity begin date for a certificate (YYYY-MM-DD).
A top-level or public suffix domain, such as com, org, or co.uk. Must not include a leading dot.
Search filter parameter. Restrict results to domains under the specified top-level domain (TLD).
An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.
Flag. If set to true, includes the full parsed Domain RDAP record in the response.
An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.
Flag. If set to 'true', includes the full parsed WHOIS record in the response.
An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.
The URL for the next page of search results, emitted as a next field in the response, using the position marker.
The desired response format.
Specifies the desired response format.
Adjusts the number of results returned per page. The default is 100; the maximum is 500.
An opaque string token used for cursor-based pagination. Returned in the position field of a paginated response when has_more_results is true, and used as a query parameter to retrieve the next result set. Example: 2c056abadfb64b67ba18896af2c5b900
Cursor for paginated results. Use the value returned in a previous response to retrieve the next page.
Specifies the field to sort the results by.
Determines the sort direction, either ascending or descending. This is used in combination with the 'sort_by' parameter.
A short identifier, code, or handle.
Appliance, module, or playbook, or any combination of these.
A short identifier, code, or handle.
Your product name.
A short identifier, code, or handle.
Version of your integration/connector.
Response
OK
Example response
{
"response": {
"results": [
{
"domain_risk": {
"components": [
{
"evidence": [
"dns"
]
}
]
}
}
]
}
}Changes
No recorded changes to this operation across all 1 revision of this API.