--- title: "Returns data from a GET request. Parameters are identified in descriptions as either base or filter. Search with base parameters and filter down base results with filter parameters." method: GET path: "/v1/iris-investigate/" tags: ["Iris Investigate"] --- # Returns data from a GET request. Parameters are identified in descriptions as either base or filter. Search with base parameters and filter down base results with filter parameters. `GET /v1/iris-investigate/` ## Request - Base URL: `https://api.domaintools.com` - URL: `https://api.domaintools.com/v1/iris-investigate/` - Auth: one of: - API key in header `X-Api-Key` - HTTP basic - API key in query parameter `signature` - TypeScript: (a function with typed inputs; its response is checked against the schema) Consider using POST for complex requests. ## Query parameters - `adsense` string: A short identifier, code, or handle. - `baidu_analytics` string: A short identifier, code, or handle. - `contact_name` string: A generic and unconstrained string value. - `contact_phone` string: A generic and unconstrained string value. - `contact_street` string: A generic and unconstrained string value. - `ip` string, ipv4: A standard IPv4 address. - `domain` string: A comma-separated list of one or more apex domains to investigate. - `email` string, email: A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts. - `email_dns_soa` string, email: A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts. - `email_domain` string: A base (apex) domain like example.com, excluding subdomains. - `facebook` string: A short identifier, code, or handle. - `ga4` string: A short identifier, code, or handle. - `google_analytics` string: A short identifier, code, or handle. - `google_tag_manager` string: A short identifier, code, or handle. - `hotjar` string: A short identifier, code, or handle. - `iana_id` string: A short identifier, code, or handle. - `mailserver_domain` string: A base (apex) domain like example.com, excluding subdomains. - `mailserver_host` string, hostname: A Fully Qualified Domain Name (FQDN), including subdomains (e.g., www.example.com). Must be a valid DNS hostname per RFC 1123, excluding trailing dot. - `mailserver_ip` string, ipv4: A standard IPv4 address. - `matomo` string: A short identifier, code, or handle. - `nameserver_domain` string, hostname: A valid, fully-qualified domain name (FQDN). - `nameserver_host` string, hostname: A valid, fully-qualified domain name (FQDN). - `nameserver_ip` string, ipv4: A standard IPv4 address. - `redirect_domain` string: A generic and unconstrained string value. - `registrant` string: A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation. - `historical_registrant` string: A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation. - `registrant_org` string: A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation. - `registrar` string: A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation. - `search_hash` string: Opaque token representing a saved search from the Iris Investigate UI. Exported via “Search → Export” in the Iris UI. Example: `aGVsbG93b3yY2hfaGFzaF9jb2RlJsZF9zZWFcw==` - `server_type` string: A non-empty string with a standard length limit. - `ssl_alt_names` string: A generic and unconstrained string value. - `ssl_common_name` string: A generic and unconstrained string value. - `ssl_duration` integer - `ssl_email` string, email: A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts. - `ssl_hash` string: A 40-character hexadecimal SHA-1 hash string, typically used to identify SSL certificates or digital signatures. - `ssl_org` string: A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation. - `ssl_subject` string: A distinguished name (DN) string representing the Subject field of an SSL certificate. Typically includes components like CN, O, C, ST, and L in a comma-separated format. Example: `C=US, ST=California, L=San Francisco, O=Example Corp, CN=example.com` - `ssl_issuer_common_name` string: A generic and unconstrained string value. - `statcounter_project` string: A short identifier, code, or handle. - `statcounter_security` string: A short identifier, code, or handle. - `tagged_with_all` string: A generic and unconstrained string value. - `tagged_with_any` string: A generic and unconstrained string value. - `website_title` string: The exact value of the `` tag from a website's HTML. - `whois` string: A generic and unconstrained string value. - `historical_free_text` string: A generic and unconstrained string value. - `yandex_metrica` string: A short identifier, code, or handle. - `active` boolean - `create_date` string: A date in YYYY-MM-DD format, optionally prefixed with an operator (`>`, `>=`, `<`, `<=`) for comparison. Example: `<=2025-01-01` - `create_date_within` integer: A positive integer representing the maximum number of days. - `expiration_date` string, date: A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone. - `first_seen_since` union: Defines a point in time for filtering results. Accepts one of: - relative time, in negative seconds - absolute time, in an ISO 8601 timestamp - integer: Relative offset in seconds before the current UTC time. Must be between -1 (1 second ago) and -432000 (5 days ago). - string, date-time: ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: `YYYY-MM-DDTHH:MM:SSZ`. The timestamp must represent a point between *1 second ago* and *5 days ago*, relative to the current UTC time. - `first_seen_within` integer: A positive integer representing a time window, in seconds. Used to filter results based on how recently an event occurred. - `ip_country_code` string: Two-letter ISO country code (uppercase) - `not_tagged_with_all` string: A comma-separated list of tag names. Tags are matched exactly and compared case-insensitively unless otherwise specified. - `not_tagged_with_any` string: A comma-separated list of tag names. Tags are matched exactly and compared case-insensitively unless otherwise specified. - `rank` integer - `risk_score` integer - `ssl_not_after` string, date: A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone. - `ssl_not_before` string, date: A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone. - `tld` string: A top-level or public suffix domain, such as `com`, `org`, or `co.uk`. Must not include a leading dot. - `parsed_domain_rdap` boolean: An optional boolean flag that enables a specific feature or response extension when set to `true`. If `false` or omitted, the feature is ignored. - `parsed_whois` boolean: An optional boolean flag that enables a specific feature or response extension when set to `true`. If `false` or omitted, the feature is ignored. - `next` boolean: An optional boolean flag that enables a specific feature or response extension when set to `true`. If `false` or omitted, the feature is ignored. - `format` 'html' | 'json' | 'xml': The desired response format. - `page_size` integer - `position` string: An opaque string token used for cursor-based pagination. Returned in the `position` field of a paginated response when `has_more_results` is true, and used as a query parameter to retrieve the next result set. Example: `2c056abadfb64b67ba18896af2c5b900` - `sort_by` 'first_seen_since' | 'create_date' | 'domain' | 'risk_score' - `sort_direction` 'asc' | 'dsc' - `app_name` string: A short identifier, code, or handle. - `app_partner` string: A short identifier, code, or handle. - `app_version` string: A short identifier, code, or handle. ## Response `200` OK - object - `response` object - `limit_exceeded` boolean - `has_more_results` boolean - `message` string - `results_count` integer - `total_count` integer - `results` InvestigateResult[] - `domain` string - `whois_url` string, uri - `adsense` unknown - `alexa` integer - `popularity_rank` number - `active` boolean - `google_analytics` unknown - `ga4` unknown[] - unknown - `gtm_codes` unknown[] - unknown - `fb_codes` unknown[] - unknown - `hotjar_codes` unknown[] - unknown - `baidu_codes` unknown[] - unknown - `yandex_codes` unknown[] - unknown - `matomo_codes` unknown[] - unknown - `statcounter_project_codes` unknown[] - unknown - `statcounter_security_codes` unknown[] - unknown - `admin_contact` BaseContact: A template for contact information blocks. - `name` unknown - `org` unknown - `street` unknown - `city` unknown - `state` unknown - `postal` unknown - `country` unknown - `phone` unknown - `fax` unknown - `email` unknown[] - unknown - `billing_contact` BaseContact: A template for contact information blocks. - `name` unknown - `org` unknown - `street` unknown - `city` unknown - `state` unknown - `postal` unknown - `country` unknown - `phone` unknown - `fax` unknown - `email` unknown[] - unknown - `registrant_contact` BaseContact: A template for contact information blocks. - `name` unknown - `org` unknown - `street` unknown - `city` unknown - `state` unknown - `postal` unknown - `country` unknown - `phone` unknown - `fax` unknown - `email` unknown[] - unknown - `technical_contact` BaseContact: A template for contact information blocks. - `name` unknown - `org` unknown - `street` unknown - `city` unknown - `state` unknown - `postal` unknown - `country` unknown - `phone` unknown - `fax` unknown - `email` unknown[] - unknown - `create_date` unknown - `expiration_date` unknown - `email_domain` unknown[] - unknown - `soa_email` unknown[] - unknown - `ssl_email` unknown[] - unknown - `additional_whois_email` unknown[] - unknown - `ip` object[] - `address` unknown - `asn` unknown[] - unknown - `country_code` unknown - `isp` unknown - `mx` object[] - `host` unknown - `domain` unknown - `ip` unknown[] - unknown - `priority` number - `name_server` object[] - `host` unknown - `domain` unknown - `ip` unknown[] - unknown - `domain_risk` DomainRisk: Domain risk assessment including overall score and contributing components. - `risk_score` integer: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk). - `components` DomainRiskComponent[]: A list of risk components and their individual scores that contribute to the overall domain risk. - union: A polymorphic schema representing one of several types of risk components. - Proximity: Indicates risk based on proximity to known threats or suspicious infrastructure. - … - ThreatProfile: Indicates risk based on machine-learning models. - … - ThreatProfileMalware: Indicates risk based on a machine-learning model that classifies domains as malware-related. - … - ThreatProfilePhishing: Indicates risk based on a machine-learning model that classifies domains as phishing-related. - … - ThreatProfileSpam: Indicates risk based on a machine-learning model that classifies domains as spam-related. - … - ZeroListedScore: Indicates the domain is on a known-good 'zero list' and is not considered a threat. - … - `redirect` unknown - `redirect_domain` unknown - `registrant_name` unknown - `registrant_org` unknown - `registrar` unknown - `registrar_status` string[] - `spf_info` string - `ssl_info` BaseSslInfo[] - `hash` unknown - `subject` unknown - `organization` unknown - `email` string[] - `alt_names` unknown[] - unknown - `sources` object - `active` integer - `passive` integer - `common_name` unknown - `issuer_common_name` unknown - `not_after` unknown - `not_before` unknown - `duration` unknown - `tld` string - `website_response` number - `data_updated_timestamp` string: ISO 8601 datetime when the domain data was last updated. - `website_title` unknown - `server_type` unknown - `first_seen` unknown - `tags` object[] - `label` string - `scope` string - `tagged_at` string, date-time - `parsed_whois` ParsedWhois: Parsed data from the domain's WHOIS record. Present only when the request includes `parsed_whois=true`. - `technical_contact` WhoisContact: Contact details from a WHOIS record. - `name` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `org` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `street` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `city` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `state` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `postal` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `country` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `phone` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `fax` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `email` PivotedValue[] - `value` union - … - `count` integer: The number of other domains that share this exact value. - `registrant_contact` WhoisContact: Contact details from a WHOIS record. - `name` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `org` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `street` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `city` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `state` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `postal` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `country` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `phone` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `fax` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `email` PivotedValue[] - `value` union - … - `count` integer: The number of other domains that share this exact value. - `admin_contact` WhoisContact: Contact details from a WHOIS record. - `name` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `org` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `street` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `city` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `state` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `postal` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `country` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `phone` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `fax` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `email` PivotedValue[] - `value` union - … - `count` integer: The number of other domains that share this exact value. - `additional_whois_email` PivotedValue[] - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `registrar` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `create_date` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `expiration_date` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `registrant_name` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `registrant_org` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `registrar_status` PivotedValue[] - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `parsed_domain_rdap` ParsedDomainRdap: Parsed data from the domain's RDAP record. Present only when the request includes `parsed_domain_rdap=true`. - `registrant_contact` RdapContact: Contact details from an RDAP record. - `name` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `org` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `street` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `city` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `state` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `postal` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `country` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `phone` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `fax` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `email` PivotedValue[] - `value` union - … - `count` integer: The number of other domains that share this exact value. - `admin_contact` RdapContact: Contact details from an RDAP record. - `name` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `org` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `street` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `city` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `state` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `postal` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `country` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `phone` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `fax` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `email` PivotedValue[] - `value` union - … - `count` integer: The number of other domains that share this exact value. - `technical_contact` RdapContact: Contact details from an RDAP record. - `name` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `org` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `street` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `city` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `state` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `postal` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `country` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `phone` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `fax` PivotedValue - `value` union - … - `count` integer: The number of other domains that share this exact value. - `email` PivotedValue[] - `value` union - … - `count` integer: The number of other domains that share this exact value. - `registrant_name` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `registrar_iana_id` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `additional_whois_email` PivotedValue[] - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `registrar` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `create_date` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `expiration_date` PivotedValue - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `registrar_status` PivotedValue[] - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `email_domain` PivotedValue[] - `value` union - string - integer - `count` integer: The number of other domains that share this exact value. - `missing_domains` ApexDomain[] ## Other responses - `206`: 206: Partial Content. The response is a subset of the full results. The `has_more_results` field in the response will be `true`. - `400`: 400: Bad Request. The request was invalid. The response will contain details about the error. - `401`: 401: Unauthorized. API credentials are required and were not provided, or the provided credentials are not valid. - `403`: 403: Forbidden. The API credentials provided do not have access to the requested resource or endpoint. - `404`: 404: Not Found. The requested resource does not exist. - `500`: 500: Internal Server Error. An unexpected error occurred on the server. If the problem persists, contact DomainTools support. - `503`: 503: Service Unavailable. The service is temporarily unavailable. --- [API](https://skmtc.dev/domaintools/apis/domaintools-iris-api.md) - [All operations](https://skmtc.dev/domaintools/apis/domaintools-iris-api/llms.txt) - [OpenAPI document](https://skmtc.dev/domaintools/apis/domaintools-iris-api/revisions/74a0d057a130?raw)