Returns data from a POST request.
The GET method is available for simple queries.
The POST method supports two request formats:
- Form parameters (application/x-www-form-urlencoded): Traditional parameter-based searches
- IrisQL (text/plain): Complex queries using IrisQL query language for advanced filtering and OR logic
For IrisQL usage and syntax, see the IrisQL API Guide.
Request
- Base URLhttps://api.domaintools.com
- Auth
- API key in header X-Api-Key
- or HTTP basic
- or API key in query parameter signature
- TypeScriptA function with typed inputs. Its response is checked against the schema.
Request body application/x-www-form-urlencoded
A short identifier, code, or handle.
A short identifier, code, or handle.
A generic and unconstrained string value.
A generic and unconstrained string value.
A generic and unconstrained string value.
A standard IPv4 address.
A comma-separated list of one or more apex domains to investigate.
A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts.
A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts.
A base (apex) domain like example.com, excluding subdomains.
A generic and unconstrained string value.
A short identifier, code, or handle.
A short identifier, code, or handle.
A short identifier, code, or handle.
A short identifier, code, or handle.
A short identifier, code, or handle.
A short identifier, code, or handle.
A base (apex) domain like example.com, excluding subdomains.
A Fully Qualified Domain Name (FQDN), including subdomains (e.g., www.example.com). Must be a valid DNS hostname per RFC 1123, excluding trailing dot.
A standard IPv4 address.
A short identifier, code, or handle.
A valid, fully-qualified domain name (FQDN).
A valid, fully-qualified domain name (FQDN).
A standard IPv4 address.
A generic and unconstrained string value.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
Opaque token representing a saved search from the Iris Investigate UI. Exported via “Search → Export” in the Iris UI. Example: aGVsbG93b3yY2hfaGFzaF9jb2RlJsZF9zZWFcw==
A non-empty string with a standard length limit.
A generic and unconstrained string value.
A generic and unconstrained string value.
A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts.
A 40-character hexadecimal SHA-1 hash string, typically used to identify SSL certificates or digital signatures.
A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization. Supports Unicode letters and numbers, along with common punctuation.
A distinguished name (DN) string representing the Subject field of an SSL certificate. Typically includes components like CN, O, C, ST, and L in a comma-separated format. Example: C=US, ST=California, L=San Francisco, O=Example Corp, CN=example.com
A generic and unconstrained string value.
A short identifier, code, or handle.
A short identifier, code, or handle.
A generic and unconstrained string value.
A generic and unconstrained string value.
The exact value of the <title> tag from a website's HTML.
A generic and unconstrained string value.
A short identifier, code, or handle.
A date in YYYY-MM-DD format, optionally prefixed with an operator (>, >=, <, <=) for comparison. Example: <=2025-01-01
A positive integer representing the maximum number of days.
A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone.
A positive integer representing a time window, in seconds. Used to filter results based on how recently an event occurred.
A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone.
A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date). Does not include a time or timezone.
A comma-separated list of tag names. Tags are matched exactly and compared case-insensitively unless otherwise specified.
A comma-separated list of tag names. Tags are matched exactly and compared case-insensitively unless otherwise specified.
A top-level or public suffix domain, such as com, org, or co.uk. Must not include a leading dot.
An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.
An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.
An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.
The desired response format.
An opaque string token used for cursor-based pagination. Returned in the position field of a paginated response when has_more_results is true, and used as a query parameter to retrieve the next result set. Example: 2c056abadfb64b67ba18896af2c5b900
A short identifier, code, or handle.
A short identifier, code, or handle.
A short identifier, code, or handle.
Response
OK
Example response
{
"response": {
"results": [
{
"domain_risk": {
"components": [
{
"evidence": [
"dns"
]
}
]
}
}
]
}
}Changes
No recorded changes to this operation across all 1 revision of this API.