DOdomaintools
Download API

Download feed archive from real-time or daily feeds.

Get signed URLs for one or more downloadable feed files.

Note: The page parameter is used only for Daily and 5-minute feeds (not realtime feeds). The limit parameter caps the number of files returned for any feed, and prefix filters filenames using the format for the feed you request.

get/v1/download/{feed}/

Request

Path parameters

feed'domaindiscovery' | 'domainhotlist' | 'domainrdap' | 'domainrisk' | 'iphotlist' | 'iprisk' | 'nad' | 'nod' | 'noh' | '5_min_domain_whois' | '5_min_domain_whois_parsed' | '5_min_ip_whois' | '5_min_ip_whois_parsed' | 'daily_domain_discovery' | 'daily_domain_hotlist' | 'daily_domain_risk' | 'daily_ip_hotlist' | 'daily_ip_risk' | 'on_premise_v3' | 'on_premise_v3_full' required

Feed identifier for use in Download API path. Includes:

  • Real-time feeds
  • 5-minute feeds
  • Daily feeds

Query parameters

app_partnerstring

Your product or integration name.

app_namestring

Appliance/module/playbook name

app_versionstring

Your product or integration version.

limitinteger

Optional parameter to limit the number of downloadable files returned, starting from the most recent.

Must be a positive integer. Defaults to an implementation-defined maximum if omitted.

Limits the number of files returned in the response, starting from the most recent.

Use to control payload size or test specific cases. Must be a positive integer.

api_usernamestring

Only required for HMAC authentication.

Your DomainTools API username.

signaturestring

Hex-encoded HMAC signature computed over the string api_username + timestamp + request_path using the API key and a supported algorithm (MD5, SHA1, or SHA256) as the HMAC secret. For example, if using SHA256, compute:

hex(HMAC_SHA256(api_key, api_username + timestamp + "/v1/feed/nad/"))

and pass that as ?signature=….

timestampstring

Only required for HMAC authentication.

Current UTC timestamp in ISO 8601 format (YYYY-MM-DDTHH:MM:SSZ). Used to prevent replay attacks; the server will reject timestamps outside an allowed window.

prefixstring

Filters Download API results by filename prefix. The prefix format varies by feed: hourly real-time feeds use YYYY-MM-DD (e.g. 2025-06-24); 5-minute feeds use YYYYMMDDHHMM (e.g. 202506242000); daily Domain Discovery uses NEW_DOMAINS_YYYYMMDD (e.g. NEW_DOMAINS_20250624).

pageinteger

Only used for daily and 5-minute feeds. Sets the page of results to retrieve from the server.

Response

200 OK — List of signed URLs to download historical feed data and checksums.

Example response

{
  "response": {
    "download_name": "nod",
    "files": [
      {
        "name": "nod/2025-05-30/nod-20250530.1400-1500.json.gz",
        "last_modified": "2025-05-30T15:00:11+00:00",
        "etag": "d3305dab490fe7338bfdc07be92a23f5",
        "size": 204000,
        "url": "https://cdn.domaintools.com/nod/2025-05-30/nod-20250530.1400-1500.json.gz?Expires=1748660992&Signature=AbCdEf1234567890&Key-Pair-Id=APKAEXAMPLE"
      }
    ]
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.