---
title: "Download feed archive from real-time or daily feeds."
method: GET
path: "/v1/download/{feed}/"
tags: ["Download API"]
---

# Download feed archive from real-time or daily feeds.

`GET /v1/download/{feed}/`

## Request

- Base URL: `https://api.domaintools.com`
- URL: `https://api.domaintools.com/v1/download/{feed}/`
- Auth: one of:
  - API key in header `X-Api-Key`
  - HTTP basic
  - API key in query parameter `signature`
- TypeScript: <https://skmtc.dev/domaintools/apis/domaintools-threat-feeds/docs/v1/download/:feed/get.ts> (a function with typed inputs; its response is checked against the schema)

Get signed URLs for one or more downloadable feed files.

- [Feed data retrieval documentation](https://docs.domaintools.com/api/threat-feeds/data-retrieval/)

Note: The `page` parameter is used only for Daily and 5-minute feeds (not realtime feeds). The `limit` parameter caps the number of files returned for any feed, and `prefix` filters filenames using the format for the feed you request.

## Path parameters

- `feed` 'domaindiscovery' | 'domainhotlist' | 'domainrdap' | 'domainrisk' | 'iphotlist' | 'iprisk' | 'nad' | 'nod' | 'noh' | '5_min_domain_whois' | '5_min_domain_whois_parsed' | '5_min_ip_whois' | '5_min_ip_whois_parsed' | 'daily_domain_discovery' | 'daily_domain_hotlist' | 'daily_domain_risk' | 'daily_ip_hotlist' | 'daily_ip_risk' | 'on_premise_v3' | 'on_premise_v3_full', required: Feed identifier for use in Download API path. Includes: - Real-time feeds - 5-minute feeds - Daily feeds

## Query parameters

- `app_partner` string
- `app_name` string
- `app_version` string
- `limit` integer: Optional parameter to limit the number of downloadable files returned, starting from the most recent. Must be a positive integer. Defaults to an implementation-defined maximum if omitted.
- `api_username` string
- `signature` string
- `timestamp` string
- `prefix` string
- `page` integer

## Response `200`

200 OK — List of signed URLs to download historical feed data and checksums.

- DLGetSuccess: A list of downloadable files for a specified DomainTools feed and timeframe.
  - `response` object
    - `download_name` string: Identifier for the requested feed (e.g., `nod`, `nad`, `noh`, `domainrdap`, `domaindiscovery`).
    - `files` object[]: List of downloadable file entries, including both data and checksum files.
      - `name` string: Path and filename of the downloadable file.
      - `last_modified` string, date-time: Timestamp of last modification in ISO 8601 UTC format.
      - `etag` string: ETag (hash) used to verify file identity and versioning.
      - `size` integer: File size in kilobytes (KB).
      - `url` string, uri: Temporary signed URL to download the file from AWS CloudFront.

## Other responses

- `400`: Bad Request.
- `403`: 403 Forbidden — missing or invalid API credentials.

---

[API](https://skmtc.dev/domaintools/apis/domaintools-threat-feeds.md) - [All operations](https://skmtc.dev/domaintools/apis/domaintools-threat-feeds/llms.txt) - [OpenAPI document](https://skmtc.dev/domaintools/apis/domaintools-threat-feeds/revisions/80526c74aa49?raw)