--- title: "Returns data from the Newly Active Domains (NAD) feed." method: GET path: "/v1/feed/nad/" tags: ["Newly Active Domains Feed"] --- # Returns data from the Newly Active Domains (NAD) feed. `GET /v1/feed/nad/` ## Request - Base URL: `https://api.domaintools.com` - URL: `https://api.domaintools.com/v1/feed/nad/` - Auth: one of: - API key in header `X-Api-Key` - HTTP basic - API key in query parameter `signature` - TypeScript: (a function with typed inputs; its response is checked against the schema) Apex-level domains (e.g. `example.com`` but not `www.example.com`) that we observe based on the latest lifecycle of the domain. A domain may be seen either for the first time ever, or again after at least 10 days of inactivity. Populated with our global passive DNS (pDNS) sensor network. ## Query parameters - `domain` string: A domain name or substring using the DNS character set (letters, digits, hyphens). An asterisk (`*`) may be used as a wildcard prefix or suffix, but not in the middle. Omit the parameter entirely to fetch all domains. A trailing dot is acceptable. International characters must be in [punycode](https://en.wikipedia.org/wiki/Punycode). - `before` union: Defines the *end* of the query window for filtering domains by when they were observed. Accepts one of: Relative time, in negative seconds; Absolute time, in an ISO 8601 timestamp - integer: Relative offset in seconds before the current UTC time. The query window covers the most recent 5 days, from -1 (1 second ago) to -432000 (5 days ago). A value older than -432000 places the window entirely outside it, and the response contains no records. - string, date-time: ISO 8601 datetime in strict UTC format with no milliseconds or timezone offset. Format: `YYYY-MM-DDTHH:MM:SSZ`. The query window covers the most recent 5 days. A timestamp older than 5 days places the window entirely outside it, and the response contains no records. - `after` union: Defines the *start* of the query window for filtering domains by when they were first observed. Accepts one of: - relative time, in negative seconds - absolute time, in an ISO 8601 timestamp Use in combination with `seenBefore` to define a bounded time range. - integer: Relative offset in seconds before the current UTC time. The query window covers the most recent 5 days, from -1 (1 second ago) to -432000 (5 days ago). A value older than -432000 is capped to the start of that window, and the response begins 5 days back. - string, date-time: ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: `YYYY-MM-DDTHH:MM:SSZ`. The query window covers the most recent 5 days. A timestamp older than 5 days is capped to the start of that window, and the response begins 5 days back. - `headers` boolean: Optional flag to include a header row as the first line of the response when the response format is `text/csv`. Set to `1` to enable CSV headers. If omitted, no header row is included. Accepts `true`, `false`, `1`, or `0`; `false` is the default. Enabling it on a request that doesn't ask for `text/csv` returns `422`, as does a value that isn't a boolean. - `sessionID` string: Unique, client-generated session identifier for incremental feed retrieval. Requirements: - 1 to 64 characters in length - Alphanumeric characters and hyphens only - Case-sensitive Use a new value to start a new session; reuse the same value to resume a session and fetch additional results. If omitted, time window parameters (such as `after`/`before`) are required. - `fromBeginning` boolean: Optional flag to return data from the start of the available window (the first hour) when beginning a new session. Requires `sessionID`. Accepts `true`, `false`, `1`, or `0`; `false` is the default. Only use on the first request with a new session ID — a session ID that already exists returns `406`. A value that isn't a boolean returns `422`, as does use without a `sessionID`. - `top` integer: Maximum number of feed entries to return in the response payload. Primarily intended for testing. - `api_username` string - `signature` string - `timestamp` string - `app_partner` string - `app_name` string - `app_version` string ## Response `200` OK ## Other responses - `206`: Partial content limited to 10M rows or 1 hour evaluation window - `403`: 403 Forbidden — missing or invalid API credentials. - `404`: The requested resource could not be found. - `406`: Returned for either of two reasons. The specified Accept header value is not supported. If the Accept header is omitted, the API defaults to `application/x-ndjson`. Only `application/x-ndjson` and `text/csv` are accepted as explicit values. Or `fromBeginning` was used with a `sessionID` that already exists. It can only be used on the first request with a new session ID. - `422`: 422 Unprocessable Entity — The request is syntactically valid but violates semantic or domain-specific rules. --- [API](https://skmtc.dev/domaintools/apis/domaintools-threat-feeds.md) - [All operations](https://skmtc.dev/domaintools/apis/domaintools-threat-feeds/llms.txt) - [OpenAPI document](https://skmtc.dev/domaintools/apis/domaintools-threat-feeds/revisions/80526c74aa49?raw)