API documentation
DomainTools APIs for domain intelligence, threat detection, and DNS data. Each product page covers authentication, endpoints, and reference docs.
Available APIs
Section titled “Available APIs”- Iris: investigation, enrichment, and detection API
- Farsight DNSDB: passive DNS database API
- Farsight SIE: real-time streaming and batch passive DNS access
- SIE Batch: REST API and web interface for the last 12-18 hours of subscribed feed data
- SIE Remote Access: real-time streaming via a network tunnel (AXA/AXAMD)
- Threat Feeds: predictive risk and discovery feeds
- Lookups and Monitors: WHOIS, RDAP, and monitoring APIs
Base URLs
Section titled “Base URLs”| Product | Base URL |
|---|---|
| Iris, Lookups and Monitors, Threat Feeds | api.domaintools.com |
| Farsight DNSDB | api.dnsdb.info |
| Farsight SIE Batch | batch.sie-remote.net |
| Farsight SIE Remote Access | Per-subscription endpoint |
All APIs require an API key. See Authentication for methods, per-product setup, and rate limits.
Related resources
Section titled “Related resources”- Developer Resources: OpenAPI specs, SDKs, PDFs, and LLM-optimized docs
- Developer tools: Python SDK, MCP Server, and SOAR playbooks
- Changelog: API updates and releases