Iris Enrich API guide
Overview
Section titled “Overview”The Iris Enrich API provides high-volume domain enrichment optimized for SIEM and SOAR platform integration. Enrich up to 100 domains per request with domain risk scores, RDAP, WHOIS, IP, DNS, website, and SSL/TLS certificate data. For a complete overview of Iris Enrich capabilities and use cases, see the Iris Enrich overview.
The Iris Enrich API provides high-volume domain enrichment with actionable threat intelligence and domain metadata. The API is optimized for batch processing and fast response times, making it ideal for enriching proxy logs, DNS logs, and other domain data at scale within SIEM solutions like Splunk or QRadar, or custom data analytics platforms.
Key characteristics:
- Batch enrichment of up to 100 domains per request
- Multiple domain attributes including risk scores, RDAP, WHOIS, IP, DNS, website, and SSL/TLS certificate data
- Dedicated service levels with customized rate limiting
- Optimized for enrichment workflows
- Domain-name queries only (forward lookups)
API endpoint
Section titled “API endpoint”The API returns JSON results and supports both POST and GET requests at this endpoint:
https://api.domaintools.com/v1/iris-enrich/What Iris Enrich does and doesn’t do
Section titled “What Iris Enrich does and doesn’t do”Iris Enrich is designed specifically for forward lookups: you provide domain names and receive enrichment data about those domains.
Supported use case
Section titled “Supported use case”Query domains to retrieve enrichment data including risk scores, registration information, DNS records, and SSL/TLS certificate details.
Not supported
Section titled “Not supported”- Reverse lookups/pivoting: You can’t query by IP addresses, nameservers, SSL/TLS certificate hashes, or other attributes to find domains. Iris Enrich only accepts domain names as input.
- Domain counts: The API doesn’t include counts of how many domains share a given attribute value (such as the number of domains on the same IP address).
For reverse lookups, pivoting capabilities, and domain counts, use the Iris Investigate API instead.
Authentication
Section titled “Authentication”The Iris Enrich API uses the same authentication mechanisms as the Iris Investigate API (open-key or signed). However, unlike the Investigate API, the Iris Enrich API uses an independent service level to define access levels, query caps, and rate limits. It does not pull from the same queries as the Iris Investigate UI and can be used at much greater scale and throughput. The API endpoint must be explicitly configured on an enterprise account.
For complete information about Iris API rate limits and how Enrich differs from other Iris products, consult the Iris API rate limits documentation.
Request parameters
Section titled “Request parameters”The Iris Enrich API is optimized for fast responses and high-volume lookups. Provide a list of up to 100 domains in the domain parameter (comma-separated).
Example request
Section titled “Example request”https://api.domaintools.com/v1/iris-enrich/?domain=domaintools.com,domaintools.netRequired parameters
Section titled “Required parameters”| Parameter | Type | Description |
|---|---|---|
domain | string | Comma-separated list of up to 100 domains to enrich. |
Optional parameters
Section titled “Optional parameters”| Parameter | Type | Description |
|---|---|---|
parsed_whois | boolean | Set to true to include the full parsed WHOIS record in the response. |
parsed_domain_rdap | boolean | Set to true to include the full parsed RDAP record in the response. |
screenshots | flag | Set to 1 to include screenshot data in the response. See working with screenshots for details. |
Response format
Section titled “Response format”The Iris Enrich API response format differs from the Investigate API in several key ways:
- Counts of connected domains are not included
- Most domain attribute values still appear under the
valuesubkey for consistency with the Investigate API - An additional
missing_domainskey lists any domains submitted in thedomainparameter that were not found in the Iris dataset
Example response structure
Section titled “Example response structure”{ "response": { "limit_exceeded": false, "message": "Success", "results_count": 2, "has_more_results": false, "results": [ { "domain": "domaintools.com", "active": true, "domain_risk": { "risk_score": 0, "components": [] }, "create_date": { "value": "1998-08-02" } } ], "missing_domains": [] }}Working with RDAP and WHOIS registration data
Section titled “Working with RDAP and WHOIS registration data”Domain registries and registrars are transitioning from WHOIS to the Registration Data Access Protocol (RDAP) as a method to communicate domain registration data.
DomainTools supports both WHOIS and RDAP registration data in the Iris suite. These updates are available now, prior to the date at which ICANN will permit gTLD registries and registrars to sunset WHOIS in their Registration Data Directory Services (RDDS).
Note that these changes apply to the subset of registration data and not other domain records provided in the responses.
Backward-compatible response structure
Section titled “Backward-compatible response structure”Set parameters for parsed_whois=true and/or parsed_domain_rdap=true to return the parsed WHOIS and/or parsed RDAP record along with the default response.
Default query
Section titled “Default query”https://api.domaintools.com/v1/iris-enrich/?domain=github.com&api_username=USERNAME&api_key=KEYThis query returns standard registration data as part of the response root fields. Registration data is included at the same level as other domain data.
Registration data is populated from a single source — WHOIS or RDAP — selected per domain in this order:
- If only one source is present, that record is used.
- If both are present and were collected more than three days apart, the newer record is used (field count is not considered).
- If both were collected within three days of each other, the record with more populated fields is used.
- On a tie — including when neither record has populated fields — RDAP is used.
To work with source-specific data, use the parsed_whois and parsed_domain_rdap records.
Response structure:
response: limit_exceeded has_more_results message result_count total_count results domain whois_url adsense alexa popularity_rank ...Query with full WHOIS and RDAP records
Section titled “Query with full WHOIS and RDAP records”https://api.domaintools.com/v1/iris-enrich/?domain=github.com&parsed_whois=true&parsed_domain_rdap=true&api_username=USERNAME&api_key=KEYRegistration data is included as before, but with additional root-level fields for parsed_whois and parsed_domain_rdap:
response: limit_exceeded has_more_results message result_count total_count results domain whois_url adsense alexa popularity_rank ... parsed_whois # PARSED WHOIS FIELD registrant_contact ... parsed_domain_rdap # PARSED RDAP FIELD admin_contact ...Registrar IANA ID
Section titled “Registrar IANA ID”The domain registrar’s IANA ID is included in the RDAP object when the parsed_domain_rdap=true parameter is used in an API request.
Working with screenshots
Section titled “Working with screenshots”You can retrieve domain screenshots through the Iris Enrich API by adding the screenshots=1 parameter to your request. For detailed information about retrieving, resizing, and interpreting screenshot data, see working with screenshots in Iris APIs.
Appendix: API response examples
Section titled “Appendix: API response examples”Basic enrichment request
Section titled “Basic enrichment request”This example shows a simple enrichment request for two domains:
GET https://api.domaintools.com/v1/iris-enrich/?domain=domaintools.com,example.com&api_username=USERNAME&api_key=KEYBasic enrichment response
Section titled “Basic enrichment response”The response includes enriched data for each domain with most values nested under a value subkey:
{ "response": { "limit_exceeded": false, "message": "Enjoy your data.", "results_count": 2, "results": [ { "domain": "domaintools.com", "active": true, "popularity_rank": 2417, "domain_risk": { "risk_score": 0, "components": [ { "name": "zerolist", "risk_score": 0 } ] }, "create_date": { "value": "1998-08-02" }, "expiration_date": { "value": "2027-08-01" }, "registrar": { "value": "ENOM, INC." }, "ip": [ { "address": { "value": "141.193.213.20" }, "country_code": { "value": "us" }, "isp": { "value": "WPEngine Inc." } } ], "name_server": [ { "host": { "value": "dns1.p04.nsone.net" }, "domain": { "value": "nsone.net" } } ] } ], "missing_domains": [] }}Full enrichment with WHOIS and RDAP
Section titled “Full enrichment with WHOIS and RDAP”This example shows a request that includes both parsed WHOIS and RDAP records:
Request example
Section titled “Request example”GET https://api.domaintools.com/v1/iris-enrich/?domain=domaintools.com,example.com&parsed_whois=true&parsed_domain_rdap=true&api_username=USERNAME&api_key=KEYResponse example
Section titled “Response example”The response includes the standard enrichment data plus additional parsed_whois and parsed_domain_rdap objects for each domain:
{ "response": { "limit_exceeded": false, "message": "Enjoy your data.", "results_count": 2, "results": [ { "domain": "domaintools.com", "whois_url": "https://whois.domaintools.com/domaintools.com", "adsense": { "value": "" }, "alexa": 3954, "popularity_rank": 2417, "active": true, "google_analytics": { "value": "" }, "ga4": [ { "value": "G-RPLVMKCB3Y" } ], "gtm_codes": [ { "value": "GTM-5P2JCN" } ], "fb_codes": [], "hotjar_codes": [], "baidu_codes": [], "yandex_codes": [], "matomo_codes": [], "statcounter_project_codes": [], "statcounter_security_codes": [], "admin_contact": { "name": { "value": "" }, "org": { "value": "" }, "street": { "value": "" }, "city": { "value": "" }, "state": { "value": "" }, "postal": { "value": "" }, "country": { "value": "" }, "phone": { "value": "" }, "fax": { "value": "" }, "email": [] }, "billing_contact": { "name": { "value": "" }, "org": { "value": "" }, "street": { "value": "" }, "city": { "value": "" }, "state": { "value": "" }, "postal": { "value": "" }, "country": { "value": "" }, "phone": { "value": "" }, "fax": { "value": "" }, "email": [] }, "registrant_contact": { "name": { "value": "Domain Administrator" }, "org": { "value": "DomainTools, LLC" }, "street": { "value": "2101 4th Ave Suite 1720" }, "city": { "value": "Seattle" }, "state": { "value": "WA" }, "postal": { "value": "98121" }, "country": { "value": "US" }, "phone": { "value": "tel:+1.2068389035" }, "fax": { "value": "" }, "email": [ { "value": "memberservices@domaintools.com" } ] }, "technical_contact": { "name": { "value": "" }, "org": { "value": "" }, "street": { "value": "" }, "city": { "value": "" }, "state": { "value": "" }, "postal": { "value": "" }, "country": { "value": "" }, "phone": { "value": "" }, "fax": { "value": "" }, "email": [] }, "create_date": { "value": "1998-08-02" }, "expiration_date": { "value": "2027-08-01" }, "email_domain": [ { "value": "enom.com" }, { "value": "nsone.net" }, { "value": "domaintools.com" } ], "soa_email": [ { "value": "hostmaster@nsone.net" } ], "ssl_email": [], "additional_whois_email": [ { "value": "abuse@enom.com" } ], "ip": [ { "address": { "value": "141.193.213.20" }, "asn": [ { "value": 209242 } ], "country_code": { "value": "us" }, "isp": { "value": "WPEngine Inc." } }, { "address": { "value": "141.193.213.21" }, "asn": [ { "value": 209242 } ], "country_code": { "value": "us" }, "isp": { "value": "WPEngine Inc." } } ], "mx": [ { "host": { "value": "aspmx.l.google.com" }, "domain": { "value": "google.com" }, "ip": [ { "value": "74.125.195.26" } ], "priority": 1 }, { "host": { "value": "alt1.aspmx.l.google.com" }, "domain": { "value": "google.com" }, "ip": [ { "value": "142.250.101.26" } ], "priority": 5 }, { "host": { "value": "alt2.aspmx.l.google.com" }, "domain": { "value": "google.com" }, "ip": [ { "value": "192.178.164.27" } ], "priority": 5 }, { "host": { "value": "aspmx2.googlemail.com" }, "domain": { "value": "googlemail.com" }, "ip": [ { "value": "142.250.101.27" } ], "priority": 10 }, { "host": { "value": "aspmx3.googlemail.com" }, "domain": { "value": "googlemail.com" }, "ip": [ { "value": "192.178.164.26" } ], "priority": 10 }, { "host": { "value": "aspmx4.googlemail.com" }, "domain": { "value": "googlemail.com" }, "ip": [ { "value": "192.178.220.27" } ], "priority": 10 } ], "name_server": [ { "host": { "value": "dns3.p04.nsone.net" }, "domain": { "value": "nsone.net" }, "ip": [ { "value": "198.51.44.68" } ] }, { "host": { "value": "dns1.p04.nsone.net" }, "domain": { "value": "nsone.net" }, "ip": [ { "value": "198.51.44.4" } ] }, { "host": { "value": "dns2.p04.nsone.net" }, "domain": { "value": "nsone.net" }, "ip": [ { "value": "198.51.45.4" } ] }, { "host": { "value": "dns4.p04.nsone.net" }, "domain": { "value": "nsone.net" }, "ip": [ { "value": "198.51.45.68" } ] } ], "domain_risk": { "risk_score": 0, "components": [ { "name": "zerolist", "risk_score": 0 } ] }, "redirect": { "value": "" }, "redirect_domain": { "value": "" }, "registrant_name": { "value": "Domain Administrator" }, "registrant_org": { "value": "DomainTools, LLC" }, "registrar": { "value": "ENOM, INC." }, "registrar_status": [ "client transfer prohibited" ], "spf_info": "", "ssl_info": [ { "hash": { "value": "11fc54c990c58d66f986320c9bc72052f541fe92" }, "subject": { "value": "CN=www.domaintools.com" }, "organization": { "value": "" }, "email": [], "alt_names": [ { "value": "www.domaintools.com" }, { "value": "blog.domaintools.com" }, { "value": "domaintools.com" } ], "sources": { "active": 1764613130569, "passive": 1759158600086 }, "common_name": { "value": "www.domaintools.com" }, "issuer_common_name": { "value": "Sectigo Public Server Authentication CA DV R36" }, "not_after": { "value": 20260919 }, "not_before": { "value": 20250820 }, "duration": { "value": 396 } } ], "tld": "com", "website_response": 200, "data_updated_timestamp": "2025-12-03T16:37:56.267000", "website_title": { "value": "DomainTools - The first place to go when you need to know." }, "server_type": { "value": "cloudflare" }, "first_seen": { "value": "2001-10-26T00:00:00Z" }, "tags": [], "parsed_whois": { "admin_contact": { "country": { "value": "REDACTED FOR PRIVACY" }, "street": { "value": "REDACTED FOR PRIVACY" }, "postal": { "value": "REDACTED FOR PRIVACY" }, "city": { "value": "REDACTED FOR PRIVACY" }, "org": { "value": "REDACTED FOR PRIVACY" }, "state": { "value": "REDACTED FOR PRIVACY" }, "name": { "value": "REDACTED FOR PRIVACY" }, "email": [ { "value": "redacted for privacy" } ] }, "technical_contact": { "country": { "value": "REDACTED FOR PRIVACY" }, "street": { "value": "REDACTED FOR PRIVACY" }, "postal": { "value": "REDACTED FOR PRIVACY" }, "city": { "value": "REDACTED FOR PRIVACY" }, "org": { "value": "REDACTED FOR PRIVACY" }, "state": { "value": "REDACTED FOR PRIVACY" }, "name": { "value": "REDACTED FOR PRIVACY" }, "email": [ { "value": "redacted for privacy" } ] }, "registrant_contact": { "country": { "value": "us" }, "street": { "value": "2101 4th Ave" }, "fax": { "value": "12068389056" }, "postal": { "value": "98121" }, "city": { "value": "Seattle" }, "org": { "value": "DomainTools, LLC" }, "state": { "value": "WA" }, "phone": { "value": "12068389035" }, "name": { "value": "Domain Administrator" }, "email": [ { "value": "memberservices@domaintools.com" } ] }, "registrar": { "value": "eNom, LLC" }, "expiration_date": { "value": "2027-08-01" }, "additional_whois_email": [ { "value": "abuse@enom.com" } ], "create_date": { "value": "1998-08-02" }, "registrant_name": { "value": "Domain Administrator" }, "registrant_org": { "value": "DomainTools, LLC" }, "registrar_status": [ "clienttransferprohibited" ], "email_domain": [ { "value": "enom.com" }, { "value": "nsone.net" } ] }, "parsed_domain_rdap": { "registrant_contact": { "country": { "value": "US" }, "street": { "value": "2101 4th Ave Suite 1720" }, "postal": { "value": "98121" }, "city": { "value": "Seattle" }, "org": { "value": "DomainTools, LLC" }, "state": { "value": "WA" }, "phone": { "value": "tel:+1.2068389035" }, "name": { "value": "Domain Administrator" }, "email": [ { "value": "memberservices@domaintools.com" } ] }, "registrant_name": { "value": "Domain Administrator" }, "registrant_org": { "value": "DomainTools, LLC" }, "registrar_iana_id": { "value": "48" }, "additional_whois_email": [ { "value": "abuse@enom.com" } ], "registrar": { "value": "ENOM, INC." }, "create_date": { "value": "1998-08-02" }, "registrar_status": [ "client transfer prohibited" ], "expiration_date": { "value": "2027-08-01" }, "email_domain": [ { "value": "enom.com" }, { "value": "nsone.net" }, { "value": "domaintools.com" } ] } }, { "domain": "example.com", "whois_url": "https://whois.domaintools.com/example.com", "adsense": { "value": "" }, "alexa": 26830, "popularity_rank": 299, "active": true, "google_analytics": { "value": "" }, "ga4": [], "gtm_codes": [], "fb_codes": [], "hotjar_codes": [], "baidu_codes": [], "yandex_codes": [], "matomo_codes": [], "statcounter_project_codes": [], "statcounter_security_codes": [], "admin_contact": { "name": { "value": "" }, "org": { "value": "" }, "street": { "value": "" }, "city": { "value": "" }, "state": { "value": "" }, "postal": { "value": "" }, "country": { "value": "" }, "phone": { "value": "" }, "fax": { "value": "" }, "email": [] }, "billing_contact": { "name": { "value": "" }, "org": { "value": "" }, "street": { "value": "" }, "city": { "value": "" }, "state": { "value": "" }, "postal": { "value": "" }, "country": { "value": "" }, "phone": { "value": "" }, "fax": { "value": "" }, "email": [] }, "registrant_contact": { "name": { "value": "" }, "org": { "value": "Internet Assigned Numbers Authority" }, "street": { "value": "" }, "city": { "value": "" }, "state": { "value": "" }, "postal": { "value": "" }, "country": { "value": "" }, "phone": { "value": "" }, "fax": { "value": "" }, "email": [] }, "technical_contact": { "name": { "value": "" }, "org": { "value": "" }, "street": { "value": "" }, "city": { "value": "" }, "state": { "value": "" }, "postal": { "value": "" }, "country": { "value": "" }, "phone": { "value": "" }, "fax": { "value": "" }, "email": [] }, "create_date": { "value": "1992-01-01" }, "expiration_date": { "value": "2026-08-13" }, "email_domain": [ { "value": "icann.org" } ], "soa_email": [ { "value": "noc.dns@icann.org" } ], "ssl_email": [], "additional_whois_email": [], "ip": [ { "address": { "value": "23.215.0.136" }, "asn": [ { "value": 20940 } ], "country_code": { "value": "us" }, "isp": { "value": "Akamai Technologies Inc." } }, { "address": { "value": "23.215.0.138" }, "asn": [ { "value": 20940 } ], "country_code": { "value": "us" }, "isp": { "value": "Akamai Technologies Inc." } } ], "mx": [], "name_server": [ { "host": { "value": "a.iana-servers.net" }, "domain": { "value": "iana-servers.net" }, "ip": [ { "value": "199.43.135.53" } ] }, { "host": { "value": "b.iana-servers.net" }, "domain": { "value": "iana-servers.net" }, "ip": [ { "value": "199.43.133.53" } ] } ], "domain_risk": { "risk_score": 1, "components": [ { "name": "proximity", "risk_score": 1 } ] }, "redirect": { "value": "" }, "redirect_domain": { "value": "" }, "registrant_name": { "value": "" }, "registrant_org": { "value": "Internet Assigned Numbers Authority" }, "registrar": { "value": "RESERVED-Internet Assigned Numbers Authority" }, "registrar_status": [ "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "spf_info": "", "ssl_info": [ { "hash": { "value": "310db7af4b2bc9040c8344701aca08d0c69381e3" }, "subject": { "value": "CN=*.example.com,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US" }, "organization": { "value": "Internet Corporation for Assigned Names and Numbers" }, "email": [], "alt_names": [ { "value": "*.example.com" }, { "value": "example.com" } ], "sources": { "active": 1763429847000 }, "common_name": { "value": "*.example.com" }, "issuer_common_name": { "value": "DigiCert Global G3 TLS ECC SHA384 2020 CA1" }, "not_after": { "value": 20260115 }, "not_before": { "value": 20250115 }, "duration": { "value": 366 } } ], "tld": "com", "website_response": 200, "data_updated_timestamp": "2025-12-03T16:37:01.621000", "website_title": { "value": "Example Domain" }, "server_type": { "value": "ECS (laa/7BA2)" }, "first_seen": { "value": "2002-01-07T00:00:00Z" }, "tags": [], "parsed_whois": { "registrant_contact": { "org": { "value": "Internet Assigned Numbers Authority" } }, "registrar": { "value": "RESERVED-Internet Assigned Numbers Authority" }, "expiration_date": { "value": "2026-08-13" }, "create_date": { "value": "1992-01-01" }, "registrant_org": { "value": "Internet Assigned Numbers Authority" }, "registrar_status": [ "clientdeleteprohibited", "clienttransferprohibited", "clientupdateprohibited" ], "email_domain": [ { "value": "icann.org" } ] }, "parsed_domain_rdap": { "registrar_iana_id": { "value": "376" }, "registrar": { "value": "RESERVED-Internet Assigned Numbers Authority" }, "create_date": { "value": "1995-08-14" }, "registrar_status": [ "client delete prohibited", "client transfer prohibited", "client update prohibited" ], "expiration_date": { "value": "2025-08-13" }, "email_domain": [ { "value": "icann.org" } ] } } ], "missing_domains": [] }}Note the key differences when parsed_whois=true and parsed_domain_rdap=true are included:
- Each domain result includes
parsed_whoisandparsed_domain_rdapobjects - The
parsed_domain_rdapobject includes theregistrar_iana_idfield - WHOIS data may show “REDACTED FOR PRIVACY” for privacy-protected domains
- RDAP data typically provides more structured and complete registration information