Iris Enrich API guide¶
Overview¶
The Iris Enrich API provides high-volume domain enrichment optimized for SIEM and SOAR platform integration. Enrich up to 100 domains per request with domain risk scores, RDAP, WHOIS, IP, DNS, website, and SSL/TLS certificate data. For a complete overview of Iris Enrich capabilities and use cases, see the Iris Enrich overview.
The Iris Enrich API provides high-volume domain enrichment with actionable threat intelligence and domain metadata. The API is optimized for batch processing and fast response times, making it ideal for enriching proxy logs, DNS logs, and other domain data at scale within SIEM solutions like Splunk or QRadar, or custom data analytics platforms.
Key characteristics:
- Batch enrichment of up to 100 domains per request
- Multiple domain attributes including risk scores, RDAP, WHOIS, IP, DNS, website, and SSL/TLS certificate data
- Dedicated service levels with customized rate limiting
- Optimized for enrichment workflows
- Domain-name queries only (forward lookups)
API endpoint¶
The API returns JSON results and supports both POST and GET requests at this endpoint:
What Iris Enrich does and doesn't do¶
Iris Enrich is designed specifically for forward lookups: you provide domain names and receive enrichment data about those domains.
Supported use case¶
Query domains to retrieve enrichment data including risk scores, registration information, DNS records, and SSL/TLS certificate details.
Not supported¶
- Reverse lookups/pivoting: You can't query by IP addresses, nameservers, SSL/TLS certificate hashes, or other attributes to find domains. Iris Enrich only accepts domain names as input.
- Domain counts: The API doesn't include counts of how many domains share a given attribute value (such as the number of domains on the same IP address).
For reverse lookups, pivoting capabilities, and domain counts, use the Iris Investigate API instead.
Authentication¶
The Iris Enrich API uses the same authentication mechanisms as the Iris Investigate API (open-key or signed). However, unlike the Investigate API, the Iris Enrich API uses an independent service level to define access levels, query caps, and rate limits. It does not pull from the same queries as the Iris Investigate UI and can be used at much greater scale and throughput. The API endpoint must be explicitly configured on an enterprise account.
For complete information about Iris API rate limits and how Enrich differs from other Iris products, consult the Iris API rate limits documentation.
Request parameters¶
The Iris Enrich API is optimized for fast responses and high-volume lookups. Provide a list of up to 100 domains in the domain parameter (comma-separated).
Example request¶
Required parameters¶
| Parameter | Type | Description |
|---|---|---|
domain |
string | Comma-separated list of up to 100 domains to enrich. |
Optional parameters¶
| Parameter | Type | Description |
|---|---|---|
parsed_whois |
boolean | Set to true to include the full parsed WHOIS record in the response. |
parsed_domain_rdap |
boolean | Set to true to include the full parsed RDAP record in the response. |
screenshots |
flag | Set to 1 to include screenshot data in the response. See working with screenshots for details. |
Response format¶
The Iris Enrich API response format differs from the Investigate API in several key ways:
- Counts of connected domains are not included
- Most domain attribute values still appear under the
valuesubkey for consistency with the Investigate API - An additional
missing_domainskey lists any domains submitted in thedomainparameter that were not found in the Iris dataset
Example response structure¶
{
"response": {
"limit_exceeded": false,
"message": "Success",
"results_count": 2,
"has_more_results": false,
"results": [
{
"domain": "domaintools.com",
"active": true,
"domain_risk": {
"risk_score": 0,
"components": []
},
"create_date": {
"value": "1998-08-02"
}
}
],
"missing_domains": []
}
}
Working with RDAP and WHOIS registration data¶
Domain registries and registrars are transitioning from WHOIS to the Registration Data Access Protocol (RDAP) as a method to communicate domain registration data.
DomainTools supports both WHOIS and RDAP registration data in the Iris suite. These updates are available now, prior to the date at which ICANN will permit gTLD registries and registrars to sunset WHOIS in their Registration Data Directory Services (RDDS).
Note that these changes apply to the subset of registration data and not other domain records provided in the responses.
Backward-compatible response structure¶
Set parameters for parsed_whois=true and/or parsed_domain_rdap=true to return the parsed WHOIS and/or parsed RDAP record along with the default response.
Default query¶
This query returns standard registration data as part of the response root fields. Registration data is from either RDAP or WHOIS, depending on which record is more complete. Registration data is included at the same level as other domain data.
Response structure:
response:
limit_exceeded
has_more_results
message
result_count
total_count
results
domain
whois_url
adsense
alexa
popularity_rank
...
Query with full WHOIS and RDAP records¶
https://api.domaintools.com/v1/iris-enrich/?domain=github.com&parsed_whois=true&parsed_domain_rdap=true&api_username=USERNAME&api_key=KEY
Registration data is included as before, but with additional root-level fields for parsed_whois and parsed_domain_rdap:
response:
limit_exceeded
has_more_results
message
result_count
total_count
results
domain
whois_url
adsense
alexa
popularity_rank
...
parsed_whois # PARSED WHOIS FIELD
registrant_contact
...
parsed_domain_rdap # PARSED RDAP FIELD
admin_contact
...
Registrar IANA ID¶
The domain registrar's IANA ID is included in the RDAP object when the parsed_domain_rdap=true parameter is used in an API request.
Working with screenshots¶
You can retrieve domain screenshots through the Iris Enrich API by adding the screenshots=1 parameter to your request. For detailed information about retrieving, resizing, and interpreting screenshot data, see working with screenshots in Iris APIs.
Appendix: API response examples¶
Basic enrichment request¶
This example shows a simple enrichment request for two domains:
GET https://api.domaintools.com/v1/iris-enrich/?domain=domaintools.com,example.com&api_username=USERNAME&api_key=KEY
Basic enrichment response¶
The response includes enriched data for each domain with most values nested under a value subkey:
{
"response": {
"limit_exceeded": false,
"message": "Enjoy your data.",
"results_count": 2,
"results": [
{
"domain": "domaintools.com",
"active": true,
"popularity_rank": 2417,
"domain_risk": {
"risk_score": 0,
"components": [
{
"name": "zerolist",
"risk_score": 0
}
]
},
"create_date": {
"value": "1998-08-02"
},
"expiration_date": {
"value": "2027-08-01"
},
"registrar": {
"value": "ENOM, INC."
},
"ip": [
{
"address": {
"value": "141.193.213.20"
},
"country_code": {
"value": "us"
},
"isp": {
"value": "WPEngine Inc."
}
}
],
"name_server": [
{
"host": {
"value": "dns1.p04.nsone.net"
},
"domain": {
"value": "nsone.net"
}
}
]
}
],
"missing_domains": []
}
}
Full enrichment with WHOIS and RDAP¶
This example shows a request that includes both parsed WHOIS and RDAP records:
Request example¶
GET https://api.domaintools.com/v1/iris-enrich/?domain=domaintools.com,example.com&parsed_whois=true&parsed_domain_rdap=true&api_username=USERNAME&api_key=KEY
Response example¶
The response includes the standard enrichment data plus additional parsed_whois and parsed_domain_rdap objects for each domain:
{
"response": {
"limit_exceeded": false,
"message": "Enjoy your data.",
"results_count": 2,
"results": [
{
"domain": "domaintools.com",
"whois_url": "https://whois.domaintools.com/domaintools.com",
"adsense": {
"value": ""
},
"alexa": 3954,
"popularity_rank": 2417,
"active": true,
"google_analytics": {
"value": ""
},
"ga4": [
{
"value": "G-RPLVMKCB3Y"
}
],
"gtm_codes": [
{
"value": "GTM-5P2JCN"
}
],
"fb_codes": [],
"hotjar_codes": [],
"baidu_codes": [],
"yandex_codes": [],
"matomo_codes": [],
"statcounter_project_codes": [],
"statcounter_security_codes": [],
"admin_contact": {
"name": {
"value": ""
},
"org": {
"value": ""
},
"street": {
"value": ""
},
"city": {
"value": ""
},
"state": {
"value": ""
},
"postal": {
"value": ""
},
"country": {
"value": ""
},
"phone": {
"value": ""
},
"fax": {
"value": ""
},
"email": []
},
"billing_contact": {
"name": {
"value": ""
},
"org": {
"value": ""
},
"street": {
"value": ""
},
"city": {
"value": ""
},
"state": {
"value": ""
},
"postal": {
"value": ""
},
"country": {
"value": ""
},
"phone": {
"value": ""
},
"fax": {
"value": ""
},
"email": []
},
"registrant_contact": {
"name": {
"value": "Domain Administrator"
},
"org": {
"value": "DomainTools, LLC"
},
"street": {
"value": "2101 4th Ave Suite 1720"
},
"city": {
"value": "Seattle"
},
"state": {
"value": "WA"
},
"postal": {
"value": "98121"
},
"country": {
"value": "US"
},
"phone": {
"value": "tel:+1.2068389035"
},
"fax": {
"value": ""
},
"email": [
{
"value": "memberservices@domaintools.com"
}
]
},
"technical_contact": {
"name": {
"value": ""
},
"org": {
"value": ""
},
"street": {
"value": ""
},
"city": {
"value": ""
},
"state": {
"value": ""
},
"postal": {
"value": ""
},
"country": {
"value": ""
},
"phone": {
"value": ""
},
"fax": {
"value": ""
},
"email": []
},
"create_date": {
"value": "1998-08-02"
},
"expiration_date": {
"value": "2027-08-01"
},
"email_domain": [
{
"value": "enom.com"
},
{
"value": "nsone.net"
},
{
"value": "domaintools.com"
}
],
"soa_email": [
{
"value": "hostmaster@nsone.net"
}
],
"ssl_email": [],
"additional_whois_email": [
{
"value": "abuse@enom.com"
}
],
"ip": [
{
"address": {
"value": "141.193.213.20"
},
"asn": [
{
"value": 209242
}
],
"country_code": {
"value": "us"
},
"isp": {
"value": "WPEngine Inc."
}
},
{
"address": {
"value": "141.193.213.21"
},
"asn": [
{
"value": 209242
}
],
"country_code": {
"value": "us"
},
"isp": {
"value": "WPEngine Inc."
}
}
],
"mx": [
{
"host": {
"value": "aspmx.l.google.com"
},
"domain": {
"value": "google.com"
},
"ip": [
{
"value": "74.125.195.26"
}
],
"priority": 1
},
{
"host": {
"value": "alt1.aspmx.l.google.com"
},
"domain": {
"value": "google.com"
},
"ip": [
{
"value": "142.250.101.26"
}
],
"priority": 5
},
{
"host": {
"value": "alt2.aspmx.l.google.com"
},
"domain": {
"value": "google.com"
},
"ip": [
{
"value": "192.178.164.27"
}
],
"priority": 5
},
{
"host": {
"value": "aspmx2.googlemail.com"
},
"domain": {
"value": "googlemail.com"
},
"ip": [
{
"value": "142.250.101.27"
}
],
"priority": 10
},
{
"host": {
"value": "aspmx3.googlemail.com"
},
"domain": {
"value": "googlemail.com"
},
"ip": [
{
"value": "192.178.164.26"
}
],
"priority": 10
},
{
"host": {
"value": "aspmx4.googlemail.com"
},
"domain": {
"value": "googlemail.com"
},
"ip": [
{
"value": "192.178.220.27"
}
],
"priority": 10
}
],
"name_server": [
{
"host": {
"value": "dns3.p04.nsone.net"
},
"domain": {
"value": "nsone.net"
},
"ip": [
{
"value": "198.51.44.68"
}
]
},
{
"host": {
"value": "dns1.p04.nsone.net"
},
"domain": {
"value": "nsone.net"
},
"ip": [
{
"value": "198.51.44.4"
}
]
},
{
"host": {
"value": "dns2.p04.nsone.net"
},
"domain": {
"value": "nsone.net"
},
"ip": [
{
"value": "198.51.45.4"
}
]
},
{
"host": {
"value": "dns4.p04.nsone.net"
},
"domain": {
"value": "nsone.net"
},
"ip": [
{
"value": "198.51.45.68"
}
]
}
],
"domain_risk": {
"risk_score": 0,
"components": [
{
"name": "zerolist",
"risk_score": 0
}
]
},
"redirect": {
"value": ""
},
"redirect_domain": {
"value": ""
},
"registrant_name": {
"value": "Domain Administrator"
},
"registrant_org": {
"value": "DomainTools, LLC"
},
"registrar": {
"value": "ENOM, INC."
},
"registrar_status": [
"client transfer prohibited"
],
"spf_info": "",
"ssl_info": [
{
"hash": {
"value": "11fc54c990c58d66f986320c9bc72052f541fe92"
},
"subject": {
"value": "CN=www.domaintools.com"
},
"organization": {
"value": ""
},
"email": [],
"alt_names": [
{
"value": "www.domaintools.com"
},
{
"value": "blog.domaintools.com"
},
{
"value": "domaintools.com"
}
],
"sources": {
"active": 1764613130569,
"passive": 1759158600086
},
"common_name": {
"value": "www.domaintools.com"
},
"issuer_common_name": {
"value": "Sectigo Public Server Authentication CA DV R36"
},
"not_after": {
"value": 20260919
},
"not_before": {
"value": 20250820
},
"duration": {
"value": 396
}
}
],
"tld": "com",
"website_response": 200,
"data_updated_timestamp": "2025-12-03T16:37:56.267000",
"website_title": {
"value": "DomainTools - The first place to go when you need to know."
},
"server_type": {
"value": "cloudflare"
},
"first_seen": {
"value": "2001-10-26T00:00:00Z"
},
"tags": [],
"parsed_whois": {
"admin_contact": {
"country": {
"value": "REDACTED FOR PRIVACY"
},
"street": {
"value": "REDACTED FOR PRIVACY"
},
"postal": {
"value": "REDACTED FOR PRIVACY"
},
"city": {
"value": "REDACTED FOR PRIVACY"
},
"org": {
"value": "REDACTED FOR PRIVACY"
},
"state": {
"value": "REDACTED FOR PRIVACY"
},
"name": {
"value": "REDACTED FOR PRIVACY"
},
"email": [
{
"value": "redacted for privacy"
}
]
},
"technical_contact": {
"country": {
"value": "REDACTED FOR PRIVACY"
},
"street": {
"value": "REDACTED FOR PRIVACY"
},
"postal": {
"value": "REDACTED FOR PRIVACY"
},
"city": {
"value": "REDACTED FOR PRIVACY"
},
"org": {
"value": "REDACTED FOR PRIVACY"
},
"state": {
"value": "REDACTED FOR PRIVACY"
},
"name": {
"value": "REDACTED FOR PRIVACY"
},
"email": [
{
"value": "redacted for privacy"
}
]
},
"registrant_contact": {
"country": {
"value": "us"
},
"street": {
"value": "2101 4th Ave"
},
"fax": {
"value": "12068389056"
},
"postal": {
"value": "98121"
},
"city": {
"value": "Seattle"
},
"org": {
"value": "DomainTools, LLC"
},
"state": {
"value": "WA"
},
"phone": {
"value": "12068389035"
},
"name": {
"value": "Domain Administrator"
},
"email": [
{
"value": "memberservices@domaintools.com"
}
]
},
"registrar": {
"value": "eNom, LLC"
},
"expiration_date": {
"value": "2027-08-01"
},
"additional_whois_email": [
{
"value": "abuse@enom.com"
}
],
"create_date": {
"value": "1998-08-02"
},
"registrant_name": {
"value": "Domain Administrator"
},
"registrant_org": {
"value": "DomainTools, LLC"
},
"registrar_status": [
"clienttransferprohibited"
],
"email_domain": [
{
"value": "enom.com"
},
{
"value": "nsone.net"
}
]
},
"parsed_domain_rdap": {
"registrant_contact": {
"country": {
"value": "US"
},
"street": {
"value": "2101 4th Ave Suite 1720"
},
"postal": {
"value": "98121"
},
"city": {
"value": "Seattle"
},
"org": {
"value": "DomainTools, LLC"
},
"state": {
"value": "WA"
},
"phone": {
"value": "tel:+1.2068389035"
},
"name": {
"value": "Domain Administrator"
},
"email": [
{
"value": "memberservices@domaintools.com"
}
]
},
"registrant_name": {
"value": "Domain Administrator"
},
"registrant_org": {
"value": "DomainTools, LLC"
},
"registrar_iana_id": {
"value": "48"
},
"additional_whois_email": [
{
"value": "abuse@enom.com"
}
],
"registrar": {
"value": "ENOM, INC."
},
"create_date": {
"value": "1998-08-02"
},
"registrar_status": [
"client transfer prohibited"
],
"expiration_date": {
"value": "2027-08-01"
},
"email_domain": [
{
"value": "enom.com"
},
{
"value": "nsone.net"
},
{
"value": "domaintools.com"
}
]
}
},
{
"domain": "example.com",
"whois_url": "https://whois.domaintools.com/example.com",
"adsense": {
"value": ""
},
"alexa": 26830,
"popularity_rank": 299,
"active": true,
"google_analytics": {
"value": ""
},
"ga4": [],
"gtm_codes": [],
"fb_codes": [],
"hotjar_codes": [],
"baidu_codes": [],
"yandex_codes": [],
"matomo_codes": [],
"statcounter_project_codes": [],
"statcounter_security_codes": [],
"admin_contact": {
"name": {
"value": ""
},
"org": {
"value": ""
},
"street": {
"value": ""
},
"city": {
"value": ""
},
"state": {
"value": ""
},
"postal": {
"value": ""
},
"country": {
"value": ""
},
"phone": {
"value": ""
},
"fax": {
"value": ""
},
"email": []
},
"billing_contact": {
"name": {
"value": ""
},
"org": {
"value": ""
},
"street": {
"value": ""
},
"city": {
"value": ""
},
"state": {
"value": ""
},
"postal": {
"value": ""
},
"country": {
"value": ""
},
"phone": {
"value": ""
},
"fax": {
"value": ""
},
"email": []
},
"registrant_contact": {
"name": {
"value": ""
},
"org": {
"value": "Internet Assigned Numbers Authority"
},
"street": {
"value": ""
},
"city": {
"value": ""
},
"state": {
"value": ""
},
"postal": {
"value": ""
},
"country": {
"value": ""
},
"phone": {
"value": ""
},
"fax": {
"value": ""
},
"email": []
},
"technical_contact": {
"name": {
"value": ""
},
"org": {
"value": ""
},
"street": {
"value": ""
},
"city": {
"value": ""
},
"state": {
"value": ""
},
"postal": {
"value": ""
},
"country": {
"value": ""
},
"phone": {
"value": ""
},
"fax": {
"value": ""
},
"email": []
},
"create_date": {
"value": "1992-01-01"
},
"expiration_date": {
"value": "2026-08-13"
},
"email_domain": [
{
"value": "icann.org"
}
],
"soa_email": [
{
"value": "noc.dns@icann.org"
}
],
"ssl_email": [],
"additional_whois_email": [],
"ip": [
{
"address": {
"value": "23.215.0.136"
},
"asn": [
{
"value": 20940
}
],
"country_code": {
"value": "us"
},
"isp": {
"value": "Akamai Technologies Inc."
}
},
{
"address": {
"value": "23.215.0.138"
},
"asn": [
{
"value": 20940
}
],
"country_code": {
"value": "us"
},
"isp": {
"value": "Akamai Technologies Inc."
}
}
],
"mx": [],
"name_server": [
{
"host": {
"value": "a.iana-servers.net"
},
"domain": {
"value": "iana-servers.net"
},
"ip": [
{
"value": "199.43.135.53"
}
]
},
{
"host": {
"value": "b.iana-servers.net"
},
"domain": {
"value": "iana-servers.net"
},
"ip": [
{
"value": "199.43.133.53"
}
]
}
],
"domain_risk": {
"risk_score": 1,
"components": [
{
"name": "proximity",
"risk_score": 1
}
]
},
"redirect": {
"value": ""
},
"redirect_domain": {
"value": ""
},
"registrant_name": {
"value": ""
},
"registrant_org": {
"value": "Internet Assigned Numbers Authority"
},
"registrar": {
"value": "RESERVED-Internet Assigned Numbers Authority"
},
"registrar_status": [
"clientdeleteprohibited",
"clienttransferprohibited",
"clientupdateprohibited"
],
"spf_info": "",
"ssl_info": [
{
"hash": {
"value": "310db7af4b2bc9040c8344701aca08d0c69381e3"
},
"subject": {
"value": "CN=*.example.com,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US"
},
"organization": {
"value": "Internet Corporation for Assigned Names and Numbers"
},
"email": [],
"alt_names": [
{
"value": "*.example.com"
},
{
"value": "example.com"
}
],
"sources": {
"active": 1763429847000
},
"common_name": {
"value": "*.example.com"
},
"issuer_common_name": {
"value": "DigiCert Global G3 TLS ECC SHA384 2020 CA1"
},
"not_after": {
"value": 20260115
},
"not_before": {
"value": 20250115
},
"duration": {
"value": 366
}
}
],
"tld": "com",
"website_response": 200,
"data_updated_timestamp": "2025-12-03T16:37:01.621000",
"website_title": {
"value": "Example Domain"
},
"server_type": {
"value": "ECS (laa/7BA2)"
},
"first_seen": {
"value": "2002-01-07T00:00:00Z"
},
"tags": [],
"parsed_whois": {
"registrant_contact": {
"org": {
"value": "Internet Assigned Numbers Authority"
}
},
"registrar": {
"value": "RESERVED-Internet Assigned Numbers Authority"
},
"expiration_date": {
"value": "2026-08-13"
},
"create_date": {
"value": "1992-01-01"
},
"registrant_org": {
"value": "Internet Assigned Numbers Authority"
},
"registrar_status": [
"clientdeleteprohibited",
"clienttransferprohibited",
"clientupdateprohibited"
],
"email_domain": [
{
"value": "icann.org"
}
]
},
"parsed_domain_rdap": {
"registrar_iana_id": {
"value": "376"
},
"registrar": {
"value": "RESERVED-Internet Assigned Numbers Authority"
},
"create_date": {
"value": "1995-08-14"
},
"registrar_status": [
"client delete prohibited",
"client transfer prohibited",
"client update prohibited"
],
"expiration_date": {
"value": "2025-08-13"
},
"email_domain": [
{
"value": "icann.org"
}
]
}
}
],
"missing_domains": []
}
}
Note the key differences when parsed_whois=true and parsed_domain_rdap=true are included:
- Each domain result includes
parsed_whoisandparsed_domain_rdapobjects - The
parsed_domain_rdapobject includes theregistrar_iana_idfield - WHOIS data may show "REDACTED FOR PRIVACY" for privacy-protected domains
- RDAP data typically provides more structured and complete registration information