Work with domain tags in the Iris Investigate API
Search for domains that have already been tagged within the Iris Investigate UI. All Tags created within your instance of the Iris Investigate UI are accessible via the API.
Use Domain Tags as a Search Parameter
Section titled “Use Domain Tags as a Search Parameter”Use tagged_with_any and tagged_with_all to perform base searches on tags:
| Use Case | Sample Parameter | Expected Result |
|---|---|---|
| Retrieve Domains matching one of the specified Tags | ?tagged_with_any=watch,monitor | All Domains which have been tagged as ‘watch’ OR ‘monitor’ |
| Retrieve Domains matching a list of Tags | ?tagged_with_all=block,dangerous,evil | All Domains which have been tagged with all 3 tags – ‘block’ and ‘dangerous’ and ‘evil’ |
Examples
Section titled “Examples”Search for domains tagged with either “watch” or “monitor”:
https://api.domaintools.com/v1/iris-investigate/?tagged_with_any=watch,monitorSearch for domains tagged with all three tags:
https://api.domaintools.com/v1/iris-investigate/?tagged_with_all=block,dangerous,evilUse Domain Tags as a Search Filter
Section titled “Use Domain Tags as a Search Filter”Limit base results by filtering for tagged domains:
| Use Case | Sample Parameter | Expected Result |
|---|---|---|
| Filter result sets by only displaying Domains matching one of the specified ‘Tags’ | ?nameserver_domain=markmonitor.zone&tagged_with_any=watch,monitor | Only list Domains which are tagged as ‘watch’ OR ‘monitor’ |
| Filter result sets by only displaying Domains matching a List of ‘Tags’ | ?nameserver_domain=markmonitor.zone&tagged_with_all=block,dangerous,evil | Only list Domains which are tagged with all 3 tags – ‘watch’ and ‘dangerous’ and ‘evil’ |
| Filter result sets by excluding domains matching one of the specified ‘Tags’ | ?nameserver_domain=markmonitor.zone¬_tagged_with_any=watch,monitor | Only list Domains which are not tagged with ‘watch’ or ‘monitor’ |
| Filter result sets by excluding domains matching a List of ‘Tags’ | ?nameserver_domain=markmonitor.zone¬_tagged_with_all=zerolisted,safe,trusted | Only list Domains which are not tagged as ‘zerolisted’ and ‘safe’ and ‘trusted’ |
Examples
Section titled “Examples”Filter nameserver search to only show domains tagged as “watch” or “monitor”:
https://api.domaintools.com/v1/iris-investigate/?nameserver_domain=markmonitor.zone&tagged_with_any=watch,monitorFilter nameserver search to exclude domains tagged as safe:
https://api.domaintools.com/v1/iris-investigate/?nameserver_domain=markmonitor.zone¬_tagged_with_any=safe,trustedTag Parameters Reference
Section titled “Tag Parameters Reference”| Parameter | Type | Description |
|---|---|---|
tagged_with_any | Base search or filter | Domains tagged with any of the specified tags (OR logic) |
tagged_with_all | Base search or filter | Domains tagged with all of the specified tags (AND logic) |
not_tagged_with_any | Filter only | Domains not tagged with any of the specified tags |
not_tagged_with_all | Filter only | Domains not tagged with all of the specified tags |
See Also
Section titled “See Also”- Base Search Parameters - Complete list of search parameters
- Filter Parameters - Complete list of filter parameters
- Search Overview - Learn about search capabilities