Lookup + Monitor OpenAPI Specification¶
Note
View this specification or browse all our OpenAPI specifications on Swagger API Hub.
openapi: 3.0.3
info:
title: DomainTools Lookup and Monitor API
version: 1.0.0
description: |
The OpenAPI spec for DomainTools Lookup, Reversing, and Monitoring endpoints.
contact:
name: DomainTools Support
url: https://www.domaintools.com/support
email: enterprisesupport@domaintools.com
license:
name: MIT
termsOfService: https://www.domaintools.com/company/terms-of-service/
servers:
- url: https://api.domaintools.com
description: DomainTools APIs
security:
- header_auth: []
- open_key_auth: []
- hmac_auth: []
tags:
- name: Information
description: |
Access the latest information about your account, including service limits.
- name: Lookups
description: |
Endpoints for retrieving detailed information about domains and IPs, and for finding connections between domains and infrastructure.
- name: Monitors
description: |
Endpoints for monitoring new domain registrations, changes to IP ranges, and other key infrastructure events based on specific terms.
paths:
/v1/account/:
get:
operationId: getAccountInfo
summary: Account Information
description: Information of the active API endpoints, rate limits and usage for an account.
tags:
- Information
parameters:
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/AccountSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/general/account_information/
/v1/{domain}/:
get:
operationId: getDomainProfile
summary: Domain Profile
description: Basic registrant, server, and registration data for a domain name, plus preview data for other products.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainPath'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/DomainProfileSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
/v1/{domain}/hosting-history/:
get:
operationId: getHostingHistory
summary: Hosting History
description: |
Provides the registrar, IP and name server history for a domain name.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainPath'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/HostingHistorySuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/hosting_history/
/v1/{domain}/rdap/parsed/:
get:
operationId: getParsedDomainRdap
summary: Parsed Domain RDAP
description: Returns the most recent Domain-RDAP registration record.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainPath'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
responses:
'200':
$ref: '#/components/responses/ParsedDomainRdapSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/parsed_rdap/
/v1/{query}/whois/:
get:
operationId: getWhoisLookup
summary: WHOIS Lookup
description: WHOIS records for domain names and IP addresses.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainOrIpPath'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/WhoisLookupSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/whois_lookup/
/v1/{domain}/whois/history/:
get:
operationId: getWhoisHistory
summary: WHOIS History
description: Retrieve historical WHOIS records of a given domain name.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainPath'
- $ref: '#/components/parameters/whoisHistorySort'
- $ref: '#/components/parameters/resultsLimit'
- $ref: '#/components/parameters/resultsOffset'
- $ref: '#/components/parameters/whoisHistoryMode'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/WhoisHistorySuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/whois_history/
/v1/{query}/whois/parsed/:
get:
operationId: getParsedWhois
summary: Parsed WHOIS
description: Parsed results for WHOIS records for domain names and IP addresses.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainOrIpPath'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/ParsedWhoisSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/parsed_whois/
/v1/reputation/:
get:
operationId: getDomainReputation
summary: Domain Reputation
description: This functionality is superseded by the Domain Risk Score `/risk/` endpoint, which offers a more complete and robust evaluation and should be used for all new development.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainQueryRequired'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/DomainReputationSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/domain_reputation/
/v1/risk/:
get:
operationId: getDomainRiskScore
summary: Domain Risk Score
description: Provides risk scores and threat predictions based on DomainTools Proximity and Threat Profile algorithms.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainQueryRequired'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/DomainRiskScoreSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/domain_risk_score/
/v1/risk/evidence/:
get:
operationId: getRiskScoreEvidence
summary: Risk Score Evidence
description: Provides the reasons for a domain's risk score, categorized by evidence type.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainQueryRequired'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/RiskScoreEvidenceSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/domain_risk_score/
/v1/{ip}/host-domains/:
get:
operationId: getHostDomains
summary: Reverse IP
description: List of domains that share the same network host (IP Address).
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/ipAddressPath'
- $ref: '#/components/parameters/resultsLimit'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/ReverseIpSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/reverse_ip/
/v1/{nameServer}/name-server-domains/:
get:
operationId: getNameServerDomains
summary: Reverse Name Server
description: List of domains that share the same primary name server.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/nameServerPath'
- $ref: '#/components/parameters/resultsLimit'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/ReverseNameServerSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/reverse_nameserver/
/v1/{domain}/reverse-ip/:
get:
operationId: getReverseIpForDomain
summary: Reverse IP (from Domain)
description: List of domains that share the same IP address as the given domain.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainPath'
- $ref: '#/components/parameters/resultsLimit'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/ReverseIpSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/reverse_ip/
/v1/reverse-ip-whois/:
get:
operationId: getReverseIpWhois
summary: Reverse IP WHOIS
description: |
Provides a list of IP network ranges with WHOIS records that match a specific query.
NOTE: Either an `ip` or `query` parameter is required.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/ipQuery'
- $ref: '#/components/parameters/reverseIpWhoisQuery'
- $ref: '#/components/parameters/countryCode'
- $ref: '#/components/parameters/whoisServer'
- $ref: '#/components/parameters/includeTotalCount'
- $ref: '#/components/parameters/page'
- $ref: '#/components/parameters/ipVersion'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/ReverseIpWhoisSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/reverse_ip_whois/
/v1/reverse-whois/:
get:
operationId: getReverseWhois
summary: Reverse WHOIS
description: Provides a list of domain names with WHOIS records that match specific query terms.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/reverseWhoisTerms'
- $ref: '#/components/parameters/excludeTerms'
- $ref: '#/components/parameters/reverseWhoisScope'
- $ref: '#/components/parameters/reverseWhoisMode'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/ReverseWhoisSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/reverse_whois/
/v2/domain-search/:
get:
operationId: getDomainSearch
summary: Domain Search
description: Searches active and deleted domain names that match a query string.
tags:
- Lookups
parameters:
- $ref: '#/components/parameters/domainSearchQuery'
- $ref: '#/components/parameters/excludeQuery'
- $ref: '#/components/parameters/maxLength'
- $ref: '#/components/parameters/minLength'
- $ref: '#/components/parameters/hasHyphen'
- $ref: '#/components/parameters/hasNumber'
- $ref: '#/components/parameters/activeOnly'
- $ref: '#/components/parameters/deletedOnly'
- $ref: '#/components/parameters/anchorLeft'
- $ref: '#/components/parameters/anchorRight'
- $ref: '#/components/parameters/page'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/DomainSearchSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/lookups/domain_search/
/v1/ip-monitor/:
get:
operationId: getIpMonitor
summary: IP Monitor
description: Receive notifications for new and/or deleted domains on a given IP Address.
tags:
- Monitors
parameters:
- $ref: '#/components/parameters/ipAddressQuery'
- $ref: '#/components/parameters/daysBack'
- $ref: '#/components/parameters/page'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/IpMonitorSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/monitors/ip_monitor/
/v1/ip-registrant-monitor/:
get:
operationId: getIpRegistrantMonitor
summary: IP Registrant Monitor
description: Receive notification when specific people or organizations are allocated new IP ranges or have existing ranges de-allocated.
tags:
- Monitors
parameters:
- $ref: '#/components/parameters/ipRegistrantQuery'
- $ref: '#/components/parameters/countryCode'
- $ref: '#/components/parameters/whoisServer'
- $ref: '#/components/parameters/includeTotalCount'
- $ref: '#/components/parameters/page'
- $ref: '#/components/parameters/searchType'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/IpRegistrantMonitorSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/monitors/ip_registrant_monitor/
/v1/mark-alert/:
get:
operationId: getBrandMonitor
summary: Brand Monitor
description: Monitor new domain registrations for specific keywords.
tags:
- Monitors
parameters:
- $ref: '#/components/parameters/monitorQuery'
- $ref: '#/components/parameters/excludeTerms'
- $ref: '#/components/parameters/domainStatus'
- $ref: '#/components/parameters/daysBack'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/BrandMonitorSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/monitors/brand_monitor/
/v1/name-server-monitor/:
get:
operationId: getNameServerMonitor
summary: Name Server Monitor
description: Receive notification when there are new and/or deleted domains on a given Domain Name Server.
tags:
- Monitors
parameters:
- $ref: '#/components/parameters/nameServerQuery'
- $ref: '#/components/parameters/daysBack'
- $ref: '#/components/parameters/page'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/NameServerMonitorSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/monitors/name_server_monitor/
/v1/registrant-alert/:
get:
operationId: getRegistrantMonitor
summary: Registrant Monitor
description: Receive notification when specific people or organizations register, renew, or delete domain names.
tags:
- Monitors
parameters:
- $ref: '#/components/parameters/monitorQuery'
- $ref: '#/components/parameters/excludeTerms'
- $ref: '#/components/parameters/daysBack'
- $ref: '#/components/parameters/resultsLimit'
- $ref: '#/components/parameters/appPartner'
- $ref: '#/components/parameters/appName'
- $ref: '#/components/parameters/appVersion'
- $ref: '#/components/parameters/responseFormat'
responses:
'200':
$ref: '#/components/responses/RegistrantMonitorSuccess'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
'503':
$ref: '#/components/responses/ServiceUnavailable'
externalDocs:
url: https://docs.domaintools.com/api/monitors/registrant_monitor/
components:
parameters:
activeOnly:
in: query
name: active_only
description: Return only domains currently registered.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
anchorLeft:
in: query
name: anchor_left
description: Return only domains that start with the query term.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
anchorRight:
in: query
name: anchor_right
description: Return only domains that end with the query term.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
appName:
name: app_name
in: query
description: |
Appliance, module, or playbook, or any combination of these.
schema:
$ref: '#/components/schemas/IdentifierString'
appPartner:
name: app_partner
in: query
description: |
Your product name.
schema:
$ref: '#/components/schemas/IdentifierString'
appVersion:
name: app_version
in: query
description: |
Version of your integration/connector.
schema:
$ref: '#/components/schemas/IdentifierString'
countryCode:
in: query
name: country
description: |
Limits results to IP addresses allocated to an entity with a particular country.
Must be a valid ISO 3166-1 two-character country code.
schema:
type: string
pattern: ^[A-Z]{2}$
daysBack:
in: query
name: days_back
description: Search domains registered up to six days prior to the current date.
schema:
type: integer
minimum: 1
maximum: 6
deletedOnly:
in: query
name: deleted_only
description: Return only domains previously registered but not currently registered.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
domainOrIpPath:
in: path
name: query
description: A valid domain name or IP address.
required: true
schema:
type: string
domainPath:
in: path
name: domain
description: A valid domain name.
required: true
schema:
$ref: '#/components/schemas/ApexDomain'
domainQueryRequired:
in: query
name: domain
description: Required. A valid domain name.
required: true
schema:
$ref: '#/components/schemas/ApexDomain'
domainSearchQuery:
in: query
name: query
description: Terms to search for. Each term must be at least three characters long. Use spaces to separate multiple terms.
required: true
schema:
$ref: '#/components/schemas/BasicString'
domainStatus:
in: query
name: domain_status
description: Sets the scope of domain names to search. Defaults to searching both `new` and `on-hold` domains.
schema:
type: string
enum:
- new
- on-hold
excludeQuery:
in: query
name: exclude_query
description: Terms to exclude from matching. Each term must be at least three characters long. Use spaces to separate multiple terms.
schema:
$ref: '#/components/schemas/BasicString'
excludeTerms:
in: query
name: exclude
description: Domain names with these words will be excluded from the result set. For exclusions of multiple terms, use the `|` character as a separator.
schema:
$ref: '#/components/schemas/BasicString'
hasHyphen:
in: query
name: has_hyphen
description: Return results with hyphens in the domain name.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
hasNumber:
in: query
name: has_number
description: Return results with numbers in the domain name.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
includeTotalCount:
in: query
name: include_total_count
description: Returns the total number of results for a query. This should typically be used only for the first page of a large result set.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
ipAddressPath:
in: path
name: ip
description: The IP Address to query.
required: true
schema:
$ref: '#/components/schemas/IPv4Address'
ipAddressQuery:
in: query
name: query
description: The IP Address to query.
required: true
schema:
$ref: '#/components/schemas/IPv4Address'
ipQuery:
in: query
name: ip
description: IPv4 address the registered domain was last known to point to during an active DNS check.
schema:
$ref: '#/components/schemas/IPv4Address'
ipRegistrantQuery:
in: query
name: query
description: A space-separated list of free text query terms with support for `+` (must include), `-` (must not include), and `*` (prefix) modifiers.
required: true
schema:
$ref: '#/components/schemas/BasicString'
ipVersion:
in: query
name: ip_version
description: Limits the query search results to a particular IP version. If omitted, the default is IPv4.
schema:
type: integer
enum:
- 4
- 6
default: 4
maxLength:
in: query
name: max_length
description: Limit the maximum domain character count.
schema:
type: integer
maximum: 63
minLength:
in: query
name: min_length
description: Limit the minimum domain character count.
schema:
type: integer
minimum: 1
monitorQuery:
in: query
name: query
description: One or more terms, where the pipe character ( | ) may be used as a logical AND to require that all strings be present in order to match.
required: true
schema:
$ref: '#/components/schemas/BasicString'
nameServerPath:
in: path
name: nameServer
description: The name server hostname to query.
required: true
schema:
$ref: '#/components/schemas/Hostname'
nameServerQuery:
in: query
name: query
description: The name server hostname to query.
required: true
schema:
$ref: '#/components/schemas/Hostname'
resultsOffset:
name: offset
in: query
description: Specifies the starting point for the result set, used for paginating when the number of results exceeds the 'limit'. An offset of 0 starts from the first result.
schema:
type: integer
minimum: 0
page:
in: query
name: page
description: Sets the page of results to retrieve from the server (used in services that support pagination).
schema:
type: integer
minimum: 1
responseFormat:
name: format
in: query
description: |
Specifies the desired response format.
schema:
$ref: '#/components/schemas/ResponseFormat'
parsedDomainRdapFlag:
name: parsed_domain_rdap
in: query
description: |
Flag.
If set to `true`, includes the full parsed Domain RDAP record in the response.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
parsedWhoisFlag:
name: parsed_whois
in: query
description: |
Flag.
If set to 'true', includes the full parsed WHOIS record in the response.
schema:
$ref: '#/components/schemas/BooleanOptInFlag'
resultsLimit:
name: limit
in: query
description: |
Specify the maximum number of records to retrieve in an API query.
The maximum value is **100**.
schema:
type: integer
maximum: 100
minimum: 1
resultsPageSize:
name: page_size
in: query
description: |
Adjusts the number of results returned per page.
The default is 500. Use this parameter to request a smaller page size.
schema:
type: integer
minimum: 1
maximum: 500
reverseIpWhoisQuery:
name: query
in: query
description: |
A space-separated list of free text query terms with support for `+` (must include), `-` (must not include), and `*` (prefix) modifiers.
schema:
type: string
reverseWhoisMode:
in: query
name: mode
description: |
- `quote`: Returns the size and estimated price of the query.
- `purchase`: Returns the complete list of matching domain names.
schema:
type: string
enum:
- quote
- purchase
reverseWhoisScope:
in: query
name: scope
description: Sets the scope of the report to include only current WHOIS records, or to include both current and historic records.
schema:
type: string
enum:
- current
- historic
default: current
reverseWhoisTerms:
in: query
name: terms
description: One or more terms, where the pipe character `|` may be used as a logical AND to require that all strings be present in order to match.
required: true
schema:
$ref: '#/components/schemas/BasicString'
searchType:
in: query
name: search_type
description: Type of changes to return in the monitor results.
schema:
type: string
default: all
enum:
- all
- additions
- removals
- modifications
whoisHistoryMode:
in: query
name: mode
description: |
- `list` (default): Returns the historical records.
- `count`: Returns only the total count of historical records.
- `check_existence`: Returns a boolean indicating if history exists.
schema:
type: string
enum:
- list
- count
- check_existence
default: list
whoisHistorySort:
in: query
name: sort
description: Sort the records returned in either ascending or descending order by date.
schema:
type: string
enum:
- date_asc
- date_desc
whoisServer:
in: query
name: server
description: Limits results to ranges from a particular RIR WHOIS server.
schema:
type: string
enum:
- whois.arin.net
- whois.apnic.net
- whois.ripe.net
- whois.lacnic.net
- whois.afrinic.net
responses:
AccountSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/AccountInformation'
BrandMonitorSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/BrandMonitor'
DomainProfileSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/DomainProfile'
DomainReputationSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/DomainReputation'
DomainRiskScoreSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/DomainRiskScore'
DomainSearchSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/DomainSearch'
HostingHistorySuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/HostingHistory'
IpMonitorSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/IpMonitor'
IpRegistrantMonitorSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/IpRegistrantMonitor'
NameServerMonitorSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/NameServerMonitor'
ParsedDomainRdapSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ParsedDomainRdapResponse'
ParsedWhoisSuccess:
description: OK
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/ParsedWhoisDomain'
- $ref: '#/components/schemas/ParsedWhoisIp'
RegistrantMonitorSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/RegistrantMonitor'
ReverseIpSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ReverseIp'
ReverseIpWhoisSuccess:
description: OK
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/ReverseIpWhoisIp'
- $ref: '#/components/schemas/ReverseIpWhoisQuery'
ReverseNameServerSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ReverseNameServer'
ReverseWhoisSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ReverseWhois'
RiskScoreEvidenceSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/DomainRiskScoreEvidence'
WhoisHistorySuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/WhoisHistory'
WhoisLookupSuccess:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/WhoisLookup'
BadRequest:
description: '400: Bad Request. The request was invalid. The response will contain details about the error.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: '401: Unauthorized. API credentials are required and were not provided, or the provided credentials are not valid.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Forbidden:
description: '403: Forbidden. The API credentials provided do not have access to the requested resource or endpoint.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
NotFound:
description: '404: Not Found. The requested resource does not exist.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
InternalServerError:
description: '500: Internal Server Error. An unexpected error occurred on the server. If the problem persists, contact DomainTools support.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
ServiceUnavailable:
description: '503: Service Unavailable. The service is temporarily unavailable.'
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
schemas:
ApexDomain:
type: string
description: A base (apex) domain like example.com, excluding subdomains.
pattern: ^(?!\-)(?:[a-zA-Z0-9-]{1,63}\.)+[a-zA-Z]{2,63}$
BasicString:
type: string
minLength: 1
maxLength: 255
description: A non-empty string with a standard length limit.
BooleanOptInFlag:
type: boolean
description: |
An optional boolean flag that enables a specific feature or response extension when set to `true`. If `false` or omitted, the feature is ignored.
ErrorResponse:
type: object
properties:
error:
type: object
properties:
code:
type: integer
description: An internal error code.
message:
type: string
description: A human-readable error message.
FieldsCsvList:
type: string
description: A comma-separated list of the fields to surface in the response.
pattern: ^[a-zA-Z0-9_]+(,[a-zA-Z0-9_]+)*$
example: id,domain,create_date,risk_score
Hostname:
type: string
format: hostname
description: A valid, fully-qualified domain name (FQDN).
IdentifierString:
type: string
minLength: 1
maxLength: 128
description: A short identifier, code, or handle.
IPv4Address:
type: string
format: ipv4
description: A standard IPv4 address.
ResponseFormat:
type: string
enum:
- html
- json
- xml
description: |
The desired response format.
BrandMonitor:
type: object
description: Response for the Brand Monitor endpoint.
properties:
response:
type: object
properties:
query:
type: string
exclude:
type: string
new:
type: boolean
on-hold:
type: boolean
date:
type: string
total:
type: integer
alerts:
type: array
items:
type: object
properties:
domain:
type: string
status:
type: string
DomainProfile:
type: object
description: Response for the Domain Profile endpoint.
properties:
response:
type: object
properties:
registrant:
type: object
properties:
name:
type: string
domain:
type: integer
product_url:
type: string
server:
type: object
properties:
ip_address:
type: string
other_domains:
type: integer
product_url:
type: string
registration:
type: object
properties:
created:
type: string
expires:
type: string
updated:
type: string
registrar:
type: string
statuses:
type: array
items:
type: string
name_servers:
type: array
items:
type: object
properties:
server:
type: string
product_url:
type: string
history:
type: object
properties:
registrar:
type: object
properties:
earliest_event:
type: string
events:
type: integer
product_url:
type: string
name_server:
type: object
properties:
events:
type: integer
timespan_in_years:
type: integer
product_url:
type: string
ip_address:
type: object
properties:
events:
type: integer
timespan_in_years:
type: integer
product_url:
type: string
whois:
type: object
properties:
records:
type: integer
earliest_event:
type: string
product_url:
type: string
seo:
type: object
properties:
score:
type: integer
product_url:
type: string
website_data:
type: object
properties:
response_code:
type: integer
title:
type: string
server:
type: string
meta:
type: array
items:
type: string
product_url:
type: string
DomainReputation:
type: object
description: Response for the Domain Reputation endpoint.
properties:
response:
type: object
required:
- domain
- risk_score
properties:
domain:
$ref: '#/components/schemas/ApexDomain'
risk_score:
type: number
minimum: 0
maximum: 100
description: Domain risk score ranging from 0 (lowest risk) to 100 (highest risk). May include decimal values for more precise risk assessment.
example: 12.19
reasons:
type: array
description: Optional list of reasons contributing to the risk score. May not be present in all responses.
items:
type: string
DomainRiskScore:
type: object
properties:
response:
type: object
properties:
domain:
$ref: '#/components/schemas/ApexDomain'
risk_score:
$ref: '#/components/schemas/RiskScoreValue'
components:
type: array
items:
$ref: '#/components/schemas/DomainRiskComponent'
DomainRiskScoreEvidence:
type: object
description: Response for the Risk Score Evidence endpoint.
properties:
response:
type: object
required:
- domain
- risk_score
- components
properties:
domain:
$ref: '#/components/schemas/ApexDomain'
risk_score:
$ref: '#/components/schemas/RiskScoreValue'
components:
type: array
description: Array of risk components contributing to the overall score.
items:
$ref: '#/components/schemas/DomainRiskComponent'
DomainSearch:
type: object
description: Response for the Domain Search endpoint.
properties:
response:
type: object
properties:
query_info:
type: object
properties:
active_only:
type: boolean
min_length:
type: integer
total_results:
type: integer
exclude_query:
type: string
has_hyphen:
type: boolean
max_length:
type: integer
anchor_right:
type: boolean
anchor_left:
type: boolean
page:
type: integer
limit:
type: integer
has_number:
type: boolean
deleted_only:
type: boolean
results:
type: array
items:
type: object
properties:
sld:
type: string
tlds:
type: array
items:
type: string
hashad_tlds:
type: array
items:
type: string
char_count:
type: integer
has_hyphen:
type: integer
has_deleted:
type: integer
has_number:
type: integer
tlds_count:
type: integer
has_active:
type: integer
HostingHistory:
type: object
description: Response for the Hosting History endpoint.
properties:
response:
type: object
properties:
domain_name:
type: string
ip_history:
type: array
items:
type: object
properties:
action:
type: string
action_in_words:
type: string
actiondate:
type: string
domain:
type: string
post_ip:
type: string
pre_ip:
type: string
nameserver_history:
type: array
items:
type: object
properties:
action:
type: string
action_in_words:
type: string
actiondate:
type: string
domain:
type: string
post_mns:
type: string
pre_mns:
type: string
registrar_history:
type: array
items:
type: object
properties:
date_created:
type: string
date_expires:
type: string
date_lastchecked:
type: string
date_updated:
type: string
domain:
type: string
registrar:
type: string
registrartag:
type: string
IpMonitor:
type: object
description: Response for the IP Monitor endpoint.
properties:
response:
type: object
properties:
limit:
type: integer
date:
type: string
ip_address:
type: string
total:
type: string
page:
type: integer
page_count:
type: integer
alerts:
type: array
items:
type: object
properties:
previous_ip_address:
type: string
new_ip_address:
type: string
action:
type: string
domain:
type: string
IpRegistrantMonitor:
type: object
description: Response for the IP Registrant Monitor endpoint.
properties:
response:
type: object
properties:
record_count:
type: integer
modified:
type: array
items:
type: string
page:
type: number
added:
type: array
items:
type: object
properties:
ip_to:
type: string
organization:
type: string
record_ip:
type: string
record_date:
type: string
range:
type: string
ip_from:
type: string
server:
type: string
country:
type: string
removed:
type: array
items:
type: object
properties:
ip_to:
type: string
record_ip:
type: string
record_date:
type: string
range:
type: string
ip_from:
type: string
organization:
type: string
server:
type: string
country:
type: string
has_more_pages:
type: string
date:
type: string
query:
type: string
NameServerMonitor:
type: object
description: Response for the Name Server Monitor endpoint.
properties:
response:
type: object
properties:
limit:
type: integer
date:
type: string
name_server:
type: string
total:
type: integer
page:
type: integer
page_count:
type: integer
alerts:
type: array
items:
type: object
properties:
new_name_server:
type: string
old_name_server:
type: string
action:
type: string
domain:
type: string
ParsedDomainRdapResponse:
type: object
description: Response for the Parsed Domain RDAP endpoint.
properties:
response:
type: object
required:
- domain_rdap
- parsed_domain_rdap
- record_source
properties:
domain_rdap:
type: array
description: Raw RDAP records from registry and/or registrar sources.
items:
type: object
required:
- source
- timestamp
- link
- record
properties:
source:
type: string
description: The source of the RDAP record.
enum:
- registry
- registrar
example: registry
timestamp:
type: string
format: date-time
description: ISO 8601 timestamp when the RDAP record was retrieved.
example: '2025-10-21T11:42:11Z'
link:
type: string
format: uri
description: URL of the RDAP server that provided the record.
example: https://rdap.verisign.com/com/v1/domain/domaintools.com
record:
type: string
description: The raw RDAP record as a JSON string.
parsed_domain_rdap:
type: object
description: Parsed and normalized RDAP data.
required:
- domain
properties:
domain:
type: string
description: The domain name.
example: domaintools.com
handle:
type: string
description: The registry-assigned unique identifier for this domain.
example: 1697312_DOMAIN_COM-VRSN
domain_statuses:
type: array
description: Current status codes for the domain.
items:
type: string
example:
- client transfer prohibited
creation_date:
type: string
format: date-time
description: ISO 8601 timestamp of when the domain was registered.
example: '1998-08-02T04:00:00+00:00'
last_changed_date:
type: string
format: date-time
description: ISO 8601 timestamp of the last modification to the domain record.
example: '2020-01-09T23:06:29+00:00'
expiration_date:
type: string
format: date-time
description: ISO 8601 timestamp when the domain registration expires.
example: '2027-08-01T04:00:00+00:00'
registrar:
type: object
description: Information about the domain registrar.
properties:
name:
type: string
description: Name of the registrar.
example: eNom, LLC
iana_id:
type: string
description: IANA-assigned registrar ID.
example: '48'
contacts:
type: array
description: Registrar contact information.
items:
type: object
properties:
name:
type: string
description: Contact name.
org:
type: string
description: Organization name.
email:
type: string
description: Contact email address.
phone:
type: string
description: Contact phone number.
roles:
type: array
description: The roles this contact performs.
items:
type: string
enum:
- abuse
- technical
- administrative
- billing
example:
- abuse
contacts:
type: array
description: Domain contact information from RDAP.
items:
type: object
properties:
handle:
type: string
description: Unique identifier for this contact.
name:
type: string
description: Contact name. May be redacted for privacy.
org:
type: string
description: Organization name.
email:
type: string
description: Contact email address. May be redacted or a privacy service URL.
phone:
type: string
description: Contact phone number.
fax:
type: string
description: Contact fax number.
street:
type: string
description: Street address.
city:
type: string
description: City.
postal:
type: string
description: Postal code.
region:
type: string
description: State or region.
country:
type: string
description: Two-character ISO 3166-1 country code.
roles:
type: array
description: The roles this contact performs for the domain.
items:
type: string
enum:
- registrant
- administrative
- technical
- billing
example:
- registrant
dnssec:
type: object
description: DNSSEC status information.
properties:
signed:
type: boolean
description: Whether DNSSEC is enabled for the domain.
example: false
nameservers:
type: array
description: List of nameserver hostnames for the domain.
items:
type: string
example:
- DNS1.P04.NSONE.NET.
- DNS2.P04.NSONE.NET.
conformance:
type: array
description: RDAP conformance levels supported.
items:
type: string
example:
- rdap_level_0
- icann_rdap_technical_implementation_guide_1
emails:
type: array
description: All email addresses found in the RDAP record.
items:
type: string
example:
- abuse@enom.com
- memberservices@domaintools.com
email_domains:
type: array
description: Unique email domains extracted from email addresses.
items:
type: string
example:
- domaintools.com
- enom.com
unclassified_emails:
type: array
description: Email addresses that don't fit standard contact categories.
items:
type: string
example: []
record_source:
type: string
description: The domain name that was queried.
example: domaintools.com
ParsedWhoisDomain:
type: object
description: Response for the Parsed WHOIS (Domain) endpoint.
properties:
response:
type: object
required:
- registration
- name_servers
- whois
- parsed_whois
- record_source
properties:
registrant:
type: string
description: Registrant organization name (if available).
example: GitHub, Inc.
registration:
type: object
description: Basic registration information.
required:
- created
- expires
- updated
- registrar
- statuses
properties:
created:
type: string
format: date
description: Date the domain was created.
example: '2007-10-09'
expires:
type: string
format: date
description: Date the domain registration expires.
example: '2026-10-09'
updated:
type: string
format: date
description: Date the domain record was last updated.
example: '2024-09-07'
registrar:
type: string
description: Name of the registrar.
example: MarkMonitor Inc.
statuses:
type: array
description: Domain status codes.
items:
type: string
example:
- clientDeleteProhibited
- clientTransferProhibited
- clientUpdateProhibited
name_servers:
type: array
description: List of nameserver hostnames for the domain.
items:
type: string
example:
- DNS1.P08.NSONE.NET
- DNS2.P08.NSONE.NET
whois:
type: object
description: Raw WHOIS record information.
required:
- date
- record
properties:
date:
type: string
format: date
description: Date the WHOIS record was retrieved.
example: '2025-10-26'
record:
type: string
description: The raw WHOIS record text.
parsed_whois:
type: object
description: Parsed and normalized WHOIS data.
required:
- domain
- created_date
- updated_date
- expired_date
- statuses
- name_servers
- registrar
- contacts
properties:
domain:
type: string
description: The domain name.
example: github.com
created_date:
type: string
format: date-time
description: ISO 8601 timestamp of when the domain was created.
example: '2007-10-09T18:20:50+00:00'
updated_date:
type: string
format: date-time
description: ISO 8601 timestamp of when the domain was last updated.
example: '2024-09-07T09:16:33+00:00'
expired_date:
type: string
format: date-time
description: ISO 8601 timestamp of when the domain registration expires.
example: '2026-10-09T00:00:00+00:00'
statuses:
type: array
description: Domain status codes.
items:
type: string
example:
- clientDeleteProhibited
- clientTransferProhibited
name_servers:
type: array
description: List of nameserver hostnames.
items:
type: string
example:
- dns1.p08.nsone.net
- dns2.p08.nsone.net
registrar:
type: object
description: Registrar information.
properties:
name:
type: string
description: Name of the registrar.
example: MarkMonitor, Inc.
abuse_contact_phone:
type: string
description: Registrar abuse contact phone number.
example: '+1.2086851750'
abuse_contact_email:
type: string
description: Registrar abuse contact email.
example: abusecomplaints@markmonitor.com
iana_id:
type: string
description: IANA registrar ID.
example: '292'
url:
type: string
format: uri
description: Registrar website URL.
example: http://www.markmonitor.com
whois_server:
type: string
description: Registrar WHOIS server hostname.
example: whois.markmonitor.com
contacts:
type: object
description: Domain contact information organized by role.
properties:
registrant:
$ref: '#/components/schemas/ParsedWhoisContact'
admin:
$ref: '#/components/schemas/ParsedWhoisContact'
tech:
$ref: '#/components/schemas/ParsedWhoisContact'
billing:
$ref: '#/components/schemas/ParsedWhoisContact'
other_properties:
type: object
description: Additional properties from the WHOIS record that don't fit standard fields.
additionalProperties: true
example:
dnssec: unsigned
registry_domain_id: 1264983250_DOMAIN_COM-VRSN
record_source:
type: string
description: The domain name that was queried.
example: github.com
ParsedWhoisContact:
type: object
description: Contact information from a WHOIS record.
properties:
name:
type: string
description: Contact name.
org:
type: string
description: Organization name.
street:
type: array
description: Street address lines.
items:
type: string
city:
type: string
description: City.
state:
type: string
description: State or region.
postal:
type: string
description: Postal code.
country:
type: string
description: Country code.
phone:
type: string
description: Phone number.
fax:
type: string
description: Fax number.
email:
type: string
description: Email address.
ParsedWhoisIp:
type: object
description: Response for the Parsed WHOIS (IP) endpoint.
properties:
response:
type: object
required:
- whois
- source
- parsed_whois
- record_source
properties:
registrant:
type: string
description: Top-level organization name for the IP range.
example: NearlyFreeSpeech.NET (NFSNI-1)
whois:
type: object
description: Raw WHOIS record information.
required:
- date
- record
properties:
date:
type: string
format: date
description: Date the WHOIS record was retrieved.
example: '2025-10-16'
record:
type: string
description: The raw WHOIS record text.
source:
type: string
description: The Regional Internet Registry (RIR) source of the WHOIS data.
enum:
- ARIN
- RIPE
- APNIC
- LACNIC
- AFRINIC
example: ARIN
parsed_whois:
type: object
description: Parsed and normalized IP WHOIS data.
required:
- networks
- contacts
properties:
networks:
type: array
description: IP network blocks and their allocation details.
items:
$ref: '#/components/schemas/ParsedWhoisIpNetwork'
contacts:
type: array
description: Organizations and persons associated with the networks.
items:
$ref: '#/components/schemas/ParsedWhoisIpContact'
routes:
type: array
description: Routing information (typically empty).
items:
type: object
referral_servers:
type: array
description: Referral server information (typically empty).
items:
type: string
other_properties:
type: array
description: Additional properties from the WHOIS record.
items:
type: object
record_source:
type: string
description: The IP address that was queried.
example: 208.94.117.131
ParsedWhoisIpNetwork:
type: object
description: IP network block information from WHOIS.
properties:
id:
type: string
description: Network identifier/handle.
example: NET-208-94-116-0-1
range:
type: object
description: IP address range information.
properties:
from:
type: string
description: Starting IP address.
example: 208.94.116.0
to:
type: string
description: Ending IP address.
example: 208.94.119.255
cidr:
type: array
description: CIDR notation for the range.
items:
type: string
example:
- 208.94.116.0/22
count:
type: integer
description: Number of IP addresses in the range.
example: 1024
asn:
type: array
description: Autonomous System Numbers.
items:
type: string
name:
type: string
description: Network name.
example: GF-PHX-IPV4-1
org:
type: string
description: Organization name and ID.
example: GridFury, LLC (CELL-1)
parent:
type: string
description: Parent network name and ID.
example: NET208 (NET-208-0-0-0-0)
parent_id:
type: string
description: Parent network ID.
example: NET-208-0-0-0-0
customer:
type: string
description: Customer information.
country:
type: string
description: Country code.
phone:
type: array
description: Contact phone numbers.
items:
type: string
descr:
type: array
description: Description or comments.
items:
type: string
example:
- http://www.gridfury.com/
contact_keys:
type: object
description: References to contact IDs by role.
additionalProperties:
type: array
items:
type: string
example:
org:
- CELL-1
tech:
- GNO70-ARIN
abuse:
- GNAT1-ARIN
status:
type: string
description: Network allocation status.
example: Direct Allocation
remarks:
type: array
description: Additional remarks.
items:
type: string
notify_email:
type: array
description: Notification email addresses.
items:
type: string
mnt_keys:
type: object
description: Maintainer keys.
additionalProperties: true
created_date:
type: string
format: date-time
description: Date the network was created.
example: '2008-08-28T00:00:00'
updated_date:
type: string
format: date-time
description: Date the network was last updated.
example: '2019-05-31T00:00:00'
changed_by:
type: array
description: Change history.
items:
type: string
source:
type: string
description: Data source.
ref:
type: string
format: uri
description: Reference URL for this network.
example: https://rdap.arin.net/registry/ip/208.94.116.0
other:
type: object
description: Additional properties.
additionalProperties: true
ParsedWhoisIpContact:
type: object
description: Contact information from IP WHOIS record.
properties:
id:
type: string
description: Contact identifier/handle.
example: NFSNI-1
type:
type: string
description: Contact type.
enum:
- organization
- person
example: organization
name:
type: string
description: Contact name.
example: NearlyFreeSpeech.NET
address:
type: array
description: Postal address lines.
items:
type: string
example:
- 1540 INTERNATIONAL PKWY STE 2000
- LAKE MARY
- FL
- '32746'
country:
type: string
description: Country code (lowercase).
example: us
phone:
type: array
description: Phone numbers.
items:
type: string
example:
- '18887414678'
fax:
type: array
description: Fax numbers.
items:
type: string
email:
type: array
description: Email addresses.
items:
type: string
example:
- noc@nearlyfreespeech.net
descr:
type: array
description: Description or comments.
items:
type: string
contact_keys:
type: object
description: References to other contact IDs by role.
additionalProperties:
type: array
items:
type: string
remarks:
type: array
description: Additional remarks.
items:
type: string
notify_email:
type: array
description: Notification email addresses.
items:
type: string
abuse_mailbox:
type: array
description: Abuse reporting email addresses.
items:
type: string
mnt_keys:
type: object
description: Maintainer keys.
additionalProperties: true
created_date:
type: string
format: date-time
description: Date the contact was created.
example: '2008-02-01T00:00:00'
updated_date:
type: string
format: date-time
description: Date the contact was last updated.
example: '2018-05-22T00:00:00'
changed_by:
type: array
description: Change history.
items:
type: string
source:
type: string
description: Data source.
ref:
type: string
format: uri
description: Reference URL for this contact.
example: https://rdap.arin.net/registry/entity/NFSNI-1
other:
type: object
description: Additional properties.
additionalProperties: true
RegistrantMonitor:
type: object
description: Response for the Registrant Monitor endpoint.
properties:
response:
type: object
properties:
query:
type: string
limit:
type: number
total:
type: number
date:
type: string
alerts:
type: array
items:
type: object
properties:
domain:
type: string
match_type:
type: string
current_owner:
type: string
created:
type: string
modified:
type: string
last_owner:
type: string
ReverseIp:
type: object
description: Response for the Reverse IP endpoint.
properties:
response:
type: object
properties:
ip_addresses:
type: array
items:
type: object
properties:
domain_count:
type: integer
domain_names:
type: array
items:
type: string
ip_address:
type: string
ReverseIpWhoisIp:
type: object
description: Response for the Reverse IP WHOIS (IP) endpoint.
properties:
response:
type: object
properties:
ip_from:
type: string
ip_to:
type: string
ip_from_alloc:
type: string
ip_to_alloc:
type: string
record_ip:
type: string
record_date:
type: string
server:
type: string
organization:
type: string
country:
type: string
range:
type: string
whois_record:
type: string
ReverseIpWhoisQuery:
type: object
description: Response for the Reverse IP WHOIS (Query) endpoint.
properties:
response:
type: object
properties:
has_more_pages:
type: boolean
page:
type: integer
total_count:
type: integer
record_count:
type: integer
records:
type: array
items:
type: object
properties:
ip_from:
type: string
ip_to:
type: string
record_ip:
type: string
record_date:
type: string
server:
type: string
organization:
type: string
country:
type: string
range:
type: string
ReverseNameServer:
type: object
description: Response for the Reverse Name Server endpoint.
properties:
response:
type: object
properties:
name_server:
type: object
properties:
hostname:
type: string
primary:
type: integer
secondary:
type: string
total:
type: integer
primary_domains:
type: array
items:
type: string
secondary_domains:
type: array
items:
type: string
ReverseWhois:
type: object
description: Response for the Reverse WHOIS endpoint.
properties:
response:
type: object
properties:
domain_count:
type: object
properties:
current:
type: integer
historic:
type: integer
domains:
type: array
items:
type: string
report_price:
type: object
properties:
current:
type: integer
historic:
type: integer
WhoisHistory:
type: object
description: Response for the WHOIS History endpoint.
properties:
response:
type: object
properties:
record_count:
type: number
history:
type: array
items:
type: object
properties:
date:
type: string
is_private:
type: string
whois:
type: object
properties:
registrant:
type: string
registration:
type: object
properties:
created:
type: string
expires:
type: string
registrar:
type: string
statuses:
type: array
items:
type: string
name_servers:
type: array
items:
type: string
server:
type: string
record:
type: string
WhoisLookup:
type: object
description: Response for the WHOIS Lookup endpoint.
properties:
response:
type: object
properties:
registrant:
type: string
registration:
type: object
properties:
created:
type: string
expires:
type: string
updated:
type: string
registrar:
type: string
statuses:
type: array
items:
type: string
name_servers:
type: array
items:
type: string
whois:
type: object
properties:
date:
type: string
record:
type: string
record_source:
type: string
AccountInformation:
type: object
description: Contains the account details and a list of product subscriptions.
properties:
response:
type: object
properties:
account:
type: object
description: Basic details about the API account.
properties:
api_username:
type: string
description: The username associated with the account.
example: api_user
active:
type: boolean
description: Indicates if the account is currently active.
example: true
products:
type: array
description: A list of product subscriptions including usage limits and expiration dates.
items:
type: object
description: Details for a single product subscription. Keys include id, rate limits, usage, and expiration_date.
example:
id: domain-profile
per_month_limit: '50000'
per_hour_limit: null
per_minute_limit: '120'
absolute_limit: null
usage:
today: '0'
month: '1'
expiration_date: '2027-12-30'
RiskScoreValue:
type: integer
minimum: 0
maximum: 100
description: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
Proximity:
type: object
required:
- name
- risk_score
properties:
name:
type: string
description: The type of risk component.
enum:
- proximity
risk_score:
$ref: '#/components/schemas/RiskScoreValue'
evidence:
type: array
description: Optional array of evidence types supporting the risk score for this component.
items:
type: string
example:
- dns
description: Indicates risk based on proximity to known threats or suspicious infrastructure.
ThreatProfile:
type: object
required:
- name
- risk_score
properties:
name:
type: string
description: The type of risk component.
enum:
- threat_profile
risk_score:
$ref: '#/components/schemas/RiskScoreValue'
evidence:
type: array
description: Optional array of evidence types supporting the risk score for this component.
items:
type: string
description: Indicates risk based on machine-learning models.
ThreatProfileMalware:
type: object
required:
- name
- risk_score
properties:
name:
type: string
description: The type of risk component.
enum:
- threat_profile_malware
risk_score:
$ref: '#/components/schemas/RiskScoreValue'
evidence:
type: array
description: Optional array of evidence types supporting the risk score for this component.
items:
type: string
description: Indicates risk based on a machine-learning model that classifies domains as malware-related.
ThreatProfilePhishing:
type: object
required:
- name
- risk_score
properties:
name:
type: string
description: The type of risk component.
enum:
- threat_profile_phishing
risk_score:
$ref: '#/components/schemas/RiskScoreValue'
evidence:
type: array
description: Optional array of evidence types supporting the risk score for this component.
items:
type: string
description: Indicates risk based on a machine-learning model that classifies domains as phishing-related.
ThreatProfileSpam:
type: object
required:
- name
- risk_score
properties:
name:
type: string
description: The type of risk component.
enum:
- threat_profile_spam
risk_score:
$ref: '#/components/schemas/RiskScoreValue'
evidence:
type: array
description: Optional array of evidence types supporting the risk score for this component.
items:
type: string
description: Indicates risk based on a machine-learning model that classifies domains as spam-related.
ZeroListedScore:
type: object
required:
- name
- risk_score
properties:
name:
type: string
description: The type of risk component.
enum:
- zerolist
risk_score:
type: integer
description: The risk score for a zerolisted domain, which is always 0.
enum:
- 0
description: Indicates the domain is on a known-good 'zero list' and is not considered a threat.
DomainRiskComponent:
description: A polymorphic schema representing one of several types of risk components.
oneOf:
- $ref: '#/components/schemas/Proximity'
- $ref: '#/components/schemas/ThreatProfile'
- $ref: '#/components/schemas/ThreatProfileMalware'
- $ref: '#/components/schemas/ThreatProfilePhishing'
- $ref: '#/components/schemas/ThreatProfileSpam'
- $ref: '#/components/schemas/ZeroListedScore'
discriminator:
propertyName: name
mapping:
proximity: '#/components/schemas/Proximity'
threat_profile: '#/components/schemas/ThreatProfile'
threat_profile_malware: '#/components/schemas/ThreatProfileMalware'
threat_profile_phishing: '#/components/schemas/ThreatProfilePhishing'
threat_profile_spam: '#/components/schemas/ThreatProfileSpam'
zerolist: '#/components/schemas/ZeroListedScore'
examples:
DomainHistoryDefaultResponse:
summary: Default response (parsed_whois)
value:
response:
domain: domaintools.com
count: 2480
registration_source: parsed_whois
next: https://api.domaintools.demo/v1/domain-history/?domain=domaintools.com&page_size=10&offset=10
changes:
- timestamp: '2025-10-15T09:30:30Z'
field: mx
before:
mx:
- host:
value: alt1.aspmx.l.google.com
domain:
value: null
ip:
- value: 142.250.101.26
priority: 5
- host:
value: aspmx2.googlemail.com
domain:
value: null
ip:
- value: 142.250.101.26
priority: 10
- host:
value: aspmx.l.google.com
domain:
value: null
ip:
- value: 142.250.99.26
priority: 1
- host:
value: alt2.aspmx.l.google.com
domain:
value: null
ip:
- value: 192.178.164.26
priority: 5
- host:
value: aspmx3.googlemail.com
domain:
value: null
ip:
- value: 192.178.164.27
priority: 10
- host:
value: aspmx4.googlemail.com
domain:
value: null
ip:
- value: 192.178.220.26
priority: 10
after:
mx:
- host:
value: alt1.aspmx.l.google.com
domain:
value: null
ip:
- value: 142.250.101.26
priority: 5
- host:
value: aspmx2.googlemail.com
domain:
value: null
ip:
- value: 142.250.101.26
priority: 10
- host:
value: alt2.aspmx.l.google.com
domain:
value: null
ip:
- value: 192.178.164.26
priority: 5
- host:
value: aspmx3.googlemail.com
domain:
value: null
ip:
- value: 192.178.164.27
priority: 10
- host:
value: aspmx4.googlemail.com
domain:
value: null
ip:
- value: 192.178.220.27
priority: 10
- host:
value: aspmx.l.google.com
domain:
value: null
ip:
- value: 74.125.142.27
priority: 1
DomainHistoryParsedDomainRdap:
summary: Response with parsed_domain_rdap enabled
value:
response:
domain: domaintools.com
count: 1534
registration_source: parsed_domain_rdap
next: https://api.domaintools.demo/v1/domain-history/?domain=domaintools.com&page_size=5&parsed_domain_rdap=true&offset=5
changes:
- timestamp: '2025-10-14T09:44:26Z'
field: mx
before:
mx:
- host:
value: aspmx2.googlemail.com
domain:
value: null
ip:
- value: 142.250.101.26
priority: 10
after:
mx:
- host:
value: alt1.aspmx.l.google.com
domain:
value: null
ip:
- value: 142.250.101.26
priority: 5
securitySchemes:
header_auth:
type: apiKey
in: header
name: X-Api-Key
description: |
A secure authentication method where the API key is provided in the `X-Api-Key` HTTP request header.
open_key_auth:
type: http
scheme: basic
description: |
A simple authentication scheme using your `api_username` as the username and your `api_key` as the password. We strongly recommend using HMAC or Header authentication instead to avoid exposing your credentials.
hmac_auth:
type: apiKey
in: query
name: signature
description: |
A secure scheme using a Hashed Message Authentication Code (HMAC).
This method requires three query parameters to be sent with the request:
1. `api_username`: Your API username.
2. `timestamp`: The current timestamp in ISO 8601 format (e.g., `2020-02-01T22:37:59Z`).
3. `signature`: The HMAC signature of the request. This is a hash (SHA-256 recommended) of your username, the timestamp, and the request URI, signed with your secret API key.