Developer Resources

Access OpenAPI specifications, automation tools, and integration resources for all DomainTools APIs.

Python SDK

The official Python SDK is a fast way to integrate DomainTools APIs into your applications.

• Python SDK Documentation
• GitHub Repository ↗ - Source code and examples
• PyPI Package ↗ - Latest releases

Available APIs

Quick links to get started:

• Iris Suite - Threat intelligence platform (investigation, enrichment, detection)
• Farsight DNSDB - Passive DNS database (300+ billion records)
• Farsight SIE - Real-time passive DNS feeds
• Lookup & Monitor - Domain research and monitoring tools
• Threat Feeds - Real-time and daily malicious infrastructure feeds

For complete API documentation, see individual product pages in the main navigation.

OpenAPI Specifications

View and interact with DomainTools API specifications using raw OpenAPI files, Swagger UI, or ReDoc viewers.

Iris Suite

Complete threat intelligence platform for investigation, enrichment, and detection.

Interactive References:

• API Reference (ReDoc) - Documentation-focused viewer
• API Reference (Swagger UI) - Try-it-out API explorer

Specifications:

• OpenAPI Specification - YAML/JSON spec file
• View on SwaggerHub - SwaggerHub project page

Documentation:

• Developer Guide - Authentication, rate limits, and guides

Farsight DNSDB

World's largest passive DNS database for threat hunting and investigation.

Interactive References:

• API Reference (Swagger UI) - Try-it-out API explorer

Specifications:

• OpenAPI Specification - YAML/JSON spec file
• View on SwaggerHub - SwaggerHub project page

Documentation:

• Developer Guide - Setup and usage guides

Farsight SIE

Real-time passive DNS feeds from the global sensor network.

Interactive References:

• API Reference (Swagger UI) - Try-it-out API explorer

Specifications:

• OpenAPI Specification - YAML/JSON spec file
• View on SwaggerHub - SwaggerHub project page

Documentation:

• Developer Guide - Access methods and configuration

Lookup & Monitor

Classic domain research and monitoring tools.

Interactive References:

• API Reference (Swagger UI) - Try-it-out API explorer

Specifications:

• OpenAPI Specification - YAML/JSON spec file
• View on SwaggerHub - SwaggerHub project page

Documentation:

• Developer Guide - API basics and examples

Threat Feeds

Real-time and daily feeds of malicious infrastructure.

Interactive References:

• API Reference (ReDoc) - Documentation-focused viewer
• API Reference (Swagger UI) - Try-it-out API explorer

Specifications:

• OpenAPI Specification - YAML/JSON spec file
• View on SwaggerHub - SwaggerHub project page

Documentation:

• Developer Guide - Feed types and integration

Automation and integration

Playbooks

Pre-built SOAR playbooks and workflow examples for automating threat intelligence tasks.

• View Playbooks
• SOAR Playbooks Repository ↗
• Workflow Examples Repository ↗

Platform integrations

Connect DomainTools to your security stack.

• All Integrations
• Splunk, Microsoft Sentinel, Palo Alto XSOAR, and more

Getting started

Authentication

All DomainTools APIs use API key authentication. Some APIs also support HMAC authentication for enhanced security.

• Iris Authentication
• Lookup & Monitor Authentication

Rate limits

Monitor your API usage and understand rate limiting.

• Iris Rate Limits
• Account Information

SDKs and tools

• Python SDK - Official Python SDK for all DomainTools APIs
• DNSDB Tools - Command-line tools for DNSDB
• SIE Tools - Tools for SIE data access

Additional resources

• All OpenAPI Specs on SwaggerHub ↗
• Product Updates
• User Management

Support

Need help? Contact DomainTools Enterprise Support at enterprisesupport@domaintools.com.