DomainTools Lookups API declares
3 security schemes
for authenticating requests.
An API key is passed in the header as X-Api-Key (header_auth).
It accepts HTTP basic authentication (open_key_auth).
An API key is passed in the query as signature (hmac_auth).
By default, every request must be authenticated.
header_auth — A secure authentication method where the API key is provided in the X-Api-Key HTTP request header.
open_key_auth — A simple authentication scheme using your apiusername as the username and your apikey as the password. We strongly recommend using HMAC or Header authenticatio…
hmac_auth — A secure scheme using a Hashed Message Authentication Code (HMAC). This method requires three query parameters to be sent with the request: 1. apiusername: You…
Paths & Operations 16
Across 16 paths, the API surfaces 16 operations — 16 GET. Each is listed below with its method, path, parameters, and response codes.
Lookups 16
Endpoints for retrieving detailed information about domains and IPs, and for finding connections between domains and infrastructure.
The contract defines 43 schemas that model the data the API accepts and returns. The most detailed are EnrichResult (47 properties), ParsedWhoisIpNetwork (22 properties), ParsedWhoisIpContact (20 properties), ParsedWhoisContact (10 properties). Each schema is shown below with its type and property counts.
IdentifierString
string
A short identifier, code, or handle.
ParsedWhoisContact
object
Contact information from a WHOIS record.
10 properties
ParsedWhoisIpContact
object
Contact information from IP WHOIS record.
20 properties
RiskScoreValue
integer
A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
BasicString
string
A non-empty string with a standard length limit.
ReverseIp
object
Response for the Reverse IP endpoint.
1 property
ParsedDomainRdapResponse
object
Response for the Parsed Domain RDAP endpoint.
1 property
ThreatProfileMalware
object
Indicates risk based on a machine-learning model that classifies domains as malware-related.
3 properties2 required
ThreatProfilePhishing
object
Indicates risk based on a machine-learning model that classifies domains as phishing-related.
3 properties2 required
ParsedWhoisDomain
object
Response for the Parsed WHOIS (Domain) endpoint.
1 property
EnrichValue
object
1 property
Proximity
object
Indicates risk based on proximity to known threats or suspicious infrastructure.
3 properties2 required
ReverseWhois
object
Response for the Reverse WHOIS endpoint.
1 property
DomainReputation
object
Response for the Domain Reputation endpoint.
1 property
ResponseFormat
string
The desired response format.
DomainRiskScoreEvidence
object
Response for the Risk Score Evidence endpoint.
1 property
EnrichResult
object
A comprehensive domain profile result from Iris Enrich API.
47 properties
HtmlResponse
string
HTML-formatted response body. JSON is the primary documented format; HTML response schemas are not individually documented.
ReverseIpWhoisQuery
object
Response for the Reverse IP WHOIS (Query) endpoint.
1 property
BooleanOptInFlag
boolean
An optional boolean flag that enables a specific feature or response extension when set to true. If false or omitted, the feature is ignored.
Hostname
string
A valid, fully-qualified domain name (FQDN).
DomainHistoryFieldsList
string
Comma-separated list of field names to include or exclude from Domain History responses. Field filtering works at the event level: it determines which change e…
DomainRiskComponent
A polymorphic schema representing one of several types of risk components.
XmlResponse
string
XML-formatted response body. JSON is the primary documented format; XML response schemas are not individually documented.
ReverseIpWhoisIp
object
Response for the Reverse IP WHOIS (IP) endpoint.
1 property
IPv4Address
string
A standard IPv4 address.
DomainSearch
object
Response for the Domain Search endpoint.
1 property
DomainRiskScore
object
1 property
ReverseNameServer
object
Response for the Reverse Name Server endpoint.
1 property
ApexDomain
string
A base (apex) domain like example.com, excluding subdomains.
ZeroListedScore
object
Indicates the domain is on a known-good 'zero list' and is not considered a threat.
2 properties2 required
DomainProfile
object
Response for the Domain Profile endpoint.
1 property
ThreatProfileSpam
object
Indicates risk based on a machine-learning model that classifies domains as spam-related.
3 properties2 required
EnrichContact
object
10 properties
EnrichTracker
object
A tracker identifier.
1 property
ThreatProfile
object
Indicates risk based on machine-learning models.
3 properties2 required
WhoisLookup
object
Response for the WHOIS Lookup endpoint.
1 property
HostingHistory
object
Response for the Hosting History endpoint.
1 property
DomainHistory
object
Response for the Domain History endpoint.
1 property
WhoisHistory
object
Response for the WHOIS History endpoint.
1 property
ParsedWhoisIp
object
Response for the Parsed WHOIS (IP) endpoint.
1 property
ParsedWhoisIpNetwork
object
IP network block information from WHOIS.
22 properties
ErrorResponse
object
2 properties
Specification
The full machine-readable OpenAPI contract behind this narrative.
Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.
Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.
MCP tools for apis
4 tools reach this content
search_api_evangelistSearch every content type across the network at once.
find_relatedThe shared-tag relevance graph — what else covers this.
get_tagEverything one tag labels, across all content types.
guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
A second provider on the same verified email joins the account you already have.
Your account
ⓘWhere this information came from
This is an independent, third-party profile of DomainTools Lookups API, published by
API Evangelist. We do not operate, host, resell, or
support these APIs, and we are not affiliated with or endorsed by the company unless stated above.
Everything here is built from publicly available information — the company's own site,
developer portal, documentation, public repositories, and the specifications it publishes for public use.
Nothing is obtained by breaching a system, defeating an access control, or using credentials.
The Kin Score and Agent Readiness rating are independently calculated assessments of a company's
public API artifacts, scored against a published rubric. They are not certifications,
endorsements, security assessments, or audits.
Corrections, re-scores, and removal are free — no partnership or purchase required, and
you do not need to justify the request. A removed company is recorded as unrated, never scored
zero for having asked. Acknowledgement within one business day; removal within two.
info@apievangelist.com
·
Read the full data-sourcing policy → On a security or compliance team? Put security in the subject line and
you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.
