Data & API
Build on the Data Under the Platform.
Deepinfo collects its own internet data, resolves it and keeps what it has observed over time. The index behind the Deepinfo Platform is open to your code: API services answer one question per call, and data feeds hand over whole datasets as files.
-
api.deepinfo.com/v1
apikeyheaderAskone call, one answer
Takea whole file, JSON or CSV
-
400M+domains
Ask:Domain Search Domain Detail WHOIS History All TLDs
Take:
all-domainsdaily-registered-domainsdaily-updated-domainsdaily-deleted-domains -
2B+subdomains
Ask:Subdomain Finder
Take:
all-subdomainsdaily-discovered-subdomains -
200B+DNS records
Ask:DNS History Reverse IP Reverse MX Reverse NS
Take:no file, ask per name
-
30B+SSL certificates
Ask:Domain Search, on certificate fields Domain Detail
Take:no file
-
CVE databaseEPSS CISA KEV CWE
Ask:Vulnerability Search Vulnerability Detail
Take:no file
-
Who builds on it
alert enrichment detection engineering internal tools
Ask a Question or Take the Dataset.
Both read one index with one apikey header. The difference is whether you want an answer or the whole set.
API services
Ask the Index, One Call at a Time
REST endpoints for one target or one query per request: live lookups, DNS and WHOIS history, pivots from an IP, mail server, name server or registrant email to every domain behind it, and CVE search with EPSS and CISA KEV.
- Lookups query the target live. History, discovery and CVE search read the index.
- JSON responses. Searches and finders also export JSON or CSV.
- Suits enrichment, investigations and product features that need an answer per request.
Data feeds
Take the Dataset With You
Files for teams that load the data into their own systems: all the domains and subdomains Deepinfo knows about, plus daily files of registered, updated and deleted domains and newly discovered subdomains.
- One file per dataset, as JSON or CSV, with file size, line count and update time.
- Each feed call returns a pre-signed download link, valid for one hour.
- Suits analytics, detection pipelines and products that need the whole set locally.
One index api.deepinfo.com/v1 apikey header
Askone call, one answer
GET /discovery/domain-detail
domain.whois.registrar
godaddy online services cayman islands ltd.
Takethe whole set, as a file
GET /feeds/all-domains
download_url pre-signed link, valid for one hour
all-domainsCSV
All registered domains Deepinfo knows about, in one file.
What the Index Saw in the Last 30 Days.
These counts come from the Domain Intelligence and Vulnerability statistics endpoints, which also feed our Internet Insights pages.
Teams That Build on the Index.
Security Vendors
Ratings, attack surface and threat intelligence products that need internet-wide data without running their own collection.
Security and Engineering Teams
Alert enrichment, detection engineering and internal tools that need an answer about a domain, an IP or a CVE inside a pipeline.
Researchers and Analysts
Questions that span the whole namespace, such as which domains share a registrant or a mail server, or how registrations moved this month.
A Reference Page for Every Endpoint.
Each reference page lists the endpoint’s parameters, response fields, errors and at least one real, sanitized response. The reference is generated from the request collection the team tests against, so the two stay in step.
Endpoint pages include a Try It console and ready-to-run code samples, and each page has a Markdown version for your tools.
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
-H "apikey: $DEEPINFO_API_KEY"import os, requests
r = requests.get(
"https://api.deepinfo.com/v1/lookup/whois",
params={"domain": "deepinfo.com"},
headers={"apikey": os.environ["DEEPINFO_API_KEY"]},
)
print(r.json()["parsed"]["registrar"])const r = await fetch(
'https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com',
{ headers: { apikey: process.env.DEEPINFO_API_KEY } }
)
const { parsed } = await r.json()
console.log(parsed.registrar)Questions About Data & API
How is Data & API different from the Deepinfo Platform?
The platform is where your team works: it discovers your assets, scores what it finds and tracks each issue to resolution. Data & API is direct access to the index underneath it, for your code, pipelines and products.
Do we need API services or data feeds?
API services fit when you need an answer about one target or one query at a time, inside a workflow or a product. Data feeds fit when you need the full set of domains or subdomains, or each day’s changes, in your own storage.
How do access and pricing work?
Which endpoints and feeds you can use, and your rate limits, depend on your plan. See pricing for how plans are put together, or talk to us with your use case.
Can we buy the data without the platform?
Yes. Data feeds and API services are priced on their own, by volume and frequency, and some customers buy only the data. Others use the platform for their own security team and the data in a product they build.
Is it the same data the platform uses?
Yes. The index behind all the modules is the one you query: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates, plus a CVE database enriched with EPSS, CISA KEV and CWE.
Can we use the data inside our own product?
That is how the cybersecurity ratings provider in our customer stories uses it. How the data can be used and shown in your product is part of the agreement, so talk to the data team about your case.
How do we keep the API key safe?
Call the API from your own backend and keep the key in an environment variable or a secret store, never in client-side code. Anyone holding the key can spend your quota, so replace an exposed key in the platform and delete the old one.
Bring Us Your Use Case.
Tell us what you are building. We’ll recommend API services, data feeds or both, and set up access so your team can test against its own targets.