Domain Detail API

Everything the Index Holds on a Domain Fits in One Record.

Q: Can we pass a subdomain?

Yes. A host such as www.deepinfo.com returns its own record, with type 2, its own DNS, certificate and web data, and the WHOIS of its registered domain.

Q: What comes back for a domain behind WHOIS privacy?

whois_privacy_enabled is true, and the registrant block shows what the registrar publishes, usually a privacy or proxy service. whois_registrant_email_historical may still hold addresses from before privacy was switched on.

Q: Does it handle internationalized domain names?

Yes. Send the punycode form, for example xn--bcher-kva.example for bücher.example. The record returns both forms, in punycode and unicode, with is_idn set to true.

Q: What does a malformed request return?

A missing domain returns a 400 application error with code 10400 and a parameters list that names the field. See errors.

Pass a domain. Get back the record Deepinfo keeps for it: what the name is made of, WHOIS with its normalized and historical fields, DNS by record type, the addresses it has resolved to, its certificate and what its website answers.

Talk to us about access Domain Detail reference

From the indexall read

deepinfo.com GET /discovery/domain-detail

Name

8 characters · keywords deep, info
no date of its own
WHOIS

godaddy online services cayman islands ltd. · created 2001-06-05 · expires 2028-10-20
check_date 2026-09-22 15:14
DNS

A 104.26.10.21 · 104.26.11.21 · MX aspmx.l.google.com
update_date 2026-09-22 15:14
IP history

104.21.29.10 · 172.67.171.60
no date of its own
SSL

WE1 · Google Trust Services · to 2026-11-20 · is_valid true
check_date 2026-09-22 15:43
Web data

301 → 200 · https://www.deepinfo.com/ · HSTS · X-Frame-Options DENY
no date of its own

There is no single timestamp for the whole record.

The Record Every Discovery Call Returns.

This is the record that Domain Search and all Discovery finders return inside results. Code that reads one reads them all.

GET https://api.deepinfo.com/v1/discovery/domain-detail Reference

Parameter	Type		Description
`domain`	string	Required	A registered domain, for example `deepinfo.com`.

Request

curl "https://api.deepinfo.com/v1/discovery/domain-detail?domain=deepinfo.com" \
  -H "apikey: YOUR_API_KEY"

import requests

r = requests.get(
    "https://api.deepinfo.com/v1/discovery/domain-detail",
    params={"domain": "deepinfo.com"},
    headers={"apikey": "YOUR_API_KEY"},
)
record = r.json()
print(record["domain"]["whois"]["registrar"])
print(record["dns"]["mx"]["mail_servers"])
print(record["ssl"]["validity"]["end_date"])

const r = await fetch(
  'https://api.deepinfo.com/v1/discovery/domain-detail?domain=deepinfo.com',
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const record = await r.json()
console.log(record.domain.whois.registrar, record.ssl.validity.end_date)

Response

200 OK · application/json

{
  "punycode": "deepinfo.com",
  "unicode": "deepinfo.com",
  "is_idn": false,
  "name": {
    "punycode": "deepinfo",
    "length": 8,
    "lang": "en",
    "keywords": ["deep", "info"],
    "contains_confusable": false
  },
  "domain": {
    "extension": { "punycode": "com", "unicode": "com", "is_idn": false },
    "registered": true,
    "whois": {
      "create_date": "2001-06-05T02:57:08Z",
      "expiry_date": "2028-10-20T11:59:59Z",
      "registrar": "godaddy online services cayman islands ltd.",
      "registrant": { "organization": "…", "country": "us" },
      "name_servers": ["may.ns.cloudflare.com", "simon.ns.cloudflare.com"],
      "check_date": "2026-09-22T15:14:21Z"
    },
    "whois_privacy_enabled": true,
    "whois_last_change_date": "2026-09-22T15:17:20Z"
  },
  "type": 1,
  "dns": {
    "a": {
      "update_date": "2026-09-22T15:14:25Z",
      "ip_addresses": ["104.26.10.21", "104.26.11.21"]
    },
    "mx": {
      "update_date": "2026-09-22T15:14:25Z",
      "mail_servers": ["aspmx.l.google.com", "alt1.aspmx.l.google.com"]
    }
  },
  "ip_history": ["104.21.29.10", "172.67.171.60"],
  "ssl": {
    "issuer": { "common_name": "WE1", "organization": "Google Trust Services" },
    "validity": {
      "start_date": "2026-08-22T16:13:55Z",
      "end_date": "2026-11-20T17:13:40Z"
    },
    "signature": { "is_self_signed": false, "is_valid": true },
    "check_date": "2026-09-22T15:43:21Z"
  },
  "webdata": {
    "connection_status": "success",
    "http": {
      "status_code_first": 301,
      "status_code_last": 200,
      "final_url": "https://www.deepinfo.com/",
      "headers": {
        "strict_transport_security": "max-age=31536000; includeSubDomains; preload",
        "x_frame_options": "DENY"
      }
    }
  }
}

The Layers the Index Keeps.

Each layer carries its own check_date, update_date or last-change date, so you can tell when each part of the record was last read. There is no single timestamp for the whole record.

name	The label without its extension: length, language, keywords, letters, digits and hyphens, and flags for internationalized and confusable characters.
domain.whois	Registrar, registrant, creation, update and expiry dates, name servers, status codes and the WHOIS server, with a `check_date`.
WHOIS history fields	Normalized registrant organization, phone and email, past creation dates, past registrant emails, `whois_privacy_enabled` and `whois_last_change_date`.
dns	A, AAAA, NS, MX, SOA, TXT, CNAME and other types such as PTR, each with its own `update_date`.
ip_history	The IP addresses the domain has resolved to over time.
ssl	Issuer, subject, validity, SHA-256, SHA-1 and MD5 fingerprints, signature checks, subject alternative names and signed certificate timestamps, with a `check_date`.
webdata	Connection status, redirect chain, first and last status codes, final URL and domain, security headers as named fields, cookies and a hash of the page source.

Choose the Indexed Record or a Fresh Read.

Domain Detail reads Deepinfo’s index, so one call returns all layers as they were last observed.

When you need a value as it stands this minute, call the matching Lookup endpoint. Those go to the live source in real time, one layer per call.

Live lookup APIs

	From the index, `GET /discovery/domain-detail` · one call, every layer	Live lookups, one layer a call, read at request time
Name	Yes	No
WHOIS	`check_date` 2026-09-22 15:14	`GET /lookup/whois` · the registry
DNS	`update_date` 2026-09-22 15:14	`GET /lookup/dns` · a resolver, by record type
IP history	Yes	No
SSL	`check_date` 2026-09-22 15:43	`GET /lookup/ssl` · the host
Web data	Yes	`GET /lookup/webdata` · the page itself

Where Teams Read the Full Record.

Incident Investigation

Enrich an indicator with registration, DNS, certificate and web data in one call, while the ticket is still open.

Use case

Phishing Triage

Read a suspicious domain’s age, mail servers, certificate issuer and final redirect target before it goes to takedown.

Use case

Attack Surface Inventory

Fill in the records behind each apex domain in your inventory, with the fields your team already filters on.

Use case

Vendor Review

Read a supplier’s primary domain with the record you use for yours.

Use case

See This Data at Work in the Platform

This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs.

Questions About Domain Detail API

Can we pass a subdomain?

Yes. A host such as www.deepinfo.com returns its own record, with type 2, its own DNS, certificate and web data, and the WHOIS of its registered domain.

What comes back for a domain behind WHOIS privacy?

whois_privacy_enabled is true, and the registrant block shows what the registrar publishes, usually a privacy or proxy service. whois_registrant_email_historical may still hold addresses from before privacy was switched on.

Does the record include a risk score?

No. It holds what was observed on each layer and leaves the judgment to you. Security scores per asset and per domain come from External Attack Surface Management, which scans the assets you approve.

Does it handle internationalized domain names?

Yes. Send the punycode form, for example xn--bcher-kva.example for bücher.example. The record returns both forms, in punycode and unicode, with is_idn set to true.

How is the Domain Detail API priced?

As part of an API services plan, priced by volume and frequency, separately from the platform. See Data & API pricing.

What does a malformed request return?

A missing domain returns a 400 application error with code 10400 and a parameters list that names the field. See errors.

What are the rate limits?

Plan-dependent. The default is one request per second per key and endpoint. See rate limits.

Pull the Record for a Domain You Care About.

Most teams start with a few of their own domains and a few they are investigating. We set up access and walk through the record on a short call.

Talk to us about access All API services

Platform

Solutions

Data & API

Resources

Company

Everything the Index Holds on a Domain Fits in One Record.

The Record Every Discovery Call Returns.

The Layers the Index Keeps.

Choose the Indexed Record or a Fresh Read.

Where Teams Read the Full Record.

Incident Investigation

Phishing Triage

Attack Surface Inventory

Vendor Review

See This Data at Work in the Platform

Questions About Domain Detail API

Pull the Record for a Domain You Care About.