Data Feeds
Pull the Index in Bulk as Files.
Deepinfo Data Feeds deliver the domain and subdomain data behind the Deepinfo Platform as files your pipeline downloads, not results it pages through. Full files list every domain and subdomain in the index, and daily files list what changed in the last day.
List GET /feeds/latest
every file, its format, size, line count and update time
-
all-domainsfull · every domain in the indexcsvupdated 09-22 10:00 UTC
-
all-subdomainsfull · every subdomain in the indexjsonupdated 09-22 10:00 UTC
-
daily-registered-domainsdaily · registered in the last daycsvupdated 09-22 10:00 UTC
-
daily-updated-domainsdaily · updated in the last daycsvupdated 09-22 10:00 UTC
-
daily-deleted-domainsdaily · deleted in the last daycsvupdated 09-22 10:00 UTC
-
daily-discovered-subdomainsdaily · discovered in the last dayjsonupdated 09-22 10:00 UTC
A line domain with WHOIS · DNS
A pull list · request · download within the hour · check line_count
One List Indexes the File Behind Each Feed.
Each feed is one endpoint and one file, in the format you ask for. A list endpoint returns all files with their metadata, so a job can see what changed before it downloads anything.
All Domain Names
All registered domains Deepinfo knows about, in one file.
GET /
All Subdomains
All subdomains Deepinfo knows about, in one file.
GET /
Daily Registered Domain Names
Domains registered in the last day.
GET /
Daily Updated Domain Names
Domains whose registration record was updated in the last day.
GET /
Daily Deleted Domain Names
Domains deleted in the last day.
GET /
Daily Discovered Subdomains
Subdomains Deepinfo discovered in the last day.
GET /
Feeds List
Each feed with its files: format, size, line count, update time and the API URL of each.
GET /
One Call Lists All Files.
The list endpoint takes no parameters. It returns each feed with its files and, for each file, the api_ that requests it.
Request
curl "https://api.deepinfo.com/v1/feeds/latest" \
-H "apikey: YOUR_API_KEY"import requests
feeds = requests.get(
"https://api.deepinfo.com/v1/feeds/latest",
headers={"apikey": "YOUR_API_KEY"},
).json()
for feed in feeds:
for f in feed["files"]:
print(feed["type"], f["file_format"], f["file_update_time"])const r = await fetch(
'https://api.deepinfo.com/v1/feeds/latest',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
for (const feed of await r.json())
for (const f of feed.files) console.log(feed.type, f.file_format, f.file_update_time)Response
[
{
"type": "all_domain",
"files": [
{
"file_format": "csv",
"file_size": …,
"line_count": …,
"file_update_time": "2026-09-22T10:00:00Z",
"api_url": "https://api.deepinfo.com/v1/feeds/all-domains?file_format=csv"
},
{
"file_format": "json",
"file_size": …,
"line_count": …,
"file_update_time": "2026-09-22T10:00:00Z",
"api_url": "https://api.deepinfo.com/v1/feeds/all-domains?file_format=json"
}
]
},
{ "type": "all_subdomain", "files": [ … ] },
…
]A Pull Takes Four Steps.
-
01
List
Call
GET /and compare each file’sfeeds/ latest file_with the one your pipeline loaded last.update_ time -
02
Request
For each file that changed, call its feed endpoint with
file_orformat=csv json. The response carries a freshdownload_.url -
03
Download
Fetch the link within the hour. If it expires first, call the feed endpoint again for a new one.
-
04
Load
Check the lines you received against
line_, then load the file. Enrich the names you care about with the lookup and history APIs.count
Cut From the Index Behind the Platform.
The feeds are cut from the index behind the Deepinfo Platform. Each file reports its own length in line_. The index as a whole holds:
Bulk History and Real Time: What Exists Today.
History and real-time data reach your team today through per-call APIs, daily files and platform notifications. Each page below shows the route that works now. For bulk history or a stream, talk to our data team.
Historical DNS Records
No bulk endpoint. Per name, DNS History returns all values it has resolved to.
GET /
Historical WHOIS Records
No bulk endpoint. Per domain, WHOIS History returns each distinct registration record.
GET /
Historical SSL Records
No history endpoint. SSL Lookup checks a host live, and Domain Search filters by certificate fields.
GET /
Newly Registered Domains, Real Time
No stream. The daily file, and instant brand alerts in Brand Risk Protection.
GET /
Newly Updated Domains, Real Time
No stream. The daily file, and change notifications on the domains you monitor.
GET /
Newly Discovered Subdomains, Real Time
No stream. The daily file, and continuous discovery on your domains.
GET /
Use Files for the Whole Set and APIs for One Target.
Use a feed when the question covers the whole index: the domains registered in the last day, or all subdomains on record. Use an API when the question starts from one domain, IP address or certificate and needs its full record now.
Most pipelines use both. The daily file says which names are new, and Domain Detail or Domain WHOIS fills in the record for the ones that matter.
Take · the whole setone request per file
daily-registered-domains csv
the domains registered in the last day
- garden-tools.example
- acme-support.examplecontains “acme”
- harbor-cafe.example
- acmf.example
- аcme.example
- …
Ask · one targetone request per target
Domain WHOIS
GET /lookup/whois?domain=acme-support.example
fills in its registrar and dates
| Data feeds | Whole files, CSV or JSON, one request per file |
|---|---|
| API services | One target per request, JSON, paged when lists are long |
| Same key | Both use the apikey header; your plan sets which endpoints it can call |
| Same index | Feeds and the search, discovery and history APIs read one data store |
See This Data at Work in the Deepinfo Platform
External Attack Surface Management runs these lookups continuously over your assets and raises what changes as issues, and Deep Search & Insights opens the whole index to your analysts.
Questions About Data Feeds
What formats do the feeds come in?
CSV or JSON. Pass file_ or file_ on the request; JSON is the default. The response reports the format, size in bytes, line count and update time of the file you asked for.
How long is a download link valid?
One hour. The download_ is pre-signed. If your job has not fetched it by then, call the feed endpoint again for a new link.
Which feeds can our API key call?
Your plan decides. A key that calls a feed outside its plan gets 403 with the message You cannot consume this service. Rate limits are plan-dependent too, and apply per key and per endpoint.
How are data feeds priced?
On their own, by volume and frequency, separately from the platform. See Data & API pricing, or talk to the data team about the feeds you need.
Is there a streaming or webhook version of a feed?
Not in the public API: each feed is a file. If your workflow needs registrations, registration updates or new subdomains faster than a daily file, talk to our data team about what your pipeline needs.
Can we get DNS, WHOIS or SSL history in bulk?
Not through a public feed endpoint. Per-name history is available now through DNS History and WHOIS History. For bulk history, talk to our data team about what your analysis needs.
Can we load the files into our own product?
That is how a cybersecurity ratings provider builds on them. How the data can be used and shown in your product is set in the agreement, so talk to the data team about your case.
Feed the Index Into Your Pipeline.
Tell us which feeds you need and how your team loads data. We set up access and walk through the files with you before you integrate.