Request demo

API Services

Query the Index From Your Code.

Deepinfo API Services are REST endpoints over the data the Deepinfo Platform runs on. Look up one target live, read a name’s DNS and WHOIS history, pivot from one indicator to the domains that share it, or pull a CVE with EPSS and CISA KEV attached.

Talk to us about access API referenceAPI catalog (PDF)

Request

GET /discovery/domain-detail?domain=deepinfo.com

apikey: YOUR_API_KEY

Response · JSON

  1. {
  2. "punycode": "deepinfo.com",
  3. "domain": {WHOIS
  4. "whois": {
  5. "registrar": "godaddy online services cayman islands ltd.",
  6. "create_date": "2001-06-05T02:57:08Z",
  7. "name_servers": ["may.ns.cloudflare.com", …]
  8. }
  9. },
  10. "dns": {DNS
  11. "a": { "ip_addresses": ["104.26.10.21", "104.26.11.21"] },
  12. "mx": { "mail_servers": ["aspmx.l.google.com", …] }
  13. },
  14. "ip_history": ["104.21.29.10", "172.67.171.60"],IP history
  15. "ssl": { "issuer": { "organization": "Google Trust Services" },SSL
  16. "validity": { "end_date": "2026-11-20T17:13:40Z" } },
  17. "webdata": { "http": { "status_code_last": 200,web data
  18. "final_url": "https://www.deepinfo.com/" } }
  19. …
  20. }

The same record comes back from Domain Search and every Discovery finder.

LookupHistoryDiscoveryVulnerability

Ask One Target for Its State Now.

Live lookups query the target at request time: the registry, a resolver, the host or the page itself.

Domain WHOIS

The registration record of a domain as the registry serves it now, raw and parsed.

/lookup/whois

API

DNS

Current records for a domain or hostname, of the record types you ask for.

/lookup/dns

API

IP WHOIS

The network, range, ASN, registry and contact entities behind an IPv4 or IPv6 address.

/lookup/ip-whois

API

SSL

The certificate a host serves, parsed, with a verdict on its signature and chain.

/lookup/ssl

API

Port Scan

Open TCP and UDP ports and the services on them, for hosts you own or are authorized to test.

/lookup/port-scan

API

Technology

The technologies a site runs, each with categories, version and a CPE name.

/lookup/technology

API

Screenshot

A capture of any page from a real browser, with options in the query string or a JSON body.

/lookup/screenshot

API

Web Data

A full page profile: technologies, metadata, links, trackers, favicons, headers and cookies.

/lookup/webdata

API

What a Name Looked Like Before Today.

History reads what Deepinfo has observed over time, so a domain has a past even if you never looked it up before.

GET · Passive DNS

DNS History

Every DNS value Deepinfo has observed for a domain or hostname, with each time it was seen.

/analyze/dns-history

API

GET · Registration

WHOIS History

Each distinct registration record of a domain, with the dates it was seen.

/analyze/whois-history

API

From One Indicator to Every Domain Behind It.

Search and pivot across the whole domain index. Finders return full domain records, so the next pivot starts from what you just found.

Domain Search

Filter the domain index on any field of a domain record, with boolean clauses, and export the result as JSON or CSV.

/discovery/domain-search

API

Domain Detail

Everything Deepinfo holds on one domain: WHOIS, DNS by type, IP history, SSL and web data.

/discovery/domain-detail

API

Subdomain Finder

All known subdomains of a domain.

/discovery/subdomain-finder

API

Associated Domain Finder

Domains that share a registrant email, organization or phone, name servers, an IP, mail servers or an SSL organization with a domain.

/discovery/associated-domain-finder

API

Same-Time Registered Domain Finder

Domains the same registrant registered within 1 to 60 minutes of a given domain.

/discovery/sametime-domain-finder

API

Reverse WHOIS Email

Domains whose registrant email is a given address, or any address at its email domain.

/discovery/reverse-email

API

Reverse NS

Domains that use a given name server.

/discovery/reverse-ns

API

Reverse MX

Domains that use a given mail server.

/discovery/reverse-mx

API

Reverse IP

Domains that resolve to an IP address, or to its /8, /16 or /24 network.

/discovery/reverse-ip

API

All TLDs

Registrations of one name under other TLDs.

/discovery/all-tlds

API

IP 203.0.113.10

  1. Reverse IP GET /discovery/reverse-ip
    • acme.example
      • MX mx1.acme.example, mx2.acme.example
    • shop.acme.example
  2. Reverse MX · apex=true GET /discovery/reverse-mx
    • acme-careers.exampleMX mx1.acme.example
    • acme-group.exampleMX mx2.acme.example

Each result is a full domain record, so the next pivot starts from what you just found.

Every CVE With Its Exploitation Signal.

CVE records carry CVSS, EPSS and CISA KEV status together, so priority is part of the answer, not a second lookup.

POST · Search

Vulnerability Search

Filter the CVE database on any field of a CVE record, EPSS and CISA KEV enrichment included.

/discovery/vulnerability-search

API

GET · Detail

Vulnerability Detail

One CVE with CVSS v2 to v4.0, EPSS, its CISA KEV entry, CWE with CAPEC, affected products and Deepinfo’s vDeep metric.

/discovery/vulnerability-detail

API

GET · Finder

Vulnerability Finder

The CVEs that affect the technologies detected on a URL.

/discovery/vulnerability-finder

API

More Endpoints Live in the Reference.

Dark web search, the CVE and registration statistics behind Internet Insights, and the feed list are documented in the reference. Each link opens its reference page.

All Calls Share One Base URL and One Header.

All endpoints live under https://api.deepinfo.com/v1 and takes your key in an apikey header, with no Bearer prefix. Keys are created in the platform under Settings, Organization Settings, API Keys.

Your plan sets which endpoints you can call and the rate limits, per key and per endpoint. Each response carries a deepinfo-request-id for support.

# One target, live
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
  -H "apikey: YOUR_API_KEY"

Other Ways Into the Index.

Data & API Data feeds All domains and subdomains, plus daily files of registered, updated and deleted domains, as JSON or CSV. Read Module · DSI Deep Search & Insights These searches and lookups inside the Deepinfo Platform, with no query to write. Read Insights Internet insights Registration and CVE trends from the index, drawn from the statistics endpoints above. Read

Questions About API Services

How do we get an API key?

Keys are created in the Deepinfo Platform under Settings, Organization Settings, API Keys, where you can generate, rename and delete them. If your team has no platform access yet, talk to us and we set it up for your plan.

Which endpoints can we call?

That depends on your plan. A valid key that calls an endpoint outside the plan gets 403 with the message You cannot consume this service.

How are API services priced?

Separately from the platform, by volume and frequency. Some endpoints, lookups among them, also count against a plan quota at one unit per request, however much data the response holds. See Data & API pricing.

What are the rate limits?

Rate limits depend on your plan and apply per key and per endpoint; the rate limits page lists the defaults. Responses carry ratelimit-remaining and ratelimit-reset headers, and a call over the limit gets 429.

What format do responses come in?

JSON, with dates and times in ISO 8601 UTC. Searches and finders can also export a result set as CSV, and the data feeds hand over their files through pre-signed download links that expire.

How do search filters work?

A search takes one JSON body with must, should and must_not lists of {name, type, value} conditions, plus an optional sort. The operators are shared by the searches that take this body, and each endpoint’s reference lists its searchable fields and the operators each field accepts.

Is there a bulk alternative to paging through results?

Discovery finders, Domain Search and Vulnerability Search can export a result set as JSON or CSV. For whole datasets, such as all registered domains, data feeds deliver files instead.

Can we also script the platform modules?

Yes. External Attack Surface Management, Cyber Threat Intelligence and Brand Risk Protection have their own APIs on this base URL and header, documented in the API reference.

Tell Us What You Want to Build.

Most teams test a few endpoints against their own domains before they integrate. We set up access for your plan and answer schema questions on a short call.

Talk to us about access API reference