DomainTools Iris Investigate API

openapi: 3.0.0
info:
  version: '2.0'
  title: dnsdb Flex search Iris Investigate API
  description: dnsdb
  contact:
    name: DomainTools Support
    url: https://www.domaintools.com/support
    email: enterprisesupport@domaintools.com
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  termsOfService: https://www.domaintools.com/company/terms-of-service/
servers:
- url: https://api.dnsdb.info/dnsdb/v2
- url: https://dnsdbfront.labs.fsi.io/dnsdb/v2
tags:
- name: Iris Investigate
  description: 'The Iris Investigate API is ideally suited for investigate and orchestrate use cases at human scale. Identify threats, map adversary infrastructure, and streamline investigations.

    '
paths:
  /v1/iris-investigate/:
    get:
      operationId: getIrisInvestigate
      summary: 'Returns data from a GET request.

        Parameters are identified in descriptions as either base or filter.

        Search with base parameters and filter down base results with filter parameters.

        '
      tags:
      - Iris Investigate
      description: 'Consider using POST for complex requests.

        '
      parameters:
      - $ref: '#/components/parameters/adsense'
      - $ref: '#/components/parameters/baiduCode'
      - $ref: '#/components/parameters/contactName'
      - $ref: '#/components/parameters/contactPhone'
      - $ref: '#/components/parameters/contactStreet'
      - $ref: '#/components/parameters/domainLastIp'
      - $ref: '#/components/parameters/domainsQuery'
      - $ref: '#/components/parameters/emailAny'
      - $ref: '#/components/parameters/emailDnsSoa'
      - $ref: '#/components/parameters/emailDomain'
      - $ref: '#/components/parameters/facebookCode'
      - $ref: '#/components/parameters/googleAnalytics4Code'
      - $ref: '#/components/parameters/googleAnalyticsCode'
      - $ref: '#/components/parameters/googleTagManagerCode'
      - $ref: '#/components/parameters/hotJarCode'
      - $ref: '#/components/parameters/ianaId'
      - $ref: '#/components/parameters/mailserverDomain'
      - $ref: '#/components/parameters/mailserverHost'
      - $ref: '#/components/parameters/mailserverIp'
      - $ref: '#/components/parameters/matomoCode'
      - $ref: '#/components/parameters/nameserverDomain'
      - $ref: '#/components/parameters/nameserverHost'
      - $ref: '#/components/parameters/nameserverIp'
      - $ref: '#/components/parameters/redirectDomain'
      - $ref: '#/components/parameters/registrant'
      - $ref: '#/components/parameters/registrantHistoricalWhois'
      - $ref: '#/components/parameters/registrantOrg'
      - $ref: '#/components/parameters/registrar'
      - $ref: '#/components/parameters/searchHash'
      - $ref: '#/components/parameters/serverType'
      - $ref: '#/components/parameters/sslAltNames'
      - $ref: '#/components/parameters/sslCommonName'
      - $ref: '#/components/parameters/sslDuration'
      - $ref: '#/components/parameters/sslEmail'
      - $ref: '#/components/parameters/sslHash'
      - $ref: '#/components/parameters/sslOrg'
      - $ref: '#/components/parameters/sslSubject'
      - $ref: '#/components/parameters/sslIssuerCommonName'
      - $ref: '#/components/parameters/statCounterProjectCode'
      - $ref: '#/components/parameters/statCounterSecurityCode'
      - $ref: '#/components/parameters/taggedWithAll'
      - $ref: '#/components/parameters/taggedWithAny'
      - $ref: '#/components/parameters/websiteTitle'
      - $ref: '#/components/parameters/whoisFreeText'
      - $ref: '#/components/parameters/whoisHistoricalFreeText'
      - $ref: '#/components/parameters/yandexCode'
      - $ref: '#/components/parameters/active'
      - $ref: '#/components/parameters/createDate'
      - $ref: '#/components/parameters/createDateWithin'
      - $ref: '#/components/parameters/expirationDate'
      - $ref: '#/components/parameters/firstSeenSince'
      - $ref: '#/components/parameters/firstSeenWithin'
      - $ref: '#/components/parameters/ipCountryCode'
      - $ref: '#/components/parameters/notTaggedWithAll'
      - $ref: '#/components/parameters/notTaggedWithAny'
      - $ref: '#/components/parameters/rank'
      - $ref: '#/components/parameters/riskScore'
      - $ref: '#/components/parameters/sslNotAfter'
      - $ref: '#/components/parameters/sslNotBefore'
      - $ref: '#/components/parameters/topLevelDomain'
      - $ref: '#/components/parameters/parsedDomainRdapFlag'
      - $ref: '#/components/parameters/parsedWhoisFlag'
      - $ref: '#/components/parameters/nextPageUrl'
      - $ref: '#/components/parameters/responseFormat'
      - $ref: '#/components/parameters/resultsPageSize'
      - $ref: '#/components/parameters/resultsPosition'
      - $ref: '#/components/parameters/resultsSortBy'
      - $ref: '#/components/parameters/resultsSortDirection'
      - $ref: '#/components/parameters/appName'
      - $ref: '#/components/parameters/appPartner'
      - $ref: '#/components/parameters/appVersion'
      responses:
        '200':
          $ref: '#/components/responses/InvestigateSuccess'
        '206':
          $ref: '#/components/responses/IrisPartialContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      externalDocs:
        url: https://docs.domaintools.com/api/iris/
    post:
      operationId: postIrisInvestigate
      summary: Returns data from a POST request.
      tags:
      - Iris Investigate
      description: 'The GET method is available for simple queries.


        The POST method supports two request formats:


        - **Form parameters** (application/x-www-form-urlencoded): Traditional parameter-based searches

        - **IrisQL** (text/plain): Complex queries using IrisQL query language for advanced filtering and OR logic


        For IrisQL usage and syntax, see the [IrisQL API Guide](https://docs.domaintools.com/api/iris/investigate/irisql/).

        '
      requestBody:
        $ref: '#/components/requestBodies/Investigate'
      responses:
        '200':
          $ref: '#/components/responses/InvestigateSuccess'
        '206':
          $ref: '#/components/responses/IrisPartialContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      externalDocs:
        url: https://docs.domaintools.com/api/iris/
components:
  parameters:
    appName:
      name: app_name
      in: query
      description: 'Appliance, module, or playbook, or any combination of these.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    ianaId:
      in: query
      name: iana_id
      description: 'Base search parameter.

        Registrar IANA code from most recent RDAP record for a domain.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    domainsQuery:
      in: query
      name: domain
      description: 'Base search parameter.

        One or more domains (comma-separated) to be investigated.

        Example: `example.com,domaintools.com`.

        '
      schema:
        $ref: '#/components/schemas/ApexDomainList'
    notTaggedWithAny:
      in: query
      name: not_tagged_with_any
      description: 'Search filter parameter.

        Exclude all domains that are tagged with **any** of the specified tags in the Iris Investigation platform.

        Accepts a comma-separated list of tags.

        '
      schema:
        $ref: '#/components/schemas/CommaSeparatedTags'
    mailserverDomain:
      in: query
      name: mailserver_domain
      description: 'Base search parameter.

        Only the registered domain portion of the mail server (e.g., `domaintools.net`).

        '
      schema:
        $ref: '#/components/schemas/ApexDomain'
    sslCommonName:
      in: query
      name: ssl_common_name
      description: 'Base search parameter.

        Domains with a matching Common Name (CN) in their SSL certificate''s subject.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    registrant:
      in: query
      name: registrant
      description: 'Base search parameter.

        Exact match to the WHOIS registrant field.

        '
      schema:
        $ref: '#/components/schemas/OrgNameString'
    expirationDate:
      in: query
      name: expiration_date
      description: 'Search filter parameter.

        Only include domains expiring on a specific date.

        '
      schema:
        $ref: '#/components/schemas/DateFilter'
    serverType:
      in: query
      name: server_type
      description: 'Base search parameter.

        Domains hosted on a specific server type (e.g., from the ''Server'' HTTP header). Must be an exact match.

        '
      schema:
        $ref: '#/components/schemas/BasicString'
    contactName:
      in: query
      name: contact_name
      description: 'Base search parameter.

        Contact name from domain registration data.

        Supports WHOIS/RDAP Fields Search.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    facebookCode:
      in: query
      name: facebook
      description: 'Facebook/Meta tracking code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    whoisHistoricalFreeText:
      in: query
      name: historical_free_text
      description: 'Base search parameter.

        Free text search of a domain''s historical WHOIS records.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    ipCountryCode:
      in: query
      name: ip_country_code
      description: 'Search filter parameter.

        Country code for IP A-record.

        '
      schema:
        type: string
        pattern: ^[A-Z]{2}$
        description: Two-letter ISO country code (uppercase)
    sslHash:
      in: query
      name: ssl_hash
      description: 'Base search parameter.

        The SHA-1 hash of an SSL certificate, used to filter for domains associated with a specific certificate.

        '
      schema:
        $ref: '#/components/schemas/Sha1HexString'
    registrantHistoricalWhois:
      in: query
      name: historical_registrant
      description: 'Base search parameter.

        Registrant names from historical WHOIS records.

        '
      schema:
        $ref: '#/components/schemas/OrgNameString'
    taggedWithAll:
      in: query
      name: tagged_with_all
      description: 'Search filter parameter.

        Comma-separated list of tags. Only returns domains tagged with the full list of tags.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    nameserverIp:
      in: query
      name: nameserver_ip
      description: 'Base search parameter.

        The IPv4 address of the name server.

        '
      schema:
        $ref: '#/components/schemas/IPv4Address'
    sslNotBefore:
      in: query
      name: ssl_not_before
      description: 'Search filter parameter.

        Validity begin date for a certificate (YYYY-MM-DD).

        '
      schema:
        $ref: '#/components/schemas/DateFilter'
    contactPhone:
      in: query
      name: contact_phone
      description: 'Base search parameter.

        Contact phone number from domain registration data.

        Supports WHOIS/RDAP Fields Search.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    sslIssuerCommonName:
      in: query
      name: ssl_issuer_common_name
      description: 'Base search parameter.

        Certificate issuer Common Name.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    sslDuration:
      in: query
      name: ssl_duration
      description: 'Base search parameter.

        Domains with an SSL certificate valid for a specific number of days.

        '
      schema:
        type: integer
        minimum: 1
    responseFormat:
      name: format
      in: query
      description: 'Specifies the desired response format.

        '
      schema:
        $ref: '#/components/schemas/ResponseFormat'
    createDate:
      in: query
      name: create_date
      description: 'Search filter parameter.

        Filters domains based on the `create_date` field.

        Supports [`>`, `>=`, `<`, `<=`] operators, or no operator for exact matches.

        '
      schema:
        $ref: '#/components/schemas/DateOperatorsFilter'
    redirectDomain:
      in: query
      name: redirect_domain
      description: 'Base search parameter.

        Domains observed to redirect to another domain name.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    notTaggedWithAll:
      in: query
      name: not_tagged_with_all
      description: 'Search filter parameter.

        Exclude all domains that are tagged with **all** of the specified tags in the Iris Investigation platform.

        This parameter accepts a comma-separated list of tag names.

        '
      schema:
        $ref: '#/components/schemas/CommaSeparatedTags'
    baiduCode:
      in: query
      name: baidu_analytics
      description: 'Base search parameter. Baidu Analytics code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    emailDnsSoa:
      in: query
      name: email_dns_soa
      description: 'Base search parameter. DNS SOA email.

        '
      schema:
        $ref: '#/components/schemas/EmailAddress'
    resultsSortBy:
      in: query
      name: sort_by
      description: 'Specifies the field to sort the results by.

        '
      schema:
        type: string
        enum:
        - first_seen_since
        - create_date
        - domain
        - risk_score
    riskScore:
      in: query
      name: risk_score
      description: 'Search filter parameter.

        Returns domains with a Domain Risk Score greater than this value. See [Domain Risk Scores](https://docs.domaintools.com/riskscore/).

        '
      schema:
        type: integer
        minimum: 0
        maximum: 100
    statCounterSecurityCode:
      in: query
      name: statcounter_security
      description: 'Base search parameter.

        Statcounter Security tracker code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    sslEmail:
      in: query
      name: ssl_email
      description: 'Base search parameter.

        Email address extracted from the SSL certificate associated with a domain.

        '
      schema:
        $ref: '#/components/schemas/EmailAddress'
    sslNotAfter:
      in: query
      name: ssl_not_after
      description: 'Search filter parameter.

        Validity end date for a certificate (YYYY-MM-DD).

        '
      schema:
        $ref: '#/components/schemas/DateFilter'
    emailAny:
      in: query
      name: email
      description: 'Base search parameter.

        Email address from the most recently available WHOIS record, DNS SOA record or SSL certificate.

        '
      schema:
        $ref: '#/components/schemas/EmailAddress'
    emailDomain:
      in: query
      name: email_domain
      description: Only the domain portion of a WHOIS or DNS SOA email address.
      schema:
        $ref: '#/components/schemas/ApexDomain'
    registrantOrg:
      in: query
      name: registrant_org
      description: 'Base search parameter.

        Exact match to the WHOIS registrant organization field

        '
      schema:
        $ref: '#/components/schemas/OrgNameString'
    resultsSortDirection:
      in: query
      name: sort_direction
      description: 'Determines the sort direction, either ascending or descending.

        This is used in combination with the ''sort_by'' parameter.

        '
      schema:
        type: string
        enum:
        - asc
        - dsc
    sslSubject:
      in: query
      name: ssl_subject
      description: 'Base search parameter.

        Exact match to the Subject distinguished name (DN) string from the SSL certificate.

        '
      schema:
        $ref: '#/components/schemas/SslSubjectDnString'
    mailserverIp:
      in: query
      name: mailserver_ip
      description: 'Base search parameter.

        IP address of the mail server.

        '
      schema:
        $ref: '#/components/schemas/IPv4Address'
    nameserverHost:
      in: query
      name: nameserver_host
      description: 'Base search parameter.

        Fully-qualified domain name (FQDN) of the name server.

        '
      required: false
      schema:
        $ref: '#/components/schemas/Hostname'
    googleTagManagerCode:
      in: query
      name: google_tag_manager
      description: 'Base search parameter.

        Google Tag Manager tracking code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    active:
      in: query
      name: active
      description: 'Search filter parameter.

        Set to `true` to only return domains that have either an entry in the global Domain Name System, OR are listed as registered by the registry.

        Set to `false` to only return domains that do not have an entry in the global DNS, AND are not listed as registered by the registry.

        '
      schema:
        type: boolean
    whoisFreeText:
      in: query
      name: whois
      description: 'Base search parameter.

        Free text search of a domain''s most recent WHOIS record.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    firstSeenWithin:
      in: query
      name: first_seen_within
      description: 'Search filter parameter.

        Filter domains based on the `first_seen` field.

        Returns only those domains first discovered within the last N seconds.

        '
      schema:
        $ref: '#/components/schemas/TimeWindowSeconds'
    appPartner:
      name: app_partner
      in: query
      description: 'Your product name.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    taggedWithAny:
      in: query
      name: tagged_with_any
      description: 'Search filter parameter.

        Comma-separated list of Iris Investigate tags. Returns domains tagged with any of the tags in a list.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    registrar:
      in: query
      name: registrar
      description: 'Base search parameter.

        Exact match to the WHOIS registrar field.

        '
      schema:
        $ref: '#/components/schemas/OrgNameString'
    nameserverDomain:
      in: query
      name: nameserver_domain
      description: 'Base search parameter.

        The registered domain name of the nameserver (e.g., `example.com`).

        '
      schema:
        $ref: '#/components/schemas/Hostname'
    parsedDomainRdapFlag:
      name: parsed_domain_rdap
      in: query
      description: 'Flag.

        If set to `true`, includes the full parsed Domain RDAP record in the response.

        '
      schema:
        $ref: '#/components/schemas/BooleanOptInFlag'
    sslAltNames:
      in: query
      name: ssl_alt_names
      description: 'Base search parameter.

        Domains with a matching Subject Alternative Name (SAN) in their SSL certificate.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
    resultsPageSize:
      name: page_size
      in: query
      description: 'Adjusts the number of results returned per page.

        The default is 500. Use this parameter to request a smaller page size.

        '
      schema:
        type: integer
        minimum: 1
        maximum: 500
    websiteTitle:
      in: query
      name: website_title
      description: 'Base search parameter.

        The value of the website’s `<title>` HTML tag. Must be an exact match.

        '
      schema:
        $ref: '#/components/schemas/WebsiteTitleString'
    firstSeenSince:
      in: query
      name: first_seen_since
      description: 'Search filter parameter.

        Filter domains based on the `first_seen` timestamp.

        Returns domains whose `current_lifecycle_first_seen` value is *after* the given datetime.

        '
      schema:
        $ref: '#/components/schemas/TimestampFilter'
    domainLastIp:
      in: query
      name: ip
      description: 'Base search parameter.

        IPv4 address the registered domain was last known to point to during an active DNS check.

        '
      required: false
      schema:
        $ref: '#/components/schemas/IPv4Address'
    sslOrg:
      in: query
      name: ssl_org
      description: 'Base search parameter.

        Organization name from the SSL certificate. Must be an exact string match.

        '
      schema:
        $ref: '#/components/schemas/OrgNameString'
    mailserverHost:
      in: query
      name: mailserver_host
      description: 'Base search parameter.

        Fully-qualified mail server hostname (e.g., mx.domaintools.net).

        Performs a Reverse MX lookup to identify domains using this mail server.

        '
      schema:
        $ref: '#/components/schemas/Fqdn'
    searchHash:
      in: query
      name: search_hash
      description: 'Base search parameter.

        Token returned by the Iris Investigate UI when exporting a search.

        Use this value to import and continue an existing search via the API.

        '
      schema:
        $ref: '#/components/schemas/SearchHashToken'
    createDateWithin:
      in: query
      name: create_date_within
      description: 'Search filter parameter.

        Filter domains based on the `create_date` field: the maximum number of days since a domain was first discovered.

        '
      schema:
        $ref: '#/components/schemas/MaxDaysSince'
    yandexCode:
      in: query
      name: yandex_metrica
      description: 'Base search parameter.

        Yandex Metrica tracker code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    appVersion:
      name: app_version
      in: query
      description: 'Version of your integration/connector.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    resultsPosition:
      in: query
      name: position
      description: 'Cursor for paginated results. Use the value returned in a previous response to retrieve the next page.

        '
      required: false
      schema:
        $ref: '#/components/schemas/PositionToken'
    googleAnalyticsCode:
      in: query
      name: google_analytics
      description: 'Base search parameter.

        Domains with a Google Analytics tracking code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    hotJarCode:
      in: query
      name: hotjar
      description: 'Base search parameter.

        Hotjar tracking code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    nextPageUrl:
      in: query
      name: next
      description: The URL for the next page of search results, emitted as a `next` field in the response, using the `position` marker.
      schema:
        $ref: '#/components/schemas/BooleanOptInFlag'
    googleAnalytics4Code:
      in: query
      name: ga4
      description: 'Base search parameter.

        Domains with a Google Analytics tracking code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    parsedWhoisFlag:
      name: parsed_whois
      in: query
      description: 'Flag.

        If set to ''true'', includes the full parsed WHOIS record in the response.

        '
      schema:
        $ref: '#/components/schemas/BooleanOptInFlag'
    statCounterProjectCode:
      in: query
      name: statcounter_project
      description: 'Base search parameter.

        Statcounter Project tracker code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    adsense:
      in: query
      name: adsense
      description: 'Base search parameter. Domains with a Google AdSense tracking code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    matomoCode:
      in: query
      name: matomo
      description: 'Base search parameter.

        Matomo tracking code.

        '
      schema:
        $ref: '#/components/schemas/IdentifierString'
    rank:
      in: query
      name: rank
      description: 'Search filter parameter.

        Popularity rank (replaces Alexa ranking).

        '
      schema:
        type: integer
        minimum: 1
    topLevelDomain:
      in: query
      name: tld
      description: 'Search filter parameter.

        Restrict results to domains under the specified top-level domain (TLD).

        '
      schema:
        $ref: '#/components/schemas/TopLevelDomain'
    contactStreet:
      in: query
      name: contact_street
      description: 'Base search parameter.

        Contact street address from domain registration data.

        Supports WHOIS/RDAP Fields Search.

        '
      schema:
        $ref: '#/components/schemas/GenericString'
  responses:
    BadRequest:
      description: '400: Bad Request. The request was invalid. The response will contain details about the error.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: '401: Unauthorized. API credentials are required and were not provided, or the provided credentials are not valid.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: '404: Not Found. The requested resource does not exist.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InvestigateSuccess:
      description: OK
      content:
        application/json:
          schema:
            type: object
            properties:
              response:
                type: object
                properties:
                  limit_exceeded:
                    type: boolean
                  has_more_results:
                    type: boolean
                  message:
                    type: string
                  results_count:
                    type: integer
                  total_count:
                    type: integer
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/InvestigateResult'
                  missing_domains:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApexDomain'
        application/xml:
          schema:
            $ref: '#/components/schemas/XmlResponse'
        text/html:
          schema:
            $ref: '#/components/schemas/HtmlResponse'
    IrisPartialContent:
      description: '206: Partial Content. The response is a subset of the full results. The `has_more_results` field in the response will be `true`.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: '500: Internal Server Error. An unexpected error occurred on the server. If the problem persists, contact DomainTools support.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ServiceUnavailable:
      description: '503: Service Unavailable. The service is temporarily unavailable.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: '403: Forbidden. The API credentials provided do not have access to the requested resource or endpoint.

        '
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    SearchHashToken:
      type: string
      description: 'Opaque token representing a saved search from the Iris Investigate UI.

        Exported via “Search → Export” in the Iris UI.

        Example: `aGVsbG93b3yY2hfaGFzaF9jb2RlJsZF9zZWFcw==`

        '
    Sha1HexString:
      type: string
      description: 'A 40-character hexadecimal SHA-1 hash string, typically used to identify SSL certificates or digital signatures.

        '
      pattern: ^[a-fA-F0-9]{40}$
    DomainRisk:
      type: object
      description: Domain risk assessment including overall score and contributing components.
      properties:
        risk_score:
          $ref: '#/components/schemas/RiskScoreValue'
        components:
          type: array
          description: A list of risk components and their individual scores that contribute to the overall domain risk.
          items:
            $ref: '#/components/schemas/DomainRiskComponent'
    PivotedValue:
      type: object
      properties:
        value:
          oneOf:
          - type: string
          - type: integer
        count:
          type: integer
          format: int64
          description: The number of other domains that share this exact value.
    TopLevelDomain:
      type: string
      minLength: 2
      maxLength: 128
      pattern: ^[a-z]{2,63}(\.[a-z]{2,63})*$
      description: 'A top-level or public suffix domain, such as `com`, `org`, or `co.uk`. Must not include a leading dot.

        '
    PivotedTracker:
      type: object
      description: A tracker identifier and its associated pivot count.
      properties:
        value:
          type: string
        count:
          type: integer
          format: int64
          description: The number of other domains that share this exact value.
    InvestigateRequestParameters:
      type: object
      properties:
        adsense:
          $ref: '#/components/schemas/IdentifierString'
        baidu_analytics:
          $ref: '#/components/schemas/IdentifierString'
        contact_name:
          $ref: '#/components/schemas/GenericString'
        contact_phone:
          $ref: '#/components/schemas/GenericString'
        contact_street:
          $ref: '#/components/schemas/GenericString'
        ip:
          $ref: '#/components/schemas/IPv4Address'
        domain:
          $ref: '#/components/schemas/ApexDomainList'
        email:
          $ref: '#/components/schemas/EmailAddress'
        email_dns_soa:
          $ref: '#/components/schemas/EmailAddress'
        email_domain:
          $ref: '#/components/schemas/ApexDomain'
        historical_free_text:
          $ref: '#/components/schemas/GenericString'
        facebook:
          $ref: '#/components/schemas/IdentifierString'
        ga4:
          $ref: '#/components/schemas/IdentifierString'
        google_analytics:
          $ref: '#/components/schemas/IdentifierString'
        google_tag_manager:
          $ref: '#/components/schemas/IdentifierString'
        hotjar:
          $ref: '#/components/schemas/IdentifierString'
        iana_id:
          $ref: '#/components/schemas/IdentifierString'
        mailserver_domain:
          $ref: '#/components/schemas/ApexDomain'
        mailserver_host:
          $ref: '#/components/schemas/Fqdn'
        mailserver_ip:
          $ref: '#/components/schemas/IPv4Address'
        matomo:
          $ref: '#/components/schemas/IdentifierString'
        nameserver_domain:
          $ref: '#/components/schemas/Hostname'
        nameserver_host:
          $ref: '#/components/schemas/Hostname'
        nameserver_ip:
          $ref: '#/components/schemas/IPv4Address'
        redirect_domain:
          $ref: '#/components/schemas/GenericString'
        registrant:
          $ref: '#/components/schemas/OrgNameString'
        historical_registrant:
          $ref: '#/components/schemas/OrgNameString'
        registrant_org:
          $ref: '#/components/schemas/OrgNameString'
        registrar:
          $ref: '#/components/schemas/OrgNameString'
        search_hash:
          $ref: '#/components/schemas/SearchHashToken'
        server_type:
          $ref: '#/components/schemas/BasicString'
        ssl_alt_names:
          $ref: '#/components/schemas/GenericString'
        ssl_common_name:
          $ref: '#/components/schem

# --- truncated at 32 KB (60 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/domaintools/refs/heads/main/openapi/domaintools-iris-investigate-api-openapi.yml