DomainTools Iris Investigate API

openapi: 3.2.0
info:
  title: DomainTools Iris Iris Investigate API
  version: 1.0.0
  description: 'The OpenAPI spec for DomainTools Iris endpoints.

    '
  contact:
    name: DomainTools Support
    url: https://www.domaintools.com/support
    email: enterprisesupport@domaintools.com
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  termsOfService: https://www.domaintools.com/company/terms-of-service/
servers:
- description: DomainTools APIs
  url: https://api.domaintools.com
security:
- header_auth: []
- open_key_auth: []
- hmac_auth: []
tags:
- name: Iris Investigate
  description: 'The Iris Investigate API is ideally suited for investigate and orchestrate use cases at human scale. Identify threats, map adversary infrastructure, and streamline investigations.

    '
paths:
  /v1/iris-investigate/:
    get:
      operationId: getIrisInvestigate
      summary: 'Returns data from a GET request.

        Parameters are identified in descriptions as either base or filter.

        Search with base parameters and filter down base results with filter parameters.

        '
      tags:
      - Iris Investigate
      description: 'Consider using POST for complex requests.

        '
      parameters:
      - $ref: '#/components/parameters/adsense'
      - $ref: '#/components/parameters/baiduCode'
      - $ref: '#/components/parameters/contactName'
      - $ref: '#/components/parameters/contactPhone'
      - $ref: '#/components/parameters/contactStreet'
      - $ref: '#/components/parameters/domainLastIp'
      - $ref: '#/components/parameters/domainsQuery'
      - $ref: '#/components/parameters/emailAny'
      - $ref: '#/components/parameters/emailDnsSoa'
      - $ref: '#/components/parameters/emailDomain'
      - $ref: '#/components/parameters/facebookCode'
      - $ref: '#/components/parameters/googleAnalytics4Code'
      - $ref: '#/components/parameters/googleAnalyticsCode'
      - $ref: '#/components/parameters/googleTagManagerCode'
      - $ref: '#/components/parameters/hotJarCode'
      - $ref: '#/components/parameters/ianaId'
      - $ref: '#/components/parameters/mailserverDomain'
      - $ref: '#/components/parameters/mailserverHost'
      - $ref: '#/components/parameters/mailserverIp'
      - $ref: '#/components/parameters/matomoCode'
      - $ref: '#/components/parameters/nameserverDomain'
      - $ref: '#/components/parameters/nameserverHost'
      - $ref: '#/components/parameters/nameserverIp'
      - $ref: '#/components/parameters/redirectDomain'
      - $ref: '#/components/parameters/registrant'
      - $ref: '#/components/parameters/registrantHistoricalWhois'
      - $ref: '#/components/parameters/registrantOrg'
      - $ref: '#/components/parameters/registrar'
      - $ref: '#/components/parameters/searchHash'
      - $ref: '#/components/parameters/serverType'
      - $ref: '#/components/parameters/sslAltNames'
      - $ref: '#/components/parameters/sslCommonName'
      - $ref: '#/components/parameters/sslDuration'
      - $ref: '#/components/parameters/sslEmail'
      - $ref: '#/components/parameters/sslHash'
      - $ref: '#/components/parameters/sslOrg'
      - $ref: '#/components/parameters/sslSubject'
      - $ref: '#/components/parameters/sslIssuerCommonName'
      - $ref: '#/components/parameters/statCounterProjectCode'
      - $ref: '#/components/parameters/statCounterSecurityCode'
      - $ref: '#/components/parameters/taggedWithAll'
      - $ref: '#/components/parameters/taggedWithAny'
      - $ref: '#/components/parameters/websiteTitle'
      - $ref: '#/components/parameters/whoisFreeText'
      - $ref: '#/components/parameters/whoisHistoricalFreeText'
      - $ref: '#/components/parameters/yandexCode'
      - $ref: '#/components/parameters/active'
      - $ref: '#/components/parameters/createDate'
      - $ref: '#/components/parameters/createDateWithin'
      - $ref: '#/components/parameters/expirationDate'
      - $ref: '#/components/parameters/firstSeenSince'
      - $ref: '#/components/parameters/firstSeenWithin'
      - $ref: '#/components/parameters/ipCountryCode'
      - $ref: '#/components/parameters/notTaggedWithAll'
      - $ref: '#/components/parameters/notTaggedWithAny'
      - $ref: '#/components/parameters/rank'
      - $ref: '#/components/parameters/riskScore'
      - $ref: '#/components/parameters/sslNotAfter'
      - $ref: '#/components/parameters/sslNotBefore'
      - $ref: '#/components/parameters/topLevelDomain'
      - $ref: '#/components/parameters/parsedDomainRdapFlag'
      - $ref: '#/components/parameters/parsedWhoisFlag'
      - $ref: '#/components/parameters/nextPageUrl'
      - $ref: '#/components/parameters/responseFormat'
      - $ref: '#/components/parameters/resultsPageSize'
      - $ref: '#/components/parameters/resultsPosition'
      - $ref: '#/components/parameters/resultsSortBy'
      - $ref: '#/components/parameters/resultsSortDirection'
      - $ref: '#/components/parameters/appName'
      - $ref: '#/components/parameters/appPartner'
      - $ref: '#/components/parameters/appVersion'
      responses:
        '200':
          $ref: '#/components/responses/InvestigateSuccess'
        '206':
          $ref: '#/components/responses/IrisPartialContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      externalDocs:
        url: https://docs.domaintools.com/api/iris/
    post:
      operationId: postIrisInvestigate
      summary: Returns data from a POST request.
      tags:
      - Iris Investigate
      description: 'The GET method is available for simple queries.


        The POST method supports two request formats:


        - **Form parameters** (application/x-www-form-urlencoded): Traditional parameter-based searches

        - **IrisQL** (text/plain): Complex queries using IrisQL query language for advanced filtering and OR logic


        For IrisQL usage and syntax, see the [IrisQL API Guide](https://docs.domaintools.com/api/iris/investigate/irisql/).

        '
      requestBody:
        $ref: '#/components/requestBodies/Investigate'
      responses:
        '200':
          $ref: '#/components/responses/InvestigateSuccess'
        '206':
          $ref: '#/components/responses/IrisPartialContent'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      externalDocs:
        url: https://docs.domaintools.com/api/iris/
components:
  schemas:
    IdentifierString:
      type: string
      minLength: 1
      maxLength: 128
      description: A short identifier, code, or handle.
    OrgNameString:
      type: string
      minLength: 1
      maxLength: 256
      pattern: ^[\p{L}\p{N} .,\-&()'/"]+$
      description: 'A human-readable organization name as used in WHOIS or RDAP records, such as a registrar, registrant, or sponsoring organization.

        Supports Unicode letters and numbers, along with common punctuation.

        '
    PivotedTracker:
      type: object
      description: A tracker identifier and its associated pivot count.
      properties:
        value:
          type: string
        count:
          type: integer
          format: int64
          description: The number of other domains that share this exact value.
    RiskScoreValue:
      type: integer
      minimum: 0
      maximum: 100
      description: A domain risk score value ranging from 0 (lowest risk) to 100 (highest risk).
    BasicString:
      type: string
      minLength: 1
      maxLength: 255
      description: A non-empty string with a standard length limit.
    DomainRisk:
      type: object
      description: Domain risk assessment including overall score and contributing components.
      properties:
        risk_score:
          $ref: '#/components/schemas/RiskScoreValue'
        components:
          type: array
          description: A list of risk components and their individual scores that contribute to the overall domain risk.
          items:
            $ref: '#/components/schemas/DomainRiskComponent'
    ThreatProfileMalware:
      type: object
      required:
      - name
      - risk_score
      properties:
        name:
          type: string
          description: The type of risk component.
          enum:
          - threat_profile_malware
        risk_score:
          $ref: '#/components/schemas/RiskScoreValue'
        evidence:
          type: array
          description: Optional array of evidence types supporting the risk score for this component.
          items:
            type: string
      description: Indicates risk based on a machine-learning model that classifies domains as malware-related.
    SearchHashToken:
      type: string
      description: 'Opaque token representing a saved search from the Iris Investigate UI.

        Exported via “Search → Export” in the Iris UI.

        Example: `aGVsbG93b3yY2hfaGFzaF9jb2RlJsZF9zZWFcw==`

        '
    ApexDomainList:
      type: string
      pattern: ^([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}(,([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,})*$
      description: A comma-separated list of one or more apex domains to investigate.
    ThreatProfilePhishing:
      type: object
      required:
      - name
      - risk_score
      properties:
        name:
          type: string
          description: The type of risk component.
          enum:
          - threat_profile_phishing
        risk_score:
          $ref: '#/components/schemas/RiskScoreValue'
        evidence:
          type: array
          description: Optional array of evidence types supporting the risk score for this component.
          items:
            type: string
      description: Indicates risk based on a machine-learning model that classifies domains as phishing-related.
    DateOperatorsFilter:
      type: string
      description: 'A date in YYYY-MM-DD format, optionally prefixed with an operator (`>`, `>=`, `<`, `<=`) for comparison.

        Example: `<=2025-01-01`

        '
      pattern: ^(>|>=|<|<=)?\d{4}-\d{2}-\d{2}$
    PositionToken:
      type: string
      description: 'An opaque string token used for cursor-based pagination.

        Returned in the `position` field of a paginated response when `has_more_results` is true, and used as a query parameter to retrieve the next result set.

        Example: `2c056abadfb64b67ba18896af2c5b900`

        '
    BaseSslInfo:
      type: object
      description: A template for SSL certificate information blocks.
      properties:
        hash: {}
        subject: {}
        organization: {}
        email:
          type: array
          items:
            type: string
        alt_names:
          type: array
          items: {}
        sources:
          type: object
          properties:
            active:
              type: integer
            passive:
              type: integer
        common_name: {}
        issuer_common_name: {}
        not_after: {}
        not_before: {}
        duration: {}
    Proximity:
      type: object
      required:
      - name
      - risk_score
      properties:
        name:
          type: string
          description: The type of risk component.
          enum:
          - proximity
        risk_score:
          $ref: '#/components/schemas/RiskScoreValue'
        evidence:
          type: array
          description: Optional array of evidence types supporting the risk score for this component.
          items:
            type: string
          example:
          - dns
      description: Indicates risk based on proximity to known threats or suspicious infrastructure.
    Fqdn:
      type: string
      format: hostname
      description: 'A Fully Qualified Domain Name (FQDN), including subdomains (e.g., www.example.com).

        Must be a valid DNS hostname per RFC 1123, excluding trailing dot.

        '
      minLength: 1
      maxLength: 253
      pattern: ^(?=.{1,253}$)(?:(?!-)[a-zA-Z0-9-]{1,63}(?<!-)\.)+[a-zA-Z]{2,63}$
    ResponseFormat:
      type: string
      enum:
      - html
      - json
      - xml
      description: 'The desired response format.

        '
    SslSubjectDnString:
      type: string
      minLength: 1
      maxLength: 1024
      description: 'A distinguished name (DN) string representing the Subject field of an SSL certificate.

        Typically includes components like CN, O, C, ST, and L in a comma-separated format.

        Example: `C=US, ST=California, L=San Francisco, O=Example Corp, CN=example.com`

        '
    TopLevelDomain:
      type: string
      minLength: 2
      maxLength: 128
      pattern: ^[a-z]{2,63}(\.[a-z]{2,63})*$
      description: 'A top-level or public suffix domain, such as `com`, `org`, or `co.uk`. Must not include a leading dot.

        '
    TimeWindowSeconds:
      type: integer
      format: int64
      minimum: 1
      description: 'A positive integer representing a time window, in seconds.

        Used to filter results based on how recently an event occurred.

        '
    CommaSeparatedTags:
      type: string
      description: 'A comma-separated list of tag names.

        Tags are matched exactly and compared case-insensitively

        unless otherwise specified.

        '
      maxLength: 512
    HtmlResponse:
      type: string
      description: 'HTML-formatted response body. JSON is the primary documented format; HTML response schemas are not individually documented.

        '
    BooleanOptInFlag:
      type: boolean
      description: 'An optional boolean flag that enables a specific feature or response extension when set to `true`.

        If `false` or omitted, the feature is ignored.

        '
    Hostname:
      type: string
      format: hostname
      description: A valid, fully-qualified domain name (FQDN).
    GenericString:
      type: string
      description: A generic and unconstrained string value.
    DomainProfileTemplate:
      type: object
      description: A comprehensive template defining the complete structure of a domain profile. Specific data types are defined in inheriting schemas.
      properties:
        domain:
          type: string
        whois_url:
          type: string
        adsense: {}
        alexa:
          type: integer
        popularity_rank:
          type: number
        active:
          type: boolean
        google_analytics: {}
        ga4:
          type: array
          items: {}
        gtm_codes:
          type: array
          items: {}
        fb_codes:
          type: array
          items: {}
        hotjar_codes:
          type: array
          items: {}
        baidu_codes:
          type: array
          items: {}
        yandex_codes:
          type: array
          items: {}
        matomo_codes:
          type: array
          items: {}
        statcounter_project_codes:
          type: array
          items: {}
        statcounter_security_codes:
          type: array
          items: {}
        admin_contact:
          $ref: '#/components/schemas/BaseContact'
        billing_contact:
          $ref: '#/components/schemas/BaseContact'
        registrant_contact:
          $ref: '#/components/schemas/BaseContact'
        technical_contact:
          $ref: '#/components/schemas/BaseContact'
        create_date: {}
        expiration_date: {}
        email_domain:
          type: array
          items: {}
        soa_email:
          type: array
          items: {}
        ssl_email:
          type: array
          items: {}
        additional_whois_email:
          type: array
          items: {}
        ip:
          type: array
          items:
            type: object
            properties:
              address: {}
              asn:
                type: array
                items: {}
              country_code: {}
              isp: {}
        mx:
          type: array
          items:
            type: object
            properties:
              host: {}
              domain: {}
              ip:
                type: array
                items: {}
              priority:
                type: number
        name_server:
          type: array
          items:
            type: object
            properties:
              host: {}
              domain: {}
              ip:
                type: array
                items: {}
        domain_risk:
          $ref: '#/components/schemas/DomainRisk'
        redirect: {}
        redirect_domain: {}
        registrant_name: {}
        registrant_org: {}
        registrar: {}
        registrar_status:
          type: array
          items:
            type: string
        spf_info:
          type: string
        ssl_info:
          type: array
          items:
            $ref: '#/components/schemas/BaseSslInfo'
        tld:
          type: string
        website_response:
          type: number
        data_updated_timestamp:
          type: string
          description: ISO 8601 datetime when the domain data was last updated.
        website_title: {}
        server_type: {}
        first_seen: {}
        tags:
          type: array
          items:
            type: object
            properties:
              label:
                type: string
              scope:
                type: string
              tagged_at:
                type: string
        parsed_whois:
          $ref: '#/components/schemas/ParsedWhois'
        parsed_domain_rdap:
          $ref: '#/components/schemas/ParsedDomainRdap'
    DomainRiskComponent:
      description: A polymorphic schema representing one of several types of risk components.
      oneOf:
      - $ref: '#/components/schemas/Proximity'
      - $ref: '#/components/schemas/ThreatProfile'
      - $ref: '#/components/schemas/ThreatProfileMalware'
      - $ref: '#/components/schemas/ThreatProfilePhishing'
      - $ref: '#/components/schemas/ThreatProfileSpam'
      - $ref: '#/components/schemas/ZeroListedScore'
      discriminator:
        propertyName: name
        mapping:
          proximity: '#/components/schemas/Proximity'
          threat_profile: '#/components/schemas/ThreatProfile'
          threat_profile_malware: '#/components/schemas/ThreatProfileMalware'
          threat_profile_phishing: '#/components/schemas/ThreatProfilePhishing'
          threat_profile_spam: '#/components/schemas/ThreatProfileSpam'
          zerolist: '#/components/schemas/ZeroListedScore'
    XmlResponse:
      type: string
      description: 'XML-formatted response body. JSON is the primary documented format; XML response schemas are not individually documented.

        '
    DateFilter:
      type: string
      format: date
      description: 'A calendar date in the format YYYY-MM-DD, per RFC 3339 (full-date).

        Does not include a time or timezone.

        '
    IPv4Address:
      type: string
      format: ipv4
      description: A standard IPv4 address.
    InvestigateResult:
      allOf:
      - $ref: '#/components/schemas/DomainProfileTemplate'
      properties:
        adsense:
          $ref: '#/components/schemas/PivotedTracker'
        google_analytics:
          $ref: '#/components/schemas/PivotedTracker'
        ga4:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        gtm_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        fb_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        hotjar_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        baidu_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        yandex_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        matomo_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        statcounter_project_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        statcounter_security_codes:
          type: array
          items:
            $ref: '#/components/schemas/PivotedTracker'
        admin_contact:
          $ref: '#/components/schemas/PivotedContact'
        billing_contact:
          $ref: '#/components/schemas/PivotedContact'
        registrant_contact:
          $ref: '#/components/schemas/PivotedContact'
        technical_contact:
          $ref: '#/components/schemas/PivotedContact'
        create_date:
          $ref: '#/components/schemas/PivotedValue'
        expiration_date:
          $ref: '#/components/schemas/PivotedValue'
        email_domain:
          type: array
          items:
            $ref: '#/components/schemas/PivotedValue'
        soa_email:
          type: array
          items:
            $ref: '#/components/schemas/PivotedValue'
        ssl_email:
          type: array
          items:
            $ref: '#/components/schemas/PivotedValue'
        additional_whois_email:
          type: array
          items:
            $ref: '#/components/schemas/PivotedValue'
        ip:
          type: array
          items:
            type: object
            properties:
              address:
                $ref: '#/components/schemas/PivotedValue'
              asn:
                type: array
                items:
                  $ref: '#/components/schemas/PivotedValue'
              country_code:
                $ref: '#/components/schemas/PivotedValue'
              isp:
                $ref: '#/components/schemas/PivotedValue'
        mx:
          type: array
          items:
            type: object
            properties:
              host:
                $ref: '#/components/schemas/PivotedValue'
              domain:
                $ref: '#/components/schemas/PivotedValue'
              ip:
                type: array
                items:
                  $ref: '#/components/schemas/PivotedValue'
              priority:
                type: number
        name_server:
          type: array
          items:
            type: object
            properties:
              host:
                $ref: '#/components/schemas/PivotedValue'
              domain:
                $ref: '#/components/schemas/PivotedValue'
              ip:
                type: array
                items:
                  $ref: '#/components/schemas/PivotedValue'
        redirect:
          $ref: '#/components/schemas/PivotedValue'
        redirect_domain:
          $ref: '#/components/schemas/PivotedValue'
        registrant_name:
          $ref: '#/components/schemas/PivotedValue'
        registrant_org:
          $ref: '#/components/schemas/PivotedValue'
        registrar:
          $ref: '#/components/schemas/PivotedValue'
        server_type:
          $ref: '#/components/schemas/PivotedValue'
        first_seen:
          $ref: '#/components/schemas/PivotedValue'
        website_title:
          $ref: '#/components/schemas/PivotedValue'
        ssl_info:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/BaseSslInfo'
            properties:
              hash:
                $ref: '#/components/schemas/PivotedValue'
              subject:
                $ref: '#/components/schemas/PivotedValue'
              organization:
                $ref: '#/components/schemas/PivotedValue'
              alt_names:
                type: array
                items:
                  $ref: '#/components/schemas/PivotedValue'
              common_name:
                $ref: '#/components/schemas/PivotedValue'
              issuer_common_name:
                $ref: '#/components/schemas/PivotedValue'
              not_after:
                $ref: '#/components/schemas/PivotedValue'
              not_before:
                $ref: '#/components/schemas/PivotedValue'
              duration:
                $ref: '#/components/schemas/PivotedValue'
    EmailAddress:
      type: string
      format: email
      maxLength: 254
      description: 'A valid email address, as defined by RFC 5322 and commonly used in WHOIS, SSL certificates, RDAP records, or domain registration contacts.

        '
    ApexDomain:
      type: string
      description: A base (apex) domain like example.com, excluding subdomains.
      pattern: ^(?!\-)(?:[a-zA-Z0-9-]{1,63}\.)+[a-zA-Z]{2,63}$
    ZeroListedScore:
      type: object
      required:
      - name
      - risk_score
      properties:
        name:
          type: string
          description: The type of risk component.
          enum:
          - zerolist
        risk_score:
          type: integer
          description: The risk score for a zerolisted domain, which is always 0.
          enum:
          - 0
      description: Indicates the domain is on a known-good 'zero list' and is not considered a threat.
    MaxDaysSince:
      type: integer
      minimum: 1
      description: A positive integer representing the maximum number of days.
    TimestampFilter:
      title: Timestamp filter
      description: "Defines a point in time for filtering results.\n\nAccepts one of:\n\n  - relative time, in negative seconds\n\n  - absolute time, in an ISO 8601 timestamp\n"
      oneOf:
      - type: integer
        minimum: -432000
        maximum: -1
        description: 'Relative offset in seconds before the current UTC time.


          Must be between -1 (1 second ago) and -432000 (5 days ago).

          '
      - type: string
        pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$
        format: date-time
        description: 'ISO 8601 datetime in UTC format with no milliseconds or timezone offset. Format: `YYYY-MM-DDTHH:MM:SSZ`.


          The timestamp must represent a point between *1 second ago* and *5 days ago*, relative to the current UTC time.

          '
    Sha1HexString:
      type: string
      description: 'A 40-character hexadecimal SHA-1 hash string, typically used to identify SSL certificates or digital signatures.

        '
      pattern: ^[a-fA-F0-9]{40}$
    ThreatProfileSpam:
      type: object
      required:
      - name
      - risk_score
      properties:
        name:
          type: string
          description: The type of risk component.
          enum:
          - threat_profile_spam
        risk_score:
          $ref: '#/components/schemas/RiskScoreValue'
        evidence:
          type: array
          description: Optional array of evidence types supporting the risk score for this component.
          items:
            type: string
      description: Indicates risk based on a machine-learning model that classifies domains as spam-related.
    WhoisContact:
      type: object
      description: Contact details from a WHOIS record.
      properties:
        name:
          $ref: '#/components/schemas/PivotedValue'
        org:
          $ref: '#/components/schemas/PivotedValue'
        street:
          $ref: '#/components/schemas/PivotedValue'
        city:
          $ref: '#/components/schemas/PivotedValue'
        state:
          $ref: '#/components/schemas/PivotedValue'
        postal:
          $ref: '#/components/schemas/PivotedValue'
        country:
          $ref: '#/components/schemas/PivotedValue'
        phone:
          $ref: '#/components/schemas/PivotedValue'
        fax:
          $ref: '#/components/schemas/PivotedValue'
        email:
          type: array
          items:
            $ref: '#/components/schemas/PivotedValue'
    InvestigateRequestParameters:
      type: object
      properties:
        adsense:
          $ref: '#/components/schemas/IdentifierString'
        baidu_analytics:
          $ref: '#/components/schemas/IdentifierString'
        contact_name:
          $ref: '#/components/schemas/GenericString'
        contact_phone:
          $ref: '#/components/schemas/GenericString'
        contact_street:
          $ref: '#/components/schemas/GenericString'
        ip:
          $ref: '#/components/schemas/IPv4Address'
        domain:
          $ref: '#/components/schemas/ApexDomainList'
        email:
          $ref: '#/components/schemas/EmailAddress'
        email_dns_soa:
          $ref: '#/components/schemas/EmailAddress'
        email_domain:
          $ref: '#/components/schemas/ApexDomain'
        historical_free_text:
          $ref: '#/components/schemas/GenericString'
        facebook:
          $ref: '#/components/schemas/IdentifierString'
        ga4:
          $ref: '#/components/schemas/IdentifierString'
        google_analytics:
          $ref: '#/components/schemas/IdentifierString'
        google_tag_manager:
          $ref: '#/components/schemas/IdentifierString'
        hotjar:
          $ref: '#/components/schemas/IdentifierString'
        iana_id:
          $ref: '#/components/schemas/IdentifierString'
        mailserver_domain:
          $ref: '#/components/schemas/ApexDomain'
        mailserver_host:
          $ref: '#/components/schemas/Fqdn'
        mailserver_ip:
          $ref: '#/components/schemas/IPv4Address'
        matomo:
          $ref: '#/components/schemas/IdentifierString'
        nameserver_domain:
          $ref: '#/components/schemas/Hostname'
        nameserver_host:
          $ref: '#/components/schemas/Hostname'
        nameserver_ip:
          $ref: '#/components/schemas/IPv4Address'
        redirect_domain:
          $ref: '#/components/schemas/GenericString'
        registrant:
          $ref: '#/components/schemas/OrgNameString'
        historical_registrant:
          $ref: '#/components/schemas/OrgNameString'
        registrant_org:
          $ref: '#/components/schemas/OrgNameString'
        registrar:
          $ref: '#/components/schemas/OrgNameString'
        search_hash:
          $ref: '#/components/schemas/SearchHashToken'
        server_type:
          $ref: '#/components/schemas/BasicString'
        ssl_alt_names:
          $ref: '#/components/schemas/GenericString'
        ssl_common_name:
          $ref: '#/components/schemas/GenericString'
        ssl_duration:
          type: integer
          minimum: 1
        ssl_email:
          $ref: '#/components/schemas/EmailAddress'
        ssl_hash:
          $ref: '#/components/schemas/Sha1HexString'
        ssl_org:
          $ref: '#/components/schemas/OrgNameString'
        ssl_subject:
          $ref: '#/components/schemas/SslSubjectDnString'
        ssl_issuer_common_name:
          $ref: '#/components/schemas/GenericString'
        statcounter_project:
          $ref: '#/components/schemas/IdentifierString'
        statcounter_security:
          $ref: '#/components/schemas/IdentifierString'
        tagged_with_all:
          $ref: '#/components/schemas/GenericString'
        tagged_with_any:
          $ref: '#/components/schemas/GenericString'
        website_title:
          $ref: '#/components/schemas/WebsiteTitleString'
        whois:
          $ref: '#/components/schemas/GenericString'
        yandex_metrica:
          $ref: '#/components/schemas/IdentifierString'
        active:
          type: boolean
        create_date:
          $ref: '#/components/schemas/DateOperatorsFilter'
        create_date_within:
          $ref: '#/components/schemas/MaxDaysSince'
        expiration_date:
          $ref: '#/components/schemas/DateFilter'
        first_seen_since:
          $ref: '#/components/schemas/TimestampFilter'
        first_seen_within:
          $ref: '#/components/schemas/TimeWindowSeconds'
        ip_country_code:
          type: string
          pattern: ^[A-Z]{2}$
        rank:
          type: integer
          minimum: 1
        risk_score:
          type: integer
          minimum: 0
          maximum: 100
        ssl_not_after:
          $ref: '#/components/schemas/DateFilter'
        ssl_not_before:
          $ref: '#/components/schemas/DateFilter'
        not_tagged_with_all:
          $ref: '#/components/schemas/CommaSeparatedTags'
        not_tagged_with_any:
          $ref: '#/components/schemas/CommaSeparatedTags'
        tld:
          $ref: '#/components/schemas/TopLevelDomain'
        parsed_domain_rdap:
          $ref:

# --- truncated at 32 KB (61 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/domaintools/refs/heads/main/openapi/domaintools-iris-investigate-api-openapi.yml