--- title: Domaintools slug: connectors/domaintools docTags: createdAt: 2026-06-09T16:29:33.140Z --- DomainTools provides domain and DNS-based threat intelligence to help organizations investigate and monitor domain names. DomainTools is a leading provider of domain and DNS-based cyber threat intelligence. This connector enables Swimlane Turbine users to automate the enrichment and investigation of domain-related data, enhancing threat detection and response capabilities. By integrating DomainTools, users can efficiently monitor domain activities, assess domain reputations, and retrieve historical domain data, all within the Swimlane platform. This integration empowers security teams to streamline their workflows, reduce manual efforts, and make informed decisions based on comprehensive domain intelligence. ## Prerequisites Before you can use the DomainTools connector for Turbine, you'll need access to the DomainTools API. This requires the following: - API key authentication using the following parameters: - URL: The endpoint URL for accessing DomainTools API services. - API Key: A unique key provided by DomainTools to authenticate API requests. ## Capabilities The DomainTools Connector has the following capabilities: - Add and Remove Domain Watchlist - Get Brand Monitor - Get Domain Profile - Get Hosting History - Get Reputation - Get Reverse IP - Get Reverse WhoIS - Get WhoIS - Get WhoIS History ## Additional Documentation - [Domaintools Connector Documentation](https://docs.swimlane.com/connectors/domaintools) - [Domaintools API Documentation](https://api.domaintools.com/) # Configurations ## DomainTools Intelligence API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | api\_username | Username | string | Optional | | api\_key | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add and Remove Domain Watchlist Add or remove domains from the DomainTools Watchlist to track recent DNS or Whois changes. Requires 'watchlist\_domain\_ids' and 'state'. ### Endpoint - **URL:** `/v1/iris-detect/domains/` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | --------------------------------------------------------------------- | | `watchlist_domain_ids` | array | Optional | ID(s) of domains being triaged. | | `state` | string | Optional | Add domains to Watchlist or ignore and mute alerts for those domains. | ### Input Example `{"json_body":{"watchlist_domain_ids":["AaLMA1oOE0"],"state":"watched"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `watchlist_domains` | array | Output field: watchlist\_domains | | `watchlist_domains.state` | string | Output field: watchlist\_domains.state | | `watchlist_domains.domain` | string | Output field: watchlist\_domains.domain | | `watchlist_domains.discovered_date` | string | Date value | | `watchlist_domains.changed_date` | string | Date value | | `watchlist_domains.id` | string | Unique identifier | | `watchlist_domains.assigned_by` | string | Output field: watchlist\_domains.assigned\_by | | `watchlist_domains.assigned_date` | string | Date value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"watchlist_domains":[{}]}}` ## Brand Monitor Search new domain registrations globally for names containing a specified brand or string using DomainTools. Requires a query parameter. ### Endpoint - **URL:** `v1/mark-alert` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------- | | `parameters.query` | string | Required | Parameters for the Brand Monitor action | ### Input Example `{"parameters":{"query":"domaintools"}}` ## Domain Profile Retrieve basic registration details and a preview of extended data for a specified domain using DomainTools. Requires the domain as a path parameter. ### Endpoint - **URL:** `/v1/{{domain}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------- | | `path_parameters.domain` | string | Required | Parameters for the Domain Profile action | ### Input Example `{"path_parameters":{"domain":"domaintools.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.response` | object | Response data | | `data.response.registrant` | object | Response data | | `data.response.registrant.name` | string | Response data | | `data.response.registrant.domains` | number | Response data | | `data.response.registrant.product_url` | string | Response data | | `data.response.server` | object | Response data | | `data.response.server.ip_address` | string | Response data | | `data.response.server.other_domains` | number | Response data | | `data.response.server.product_url` | string | Response data | | `data.response.registration` | object | Response data | | `data.response.registration.created` | string | Response data | | `data.response.registration.expires` | string | Response data | | `data.response.registration.updated` | string | Response data | | `data.response.registration.registrar` | string | Response data | | `data.response.registration.statuses` | array | Response data | | `data.response.name_servers` | array | Response data | | `data.response.name_servers.server` | string | Response data | | `data.response.name_servers.product_url` | string | Response data | | `data.response.history` | object | Response data | | `data.response.history.registrar` | object | Response data | | `data.response.history.registrar.earliest_event` | string | Response data | | `data.response.history.registrar.events` | number | Response data | | `data.response.history.registrar.product_url` | string | Response data | ### Output Example `{"data":{"response":{"registrant":{},"server":{},"registration":{},"name_servers":[],"history":{},"seo":{},"website_data":{}}},"response_text":"string"}` ## Domain Reputation Retrieve a risk score for a specified domain from DomainTools, aiding in the assessment of its reputation. ### Endpoint - **URL:** `v1/reputation` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.domain` | string | Required | Parameters for the Domain Reputation action | ### Input Example `{"parameters":{"domain":"domaintools.com"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.response` | object | Response data | | `data.response.domain` | string | Response data | | `data.response.risk_score` | number | Response data | | `response_text` | string | Output field: response\_text | | `reason` | string | Response reason phrase | ### Output Example `{"data":{"response":{"domain":"string","risk_score":123}},"response_text":"string"}` ## Hosting History Retrieve a domain's registrar, IP, and name server changes over time using DomainTools' Hosting History API. Requires the domain as a path parameter. ### Endpoint - **URL:** `v1/{{domain}}/hosting-history` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ----------------------------------------- | | `path_parameters.domain` | string | Required | Parameters for the Hosting History action | ### Input Example `{"path_parameters":{"domain":"domaintools.com"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.response` | object | Response data | | `data.response.domain_name` | string | Response data | | `data.response.ip_history` | array | Response data | | `data.response.ip_history.domain` | string | Response data | | `data.response.ip_history.post_ip` | string | Response data | | `data.response.ip_history.pre_ip` | string | Response data | | `data.response.ip_history.action` | string | Response data | | `data.response.ip_history.actiondate` | string | Response data | | `data.response.ip_history.action_in_words` | string | Response data | | `data.response.registrar_history` | array | Response data | | `data.response.registrar_history.domain` | string | Response data | | `data.response.registrar_history.date_updated` | string | Response data | | `data.response.registrar_history.date_created` | string | Response data | | `data.response.registrar_history.date_expires` | string | Response data | | `data.response.registrar_history.date_lastchecked` | string | Response data | | `data.response.registrar_history.registrar` | string | Response data | | `data.response.registrar_history.registrartag` | string | Response data | | `data.response.nameserver_history` | array | Response data | | `data.response.nameserver_history.domain` | string | Response data | | `data.response.nameserver_history.action` | string | Response data | | `data.response.nameserver_history.actiondate` | string | Response data | | `data.response.nameserver_history.action_in_words` | string | Response data | | `data.response.nameserver_history.post_mns` | string | Response data | ### Output Example `{"data":{"response":{"domain_name":"Example Name","ip_history":[],"registrar_history":[],"nameserver_history":[]}},"response_text":"string"}` ## Iris Detect New Retrieve a list of monitors and their respective IDs associated with the current DomainTools account. ### Endpoint - **URL:** `v1/iris-detect/domains/new/` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ----------------------------------------- | | `parameters.monitor_id` | string | Optional | Parameters for the Iris Detect New action | | `parameters.escalation_types` | array | Optional | Parameters for the Iris Detect New action | | `parameters.tlds` | array | Optional | Parameters for the Iris Detect New action | | `parameters.risk_score_ranges` | array | Optional | Parameters for the Iris Detect New action | | `parameters.mx_exists` | boolean | Optional | Parameters for the Iris Detect New action | | `parameters.domain_state` | string | Optional | Parameters for the Iris Detect New action | | `parameters.discovered_since` | string | Optional | Parameters for the Iris Detect New action | | `parameters.changed_since` | string | Optional | Parameters for the Iris Detect New action | | `parameters.escalated_since` | string | Optional | Parameters for the Iris Detect New action | | `parameters.search` | string | Optional | Parameters for the Iris Detect New action | | `parameters.sort` | array | Optional | Parameters for the Iris Detect New action | | `parameters.order` | string | Optional | Parameters for the Iris Detect New action | | `parameters.offset` | number | Optional | Parameters for the Iris Detect New action | | `parameters.limit` | number | Optional | Parameters for the Iris Detect New action | | `parameters.preview` | boolean | Optional | Parameters for the Iris Detect New action | ### Input Example `{"parameters":{"monitor_id":"string","escalation_types":["string"],"tlds":["string"],"risk_score_ranges":["string"],"mx_exists":true,"domain_state":"string","discovered_since":"string","changed_since":"string","escalated_since":"string","search":"string","sort":["string"],"order":"string","offset":123,"limit":123,"preview":true}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `watchlist_domains` | array | Output field: watchlist\_domains | | `watchlist_domains.file_name` | string | Name of the resource | | `watchlist_domains.file` | string | Output field: watchlist\_domains.file | | `total_count` | number | Count value | | `count` | number | Count value | | `offset` | number | Output field: offset | | `limit` | number | Output field: limit | ### Output Example `{"watchlist_domains":[{"file_name":"Example Name","file":"string"}],"total_count":123,"count":123,"offset":123,"limit":123}` ## Iris Enrich Retrieve historical WhoIs information for a specified domain from DomainTools. Requires the domain parameter. ### Endpoint - **URL:** `/v1/iris-enrich` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------- | | `parameters.domain` | string | Required | Parameters for the Iris Enrich action | ### Input Example `{"parameters":{"domain":"google.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.response` | object | Response data | | `data.response.limit_exceeded` | boolean | Response data | | `data.response.message` | string | Response data | | `data.response.results_count` | number | Response data | | `data.response.results` | array | Response data | | `data.response.results.domain` | string | Response data | | `data.response.results.whois_url` | string | Response data | | `data.response.results.adsense` | object | Response data | | `data.response.results.adsense.value` | string | Response data | | `data.response.results.alexa` | number | Response data | | `data.response.results.popularity_rank` | number | Response data | | `data.response.results.active` | boolean | Response data | | `data.response.results.google_analytics` | object | Response data | | `data.response.results.google_analytics.value` | string | Response data | | `data.response.results.admin_contact` | object | Response data | | `data.response.results.admin_contact.name` | object | Response data | | `data.response.results.admin_contact.org` | object | Response data | | `data.response.results.admin_contact.street` | object | Response data | | `data.response.results.admin_contact.city` | object | Response data | | `data.response.results.admin_contact.state` | object | Response data | | `data.response.results.admin_contact.postal` | object | Response data | | `data.response.results.admin_contact.country` | object | Response data | | `data.response.results.admin_contact.phone` | object | Response data | ### Output Example `{"data":{"response":{"limit_exceeded":true,"message":"string","results_count":123,"results":[],"missing_domains":[]}},"response_text":"string"}` ## Iris Investigate Orchestrate and investigate domain-related use cases at human scale with DomainTools. ### Endpoint - **URL:** `v1/iris-investigate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.active` | boolean | Optional | Parameters for the Iris Investigate action | | `parameters.adsense` | string | Optional | Parameters for the Iris Investigate action | | `parameters.create_date` | string | Optional | Parameters for the Iris Investigate action | | `parameters.data_updated_after` | string | Optional | Parameters for the Iris Investigate action | | `parameters.domain` | string | Optional | Parameters for the Iris Investigate action | | `parameters.email` | string | Optional | Parameters for the Iris Investigate action | | `parameters.email_domain` | string | Optional | Parameters for the Iris Investigate action | | `parameters.expiration_date` | string | Optional | Parameters for the Iris Investigate action | | `parameters.google_analytics` | string | Optional | Parameters for the Iris Investigate action | | `parameters.ip` | string | Optional | Parameters for the Iris Investigate action | | `parameters.mailserver_domain` | string | Optional | Parameters for the Iris Investigate action | | `parameters.mailserver_host` | string | Optional | Parameters for the Iris Investigate action | | `parameters.mailserver_ip` | string | Optional | Parameters for the Iris Investigate action | | `parameters.nameserver_domain` | string | Optional | Parameters for the Iris Investigate action | | `parameters.nameserver_host` | string | Optional | Parameters for the Iris Investigate action | | `parameters.nameserver_ip` | string | Optional | Parameters for the Iris Investigate action | | `parameters.not_tagged_with_all` | string | Optional | Parameters for the Iris Investigate action | | `parameters.not_tagged_with_any` | string | Optional | Parameters for the Iris Investigate action | | `parameters.position` | string | Optional | Parameters for the Iris Investigate action | | `parameters.redirect_domain` | string | Optional | Parameters for the Iris Investigate action | | `parameters.registrant` | string | Optional | Parameters for the Iris Investigate action | | `parameters.registrant_org` | string | Optional | Parameters for the Iris Investigate action | | `parameters.registrar` | string | Optional | Parameters for the Iris Investigate action | | `parameters.search_hash` | string | Optional | Parameters for the Iris Investigate action | | `parameters.ssl_email` | string | Optional | Parameters for the Iris Investigate action | ### Input Example `{"parameters":{"active":true,"adsense":"string","create_date":"string","data_updated_after":"string","domain":"string","email":"user@example.com","email_domain":"string","expiration_date":"string","google_analytics":"string","ip":"string","mailserver_domain":"string","mailserver_host":"string","mailserver_ip":"string","nameserver_domain":"Example Name","nameserver_host":"Example Name","nameserver_ip":"Example Name","not_tagged_with_all":"string","not_tagged_with_any":"string","position":"string","redirect_domain":"string","registrant":"string","registrant_org":"string","registrar":"string","search_hash":"string","ssl_email":"string","ssl_hash":"string","ssl_org":"string","ssl_subject":"string","tagged_with_all":"string","tagged_with_any":"string","tld":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------- | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response` | object | Output field: response | | `response.limit_exceeded` | boolean | Output field: response.limit\_exceeded | | `response.has_more_results` | boolean | Result of the operation | | `response.message` | string | Response message | | `response.results_count` | number | Result of the operation | | `response.total_count` | number | Count value | | `response.results` | array | Result of the operation | | `response.results.domain` | string | Result of the operation | | `response.results.whois_url` | string | URL endpoint for the request | | `response.results.adsense` | object | Result of the operation | | `response.results.adsense.value` | string | Value for the parameter | | `response.results.adsense.count` | number | Result of the operation | | `response.results.alexa` | number | Result of the operation | | `response.results.popularity_rank` | string | Result of the operation | | `response.results.active` | boolean | Result of the operation | | `response.results.google_analytics` | object | Result of the operation | | `response.results.google_analytics.value` | string | Value for the parameter | | `response.results.google_analytics.count` | number | Result of the operation | | `response.results.admin_contact` | object | Result of the operation | | `response.results.admin_contact.name` | object | Name of the resource | | `response.results.admin_contact.name.value` | string | Name of the resource | | `response.results.admin_contact.name.count` | number | Name of the resource | | `response.results.admin_contact.org` | object | Result of the operation | ### Output Example `{"response":{"limit_exceeded":true,"has_more_results":true,"message":"string","results_count":123,"total_count":123,"results":[{}],"missing_domains":[{}]}}` ## Reverse IP Retrieve a list of domain names hosted on the same IP address using DomainTools, requiring 'domain' as a path parameter. ### Endpoint - **URL:** `v1/{{domain}}/reverse-ip` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------ | | `path_parameters.domain` | string | Required | Parameters for the Reverse IP action | ### Input Example `{"path_parameters":{"domain":"domaintools.com"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.response` | object | Response data | | `data.response.ip_addresses` | array | Response data | | `data.response.ip_addresses.ip_address` | string | Response data | | `data.response.ip_addresses.domain_count` | number | Response data | | `data.response.ip_addresses.domain_names` | array | Response data | | `data.response.ip_addresses.domain_names.file_name` | string | Response data | | `data.response.ip_addresses.domain_names.file` | string | Response data | | `response_text` | string | Output field: response\_text | | `reason` | string | Response reason phrase | ### Output Example `{"data":{"response":{"ip_addresses":[]}},"response_text":"string"}` ## Reverse WhoIs Retrieve domain names with matching registrant information using DomainTools' Reverse Whois API. Requires specific search terms. ### Endpoint - **URL:** `v1/reverse-whois` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------------------------------- | | `parameters.terms` | string | Required | Parameters for the Reverse WhoIs action | | `parameters.mode` | string | Optional | Parameters for the Reverse WhoIs action | ### Input Example `{"parameters":{"terms":"DomainTools LLC|Seattle","mode":"purchase"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.response` | object | Response data | | `data.response.domain_count` | object | Response data | | `data.response.domain_count.current` | number | Response data | | `data.response.domain_count.historic` | number | Response data | | `data.response.report_price` | object | Response data | | `data.response.report_price.current` | number | Response data | | `data.response.report_price.historic` | number | Response data | | `data.response.domains` | array | Response data | | `response_text` | string | Output field: response\_text | | `reason` | string | Response reason phrase | ### Output Example `{"data":{"response":{"domain_count":{},"report_price":{},"domains":[]}},"response_text":"string"}` ## Who Is Retrieve WHOIS information for a specified IP address using DomainTools. ### Endpoint - **URL:** `/v1/{{ip}}/whois` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Who Is action | ### Input Example `{"path_parameters":{"ip":"8.8.8.8"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | --------------------------------------------- | | `response` | object | Output field: response | | `response.registrant` | string | Output field: response.registrant | | `response.registration` | object | Output field: response.registration | | `response.registration.created` | string | Output field: response.registration.created | | `response.registration.expires` | string | Output field: response.registration.expires | | `response.registration.updated` | string | Output field: response.registration.updated | | `response.registration.registrar` | string | Output field: response.registration.registrar | | `response.registration.statuses` | array | Status value | | `response.name_servers` | array | Name of the resource | | `response.whois` | object | Output field: response.whois | | `response.whois.date` | string | Date value | | `response.whois.record` | string | Output field: response.whois.record | | `response.record_source` | string | Output field: response.record\_source | ### Output Example `{"response":{"registrant":"string","registration":{"created":"2024-01-01T00:00:00Z","expires":"string","updated":"2024-01-01T00:00:00Z","registrar":"string","statuses":[]},"name_servers":["string"],"whois":{"date":"2024-01-01T00:00:00Z","record":"string"},"record_source":"string"}}` ## WhoIs History Retrieve the latest historical WHOIS records for a domain, sorted by record date in descending order. Requires the domain as a path parameter. ### Endpoint - **URL:** `v1/{{domain}}/whois/history` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------- | | `path_parameters.domain` | string | Required | Parameters for the WhoIs History action | ### Input Example `{"path_parameters":{"domain":"domaintools.com"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.response` | object | Response data | | `data.response.record_count` | number | Response data | | `data.response.history` | array | Response data | | `data.response.history.date` | string | Response data | | `data.response.history.is_private` | number | Response data | | `data.response.history.whois` | object | Response data | | `data.response.history.whois.registrant` | string | Response data | | `data.response.history.whois.registration` | object | Response data | | `data.response.history.whois.name_servers` | array | Response data | | `data.response.history.whois.server` | string | Response data | | `data.response.history.whois.record` | string | Response data | | `response_text` | string | Output field: response\_text | | `reason` | string | Response reason phrase | ### Output Example `{"data":{"response":{"record_count":123,"history":[]}},"response_text":"string"}` # Response Headers | **Header** | **Description** | **Example** | | ----------------- | ---------------------------------------------------------- | ----------------------------- | | Cache-Control | Directives for caching mechanisms | | | Content-Encoding | HTTP response header: Content-Encoding | | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT | | Expires | The date/time after which the response is considered stale | | | Pragma | HTTP response header: Pragma | | | Server | Information about the software used by the origin server | | | Set-Cookie | HTTP response header: Set-Cookie | | | Transfer-Encoding | HTTP response header: Transfer-Encoding | | | Vary | HTTP response header: Vary | | | X-TIME | HTTP response header: X-TIME | |