Skip to main content

​
Request

Additional fields include DNS recordDetails (record type, owner name, value and TTL in seconds), IPv4/IPv6 addresses, RDAP contacts and delegation metadata, and up to 25 deduplicated certificate transparency records including the current entry. CT metadata does not prove the certificate is currently served; missing revocation data is null. Passive port results also include associated hostnames, CPE software identifiers, reported CVEs and tags. These are observations, not a live vulnerability assessment. The app supports direct IP/domain pivots and an approximate network-location map when coordinates are available. All business routes use POST /tools/domain-intelligence/<operation> with { "domain": "example.com" }. Domains are lowercased; HTTP(S) URLs, paths and a trailing dot are normalized. Invalid input returns 400 VALIDATION_ERROR. Bearer authentication and a plan with the tools feature are required, including for free operations. No provider credentials are supplied by API consumers. There is no validation-only /search operation for this tool. /risk analyzes the domain string; its score is not a verdict that a domain is malicious. Certificate transparency records are not a live TLS handshake or a guarantee of current revocation status. Missing values do not imply a negative finding. Port results use passive IP observations on the domain’s primary IP, not a live scan or proof that a service belongs exclusively to this domain. The response includes ip, collection: "passive", count and openPorts; service names are null when unknown. No C99 credential is needed for this operation.

​
Full lookup

The response uses { tool, operation, query, data, meta }, where tool is domain-intelligence and query.domain is the normalized domain. /all returns dns, http, ssl, technologies, whois, security, risk, subdomains, emails, ports, reputation, collectedSections and partialErrors.

​
Progressive loading

To load a smaller first view, supply sections to /all:
sections accepts 1 to 11 entries using the collector names above. Duplicates are collected once. Omit it to preserve the full lookup behavior. Unrequested sections are null; collectedSections lists the requested collectors. This option is rejected on split routes. /all still costs 1 core search, regardless of the selected sections. Later split requests have their normal cost. Successful collectors are retained when another fails. Failed collectors are null with { collector, code, message } entries in partialErrors. If every selected collector fails, the request returns a non-2xx error. Provider errors use generic messages, without upstream URLs or credentials.

​
Website history

POST /tools/domain-intelligence/archives is an independent, free operation, not part of /all. Authentication and the tools feature are still required.
Omit year to retrieve available years (newest first). Supply a year from 1996 through the current UTC year to retrieve captures. path defaults to / and must be an exact path without a query, fragment or wildcard. The response includes domain, path, year, years, captures, sampled, granularity, truncated and returnedCount. Captures contain timestamp, date, originalUrl, replayUrl and status. Only successful HTML captures are included, sampled once per year for the year index and once per day for a selected year. These are not total capture counts. Provider responses are bounded to 400 rows; truncated signals the cap. save and sections are not accepted on this route. Archive metadata is cached for 24 hours in production. The app loads the index near the viewport, then the selected year’s dates. Selecting a date opens an isolated fullscreen archive viewer. Archived content is served by Wayback, not proxied through the Osintly application origin. Playback availability and speed depend on the archive; the viewer provides an external fallback link. Upstream throttling returns 503 PROVIDER_RATE_LIMITED with Retry-After: 60; the caller should wait before retrying. Other failures remain 502/504 and are never presented as an empty archive history.

​
Snapshot storage

save: true on /all persists exactly the returned snapshot and exposes meta.savedResult.id. Read it with GET /tools/results/<id> using the same API key and creator. Subsequent split lookups do not modify that snapshot. The app also checks ownership against the signed-in user before reading a saved result. Provider cache is shared by /all and split routes and never changes pricing. DNS is cached for 10 minutes; HTTP, technologies and security files for 30 minutes; certificates for 12 hours; registration and subdomains for 24 hours; emails and ports for 6 hours; geolocation for 7 days; reputation for 30 minutes. Cache is disabled outside production. Errors include 401 for invalid authentication, 403 PLAN_FEATURE_REQUIRED, 429 RATE_LIMIT_EXCEEDED on paid routes, and 502/503/504 for unavailable enrichment. A missing server-side provider configuration returns 503 only when the selected operation requires it. Failed requests do not incur a success usage event.