# Data & API

URL: https://www.deepinfo.com/data-api/

Snapshot · Last refresh 2026-10-29 20:01 UTC

## Build on the Data Under the Platform.

Deepinfo collects its own internet data, resolves it and keeps what it has observed over time. The index behind the Deepinfo Platform is open to your code: API services answer one question per call, and data feeds hand over whole datasets as files.

[Talk to our data team](https://www.deepinfo.com/contact/?topic=data-api) [API reference](https://docs.deepinfo.com/reference/) · [API catalog (PDF)](https://www.deepinfo.com/downloads/deepinfo-api-catalog.pdf)

### Ask a Question or Take the Dataset.

Both read one index with one `apikey` header. The difference is whether you want an answer or the whole set.

API services

#### Ask the Index, One Call at a Time

REST endpoints for one target or one query per request: live lookups, DNS and WHOIS history, pivots from an IP, mail server, name server or registrant email to every domain behind it, and CVE search with EPSS and CISA KEV.

- Lookups query the target live. History, discovery and CVE search read the index.
- JSON responses. Searches and finders also export JSON or CSV.
- Suits enrichment, investigations and product features that need an answer per request.

[API services](https://www.deepinfo.com/data-api/apis/)

Data feeds

#### Take the Dataset With You

Files for teams that load the data into their own systems: all the domains and subdomains Deepinfo knows about, plus daily files of registered, updated and deleted domains and newly discovered subdomains.

- One file per dataset, as JSON or CSV, with file size, line count and update time.
- Each feed call returns a pre-signed download link, valid for one hour.
- Suits analytics, detection pipelines and products that need the whole set locally.

[Data feeds](https://www.deepinfo.com/data-api/feeds/)

### What the Index Saw in the Last 30 Days.

These counts come from the Domain Intelligence and Vulnerability statistics endpoints, which also feed our Internet Insights pages.

- 10,911,417 domains registered: Last 30 days · Registration Stats
- 17,897 CVEs published: Last 30 days · CVE Stats
- 34 added to CISA KEV: Last 30 days · CISA KEV Stats

[Domain insights](https://www.deepinfo.com/insights/domain/) · [Vulnerability insights](https://www.deepinfo.com/insights/vulnerability/)

### Teams That Build on the Index.

#### [Security Vendors](https://www.deepinfo.com/customers/cybersecurity-ratings-provider/)

Ratings, attack surface and threat intelligence products that need internet-wide data without running their own collection.

#### [Security and Engineering Teams](https://www.deepinfo.com/audience/soc-teams/)

Alert enrichment, detection engineering and internal tools that need an answer about a domain, an IP or a CVE inside a pipeline.

#### [Researchers and Analysts](https://www.deepinfo.com/solutions/use-cases/domain-intelligence-and-research/)

Questions that span the whole namespace, such as which domains share a registrant or a mail server, or how registrations moved this month.

### A Reference Page for Every Endpoint.

Each reference page lists the endpoint’s parameters, response fields, errors and at least one real, sanitized response. The reference is generated from the request collection the team tests against, so the two stay in step.

Endpoint pages include a Try It console and ready-to-run code samples, and each page has a Markdown version for your tools.

[API reference](https://docs.deepinfo.com/reference/) · [Authentication](https://docs.deepinfo.com/getting-started/authentication/)

curl:

```bash
curl "https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com" \
  -H "apikey: $DEEPINFO_API_KEY"
```

Python:

```python
import os, requests

r = requests.get(
    "https://api.deepinfo.com/v1/lookup/whois",
    params={"domain": "deepinfo.com"},
    headers={"apikey": os.environ["DEEPINFO_API_KEY"]},
)
print(r.json()["parsed"]["registrar"])
```

JavaScript:

```javascript
const r = await fetch(
  'https://api.deepinfo.com/v1/lookup/whois?domain=deepinfo.com',
  { headers: { apikey: process.env.DEEPINFO_API_KEY } }
)
const { parsed } = await r.json()
console.log(parsed.registrar)
```

### Use the Index in More Places.

- [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (Module · DSI): The same searches, pivots and lookups inside the Deepinfo Platform, for analysts who would rather not write a query.
- [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) (API · Discovery): Filter the whole domain index on names, WHOIS, DNS, certificates and web data, and export the result.
- [Internet insights](https://www.deepinfo.com/insights/): Live charts of domain registrations and CVE publications, drawn from the index.

### Questions About Data & API

**How is Data & API different from the Deepinfo Platform?**

The platform is where your team works: it discovers your assets, scores what it finds and tracks each issue to resolution. Data & API is direct access to the index underneath it, for your code, pipelines and products.

**Do we need API services or data feeds?**

API services fit when you need an answer about one target or one query at a time, inside a workflow or a product. Data feeds fit when you need the full set of domains or subdomains, or each day’s changes, in your own storage.

**How do access and pricing work?**

Which endpoints and feeds you can use, and your rate limits, depend on your plan. See [pricing](https://www.deepinfo.com/pricing/) for how plans are put together, or [talk to us](https://www.deepinfo.com/contact/) with your use case.

**Can we buy the data without the platform?**

Yes. Data feeds and API services are priced on their own, by volume and frequency, and some customers buy only the data. Others use the platform for their own security team and the data in a product they build.

**Is it the same data the platform uses?**

Yes. The index behind all the modules is the one you query: 400M+ domains, 2B+ subdomains, 200B+ DNS records and 30B+ SSL certificates, plus a CVE database enriched with EPSS, CISA KEV and CWE.

**Can we use the data inside our own product?**

That is how the [cybersecurity ratings provider](https://www.deepinfo.com/customers/cybersecurity-ratings-provider/) in our customer stories uses it. How the data can be used and shown in your product is part of the agreement, so [talk to the data team](https://www.deepinfo.com/contact/?topic=data-api) about your case.

**How do we keep the API key safe?**

Call the API from your own backend and keep the key in an environment variable or a secret store, never in client-side code. Anyone holding the key can spend your quota, so replace an exposed key in the platform and delete the old one.

### Bring Us Your Use Case.

Tell us what you are building. We’ll recommend API services, data feeds or both, and set up access so your team can test against its own targets.

[Talk to our data team](https://www.deepinfo.com/contact/?topic=data-api) [API reference](https://docs.deepinfo.com/reference/)