All bundles Domain Intelligence bundle · 24 endpoints

Domain Intelligence

24 endpoints for WHOIS, ASN, GeoIP, SSL, DNSSEC, CAA, WAF detection, Wayback history, security.txt, social tags, caller-request inspection, and more.

For security teams, sign-up enrichment pipelines, fraud detection, compliance, SRE audits, OSINT investigations.

Endpoints in this bundle

Each endpoint is independently callable. Bundle membership is for discovery only — you do not need to opt in.

Method	Path	Credits	Summary
POST	/v1/intel/whois	1	WHOIS / RDAP registry record.
POST	/v1/intel/ssl	1	TLS certificate, chain, issuer, and validity.
POST	/v1/intel/asn	1	ASN, announcing organisation, and prefix coverage.
POST	/v1/intel/geoip	1	Country, city, and coordinates from an IP.
POST	/v1/intel/geoip/bulk	1	Batched geoip lookup.
POST	/v1/intel/ip-reputation	1	Tor, cloud, datacenter, and CDN flagging.
GET	/v1/intel/whoami	1	What the internet sees about the caller: IP, geoIP, ASN, reputation, parsed User-Agent, curated header echo. One call replaces five.
POST	/v1/intel/http-versions	1	Detect HTTP/1.1, HTTP/2 (TLS ALPN), and HTTP/3 (Alt-Svc) support, plus TLS version, cipher, and HSTS posture.
POST	/v1/intel/dnssec	1	DNSSEC posture: DNSKEY + DS + AD-flag observations. Honest three-bit verdict, not a single 'valid' bit.
POST	/v1/intel/nameservers	1	Authoritative NS records + each resolved to A/AAAA + /16 diversification flag.
POST	/v1/intel/caa	1	Which CAs may issue certs for the domain. Parses issue/issuewild/iodef and detects deny-all.
POST	/v1/intel/reverse-dns	1	PTR lookup via dns.reversename. IP -> hostname for log enrichment.
POST	/v1/dns/over-https	1	Forward query through Cloudflare 1.1.1.1 or Google 8.8.8.8 via DoH (RFC 8484).
POST	/v1/intel/security-txt	1	Fetch + parse RFC 9116 security.txt (or legacy /security.txt). Flags rfc9116_minimum_compliant.
POST	/v1/intel/social-tags	1	Open Graph + Twitter Card + canonical + title + icons + lang + theme color in one fetch.
POST	/v1/intel/cookies	1	Set-Cookie response headers parsed per RFC 6265. Header-only by design.
POST	/v1/intel/waf	1	WAF/CDN detection from headers + body fingerprints. Cloudflare, Akamai, Fastly, AWS WAF, Imperva, Sucuri, F5, ModSecurity, etc.
POST	/v1/intel/sri-audit	1	External scripts + stylesheets audit with Subresource Integrity coverage. Supply-chain hygiene.
POST	/v1/intel/wayback	1	First + most-recent Wayback Machine snapshots via the Availability API.
POST	/v1/intel/blacklist	1	DNSBL aggregate across known lists.
POST	/v1/intel/cert-transparency-history	1	crt.sh-backed certificate transparency timeline.
POST	/v1/intel/headers	1	HTTP response headers snapshot.
POST	/v1/intel/page	1	HTML summary, meta, and canonical hints.
POST	/v1/enrich/company	1	Company-from-domain enrichment.

Recipe

Sign-up enrichment + risk score

On signup, take the email domain and call /v1/enrich/company to attach firmographics.
Take the request IP and call /v1/intel/ip-reputation plus /v1/intel/geoip — flag Tor, datacenter IPs, and country mismatches against the billing address.
If the domain is unknown, run /v1/intel/whois and /v1/intel/cert-transparency-history to check age and CA history. A week-old domain with one DV cert is a fraud signal.
Compose into a single risk score and decide allow / step-up / block.

Sample code

Try a request

Pick a language. Click to expand the snippet.

curl

curl -X POST https://api.ollagraph.com/v1/intel/ip-reputation \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"185.220.101.1"}'

python

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/intel/ip-reputation",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"ip": "185.220.101.1"},
    timeout=15.0,
)
print(r.json())

node

const res = await fetch("https://api.ollagraph.com/v1/intel/ip-reputation", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ ip: "185.220.101.1" }),
});
console.log(await res.json());

FAQ

Domain Intelligence bundle FAQ

What sources feed ip-reputation?

Tor exit-node lists (live), public datacenter/cloud ASN ranges (refreshed daily), and CDN-owned prefixes. We do not subscribe to commercial threat feeds.

How big can a geoip/bulk batch be?

Up to 1000 IPs per call. We charge one credit per call, not per IP.

Does enrich/company give me employee counts and funding?

Domain, industry, country, and size band only. We do not resell funding-round data.

Ship with the Domain Intelligence bundle.

1,000 credits on signup. No card. Every endpoint in this bundle is live from minute one.

Try this bundle View on docs