All bundles Domain Intelligence bundle · 24 endpoints

Domain Intelligence

24 endpoints for WHOIS, ASN, GeoIP, SSL, DNSSEC, CAA, WAF detection, Wayback history, security.txt, social tags, caller-request inspection, and more.

For security teams, sign-up enrichment pipelines, fraud detection, compliance, SRE audits, OSINT investigations.

Endpoints in this bundle

Each endpoint is independently callable. Bundle membership is for discovery only — you do not need to opt in.

Method Path Credits Summary
POST /v1/intel/whois 1 WHOIS / RDAP registry record.
POST /v1/intel/ssl 1 TLS certificate, chain, issuer, and validity.
POST /v1/intel/asn 1 ASN, announcing organisation, and prefix coverage.
POST /v1/intel/geoip 1 Country, city, and coordinates from an IP.
POST /v1/intel/geoip/bulk 1 Batched geoip lookup.
POST /v1/intel/ip-reputation 1 Tor, cloud, datacenter, and CDN flagging.
GET /v1/intel/whoami 1 What the internet sees about the caller: IP, geoIP, ASN, reputation, parsed User-Agent, curated header echo. One call replaces five.
POST /v1/intel/http-versions 1 Detect HTTP/1.1, HTTP/2 (TLS ALPN), and HTTP/3 (Alt-Svc) support, plus TLS version, cipher, and HSTS posture.
POST /v1/intel/dnssec 1 DNSSEC posture: DNSKEY + DS + AD-flag observations. Honest three-bit verdict, not a single 'valid' bit.
POST /v1/intel/nameservers 1 Authoritative NS records + each resolved to A/AAAA + /16 diversification flag.
POST /v1/intel/caa 1 Which CAs may issue certs for the domain. Parses issue/issuewild/iodef and detects deny-all.
POST /v1/intel/reverse-dns 1 PTR lookup via dns.reversename. IP -> hostname for log enrichment.
POST /v1/dns/over-https 1 Forward query through Cloudflare 1.1.1.1 or Google 8.8.8.8 via DoH (RFC 8484).
POST /v1/intel/security-txt 1 Fetch + parse RFC 9116 security.txt (or legacy /security.txt). Flags rfc9116_minimum_compliant.
POST /v1/intel/social-tags 1 Open Graph + Twitter Card + canonical + title + icons + lang + theme color in one fetch.
POST /v1/intel/cookies 1 Set-Cookie response headers parsed per RFC 6265. Header-only by design.
POST /v1/intel/waf 1 WAF/CDN detection from headers + body fingerprints. Cloudflare, Akamai, Fastly, AWS WAF, Imperva, Sucuri, F5, ModSecurity, etc.
POST /v1/intel/sri-audit 1 External scripts + stylesheets audit with Subresource Integrity coverage. Supply-chain hygiene.
POST /v1/intel/wayback 1 First + most-recent Wayback Machine snapshots via the Availability API.
POST /v1/intel/blacklist 1 DNSBL aggregate across known lists.
POST /v1/intel/cert-transparency-history 1 crt.sh-backed certificate transparency timeline.
POST /v1/intel/headers 1 HTTP response headers snapshot.
POST /v1/intel/page 1 HTML summary, meta, and canonical hints.
POST /v1/enrich/company 1 Company-from-domain enrichment.
Recipe

Sign-up enrichment + risk score

  1. On signup, take the email domain and call /v1/enrich/company to attach firmographics.
  2. Take the request IP and call /v1/intel/ip-reputation plus /v1/intel/geoip — flag Tor, datacenter IPs, and country mismatches against the billing address.
  3. If the domain is unknown, run /v1/intel/whois and /v1/intel/cert-transparency-history to check age and CA history. A week-old domain with one DV cert is a fraud signal.
  4. Compose into a single risk score and decide allow / step-up / block.
Sample code

Try a request

Pick a language. Click to expand the snippet.

curl
curl -X POST https://api.ollagraph.com/v1/intel/ip-reputation \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"185.220.101.1"}'
python
import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/intel/ip-reputation",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"ip": "185.220.101.1"},
    timeout=15.0,
)
print(r.json())
node
const res = await fetch("https://api.ollagraph.com/v1/intel/ip-reputation", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ ip: "185.220.101.1" }),
});
console.log(await res.json());
FAQ

Domain Intelligence bundle FAQ

What sources feed ip-reputation?

Tor exit-node lists (live), public datacenter/cloud ASN ranges (refreshed daily), and CDN-owned prefixes. We do not subscribe to commercial threat feeds.

How big can a geoip/bulk batch be?

Up to 1000 IPs per call. We charge one credit per call, not per IP.

Does enrich/company give me employee counts and funding?

Domain, industry, country, and size band only. We do not resell funding-round data.

Ship with the Domain Intelligence bundle.

1,000 credits on signup. No card. Every endpoint in this bundle is live from minute one.

Try this bundle View on docs