Domain Intelligence BUNDLE · 24 ENDPOINTS

Domain Intelligence Bundle

24 endpoints for WHOIS, ASN, GeoIP, SSL, DNSSEC, CAA, WAF detection, Wayback history, security.txt, social tags, caller-request inspection, and more.

Target Persona & Use Cases:

For security teams, sign-up enrichment pipelines, fraud detection, compliance, SRE audits, OSINT investigations.

Try this bundle View on API docs

24 Endpoints

~6 cr Workflow Band

Bearer Auth Unified Token

MCP Server Compatible

SPECIFICATION

Endpoints in this bundle

Each endpoint is independently callable. Bundle membership is for discovery only — you do not need to opt in.

Method	Endpoint Path	Credits	Operation Summary
POST	/v1/intel/whois	1 cr	WHOIS / RDAP registry record.
POST	/v1/intel/ssl	1 cr	TLS certificate, chain, issuer, and validity.
POST	/v1/intel/asn	1 cr	ASN, announcing organisation, and prefix coverage.
POST	/v1/intel/geoip	1 cr	Country, city, and coordinates from an IP.
POST	/v1/intel/geoip/bulk	1 cr	Batched geoip lookup.
POST	/v1/intel/ip-reputation	1 cr	Tor, cloud, datacenter, and CDN flagging.
GET	/v1/intel/whoami	1 cr	What the internet sees about the caller: IP, geoIP, ASN, reputation, parsed User-Agent, curated header echo. One call replaces five.
POST	/v1/intel/http-versions	1 cr	Detect HTTP/1.1, HTTP/2 (TLS ALPN), and HTTP/3 (Alt-Svc) support, plus TLS version, cipher, and HSTS posture.
POST	/v1/intel/dnssec	1 cr	DNSSEC posture: DNSKEY + DS + AD-flag observations. Honest three-bit verdict, not a single 'valid' bit.
POST	/v1/intel/nameservers	1 cr	Authoritative NS records + each resolved to A/AAAA + /16 diversification flag.
POST	/v1/intel/caa	1 cr	Which CAs may issue certs for the domain. Parses issue/issuewild/iodef and detects deny-all.
POST	/v1/intel/reverse-dns	1 cr	PTR lookup via dns.reversename. IP -> hostname for log enrichment.
POST	/v1/dns/over-https	1 cr	Forward query through Cloudflare 1.1.1.1 or Google 8.8.8.8 via DoH (RFC 8484).
POST	/v1/intel/security-txt	1 cr	Fetch + parse RFC 9116 security.txt (or legacy /security.txt). Flags rfc9116_minimum_compliant.
POST	/v1/intel/social-tags	1 cr	Open Graph + Twitter Card + canonical + title + icons + lang + theme color in one fetch.
POST	/v1/intel/cookies	1 cr	Set-Cookie response headers parsed per RFC 6265. Header-only by design.
POST	/v1/intel/waf	1 cr	WAF/CDN detection from headers + body fingerprints. Cloudflare, Akamai, Fastly, AWS WAF, Imperva, Sucuri, F5, ModSecurity, etc.
POST	/v1/intel/sri-audit	1 cr	External scripts + stylesheets audit with Subresource Integrity coverage. Supply-chain hygiene.
POST	/v1/intel/wayback	1 cr	First + most-recent Wayback Machine snapshots via the Availability API.
POST	/v1/intel/blacklist	1 cr	DNSBL aggregate across known lists.
POST	/v1/intel/cert-transparency-history	1 cr	crt.sh-backed certificate transparency timeline.
POST	/v1/intel/headers	1 cr	HTTP response headers snapshot.
POST	/v1/intel/page	1 cr	HTML summary, meta, and canonical hints.
POST	/v1/enrich/company	1 cr	Company-from-domain enrichment.

PRODUCTION RECIPE

Sign-up enrichment + risk score

Recommended step-by-step workflow sequence for composing these endpoints in production:

Step 1

On signup, take the email domain and call /v1/enrich/company to attach firmographics.

Step 2

Take the request IP and call /v1/intel/ip-reputation plus /v1/intel/geoip — flag Tor, datacenter IPs, and country mismatches against the billing address.

Step 3

If the domain is unknown, run /v1/intel/whois and /v1/intel/cert-transparency-history to check age and CA history. A week-old domain with one DV cert is a fraud signal.

Step 4

Compose into a single risk score and decide allow / step-up / block.

INTEGRATION CODE

Try a request

Pick a language. Copy-pasteable code snippet configured with your standard Bearer token header.

curl -X POST https://api.ollagraph.com/v1/intel/ip-reputation \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"185.220.101.1"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/intel/ip-reputation",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"ip": "185.220.101.1"},
    timeout=15.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/intel/ip-reputation", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ ip: "185.220.101.1" }),
});
console.log(await res.json());

FREQUENTLY ASKED QUESTIONS

Domain Intelligence bundle FAQ

Common questions about rate limits, execution behavior, and parameters for this workflow.

What sources feed ip-reputation?

Tor exit-node lists (live), public datacenter/cloud ASN ranges (refreshed daily), and CDN-owned prefixes. We do not subscribe to commercial threat feeds.

How big can a geoip/bulk batch be?

Up to 1000 IPs per call. We charge one credit per call, not per IP.

Does enrich/company give me employee counts and funding?

Domain, industry, country, and size band only. We do not resell funding-round data.

Previous bundle 4 endpoints

Email Bundle

Email deliverability: verification, SPF / DKIM / DMARC posture, contact extraction, format parsing.

13 endpoints Next bundle

Scraping Bundle

Single, batch, async, smart, and llm-ready scraping, plus extraction, crawl, and captcha solve.

1,000 free credits · No card required

Ship with the Domain Intelligence bundle.

1,000 credits on signup. No card. Every endpoint in this bundle is live from minute one.

Try this bundle View on docs

✓ No credit card required

✓ Flat 1 credit / call base

✓ All 24 endpoints ready