Check that the configured SecurityTrails API key is accepted. Returns only a success flag — use securitytrails_usage for quota figures.

Report this month’s SecurityTrails API consumption against the plan allowance. Call this before a large enumeration to confirm there is remaining quota.

Fetch the current DNS records (A, AAAA, MX, NS, SOA, TXT), hostname counts and registrar metadata for one domain. The best first call when profiling an unfamiliar domain.

List known subdomains of a domain as fully-qualified hostnames, ready to feed into resolution or scanning. Costs one API query regardless of how many hostnames exist, so prefer a single call with a high limit over paging with offset — each page is separately billed. The response always reports total_count and has_more so a truncated result is never mistaken for a complete one.

Find other domains associated with this one through shared registrant details or infrastructure. Useful for expanding scope from a single known domain to an organisation’s wider estate.

Retrieve historical values of one DNS record type for a domain, with the date range each value was observed. The primary tool for spotting infrastructure migrations and origin IPs that predate a CDN.

Fetch the current WHOIS record for a domain: registrar, registrant contacts where not redacted, nameservers, and creation/expiry dates.

Retrieve past WHOIS records for a domain, each with the window it was observed in. Historical records often expose registrant details that have since been redacted behind privacy services.

List SSL/TLS certificates issued for a hostname. Subject alternative names in the results frequently reveal hostnames that subdomain enumeration alone misses. Pass status: "all" to include expired certificates, which are often the more interesting ones historically.

Return SecurityTrails’ classification tags for a domain. Many domains carry no tags at all.

List IP blocks adjacent to the given IPv4 address, with the number of sites and sample hostnames seen on each. Useful for finding sibling infrastructure in the same allocation.

Fetch WHOIS and network-block registration data for one IPv4 address — owning organisation, allocation, and abuse contacts.

List user-agent strings SecurityTrails has observed originating from one IPv4 address, with first and last seen dates. Paginated. Requires a paid SecurityTrails plan — returns a plan error on the free tier.

Look up IP addresses and ranges attributed to the organisation that owns a domain. Takes the company’s primary domain, not a company name. Requires a paid SecurityTrails plan — returns a plan error on the free tier.

Search the domain dataset by structured filter or DSL query. Valid fields include apex_domain, keyword, tld, mx, ns, cname, ipv4, ipv6 and whois_email — for example {"apex_domain": "example.com"} or "whois_email = 'admin@example.com'". Note that the domain and IP datasets accept different field names: IP-only fields such as ptr_part or open_port_80 are a syntax error here, and belong in securitytrails_search_ips. Exactly one of filter or query is required. Each page costs one API query.

Search the IP dataset by DSL query or structured filter — for example "ptr_part = 'example'" or "open_port_80 = true". These IP-dataset fields are distinct from the domain-dataset fields used by securitytrails_search_domains. Exactly one of query or filter is required. Each page costs one API query.

Fetch the next batch of a large search using a scroll id. Only usable when a previous securitytrails_search_domains or securitytrails_search_ips response included meta.scroll_id — scrolling is not enabled on every plan or every query. When no scroll id is offered, page with the page argument instead.