Validin API Documentation

Welcome to the Validin API documentation. Our APIs provide programmatic access to Validin's DNS, host response, open source threat intelligence, certificate, and registration history, empowering you to automate investigations, enrich your security tools, and gain deeper insights into the structure and connections of the internet.

What can you do with Validin APIs?

• Enrich your security tools: Integrate Validin's data into your SIEM, threat intelligence platform, and other security solutions.
• Automate your workflows: Streamline your security operations by automating tasks such as domain analysis, IP reputation checks, and threat hunting.
• Integrate with your research tools: Configure popular tools like Synapse and Maltego to pull intelligence from Validin via API.

How to get started

• Browse our API documentation: Explore our comprehensive documentation to learn more about each API endpoint and its capabilities.
• Try our interactive API explorer: Experiment with our APIs in real-time and see exact results when logged in. Copy and paste the exact code needed to replicate your API searches.
• Check out our user guide: Read more about what you can do with Validin in our online user guide.
• Create a free community account: Sign up for a Validin community account to try Validin today.

Standard Response

Most query responses use the structure in the following example.

{
  "query_opts": {                     // Inferred or provided query options
    "type": "dom",
    "annotate": false
  },
  "query_key": "example.com",         // Search key
  "status": "finished",
  "records": {                        // Answer hash
    "A": [                            // Type of association mapped to
      {                               // an array of values
        "key": "example.com",         // Key that matched
        "value": "93.184.215.14",     // Value associated with the key
        "value_type": "ip4",          // How the value is interpreted ("dom", "ip4", "ip6", "hash", or "raw")
        "first_seen": 1713463200,     // Unix timestamp of first observation window
        "last_seen": 1727719200       // Unix timestamp of most recent observation window
      }
    ]
  },
  "records_returned": 1,              // Total number of records returned
  "limited": false                    // true if result limited
}