{"type":"api","title":"Get Resource Records for Domain","meta":{"id":"/apps/pubhub/media/legacy-umbrella-api/bf58de618cbb72dda8f39b0414ce94c0a15cd467/f963d12c-70c5-3340-bb7c-d5cff60c643a","info":{"title":"Investigate API","description":"Umbrella Investigate API","version":"1.1.4","contact":{"name":"Cloud Security Developer Community"}},"security":[{"bearerAuth":[]}],"tags":[{"name":"Domain Status and Categorization"},{"name":"Domain Volume"},{"name":"Co-occurrences for a Domain"},{"name":"Passive DNS"},{"name":"Tagging Timeline"},{"name":"Subdomains for a Domain"},{"name":"Related Domains for a Domain"},{"name":"Security Information for a Domain"},{"name":"AS Information for a Domain"},{"name":"WHOIS Information for a Domain"},{"name":"Umbrella Popularity List-Top Million Domains"},{"name":"Search Domain"},{"name":"Cisco Secure Malware Analytics Integration"}],"x-parser-conf":{"overview":{"markdownPath":"investigate/investigate-explorer-overview.md"}},"openapi":"3.0.0","servers":[{"url":"https://investigate.api.umbrella.com"}],"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}}},"spec":{"summary":"Get Resource Records for Domain","operationId":"getPassiveDNSDomain","tags":["Passive DNS"],"description":"Returns the Resource Record (RR) data for DNS responses, and categorization data, where the answer (or rdata) is the domain(s).","parameters":[{"name":"domain","in":"path","required":true,"description":"A domain name. For example, 'cisco.com'.","schema":{"type":"string"},"$$ref":"#/components/parameters/domainParam"},{"name":"limit","in":"query","required":false,"description":"The number of records to return in the collection.\nThe default limit is 500 records. The maximum number of records\nreturned for all requests to the endpoint is 10,000.\n","schema":{"type":"integer"},"$$ref":"#/components/parameters/limitRecordsParam"},{"name":"offset","in":"query","required":false,"description":"A number that represents an index into the collection. By default, the offset is 0 (the first record).","schema":{"type":"integer"},"$$ref":"#/components/parameters/offsetParam"},{"name":"sortorder","in":"query","required":false,"description":"Sort records by ascending (asc) or descending (desc) order. By default, the records are returned in descending order.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"},"$$ref":"#/components/parameters/sortorderParam"},{"name":"sortby","in":"query","required":false,"description":"Sort records by one of the following fields: minTtl, maxTtl, firstSeen, or lastSeen.","schema":{"type":"string","enum":["minTtl","maxTtl","firstSeen","lastSeen"]},"$$ref":"#/components/parameters/sortbyParam"},{"name":"recordType","in":"query","required":false,"description":"The type of records. For example: 'A', 'CNAME', 'NS', 'MX'.\nUse commas to separate multiple types of record.","schema":{"type":"string"},"$$ref":"#/components/parameters/recordTypeParam"},{"name":"includefeatures","in":"query","required":false,"description":"Specify 'true' to add feature sections to the response. The default value is 'false'.","schema":{"type":"boolean"},"$$ref":"#/components/parameters/includeFeaturesParam"},{"name":"minFirstSeen","in":"query","required":false,"description":"Returns only records with firstSeen \u003e= minFirstSeen.","schema":{"type":"integer","format":"int64"},"$$ref":"#/components/parameters/minFirstSeenParam"},{"name":"maxFirstSeen","in":"query","required":false,"description":"Returns only records with firstSeen \u003c= maxFirstSeen.","schema":{"type":"integer","format":"int64"},"$$ref":"#/components/parameters/maxFirstSeenParam"},{"name":"minLastSeen","in":"query","required":false,"description":"Returns only records with lastSeen \u003e= minLastSeen.","schema":{"type":"integer","format":"int64"},"$$ref":"#/components/parameters/minLastSeenParam"},{"name":"maxLastSeen","in":"query","required":false,"description":"Returns only records with lastSeen \u003c= maxLastSeen.","schema":{"type":"integer","format":"int64"},"$$ref":"#/components/parameters/maxLastSeenParam"},{"name":"sortCategories","in":"query","required":false,"description":"Comma-separated list of security categories or 'All'. 'All' stands for all security categories.\nRecords which have at least one of these security categories will be first in the ordering.\nThe rest of the sorting parameters are applied within the records with and without any of\nthe security categories.","schema":{"type":"string"},"$$ref":"#/components/parameters/sortCategoriesParam"},{"name":"requiredCategories","in":"query","required":false,"description":"Filter for records with security categories.\nThe case-sensitive security category strings are: Drive-by Downloads/Exploits, Mobile Threats,\nDynamic DNS, High Risk Sites and Locations, Command and Control, Malware, Phishing,\nNewly Seen Domains, Potentially Harmful,\nDNS Tunneling VPN, and Cryptomining. Use commas to separate multiple security category strings.","schema":{"type":"string"},"$$ref":"#/components/parameters/requiredCategoriesParam"}],"responses":{"200":{"description":"Everything worked as expected.","content":{"application/json":{"schema":{"type":"array","items":{"properties":{"minTtl":{"type":"integer","format":"int64","description":"The minimum TTL for the record in seconds."},"maxTtl":{"type":"integer","format":"int64","description":"The maximum TTL for the record in seconds."},"firstSeen":{"type":"integer","format":"int64","description":"The first time Umbrella related the domain for the resource record, specified\nin Unix Epoch time."},"lastSeen":{"type":"integer","format":"int64","description":"The last time Umbrella related the domain for the resource record, specified\nin Unix Epoch time."},"name":{"type":"string","description":"The name of the query."},"type":{"type":"string","description":"The DNS record type. For example: A, CNAME, NS, MX."},"securityCategories":{"type":"array","items":{"type":"string"},"description":"The Umbrella security categories, if any, that match the domain."},"contentCategories":{"type":"array","items":{"type":"string"},"description":"The Umbrella content categories, if any, that match the domain."},"firstSeenISO":{"type":"string","description":"The first time Umbrella related the domain for the resource record,\nspecified in ISO date and time format."},"lastSeenISO":{"type":"string","description":"The last time Umbrella related the domain for the resource record,\nspecified in ISO date and time format."}},"$$ref":"#/components/schemas/Record"},"$$ref":"#/components/schemas/Records"},"example":[{"minTtl":3600,"maxTtl":3600,"firstSeen":1482339360,"lastSeen":1482339360,"name":"coinhive.com","type":"CNAME","rr":"www.coinhive.com.","securityCategories":["Potentially Harmful","Cryptomining"],"contentCategories":[],"firstSeenISO":"2016-12-21T16:56Z","lastSeenISO":"2016-12-21T16:56Z"}]}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/400Error"},"401":{"description":"Unauthorized request","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/401Error"},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/403Error"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/404Error"},"500":{"description":"Server error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}}}}},"$$ref":"#/components/responses/500Error"}},"__originalOperationId":"getPassiveDNSDomain","security":[{"bearerAuth":[]}],"method":"get","path":"/pdns/domain/{domain}"}}