Developers

One GET gets you a domain record with no key. Everything else on this page says where the rest of the documentation is.

issued.live publishes three things about a domain: registration data where we hold it, Certificate Transparency observations, and DNS. The corpus covers more than 420 million domains and grows as the logs and the zone feeds move. Every field is an observation with a date on it.

Which API do I want?

Plan	What it covers	Cost	Documentation
Free	Domain lookups, /api/stats and /api/feed. 1,000 requests a day per client address, resetting at 00:00 UTC. No account, no key.	$0	/developers/api
Basic	The same endpoints with the daily cap lifted, metered at 60 requests a minute, plus the daily downloadable files as csv.zst and json.zst.	$29 a month	/developers/feeds
Pro	Everything in Basic at 300 requests a minute, plus reverse IP and range lookups, pattern search, batch lookup, certificate and SPKI pivots, JA4X fingerprints, DNS per vantage point and the provisioning feed.	$149 a month	/developers/pro

Free calls are capped at 1,000 a day per client address and the count resets at 00:00 UTC; inside the last 100, replies carry an X-RateLimit-Warning header so a client learns of the cap before it meets it. Basic calls the same endpoints as the free tier with the cap lifted, so the public API page is its reference too. Full plan comparison and limits are on pricing.

Quickstart: one call, no key

One HTTP GET returns the current record for a domain. Paste the call into a shell and it works as it stands.

$ curl https://issued.live/github.com

The response:

{
  "domain": "github.com",
  "registered": "2007-10-09T18:20:50Z",
  "expires": "2026-10-09T18:20:50Z",
  "ssl_expires": "2026-12-26T23:59:59Z",
  "ssl_cert": "9F53ECDDF913AFBA5678C924A95149D2",
  "ssl_issuer": "Amazon",
  "ip": "140.82.113.4",
  "last_update": "2026-09-14T08:07:30Z",
  "first_cert_seen": null,
  "tracked": false
}

One URL serves both representations, and four things decide which. The .json suffix or ?format=json asks for JSON outright; an Accept header naming application/json and not text/html asks for it too; failing both, a User-Agent beginning curl, Wget, HTTPie, python-requests, Go-http-client, libwww-perl, axios or okhttp gets JSON. Everything else gets the HTML page, a browser included.

Subdomains fold to their registrable domain, so www.github.com and github.com return one record. A null means we hold no value for that field.

Where the reference lives

Public API: free lookups and the Basic plan

/developers/api documents the domain lookup in full: every response field, the error codes, the rate-limit headers and worked examples in curl, PHP, Node.js, Python, Go and more.

Pro API: reverse IP, search and certificate pivots

/developers/pro covers the keyed endpoints under /api/v1: reverse IP and CIDR lookups, pattern search, batch lookup, certificate and SPKI pivots, and the newly registered domain feed.

Feeds and files: daily downloads

/developers/feeds lists the downloadable files with their columns and schedule: a daily delta of what changed, and a periodic full snapshot for seeding a new system. Paging an API for the whole corpus costs both sides more than one download.

Markdown, llms.txt and MCP

Append .md to a domain record or a prose page for a markdown representation. A language model quotes that far more accurately than a page wrapped in navigation and CSS.

$ curl -sS https://issued.live/github.com.md

/llms.txt maps what is worth fetching. Markdown URLs are noindex and canonicalize to the HTML page, so they stand as a second representation of one document. The site root answers curl issued.live with a short plain-text usage summary, so an agent that lands there can read what to do next.

MCP server at POST /mcp

issued.live speaks the Model Context Protocol at https://issued.live/mcp, as JSON-RPC 2.0 over HTTP POST. The server is stateless and mints no session id, so every request stands alone and there is nothing to resume.

$ curl -sS -X POST https://issued.live/mcp \
    -H "Content-Type: application/json" \
    -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Three tools work with no key: lookup_domain, recent_certificates and corpus_stats. Three take a key on the MCP request itself: domains_on_ip, domains_in_range and new_domains. A keyed tool called without one answers HTTP 200 with a tool error naming the fix, which a model can read out loud.

Authentication

The free surface takes no credential at all. Domain lookups, /api/stats and /api/feed answer any client and never return 401. Send a User-Agent that identifies you, so we have a way to reach you if something you run causes a problem.

Paid endpoints read the key from the Authorization header as Bearer <key>. A missing or unrecognized key returns 401 with WWW-Authenticate: Bearer realm="issued.live" and the body {"error":"unauthorized","message":"Supply a key as: Authorization: Bearer <key>"}. Sign in at login to read your key once a plan is active, and pricing lists what each plan opens up.

$ curl -sS -H "Authorization: Bearer $ISSUED_KEY" \
    https://issued.live/api/v1/ip/140.82.113.4

If a limit blocks legitimate work, or something documented here behaves differently in practice, tell us.

↑ Top