{"_id":"581a0ff760c12f0f0052aa55","parentDoc":null,"user":"560b40145148ba0d009bd0b5","category":{"_id":"5615790d0f5ed00d00483dd5","__v":19,"pages":["5615790e0f5ed00d00483dd7","561d48e46386060d00e06003","561d48fe31d9630d001eb5bd","561d49b657165b0d00aa5d8b","561d4a879463520d00cd11e2","561d67f48ca8b90d00210234","561d6a0bf0cff80d00ca22c3","561d6c5b071cd60d000d3221","562f9c2543c5570d001fe6bd","56311c99eae7ef0d00270e3d","56311d6702aff217007dba23","56311f96f1c0580d00fac719","563120b7242cda1900198b79","5631229bf1c0580d00fac721","563131559ead230d00a188f6","563134a324014b0d00bd9a4f","5631392082d96a0d00b0fb1d","56313c584b36120d00fdebfb","5642658ef424a10d00118360"],"project":"5615790c0f5ed00d00483dd1","version":"5615790d0f5ed00d00483dd4","sync":{"url":"","isSync":false},"reference":false,"createdAt":"2015-10-07T19:57:01.871Z","from_sync":false,"order":0,"slug":"opendns-investigate-rest-api","title":"Umbrella Investigate REST API"},"version":{"_id":"5615790d0f5ed00d00483dd4","__v":6,"project":"5615790c0f5ed00d00483dd1","createdAt":"2015-10-07T19:57:01.307Z","releaseDate":"2015-10-07T19:57:01.307Z","categories":["5615790d0f5ed00d00483dd5","56157b2af432910d0000f9fe","56157cfb0f5ed00d00483ddb","562684d95db46b1700fd4f48","573b7ea9ef164e2900a2b8ff","582e285d8373c20f00810608"],"is_deprecated":false,"is_hidden":false,"is_beta":false,"is_stable":true,"codename":"","version_clean":"1.0.0","version":"1.0"},"__v":0,"project":"5615790c0f5ed00d00483dd1","updates":[],"next":{"pages":[],"description":""},"createdAt":"2016-11-02T16:10:31.808Z","link_external":false,"link_url":"","githubsync":"","sync_unique":"","hidden":true,"api":{"settings":"","results":{"codes":[]},"auth":"required","params":[],"url":""},"isReference":false,"order":7,"body":"[block:callout]\n{\n  \"type\": \"info\",\n  \"body\": \"This endpoint has been deprecated and replaced by the Domain Status and Categorization endpoint above. Please use the Domain Status endpoint and update any API clients as quickly as possible.\",\n  \"title\": \"IMPORTANT NOTE:\"\n}\n[/block]\nThis API method is the quickest and easiest way to know whether a domain has been flagged as malicious by Umbrella security researchers (score of -1), if it is believed to be safe (score of 1), or if it hasn't been categorized yet (score of 0).\n\nTo query for more than one domain at a time, use the POST example below and post a list of domains as an array. This method will accept up to 1000 domains in a single request.\n\nSample query for a single domain:\n[block:code]\n{\n  \"codes\": [\n    {\n      \"code\": \"curl -H \\\"Authorization: Bearer %YourToken%\\\" \\\"https://investigate.api.umbrella.com/domains/score/example.com\\\"\",\n      \"language\": \"text\"\n    }\n  ]\n}\n[/block]\nSample query for multiple domains:\n[block:code]\n{\n  \"codes\": [\n    {\n      \"code\": \"curl -H \\\"Authorization: Bearer %YourToken%\\\" --request POST \\\"https://investigate.api.umbrella.com/domains/score/\\\" -d '[\\\"example.net\\\",\\\"example.org,\\\",\\\"example.com\\\"]'\",\n      \"language\": \"text\"\n    }\n  ]\n}\n[/block]\n### Parameter for input ###\n[block:parameters]\n{\n  \"data\": {\n    \"h-0\": \"Field\",\n    \"h-1\": \"Type\",\n    \"h-2\": \"Description\",\n    \"0-0\": \"name\",\n    \"0-1\": \"string\",\n    \"0-2\": \"Domain name.\"\n  },\n  \"cols\": 3,\n  \"rows\": 1\n}\n[/block]\n### Returned value for output if Success 200 ###\n[block:parameters]\n{\n  \"data\": {\n    \"h-0\": \"Field\",\n    \"h-1\": \"Type\",\n    \"h-2\": \"Description\",\n    \"0-0\": \"score\",\n    \"0-1\": \"string\",\n    \"0-2\": \"The score will be \\\"-1\\\" if the domain is believed to be malicious, \\\"1\\\" if the domain is believed to be benign, \\\"0\\\" if it hasn't been classified yet.\"\n  },\n  \"cols\": 3,\n  \"rows\": 1\n}\n[/block]\n\n[block:html]\n{\n  \"html\": \"<div class=\\\"api-code-block\\\">\\n  <div class=\\\"api-code-block__header\\\">\\n    <span class=\\\"api-code-block__header__label\\\">GET</span> https://investigate.api.umbrella.com/domains/score/name\\n  </div>\\n  <div class=\\\"api-code-block__section\\\">\\n    <div class=\\\"api-code-block__section__header\\\">REQUEST</div>\\n    <pre>\\n    curl --include \\\\\\n     --header \\\"Authorization: Bearer %YourToken%\\\" \\\\\\nhttps://investigate.api.umbrella.com/domains/score/{name}\\n    </pre>\\n  </div>\\n  <div class=\\\"api-code-block__section\\\">\\n    <div class=\\\"api-code-block__section__header\\\">RESPONSE <em>(HTTP 200, Content-Type: application/json)</em>\\n    </div>\\n    <pre>\\n{\\n  \\\"example.com\\\": 1\\n}\\n    </pre>\\n  </div>\\n</div>\"\n}\n[/block]\n\n[block:html]\n{\n  \"html\": \"<div class=\\\"api-code-block\\\">\\n  <div class=\\\"api-code-block__header\\\">\\n    <span class=\\\"api-code-block__header__label\\\">POST</span> https://investigate.api.umbrella.com/domains/score/\\n  </div>\\n  <div class=\\\"api-code-block__section\\\">\\n    <div class=\\\"api-code-block__section__header\\\">REQUEST</div>\\n    <pre>\\n    curl --include \\\\\\n     --request POST\\n     --header \\\"Authorization: Bearer %YourToken%\\\" \\\\\\n     --data-binary \\\"[\\\\\\\"example.org\\\\\\\", \\\\\\\"example.net\\\\\\\", \\\\\\\"example.com\\\\\\\"]\\\" \\\\\\nhttps://investigate.api.umbrella.com/domains/score/{name}\\n    </pre>\\n  </div>\\n  <div class=\\\"api-code-block__section\\\">\\n    <div class=\\\"api-code-block__section__header\\\">RESPONSE <em></em>\\n    </div>\\n    <pre>\\n{\\n  \\\"example.net\\\": 1,\\n  \\\"example.org\\\": 1,\\n  \\\"example.com\\\": 1\\n}\\n    </pre>\\n  </div>\\n</div>\"\n}\n[/block]\n---\n[Domain Status and Categorization](https://docs.umbrella.com/developer/investigate-api/domain-status-and-categorization-1/) < Domain Scores > [Pattern Search](https://docs.umbrella.com/developer/investigate-api/pattern-search-1/)","excerpt":"","slug":"domain-scores-1","type":"basic","title":"Domain Scores"}
[block:callout] { "type": "info", "body": "This endpoint has been deprecated and replaced by the Domain Status and Categorization endpoint above. Please use the Domain Status endpoint and update any API clients as quickly as possible.", "title": "IMPORTANT NOTE:" } [/block] This API method is the quickest and easiest way to know whether a domain has been flagged as malicious by Umbrella security researchers (score of -1), if it is believed to be safe (score of 1), or if it hasn't been categorized yet (score of 0). To query for more than one domain at a time, use the POST example below and post a list of domains as an array. This method will accept up to 1000 domains in a single request. Sample query for a single domain: [block:code] { "codes": [ { "code": "curl -H \"Authorization: Bearer %YourToken%\" \"https://investigate.api.umbrella.com/domains/score/example.com\"", "language": "text" } ] } [/block] Sample query for multiple domains: [block:code] { "codes": [ { "code": "curl -H \"Authorization: Bearer %YourToken%\" --request POST \"https://investigate.api.umbrella.com/domains/score/\" -d '[\"example.net\",\"example.org,\",\"example.com\"]'", "language": "text" } ] } [/block] ### Parameter for input ### [block:parameters] { "data": { "h-0": "Field", "h-1": "Type", "h-2": "Description", "0-0": "name", "0-1": "string", "0-2": "Domain name." }, "cols": 3, "rows": 1 } [/block] ### Returned value for output if Success 200 ### [block:parameters] { "data": { "h-0": "Field", "h-1": "Type", "h-2": "Description", "0-0": "score", "0-1": "string", "0-2": "The score will be \"-1\" if the domain is believed to be malicious, \"1\" if the domain is believed to be benign, \"0\" if it hasn't been classified yet." }, "cols": 3, "rows": 1 } [/block] [block:html] { "html": "<div class=\"api-code-block\">\n <div class=\"api-code-block__header\">\n <span class=\"api-code-block__header__label\">GET</span> https://investigate.api.umbrella.com/domains/score/name\n </div>\n <div class=\"api-code-block__section\">\n <div class=\"api-code-block__section__header\">REQUEST</div>\n <pre>\n curl --include \\\n --header \"Authorization: Bearer %YourToken%\" \\\nhttps://investigate.api.umbrella.com/domains/score/{name}\n </pre>\n </div>\n <div class=\"api-code-block__section\">\n <div class=\"api-code-block__section__header\">RESPONSE <em>(HTTP 200, Content-Type: application/json)</em>\n </div>\n <pre>\n{\n \"example.com\": 1\n}\n </pre>\n </div>\n</div>" } [/block] [block:html] { "html": "<div class=\"api-code-block\">\n <div class=\"api-code-block__header\">\n <span class=\"api-code-block__header__label\">POST</span> https://investigate.api.umbrella.com/domains/score/\n </div>\n <div class=\"api-code-block__section\">\n <div class=\"api-code-block__section__header\">REQUEST</div>\n <pre>\n curl --include \\\n --request POST\n --header \"Authorization: Bearer %YourToken%\" \\\n --data-binary \"[\\\"example.org\\\", \\\"example.net\\\", \\\"example.com\\\"]\" \\\nhttps://investigate.api.umbrella.com/domains/score/{name}\n </pre>\n </div>\n <div class=\"api-code-block__section\">\n <div class=\"api-code-block__section__header\">RESPONSE <em></em>\n </div>\n <pre>\n{\n \"example.net\": 1,\n \"example.org\": 1,\n \"example.com\": 1\n}\n </pre>\n </div>\n</div>" } [/block] --- [Domain Status and Categorization](https://docs.umbrella.com/developer/investigate-api/domain-status-and-categorization-1/) < Domain Scores > [Pattern Search](https://docs.umbrella.com/developer/investigate-api/pattern-search-1/)