Documentation

Intelligence API

Security Accelerated exposes domain and IP intelligence through a single REST surface tuned for operational triage, enrichment, and automation.

https://api.securityaccelerated.com v0.74.1

support@securityaccelerated.com

Quickstart

Your first request

One endpoint, one header, one array naming what you want. Everything below this section is detail you can come back for.

curl -X POST https://api.securityaccelerated.com/v1/domain/lookup \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: your-api-key' \
  -d '{"domains": ["example.com"], "lookups": ["dns", "ssl"]}'

Both of those lookups are available on every plan, so this works with the key you signed up with:

{
  "results": [
    {
      "domain": "example.com",
      "inputs": ["example.com"],
      "dns": {
        "cache_hit": false,
        "a": ["93.184.216.34"],
        "mx": [{ "host": "mail.example.com", "priority": 10 }]
      },
      "ssl": {
        "cache_hit": true,
        "issuer": "DigiCert Inc",
        "days_until_expiry": 184
      }
    }
  ]
}

Three things worth knowing before you read further, because they shape every response:

lookups is required and has no default — you always name exactly what you want, and you are never charged latency for work you did not ask for.
Each lookup carries its own cache_hit, so one result can mix cached and freshly fetched fields.
A lookup that fails does not fail the request. You get 200, the field is absent, and the reason is in errors, which is present only when something failed — see partial failures.

Full reference: Domain Intelligence and IP Intelligence.

Domain Intelligence

WHOIS, DNS, SSL, headers, screenshots, reputation, email security, subdomains, CT logs, BGP and ASN, fingerprinting, threat intelligence, and DNS security (DNSSEC/CAA) in one request — with an aggregate risk score in every response.

POST/v1/domain/lookup

Open endpoint reference

IP Intelligence

GeoIP, ASN, reverse DNS, RDAP abuse contact, and threat intelligence for public IPv4 and IPv6 targets with partial-failure reporting.

POST/v1/ip/lookup

Open endpoint reference

Shared contract

Both APIs use the same authentication model, plan gating, JSON error envelope, and request tracing headers, so client integration stays predictable.

Use X-API-Key on every request.
Pass X-Client-Request-ID for your own trace IDs.
Expect 200 OK with per-lookup errors for partial failures.

Access

Authentication

All requests require an API key passed via the X-API-Key header.

X-API-Key: your-api-key-here

Commercial Model

Plans

Plans control request volume, batch size, and access to premium lookups such as screenshots, reputation, and threat intelligence.

Feature	Free	Pro
Rate limit	5 req/min	120 req/min
Domains per request	1	20
IPs per request	1	20
Core lookups (WHOIS, DNS, SSL, headers, GeoIP, ASN, RDNS)	Yes	Yes
Email security, subdomains, CT logs, BGP, fingerprint, DNS security, abuse contact	Yes	Yes
Aggregate risk score (computed on every domain lookup)	Yes	Yes
Usage statistics + self-service key rotation	Yes	Yes
Screenshot, reputation, threat intelligence	-	Yes

Upgrade Paths

Pricing

Start with a free key, then move up when you need larger request batches or premium enrichment.

Plan	Features
Free	5 req/min, 1 target per request, every lookup except screenshot, reputation, and threat intelligence	Included with any API key
Pro	120 req/min, 20 targets per request, adds screenshot, reputation, and threat intelligence	Subscribe

After subscribing, your API key is shown once on the confirmation page. Capture it immediately because it cannot be retrieved later.

Manage your subscription

Traffic Control

Rate Limiting

Requests are rate-limited per API key with a sliding window. Every response includes headers that let your client adapt without guesswork.

Header	Description
`X-RateLimit-Limit`	Maximum requests per minute for your plan
`X-RateLimit-Remaining`	Requests remaining in the current window
`Retry-After`	Seconds to wait before retrying on `429`

Freshness

Caching

Domain results are cached per lookup, per domain, each with its own TTL — 30 minutes for fast-moving data like dns and headers, up to 24 hours for whois and ct_logs. Every lookup object reports its own cache_hit, so a single result can mix cached and live fields. See the Domain Intelligence docs for the full table.

IP results work the same way, under a separate ip: key namespace — 24 hours for abuse_contact, 6 hours for reverse_dns, 30 minutes for threat_intel. geo and asn read a local database and are never cached, so their cache_hit is always false. See the IP Intelligence docs.

Failure Modes

Error Handling

HTTP errors cover malformed requests, auth failures, feature gating, and server-side faults. Partial lookup failures are returned inside successful responses instead.

Status	Meaning
`400 Bad Request`	Invalid request body, missing required fields, or invalid target
`401 Unauthorized`	Missing or invalid API key
`403 Forbidden`	Your plan does not include this feature
`413 Content Too Large`	Request body exceeds the 1 MB limit
`429 Too Many Requests`	Rate limit exceeded; inspect `Retry-After`
`500 Internal Server Error`	Unexpected server-side failure. Contact support@securityaccelerated.com if it persists.

All error responses use the same envelope:

{
  "error": "description of the problem"
}

Sub-lookups can fail without failing the request. In those cases the API still returns 200 OK and surfaces the affected lookup details in the per-result errors array.

Tracing

Request Correlation

Pass an optional X-Client-Request-ID header for end-to-end tracing. The API echoes it back in response headers and includes it in server-side logs.

Self-Service

Account & Keys

Every plan can inspect its own usage and rotate its API key without contacting support.

Endpoint	Description
GET /v1/usage	Your aggregated usage for the last 30 days (override with `?days=1..365`): request counts, cache hit rate, latency, status codes, and feature usage.
POST /v1/keys/rotate	Issues a fresh API key, returned exactly once. Previous keys keep working for a 24-hour grace window so deployed clients can be switched over without downtime.

Both are covered in full on the Account reference — parameters, every response field, four-language examples, and the sequence for rotating a key without downtime.

A rotated key is returned exactly once and cannot be retrieved again. Deploy it everywhere before old_keys_expire_at, after which the previous keys stop authenticating.

Release Notes

What's New

Every customer-facing change is listed on the changelog, newest first.