Developer Reference

Infrastructure Discovery

DomScan API: Map your organization's external infrastructure and attack surface. Discover subdomains, identify exposed services, and find potential security gaps before attackers do.

Infrastructure Discovery

Map your organization's external infrastructure and attack surface. Discover subdomains, identify exposed services, and find potential security gaps before attackers do.

GET /v1/recipes/infrastructure-discovery

Query Parameters

Parameter	Type	required
domain	string	required
depth	string	optional
include_historical	boolean	optional

Response Fields

Field	Type
`success`	boolean
`data`	object
`data.domain`	string
`data.subdomains`	object
`data.subdomains.count`	number
`data.subdomains.items[]`	object[]
`data.subdomains.items[]`	object
`data.subdomains.items[].subdomain`	string
`data.subdomains.items[].ip`	string
`data.subdomains.items[].tech[]`	string[]
`data.ip_addresses`	object
`data.ip_addresses.unique_ips`	number
`data.ip_addresses.items[]`	object[]
`data.ip_addresses.items[]`	object
`data.ip_addresses.items[].ip`	string
`data.ip_addresses.items[].asn`	string
`data.ip_addresses.items[].org`	string
`data.ip_addresses.items[].country`	string
`data.hosting`	object
`data.hosting.providers[]`	string[]
`data.hosting.regions[]`	string[]
`data.related_domains[]`	string[]
`data.technology_summary`	object
`data.technology_summary.cms`	null
`data.technology_summary.frameworks[]`	string[]
`data.technology_summary.servers[]`	string[]
`data.technology_summary.cdn`	string
`data.attack_surface`	object
`data.attack_surface.exposed_services[]`	string[]
`data.attack_surface.potential_entry_points[]`	string[]
`meta`	object
`meta.recipe_name`	string
`meta.credits_used`	number
`meta.credits_saved`	number
`meta.duration_ms`	number
`meta.components_called[]`	string[]
`meta.cached_components[]`	array
`meta.timestamp`	string
`errors[]`	array

Example Request

curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/recipes/infrastructure-discovery?domain=example.com&depth=standard&include_historical=example.com"

Example Response

{
  "success": true,
  "data": {
    "domain": "example.com",
    "subdomains": {
      "count": 4,
      "items": [
        {
          "subdomain": "api.example.com",
          "ip": "198.51.100.44",
          "tech": [
            "nginx",
            "Node.js"
          ]
        }
      ]
    },
    "ip_addresses": {
      "unique_ips": 2,
      "items": [
        {
          "ip": "198.51.100.44",
          "asn": "AS13335",
          "org": "Cloudflare, Inc.",
          "country": "US"
        }
      ]
    },
    "hosting": {
      "providers": [
        "Cloudflare",
        "Vercel"
      ],
      "regions": [
        "US",
        "EU"
      ]
    },
    "related_domains": [
      "status-example.com"
    ],
    "technology_summary": {
      "cms": null,
      "frameworks": [
        "Next.js"
      ],
      "servers": [
        "nginx"
      ],
      "cdn": "Cloudflare"
    },
    "attack_surface": {
      "exposed_services": [
        "HTTPS",
        "API"
      ],
      "potential_entry_points": [
        "api.example.com",
        "status.example.com"
      ]
    }
  },
  "meta": {
    "recipe_name": "infrastructure-discovery",
    "credits_used": 15,
    "credits_saved": 10,
    "duration_ms": 1084,
    "components_called": [
      "subdomains",
      "ip",
      "tech",
      "certificates"
    ],
    "cached_components": [],
    "timestamp": "2026-04-15T11:07:00Z"
  },
  "errors": []
}