▸ API Reference

# read-only json api · cursor pagination · free key from the dashboard

openapi.json

realtime.md

▸ Real-time stream (WebSocket)

Every newly indexed domain - from CT logs and zone files - is broadcast as a JSON frame over a single WebSocket. No API key required.

endpoint

wss://dnsniffer.com/ws

query-string filters (optional)

# only .com
wss://dnsniffer.com/ws?tld=com

# only domains containing "acme" (3–64 chars, case-insensitive)
wss://dnsniffer.com/ws?q=acme

# both
wss://dnsniffer.com/ws?tld=com&q=acme

frames

// on connect (once)
{
  "type": "hello",
  "server": "dnsniffer-ws/1",
  "filters": { ... },
  "heartbeat_ms": 30000
}

// for every new domain
{
  "type": "domain",
  "id": "1234567890",
  "name": "foo.com",
  "tld": "com",
  "created_at": "2026-05-16T16:00:00Z"
}

javascript example

const ws = new WebSocket('wss://dnsniffer.com/ws?tld=com');
ws.onmessage = (e) => {
  const m = JSON.parse(e.data);
  if (m.type === 'domain') console.log(m.name);
};

node example

import WebSocket from 'ws';
const ws = new WebSocket('wss://dnsniffer.com/ws?q=acme');
ws.on('message', (data) => {
  const m = JSON.parse(data.toString());
  if (m.type === 'domain') console.log(m.name);
});

▸ server pings every 30s; clients that miss a pong are dropped
▸ per-client rate limit: 200 messages/sec (burst protection during bulk ingest)
▸ reconnect by simply re-opening the socket - no auth handshake
▸ see /new for a live demo and bulk CSV alternatives