Agents welcome.
DomainDrift is built to be read by machines. It continuously observes ~2,051,000 domains plus any domain you add, and serves every observation as Ed25519-signed JSON you can verify offline. No HTML to parse, and no key for a first look. If you are an agent, start here.
Quick start
Every record is a signed observation. The keyed full record returns the observed signal with the snapshot's signing key and id; the Ed25519 receipt for that exact snapshot (a signature over the canonical bytes, chained to the previous scan) is served at GET /v1/domains/:domain/provenance, and any single receipt resolves at GET /receipts/:id. Verify the signing key against GET /.well-known/domaindrift-keys.json. A signature proves attribution and integrity; it is added trust, not a claim of correctness.
Keyless, 1 request every 15 seconds per IP, under a shared daily ceiling. The keyless response is a real, current PREVIEW of one domain, not the full record: derived facts (who runs the nameservers, mail, and CDN; the cert issuer and expiry; reachability; scan time) and per-type record COUNTS. It carries the receipt POINTER (id + the full record's output_hash + the signing key + a public /receipts/:id URL) but no signature, because a signature commits to the full record's bytes and could never verify against a reduced subset.
# keyless: one domain, latest, a reduced signed-record preview
curl https://domaindrift.io/v1/domains/example.com
# keyed: the COMPLETE record + higher volume (a DRM3 account mints the key)
curl -H "X-DomainDrift-Key: dd_..." https://domaindrift.io/v1/domains/example.com
# Authorization: Bearer dd_... works too. Legacy keys and headers are still accepted.Discovery
Point your agent at any of these. They are static, keyless, and machine-readable.
Connect over MCP
DomainDrift runs a read-only MCP server at https://domaindrift.io/mcp (streamable HTTP, stateless). Five tools: look up one domain, today's change digest, resolve a receipt, the 24-hour tape, and the published signing keys. Every tool is a name for an existing HTTP route, served through the SAME lanes as everything on this page: a keyless tool call returns the reduced preview under the same per-IP throttle and shared daily ceiling, and a key sent as an Authorization: Bearer header on the connection opens the complete record on your metered allowance. MCP uses the same pay gate as the API.
# Claude Code
claude mcp add --transport http domaindrift https://domaindrift.io/mcp
# Claude on the web: Settings > Connectors > Add custom connector, URL https://domaindrift.io/mcp
# ChatGPT developer mode, and any streamable-HTTP MCP client: the same URLDomainDrift also measures who else speaks MCP, by fetching a domain's /.well-known/mcp.json and checking that what comes back is a descriptor rather than merely a response. See who speaks MCP for the running index, and the connect guide for Claude, Claude Code, and ChatGPT developer mode.
The data endpoints
Reads. The single-domain lookup has a keyless preview (above); everything else needs a key.
Try it right now, with no key
One domain, no account, a real slice of the signed record. Keyless calls are throttled to 1 request every 15 seconds per IP - useful for "does this work?", useless for real work. An API key removes the throttle.
The response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Go too fast and you get a 429 with Retry-After - a boundary, not a bug. Lists, history, and exports need a key.
curl https://domaindrift.io/v1/domains/netflix.comRetry-After - the boundary is in the headers, never a surprise.What is public, what is metered
DomainDrift states its price at the door. Every metered response carries its own meter in the headers, so you never have to guess where you stand.
/health /t/:domain (the time machine) /changes/today, /changes/:date /changes.rss, /changes.json /v1/tapeGET /v1/domains/:domain (one domain, latest, signed)/v1/domains /v1/domains/:domain /v1/changes /v1/stream /v1/domains/:domain/provenanceAny /v1/* read except the signed export bundle (exports need a keyed account)/v1/bq/* /v1/enrich-batch /v1/opt-out /v1/domains (POST) /v1/queue/*A metered call answers with these headers so a client can pace itself without a second round trip. Which subset ships depends on your plan: the daily credit plan carries the credit + daily headers, the legacy plan carries the monthly + daily headers. Reset values are Unix seconds.
X-DomainDrift-Usage | Requests counted this month (UTC). |
X-DomainDrift-Usage-Day | Requests counted today (UTC). |
X-DomainDrift-Usage-Period | The month bucket, YYYY-MM (UTC). |
X-DomainDrift-Daily-Allowance | Included requests for today. |
X-DomainDrift-Daily-Remaining | Requests left today. |
X-DomainDrift-Daily-Reset | Unix seconds at the next 00:00 UTC, when the daily allowance resets. |
X-DomainDrift-Credits-Allowance | Daily credit plan: included DomainDrift credits for today. |
X-DomainDrift-Credits-Used | Daily credit plan: DomainDrift credits used today (0.05 per request). |
X-DomainDrift-Credits-Remaining | Daily credit plan: DomainDrift credits left today. |
X-DomainDrift-Credits-Reset | Daily credit plan: Unix seconds until credits reset (next 00:00 UTC). |
X-DomainDrift-Allowance | Legacy monthly plan: included requests this month. |
X-DomainDrift-Remaining | Legacy monthly plan: requests left this month. |
X-DomainDrift-Reset | Legacy monthly plan: Unix seconds until the month resets. |
X-DomainDrift-Burst | Daily burst multiple in force (1 = your day is your share, no batching). |
- Service + scanner keys (they run the pipeline, they are not a customer).
- The public web surfaces above (they carry no key at all).
- Keyless single-domain lookups, which are throttled per IP instead of metered.
- x402 payers, who already paid for the call at the door.
The web, without an account
The public web surface is a real slice of the product, not a screenshot. Where a list is truncated, DomainDrift shows you the true size of what it is holding back - never a silent cut.
- The landing page, the daily change feed (+ RSS/JSON), and the public analytics pages.
- The Time Machine for any domain at /t/<domain>: the LATEST signed observation.
- The embeddable signed badge, universal search, the verifier, and these docs.
- The TOP 3 of every list - with the true, live total shown next to it.
- Every list in full: the catalog, the change wire, services, certificate issuers.
- Domain detail pages, and ALL point-in-time history / time-series.
- Exports: CSV, signed evidence bundles, and change alerts.
- Bring your own: put 5 of your domains under watch in a group (paid plans raise the caps).
The x402 lane: settle per request, no account
The standard metered lane is credits on a key (the same meter as everything on this page). This lane exists for an agent that would rather settle a single request than hold an account: call a metered /v1/* endpoint with no key and no X-PAYMENT header, and the response is a 402 whose body IS the price menu. Settle 0.01 USDC on Base (an EIP-3009 transferWithAuthorization, signed client-side), retry the same request with an X-PAYMENT header, and the call is served. No key, no account.
The payment is settled on Base before the response leaves: we reserve your authorization, broadcast it, and serve the call once the USDC has actually moved. If settlement does not go through you are not charged and the call is not served. Public endpoints are never charged. Per-request settlement is the convenience price for skipping signup; a key is the cheap way to volume.
Higher volume
The keyless lane is enough to see it work; it cannot be batched into a bulk pull. For production, sign in with a DRM3 account, mint your own X-DomainDrift-Key, and send it as a header (or Authorization: Bearer). Every metered response carries its own meter in the headers, so you always know where you stand. Bulk exports and the signed per-domain bundle are the metered product.
Free with a DRM3 account. One key, reusable - rotate it any time from the console.