The API
One metered door, the same for everyone: /v1. It starts keyless, a DRM3 account raises it, and every response is built to be verified, not just believed. The interactive reference with your own key and live meter is the API console; the OpenAPI 3.1 spec is at /v1/openapi.json.
Keyless: the first look
curl https://domaindrift.io/v1/domains/example.com
No key, no account: one domain at a time, the latest observation, as a reduced preview - the derived facts (who runs the nameservers, mail, and CDN; certificate issuer and expiry; reachability; scan time; snapshot id) plus per-type record counts. One request every 15 seconds per IP, under a shared daily ceiling.
The preview deliberately carries no signature. A signature commits to the exact bytes of the full record, so one attached to a reduced subset could never verify - shipping it would hand you a check guaranteed to fail. Instead the preview carries the receipt pointer: the receipt id, the full record's output hash, the signing key, and a public /receipts/<id> URL you can resolve right now, keyless.
Authentication
# either header works curl -H "X-DomainDrift-Key: dd_..." https://domaindrift.io/v1/domains/example.com curl -H "Authorization: Bearer dd_..." https://domaindrift.io/v1/domains/example.com
Mint a key from the API console with a DRM3 account. A keyed call returns the complete record and opens every read endpoint below.
The read surface
| Endpoint | What it returns |
|---|---|
GET /v1/domains | The list, with filters (category, tag, search); ?format=csv for a download. |
GET /v1/domains/:domain | The latest signed record (keyless: reduced preview; keyed: full). |
GET /v1/domains/:domain/history | The snapshot time series for one domain. |
GET /v1/domains/:domain/provenance | The Ed25519 receipt chain for one domain. |
GET /v1/domains/:domain/planes | The latest observation per data plane, with completeness. |
GET /v1/changes | The global change feed as structured deltas, with sync cursors. |
GET /v1/stream | Live Server-Sent Events: scans, changes, receipts. |
GET /v1/stream/json | The polling fallback when you cannot hold an SSE open. |
GET /v1/groups | Your bring-your-own-domain monitoring groups. |
GET /v1/alerts | Your alert subscriptions (POST to create, DELETE to remove). |
GET /v1/usage | Your metered usage for the period. |
GET /v1/evidence/:domain | A printable, signed evidence report for auditors. |
GET /v1/domains/:domain/bundle | A signed, offline-verifiable export bundle (paid, rate-capped). |
Discovery, for humans and agents
| Endpoint | What it is |
|---|---|
GET /v1/openapi.json | OpenAPI 3.1 - every endpoint and schema. |
GET /.well-known/domaindrift-keys.json | The Ed25519 public keys that sign every observation. |
GET /receipts/:id | Resolve any receipt by id - public, keyless. |
GET /llms.txt | The plain-text site and API map for language models (/llms-full.txt for the long form). |
GET /badge/:domain.svg | An embeddable signed status badge for any domain. |
GET /v1/tape | The 24-hour rollup as JSON. CORS-open, safe to embed. |
POST /mcp | A read-only MCP server (streamable HTTP, stateless): lookup_domain, whats_changed_today, resolve_receipt, internet_tape, signing_keys. Descriptor at /.well-known/mcp.json. |
The MCP tools are names for the same HTTP routes and pass through the same access lanes: keyless calls get the reduced preview under the same throttle; send your key as Authorization: Bearer to open the complete record. If you are pointing an AI agent at DomainDrift, start at the machine front door - it is the same surface, arranged for agents.
The meter, in the open
Every metered response tells you where you stand: X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset ride on the response, and a 429 carries Retry-After plus a body that names the limit and where to raise it. API use is metered in DomainDrift credits - an API request is 0.05 credits against your daily allowance, and past it, requests meter from your DRM3 credit balance. The full model: Plans & limits.
Try it without writing code
The playground runs real read-only calls from the browser, and the API console is the full interactive reference with your key, your usage, and copyable requests for every endpoint.