domaintools-api-test-upload 2.8.1__tar.gz → 3.0.0__tar.gz

{domaintools_api_test_upload-2.8.1 → domaintools_api_test_upload-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
-Name: domaintools_api_test_upload
-Version: 2.8.1
+Name: domaintools-api-test-upload
+Version: 3.0.0
 Summary: DomainTools Official Python API
 Author-email: DomainTools <integrations@domaintools.com>
 License: The MIT License (MIT)
@@ -102,6 +102,41 @@ being passed in as method arguments:
 api.iris_enrich('domaintools.com')
 ```
 
+Namespaced Access
+===================
+
+In v3, each product family is also accessible as a named client attribute. Use namespaced
+access to scope calls to a specific product or to pass a single client to a helper function:
+
+```python
+api.iris.iris_investigate(domain='domaintools.com')
+api.feeds.nod(after='-60')
+api.domains.domain_profile('domaintools.com')
+api.detect.iris_detect_monitors()
+api.ips.host_domains('8.8.8.8')
+api.accounts.account_information()
+```
+
+Individual clients can also be constructed directly, sharing a single `DTAuth` object:
+
+```python
+from domaintools.auth.dt_auth import DTAuth
+from domaintools.clients.feeds import FeedsAPI
+
+auth = DTAuth('my_user', 'my_key')
+feeds = FeedsAPI(auth)
+```
+
+Pass `None` as the username if you are only using header-authenticated endpoints (RTTF feeds):
+
+```python
+auth = DTAuth(None, 'my_key')
+feeds = FeedsAPI(auth)
+```
+
+> **Upgrading from v2?** See [docs/v3-migration.md](docs/v3-migration.md) for a full list of
+> what changed and what stayed the same.
+
 You can get an overview of every endpoint that you can interact with using the builtin help function:
 
 ```python
@@ -150,14 +185,22 @@ api.iris_enrich('domaintools.com').data() == {'response': { ... }}
 api.iris_enrich('domaintools.com').response() == { ... }
 ```
 
-You can directly get the html, xml, or json version of the response by calling `.(html|xml|json)()` These only work with non AsyncResults:
+You can get the html, xml, or json version of the response using the `.html`, `.xml`, and `.json` properties. These return a new result object configured for that format — use `str()` to get the raw string:
 ```python
-json = str(api.domain_search('google').json())
-xml = str(api.domain_search('google').xml())
-html = str(api.domain_search('google').html())
+json_str = str(api.domain_search('google').json)
+xml_str  = str(api.domain_search('google').xml)
+html_str = str(api.domain_search('google').html)
 ```
 
-If any API call is unsuccesfull, one of the exceptions defined in `domaintools.exceptions` will be raised:
+You can also pass `format` directly to any endpoint method. For `xml` and `html` the result is a raw string — use `str(result)` or `result.data()` to access it. Dict-style access (`result["key"]`, iteration) is JSON-only:
+```python
+result = api.whois('google.com', format='xml')
+xml_str = str(result)       # raw XML string
+xml_str = result.data()     # same
+result['registrant']        # TypeError — use format='json' for key access
+```
+
+If any API call is unsuccessful, one of the exceptions defined in `domaintools.exceptions` will be raised:
 
 ```python-traceback
 api.domain_profile('notvalid').data()
@@ -203,6 +246,69 @@ You can get the status code of a response outside of exception handling by doing
 api.domain_profile('google.com').status == 200
 ```
 
+Parsed WHOIS and RDAP
+===================
+
+`parsed_whois()` and `parsed_domain_rdap()` return the most recent registration record for a domain, already broken
+out into fields. Both return result objects that behave like the standard results (dict access, `.data()`,
+`.response()`) and add a `.flattened()` helper:
+
+```python
+whois = api.parsed_whois('domaintools.com')
+print(whois['parsed_whois']['registrar']['name'])
+print(whois['parsed_whois']['created_date'])
+
+rdap = api.parsed_domain_rdap('domaintools.com')
+print(rdap['parsed_domain_rdap']['nameservers'])
+```
+
+`.flattened()` returns a single-level `OrderedDict`, which is convenient for CSV rows or dataframes:
+
+```python
+flat = api.parsed_whois('domaintools.com').flattened()
+flat['domain']             # 'domaintools.com'
+flat['name_servers']       # 'ns1.example.net | ns2.example.net'  (lists are joined with ' | ')
+flat['registrar_name']     # registrar fields are prefixed with 'registrar_'
+flat['registrant_email']   # contact fields are prefixed with the contact type
+
+flat = api.parsed_domain_rdap('domaintools.com').flattened()
+flat['nameservers']        # 'ns1.example.net | ns2.example.net'
+flat['registrar_name']
+flat['contact_roles_1']    # RDAP contacts are numbered from 1: contact_<field>_<n>
+flat['contact_email_1']
+```
+
+`.flattened()` needs a JSON result. Calling it on a `format='xml'` or `format='html'` result raises
+`UnsupportedFormatOperation`.
+
+### Domain history with parsed records
+
+`domain_history()` returns the change events for a domain. It supports field filtering, pagination, and embedding the
+full parsed WHOIS / RDAP record in each event's `before` / `after` objects:
+
+```python
+history = api.domain_history(
+    'domaintools.com',
+    include_fields='ip,registrar',   # or exclude_fields='all_ssl' (do not combine the two)
+    page_size=50,                    # max 100
+    offset=0,                        # 0-indexed; increment by page_size for the next page
+    parsed_whois=True,               # embed the parsed WHOIS record in before/after
+    parsed_domain_rdap=True,         # embed the parsed Domain RDAP record in before/after
+)
+for change in history:
+    print(change)
+```
+
+Pass `next=True` to get a `next` URL in the response for cursor-based pagination.
+
+The same options are available on the command line:
+
+```bash
+domaintools parsed_whois -q domaintools.com -u $TEST_USER -k $TEST_KEY
+domaintools parsed_domain_rdap -q domaintools.com -u $TEST_USER -k $TEST_KEY
+domaintools domain_history -q domaintools.com --include-fields ip,registrar --page-size 50 --parsed-whois -u $TEST_USER -k $TEST_KEY
+```
+
 IrisQL
 ===================
 
@@ -311,6 +417,19 @@ Please see the [supported versions](https://github.com/DomainTools/python_api/ra
 for the DomainTools Python support policy.
 
 
+Authentication
+===================
+
+The wrapper supports two authentication modes, selected automatically based on the product:
+
+| Product | Default method | Params sent |
+|---|---|---|
+| Standard API (Iris, Whois, etc.) | HMAC-SHA256 signed | `api_username`, `timestamp`, `signature` as query params |
+| Real-Time Threat Feeds (RTTF) | Header authentication | `X-Api-Key` header |
+
+RTTF feeds also support HMAC signing as an opt-in via `always_sign_api_key=True` — see the RTTF section below.
+
+
 Real-Time Threat Feeds
 ===================
 
@@ -322,18 +441,24 @@ Custom parameters aside from the common `GET` Request parameters:
     api = API(USERNAME, KEY)
     api.nod(endpoint="feed", **kwargs)
     ```
-- `header_authentication`: by default, we're using API Header Authentication. Set this False if you want to use API Key and Secret Authentication. Apparently, you can't use API Header Authentication for `download` endpoints so this will be defaulted to `False` even without explicitly setting it.
+- `header_authentication`: by default, all RTTF endpoints (both `feed` and `download`) use API Header Authentication, sending the API key via the `X-Api-Key` header. Set this to `False` to pass the API key as a query parameter instead.
     ```python
     api = API(USERNAME, KEY, header_authentication=False)
     api.nod(**kwargs)
     ```
+- `always_sign_api_key`: set to `True` to use HMAC-SHA256 signed authentication instead of header auth. When set, `header_authentication` automatically defaults to `False` — both methods do not fire simultaneously. The signing algorithm is identical to the standard API: `HMAC-SHA256(key, username + timestamp + path)`, with `timestamp` and `signature` sent as query parameters.
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=True)
+    api.nod(after="-60")
+    # sends: api_username, timestamp, signature — no X-Api-Key header
+    ```
 - `output_format`: (choose either `csv` or `jsonl` - default is `jsonl`). Cannot be used in `domainrdap` feeds. Additionally, `csv` is not available for `download` endpoints.
     ```python
     api = API(USERNAME, KEY)
     api.nod(output_format="csv", **kwargs)
     ```
 
-The Feed API standard access pattern is to periodically request the most recent feed data, as often as every 60 seconds. Specify the range of data you receive in one of two ways:
+The `feed` endpoint streams live NDJSON data. The standard access pattern is to poll as often as every 60 seconds. Specify the range of data you receive in one of two ways:
 
 1. With `sessionID`: Make a call and provide a new `sessionID` parameter of your choosing. The API will return the last hour of data by default.
     - Each subsequent call to the API using your `sessionID` will return all data since the last.
@@ -342,9 +467,75 @@ The Feed API standard access pattern is to periodically request the most recent
     - Either an `after=-60` query parameter, where (in this example) -60 indicates the previous 60 seconds.
     - Or `after` and `before` query parameters for a time range, with each parameter accepting an ISO-8601 UTC formatted timestamp (a UTC date and time of the format YYYY-MM-DDThh:mm:ssZ)
 
-## Handling iterative response from RTUF endpoints:
+The `download` endpoint returns a standard JSON response (not a stream) listing available S3 batch files. Time parameters (`sessionID`, `after`, `before`) are **not** required for download calls.
+
+```python
+api = API(USERNAME, KEY)
+result = api.nod(endpoint="download", limit=5)
+print(result["download_name"])
+for f in result["files"]:
+    print(f["name"], f["url"])
+```
+
+### Feed parameters
+
+The feed methods accept the following parameters, grouped by purpose. Availability depends on the feed (see the notes below the table).
+
+#### Session Management Parameters
+
+- `sessionID`: A custom string used to distinguish between different sessions. Required when using `fromBeginning`.
+- `after`: Start of the query window. Either an integer offset relative to now in seconds (e.g. `-60`), or an absolute ISO 8601 UTC datetime (`YYYY-MM-DDTHH:MM:SSZ`).
+- `before`: End of the query window (inclusive). Either an integer from `-1` to `-432000` (seconds before now), or an absolute ISO 8601 UTC datetime. The query window covers at most the most recent 5 days; a value older than 5 days returns no records.
+- `fromBeginning`: Boolean (`true`/`false`/`1`/`0`, default `false`). Requires a valid `sessionID`. When `true` on the first request of a new session, returns the first hour of data in the time window instead of the last. Using it with an existing `sessionID` returns an HTTP 406; using it without a `sessionID` or with a non-boolean value returns an HTTP 422.
+
+    ```python
+    api = API(USERNAME, KEY)
+    api.nod(sessionID="my-new-session-id", after=-3600, fromBeginning=True)
+    ```
+
+#### Filter Parameters
+
+- `domain`: Filter for an exact domain or a substring contained within a domain by prefixing or suffixing your substring with `*`.
+- `overall_min`, `malware_min`, `phishing_min`, `spam_min`, `proximity_min`: Integer risk score thresholds (range `1` to `99`, optional). Available on the `realtime_domain_risk` and `domainhotlist` feeds only. When multiple are supplied they act as a logical AND — a domain must meet ALL specified thresholds to be returned.
+
+    ```python
+    api = API(USERNAME, KEY)
+    api.domainhotlist(after=-3600, overall_min=70, phishing_min=50)
+    ```
+
+- IP feed filters (available on the `iprisk` and `iphotlist` feeds only). All are optional integers/strings and combine as a logical AND:
+    - Domain activity & volume: `pdns_resolutions_min`, `bad_pdns_resolutions_min` (positive integers, distinct/bad domains resolving to the IP in the last 24 hours) and `total_domains_max` (positive integer; caps total hosted domains to filter out superhosters like CDNs).
+    - Threat intelligence & combined risk percentages: `third_party_threats_min` (positive integer), plus `all_threats_combined_percent_min`, `combined_phishing_percent_min`, `combined_malware_percent_min`, `combined_spam_percent_min` (percentages `0` to `100` of hosted domains confirmed or predicted malicious).
+    - Confirmed threat percentages: `all_threats_percent_min`, `percent_phishing_min`, `percent_malware_min`, `percent_spam_min` (percentages `0` to `100` of hosted domains actively confirmed).
+    - Infrastructure & geolocation: `asn` (integer, digits only — no `AS` prefix or wildcards), `organization` (exact name, no wildcards) and `country_code` (case-sensitive two-letter code, e.g. `CN`, `US`, `NL`).
+
+    ```python
+    api = API(USERNAME, KEY)
+    api.iprisk(after=-3600, bad_pdns_resolutions_min=5, total_domains_max=1000, country_code="US")
+    ```
+
+#### Result formatting parameters
+
+- `output_format`: `csv` or `jsonl` (default `jsonl`). Not available on the `domainrdap` feed. `csv` is not available for `download` endpoints.
+- `headers`: When `csv` output is used, adds a header row to the first line of the response.
+- `top`: Positive integer from `1` to `1,000,000,000` limiting the number of results in the response payload. Ignored for the `download` endpoint.
+
+#### Download-only parameters
+
+These parameters are only accepted when `endpoint="download"`. They are ignored for the `feed` endpoint.
+
+- `limit`: Maximum number of files to return in the response.
+- `page`: Zero-indexed page of results to return. Available on `realtime_domain_risk`, `domainhotlist`, `iphotlist`, and `iprisk`.
+- `prefix`: Filter files by date prefix (e.g. `"2026-08-"`). Available on `realtime_domain_risk`, `domainhotlist`, `iphotlist`, and `iprisk`.
+
+```python
+api = API(USERNAME, KEY)
+api.iphotlist(endpoint="download", limit=10, page=0, prefix="2026-08-")
+```
+
+## Handling iterative response from RTTF endpoints:
 
-Since we may dealing with large feeds datasets, the python wrapper uses `generator` for efficient memory handling. Therefore, we need to iterate through the `generator` if we're accessing the partial results of the feeds data.
+Since we may be dealing with large feeds datasets, the python wrapper uses `generator` for efficient memory handling. Therefore, we need to iterate through the `generator` if we're accessing the partial results of the feeds data.
 
 ### Single request because the requested data is within the maximum result:
 ```python

{domaintools_api_test_upload-2.8.1 → domaintools_api_test_upload-3.0.0}/README.md

@@ -44,6 +44,41 @@ being passed in as method arguments:
 api.iris_enrich('domaintools.com')
 ```
 
+Namespaced Access
+===================
+
+In v3, each product family is also accessible as a named client attribute. Use namespaced
+access to scope calls to a specific product or to pass a single client to a helper function:
+
+```python
+api.iris.iris_investigate(domain='domaintools.com')
+api.feeds.nod(after='-60')
+api.domains.domain_profile('domaintools.com')
+api.detect.iris_detect_monitors()
+api.ips.host_domains('8.8.8.8')
+api.accounts.account_information()
+```
+
+Individual clients can also be constructed directly, sharing a single `DTAuth` object:
+
+```python
+from domaintools.auth.dt_auth import DTAuth
+from domaintools.clients.feeds import FeedsAPI
+
+auth = DTAuth('my_user', 'my_key')
+feeds = FeedsAPI(auth)
+```
+
+Pass `None` as the username if you are only using header-authenticated endpoints (RTTF feeds):
+
+```python
+auth = DTAuth(None, 'my_key')
+feeds = FeedsAPI(auth)
+```
+
+> **Upgrading from v2?** See [docs/v3-migration.md](docs/v3-migration.md) for a full list of
+> what changed and what stayed the same.
+
 You can get an overview of every endpoint that you can interact with using the builtin help function:
 
 ```python
@@ -92,14 +127,22 @@ api.iris_enrich('domaintools.com').data() == {'response': { ... }}
 api.iris_enrich('domaintools.com').response() == { ... }
 ```
 
-You can directly get the html, xml, or json version of the response by calling `.(html|xml|json)()` These only work with non AsyncResults:
+You can get the html, xml, or json version of the response using the `.html`, `.xml`, and `.json` properties. These return a new result object configured for that format — use `str()` to get the raw string:
 ```python
-json = str(api.domain_search('google').json())
-xml = str(api.domain_search('google').xml())
-html = str(api.domain_search('google').html())
+json_str = str(api.domain_search('google').json)
+xml_str  = str(api.domain_search('google').xml)
+html_str = str(api.domain_search('google').html)
 ```
 
-If any API call is unsuccesfull, one of the exceptions defined in `domaintools.exceptions` will be raised:
+You can also pass `format` directly to any endpoint method. For `xml` and `html` the result is a raw string — use `str(result)` or `result.data()` to access it. Dict-style access (`result["key"]`, iteration) is JSON-only:
+```python
+result = api.whois('google.com', format='xml')
+xml_str = str(result)       # raw XML string
+xml_str = result.data()     # same
+result['registrant']        # TypeError — use format='json' for key access
+```
+
+If any API call is unsuccessful, one of the exceptions defined in `domaintools.exceptions` will be raised:
 
 ```python-traceback
 api.domain_profile('notvalid').data()
@@ -145,6 +188,69 @@ You can get the status code of a response outside of exception handling by doing
 api.domain_profile('google.com').status == 200
 ```
 
+Parsed WHOIS and RDAP
+===================
+
+`parsed_whois()` and `parsed_domain_rdap()` return the most recent registration record for a domain, already broken
+out into fields. Both return result objects that behave like the standard results (dict access, `.data()`,
+`.response()`) and add a `.flattened()` helper:
+
+```python
+whois = api.parsed_whois('domaintools.com')
+print(whois['parsed_whois']['registrar']['name'])
+print(whois['parsed_whois']['created_date'])
+
+rdap = api.parsed_domain_rdap('domaintools.com')
+print(rdap['parsed_domain_rdap']['nameservers'])
+```
+
+`.flattened()` returns a single-level `OrderedDict`, which is convenient for CSV rows or dataframes:
+
+```python
+flat = api.parsed_whois('domaintools.com').flattened()
+flat['domain']             # 'domaintools.com'
+flat['name_servers']       # 'ns1.example.net | ns2.example.net'  (lists are joined with ' | ')
+flat['registrar_name']     # registrar fields are prefixed with 'registrar_'
+flat['registrant_email']   # contact fields are prefixed with the contact type
+
+flat = api.parsed_domain_rdap('domaintools.com').flattened()
+flat['nameservers']        # 'ns1.example.net | ns2.example.net'
+flat['registrar_name']
+flat['contact_roles_1']    # RDAP contacts are numbered from 1: contact_<field>_<n>
+flat['contact_email_1']
+```
+
+`.flattened()` needs a JSON result. Calling it on a `format='xml'` or `format='html'` result raises
+`UnsupportedFormatOperation`.
+
+### Domain history with parsed records
+
+`domain_history()` returns the change events for a domain. It supports field filtering, pagination, and embedding the
+full parsed WHOIS / RDAP record in each event's `before` / `after` objects:
+
+```python
+history = api.domain_history(
+    'domaintools.com',
+    include_fields='ip,registrar',   # or exclude_fields='all_ssl' (do not combine the two)
+    page_size=50,                    # max 100
+    offset=0,                        # 0-indexed; increment by page_size for the next page
+    parsed_whois=True,               # embed the parsed WHOIS record in before/after
+    parsed_domain_rdap=True,         # embed the parsed Domain RDAP record in before/after
+)
+for change in history:
+    print(change)
+```
+
+Pass `next=True` to get a `next` URL in the response for cursor-based pagination.
+
+The same options are available on the command line:
+
+```bash
+domaintools parsed_whois -q domaintools.com -u $TEST_USER -k $TEST_KEY
+domaintools parsed_domain_rdap -q domaintools.com -u $TEST_USER -k $TEST_KEY
+domaintools domain_history -q domaintools.com --include-fields ip,registrar --page-size 50 --parsed-whois -u $TEST_USER -k $TEST_KEY
+```
+
 IrisQL
 ===================
 
@@ -253,6 +359,19 @@ Please see the [supported versions](https://github.com/DomainTools/python_api/ra
 for the DomainTools Python support policy.
 
 
+Authentication
+===================
+
+The wrapper supports two authentication modes, selected automatically based on the product:
+
+| Product | Default method | Params sent |
+|---|---|---|
+| Standard API (Iris, Whois, etc.) | HMAC-SHA256 signed | `api_username`, `timestamp`, `signature` as query params |
+| Real-Time Threat Feeds (RTTF) | Header authentication | `X-Api-Key` header |
+
+RTTF feeds also support HMAC signing as an opt-in via `always_sign_api_key=True` — see the RTTF section below.
+
+
 Real-Time Threat Feeds
 ===================
 
@@ -264,18 +383,24 @@ Custom parameters aside from the common `GET` Request parameters:
     api = API(USERNAME, KEY)
     api.nod(endpoint="feed", **kwargs)
     ```
-- `header_authentication`: by default, we're using API Header Authentication. Set this False if you want to use API Key and Secret Authentication. Apparently, you can't use API Header Authentication for `download` endpoints so this will be defaulted to `False` even without explicitly setting it.
+- `header_authentication`: by default, all RTTF endpoints (both `feed` and `download`) use API Header Authentication, sending the API key via the `X-Api-Key` header. Set this to `False` to pass the API key as a query parameter instead.
     ```python
     api = API(USERNAME, KEY, header_authentication=False)
     api.nod(**kwargs)
     ```
+- `always_sign_api_key`: set to `True` to use HMAC-SHA256 signed authentication instead of header auth. When set, `header_authentication` automatically defaults to `False` — both methods do not fire simultaneously. The signing algorithm is identical to the standard API: `HMAC-SHA256(key, username + timestamp + path)`, with `timestamp` and `signature` sent as query parameters.
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=True)
+    api.nod(after="-60")
+    # sends: api_username, timestamp, signature — no X-Api-Key header
+    ```
 - `output_format`: (choose either `csv` or `jsonl` - default is `jsonl`). Cannot be used in `domainrdap` feeds. Additionally, `csv` is not available for `download` endpoints.
     ```python
     api = API(USERNAME, KEY)
     api.nod(output_format="csv", **kwargs)
     ```
 
-The Feed API standard access pattern is to periodically request the most recent feed data, as often as every 60 seconds. Specify the range of data you receive in one of two ways:
+The `feed` endpoint streams live NDJSON data. The standard access pattern is to poll as often as every 60 seconds. Specify the range of data you receive in one of two ways:
 
 1. With `sessionID`: Make a call and provide a new `sessionID` parameter of your choosing. The API will return the last hour of data by default.
     - Each subsequent call to the API using your `sessionID` will return all data since the last.
@@ -284,9 +409,75 @@ The Feed API standard access pattern is to periodically request the most recent
     - Either an `after=-60` query parameter, where (in this example) -60 indicates the previous 60 seconds.
     - Or `after` and `before` query parameters for a time range, with each parameter accepting an ISO-8601 UTC formatted timestamp (a UTC date and time of the format YYYY-MM-DDThh:mm:ssZ)
 
-## Handling iterative response from RTUF endpoints:
+The `download` endpoint returns a standard JSON response (not a stream) listing available S3 batch files. Time parameters (`sessionID`, `after`, `before`) are **not** required for download calls.
+
+```python
+api = API(USERNAME, KEY)
+result = api.nod(endpoint="download", limit=5)
+print(result["download_name"])
+for f in result["files"]:
+    print(f["name"], f["url"])
+```
+
+### Feed parameters
+
+The feed methods accept the following parameters, grouped by purpose. Availability depends on the feed (see the notes below the table).
+
+#### Session Management Parameters
+
+- `sessionID`: A custom string used to distinguish between different sessions. Required when using `fromBeginning`.
+- `after`: Start of the query window. Either an integer offset relative to now in seconds (e.g. `-60`), or an absolute ISO 8601 UTC datetime (`YYYY-MM-DDTHH:MM:SSZ`).
+- `before`: End of the query window (inclusive). Either an integer from `-1` to `-432000` (seconds before now), or an absolute ISO 8601 UTC datetime. The query window covers at most the most recent 5 days; a value older than 5 days returns no records.
+- `fromBeginning`: Boolean (`true`/`false`/`1`/`0`, default `false`). Requires a valid `sessionID`. When `true` on the first request of a new session, returns the first hour of data in the time window instead of the last. Using it with an existing `sessionID` returns an HTTP 406; using it without a `sessionID` or with a non-boolean value returns an HTTP 422.
+
+    ```python
+    api = API(USERNAME, KEY)
+    api.nod(sessionID="my-new-session-id", after=-3600, fromBeginning=True)
+    ```
+
+#### Filter Parameters
+
+- `domain`: Filter for an exact domain or a substring contained within a domain by prefixing or suffixing your substring with `*`.
+- `overall_min`, `malware_min`, `phishing_min`, `spam_min`, `proximity_min`: Integer risk score thresholds (range `1` to `99`, optional). Available on the `realtime_domain_risk` and `domainhotlist` feeds only. When multiple are supplied they act as a logical AND — a domain must meet ALL specified thresholds to be returned.
+
+    ```python
+    api = API(USERNAME, KEY)
+    api.domainhotlist(after=-3600, overall_min=70, phishing_min=50)
+    ```
+
+- IP feed filters (available on the `iprisk` and `iphotlist` feeds only). All are optional integers/strings and combine as a logical AND:
+    - Domain activity & volume: `pdns_resolutions_min`, `bad_pdns_resolutions_min` (positive integers, distinct/bad domains resolving to the IP in the last 24 hours) and `total_domains_max` (positive integer; caps total hosted domains to filter out superhosters like CDNs).
+    - Threat intelligence & combined risk percentages: `third_party_threats_min` (positive integer), plus `all_threats_combined_percent_min`, `combined_phishing_percent_min`, `combined_malware_percent_min`, `combined_spam_percent_min` (percentages `0` to `100` of hosted domains confirmed or predicted malicious).
+    - Confirmed threat percentages: `all_threats_percent_min`, `percent_phishing_min`, `percent_malware_min`, `percent_spam_min` (percentages `0` to `100` of hosted domains actively confirmed).
+    - Infrastructure & geolocation: `asn` (integer, digits only — no `AS` prefix or wildcards), `organization` (exact name, no wildcards) and `country_code` (case-sensitive two-letter code, e.g. `CN`, `US`, `NL`).
+
+    ```python
+    api = API(USERNAME, KEY)
+    api.iprisk(after=-3600, bad_pdns_resolutions_min=5, total_domains_max=1000, country_code="US")
+    ```
+
+#### Result formatting parameters
+
+- `output_format`: `csv` or `jsonl` (default `jsonl`). Not available on the `domainrdap` feed. `csv` is not available for `download` endpoints.
+- `headers`: When `csv` output is used, adds a header row to the first line of the response.
+- `top`: Positive integer from `1` to `1,000,000,000` limiting the number of results in the response payload. Ignored for the `download` endpoint.
+
+#### Download-only parameters
+
+These parameters are only accepted when `endpoint="download"`. They are ignored for the `feed` endpoint.
+
+- `limit`: Maximum number of files to return in the response.
+- `page`: Zero-indexed page of results to return. Available on `realtime_domain_risk`, `domainhotlist`, `iphotlist`, and `iprisk`.
+- `prefix`: Filter files by date prefix (e.g. `"2026-08-"`). Available on `realtime_domain_risk`, `domainhotlist`, `iphotlist`, and `iprisk`.
+
+```python
+api = API(USERNAME, KEY)
+api.iphotlist(endpoint="download", limit=10, page=0, prefix="2026-08-")
+```
+
+## Handling iterative response from RTTF endpoints:
 
-Since we may dealing with large feeds datasets, the python wrapper uses `generator` for efficient memory handling. Therefore, we need to iterate through the `generator` if we're accessing the partial results of the feeds data.
+Since we may be dealing with large feeds datasets, the python wrapper uses `generator` for efficient memory handling. Therefore, we need to iterate through the `generator` if we're accessing the partial results of the feeds data.
 
 ### Single request because the requested data is within the maximum result:
 ```python

domaintools_api_test_upload-3.0.0/VERSION

@@ -0,0 +1 @@
+3.0.0

domaintools_api_test_upload-3.0.0/domaintools/__init__.py

@@ -0,0 +1,29 @@
+"""DomainTools Official Python API"""
+
+from domaintools._version import current
+from domaintools.api import API
+from domaintools.auth.dt_auth import AuthMode, DTAuth
+from domaintools.clients import (
+    AccountsAPI,
+    CertsAPI,
+    DetectAPI,
+    DomainsAPI,
+    FeedsAPI,
+    IpsAPI,
+    IrisAPI,
+)
+
+__version__ = current
+
+__all__ = [
+    "API",
+    "DTAuth",
+    "AuthMode",
+    "DomainsAPI",
+    "IpsAPI",
+    "IrisAPI",
+    "AccountsAPI",
+    "DetectAPI",
+    "FeedsAPI",
+    "CertsAPI",
+]

{domaintools_api_test_upload-2.8.1 → domaintools_api_test_upload-3.0.0}/domaintools/_version.py

@@ -20,4 +20,4 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 """
 
-current = "2.8.1"
+current = "3.0.0"