domaintools-api 2.1.0__tar.gz → 2.3.0__tar.gz

{domaintools_api-2.1.0/domaintools_api.egg-info → domaintools_api-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: domaintools_api
-Version: 2.1.0
+Version: 2.3.0
 Summary: DomainTools Official Python API
 Author-email: DomainTools <integrations@domaintools.com>
 License: The MIT License (MIT)
@@ -33,16 +33,11 @@ Classifier: Natural Language :: English
 Classifier: Environment :: Console
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.6
-Classifier: Programming Language :: Python :: 3.7
-Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Utilities
-Requires-Python: >=3.6
+Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: httpx
@@ -265,5 +260,63 @@ API_KEY
 Python Version Support Policy
 ===================
 
-Please see the [supported versions](https://github.com/DomainTools/python_api/raw/main/PYTHON_SUPPORT.md) document 
+Please see the [supported versions](https://github.com/DomainTools/python_api/raw/main/PYTHON_SUPPORT.md) document
 for the DomainTools Python support policy.
+
+
+Real-Time Threat Intelligence Feeds
+===================
+
+Real-Time Threat Intelligence Feeds provide data on the different stages of the domain lifecycle: from first-observed in the wild, to newly re-activated after a period of quiet. Access current feed data in real-time or retrieve historical feed data through separate APIs.
+
+Custom parameters aside from the common `GET` Request parameters:
+- `endpoint` (choose either `download` or `feed` API endpoint - default is `feed`)
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=False)
+    api.nod(endpoint="feed", **kwargs)
+    ```
+- `header_authentication`: by default, we're using API Header Authentication. Set this False if you want to use API Key and Secret Authentication. Apparently, you can't use API Header Authentication for `download` endpoints so this will be defaulted to `False` even without explicitly setting it.
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=False)
+    api.nod(header_authentication=False, **kwargs)
+    ```
+- `output_format`: (choose either `csv` or `jsonl` - default is `jsonl`). Cannot be used in `domainrdap` feeds. Additionally, `csv` is not available for `download` endpoints.
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=False)
+    api.nod(output_format="csv", **kwargs)
+    ```
+
+The Feed API standard access pattern is to periodically request the most recent feed data, as often as every 60 seconds. Specify the range of data you receive in one of two ways:
+
+1. With `sessionID`: Make a call and provide a new `sessionID` parameter of your choosing. The API will return the last hour of data by default.
+    - Each subsequent call to the API using your `sessionID` will return all data since the last.
+    - Any single request returns a maximum of 10M results. Requests that exceed 10M results will return a HTTP 206 response code; repeat the same request (with the same `sessionID`) to receive the next tranche of data until receiving a HTTP 200 response code.
+2. Or, specify the time range in one of two ways:
+    - Either an `after=-60` query parameter, where (in this example) -60 indicates the previous 60 seconds.
+    - Or `after` and `before` query parameters for a time range, with each parameter accepting an ISO-8601 UTC formatted timestamp (a UTC date and time of the format YYYY-MM-DDThh:mm:ssZ)
+
+## Handling iterative response from RTUF endpoints:
+
+Since we may dealing with large feeds datasets, the python wrapper uses `generator` for efficient memory handling. Therefore, we need to iterate through the `generator` if we're accessing the partial results of the feeds data.
+
+### Single request because the requested data is within the maximum result:
+```python
+from domaintools import API
+
+api = API(USERNAME, KEY, always_sign_api_key=False)
+results = api.nod(sessionID="my-session-id", after=-60)
+
+for result in results.response() # generator that holds NOD feeds data for the past 60 seconds and is expected to request only once
+    # do things to result
+```
+
+## Multiple requests because the requested data is more than the maximum result per request:
+```python
+from domaintools import API
+
+api = API(USERNAME, KEY, always_sign_api_key=False)
+results = api.nod(sessionID="my-session-id", after=-7200)
+
+for partial_result in results.response() # generator that holds NOD feeds data for the past 2 hours and is expected to request multiple times
+    # do things to partial_result
+```

{domaintools_api-2.1.0 → domaintools_api-2.3.0}/README.md

@@ -211,5 +211,63 @@ API_KEY
 Python Version Support Policy
 ===================
 
-Please see the [supported versions](https://github.com/DomainTools/python_api/raw/main/PYTHON_SUPPORT.md) document 
+Please see the [supported versions](https://github.com/DomainTools/python_api/raw/main/PYTHON_SUPPORT.md) document
 for the DomainTools Python support policy.
+
+
+Real-Time Threat Intelligence Feeds
+===================
+
+Real-Time Threat Intelligence Feeds provide data on the different stages of the domain lifecycle: from first-observed in the wild, to newly re-activated after a period of quiet. Access current feed data in real-time or retrieve historical feed data through separate APIs.
+
+Custom parameters aside from the common `GET` Request parameters:
+- `endpoint` (choose either `download` or `feed` API endpoint - default is `feed`)
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=False)
+    api.nod(endpoint="feed", **kwargs)
+    ```
+- `header_authentication`: by default, we're using API Header Authentication. Set this False if you want to use API Key and Secret Authentication. Apparently, you can't use API Header Authentication for `download` endpoints so this will be defaulted to `False` even without explicitly setting it.
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=False)
+    api.nod(header_authentication=False, **kwargs)
+    ```
+- `output_format`: (choose either `csv` or `jsonl` - default is `jsonl`). Cannot be used in `domainrdap` feeds. Additionally, `csv` is not available for `download` endpoints.
+    ```python
+    api = API(USERNAME, KEY, always_sign_api_key=False)
+    api.nod(output_format="csv", **kwargs)
+    ```
+
+The Feed API standard access pattern is to periodically request the most recent feed data, as often as every 60 seconds. Specify the range of data you receive in one of two ways:
+
+1. With `sessionID`: Make a call and provide a new `sessionID` parameter of your choosing. The API will return the last hour of data by default.
+    - Each subsequent call to the API using your `sessionID` will return all data since the last.
+    - Any single request returns a maximum of 10M results. Requests that exceed 10M results will return a HTTP 206 response code; repeat the same request (with the same `sessionID`) to receive the next tranche of data until receiving a HTTP 200 response code.
+2. Or, specify the time range in one of two ways:
+    - Either an `after=-60` query parameter, where (in this example) -60 indicates the previous 60 seconds.
+    - Or `after` and `before` query parameters for a time range, with each parameter accepting an ISO-8601 UTC formatted timestamp (a UTC date and time of the format YYYY-MM-DDThh:mm:ssZ)
+
+## Handling iterative response from RTUF endpoints:
+
+Since we may dealing with large feeds datasets, the python wrapper uses `generator` for efficient memory handling. Therefore, we need to iterate through the `generator` if we're accessing the partial results of the feeds data.
+
+### Single request because the requested data is within the maximum result:
+```python
+from domaintools import API
+
+api = API(USERNAME, KEY, always_sign_api_key=False)
+results = api.nod(sessionID="my-session-id", after=-60)
+
+for result in results.response() # generator that holds NOD feeds data for the past 60 seconds and is expected to request only once
+    # do things to result
+```
+
+## Multiple requests because the requested data is more than the maximum result per request:
+```python
+from domaintools import API
+
+api = API(USERNAME, KEY, always_sign_api_key=False)
+results = api.nod(sessionID="my-session-id", after=-7200)
+
+for partial_result in results.response() # generator that holds NOD feeds data for the past 2 hours and is expected to request multiple times
+    # do things to partial_result
+```

domaintools_api-2.3.0/VERSION

@@ -0,0 +1 @@
+2.3.0

{domaintools_api-2.1.0 → domaintools_api-2.3.0}/domaintools/_version.py

@@ -20,4 +20,4 @@ OTHER DEALINGS IN THE SOFTWARE.
 
 """
 
-current = "2.1.0"
+current = "2.3.0"

{domaintools_api-2.1.0 → domaintools_api-2.3.0}/domaintools/api.py

@@ -1,10 +1,19 @@
 from datetime import datetime, timedelta, timezone
 from hashlib import sha1, sha256, md5
 from hmac import new as hmac
+
 import re
 
+from domaintools.constants import Endpoint, ENDPOINT_TO_SOURCE_MAP, FEEDS_PRODUCTS_LIST, OutputFormat
 from domaintools._version import current as version
-from domaintools.results import GroupedIterable, ParsedWhois, Reputation, Results
+from domaintools.results import (
+    GroupedIterable,
+    ParsedWhois,
+    ParsedDomainRdap,
+    Reputation,
+    Results,
+    FeedsResults,
+)
 from domaintools.filters import (
     filter_by_riskscore,
     filter_by_expire_date,
@@ -12,6 +21,8 @@ from domaintools.filters import (
     filter_by_field,
     DTResultFilter,
 )
+from domaintools.utils import validate_feeds_parameters
+
 
 AVAILABLE_KEY_SIGN_HASHES = ["sha1", "sha256", "md5"]
 
@@ -77,16 +88,9 @@ class API(object):
         self._build_api_url(api_url, api_port)
 
         if not https:
-            raise Exception(
-                "The DomainTools API endpoints no longer support http traffic. Please make sure https=True."
-            )
-        if proxy_url:
-            if isinstance(proxy_url, str):
-                self.proxy_url = {"http://": proxy_url, "https://": proxy_url}
-            else:
-                raise Exception(
-                    "Proxy URL must be a string. For example: '127.0.0.1:8888'"
-                )
+            raise Exception("The DomainTools API endpoints no longer support http traffic. Please make sure https=True.")
+        if proxy_url and not isinstance(proxy_url, str):
+            raise Exception("Proxy URL must be a string. For example: '127.0.0.1:8888'")
 
     def _build_api_url(self, api_url=None, api_port=None):
         """Build the API url based on the given url and port. Defaults to `https://api.domaintools.com`"""
@@ -110,51 +114,38 @@ class API(object):
             hours = limit_hours and 3600 / float(limit_hours)
             minutes = limit_minutes and 60 / float(limit_minutes)
 
-            self.limits[product["id"]] = {
-                "interval": timedelta(seconds=minutes or hours or default)
-            }
+            self.limits[product["id"]] = {"interval": timedelta(seconds=minutes or hours or default)}
 
     def _results(self, product, path, cls=Results, **kwargs):
         """Returns _results for the specified API path with the specified **kwargs parameters"""
-        if (
-            product != "account-information"
-            and self.rate_limit
-            and not self.limits_set
-            and not self.limits
-        ):
+        if product != "account-information" and self.rate_limit and not self.limits_set and not self.limits:
             self._rate_limit()
 
         uri = "/".join((self._rest_api_url, path.lstrip("/")))
         parameters = self.default_parameters.copy()
         parameters["api_username"] = self.username
-        self.handle_api_key(path, parameters)
-        parameters.update(
-            {
-                key: str(value).lower() if value in (True, False) else value
-                for key, value in kwargs.items()
-                if value is not None
-            }
-        )
+        header_authentication = kwargs.pop("header_authentication", True)  # Used only by Real-Time Threat Intelligence Feeds endpoints for now
+        self.handle_api_key(product, path, parameters, header_authentication)
+        parameters.update({key: str(value).lower() if value in (True, False) else value for key, value in kwargs.items() if value is not None})
 
         return cls(self, product, uri, **parameters)
 
-    def handle_api_key(self, path, parameters):
+    def handle_api_key(self, product, path, parameters, header_authentication):
         if self.https and not self.always_sign_api_key:
-            parameters["api_key"] = self.key
+            if product in FEEDS_PRODUCTS_LIST and header_authentication:
+                parameters["X-Api-Key"] = self.key
+            else:
+                parameters["api_key"] = self.key
         else:
             if self.key_sign_hash and self.key_sign_hash in AVAILABLE_KEY_SIGN_HASHES:
                 signing_hash = eval(self.key_sign_hash)
             else:
                 raise ValueError(
                     "Invalid value '{0}' for 'key_sign_hash'. "
-                    "Values available are {1}".format(
-                        self.key_sign_hash, ",".join(AVAILABLE_KEY_SIGN_HASHES)
-                    )
+                    "Values available are {1}".format(self.key_sign_hash, ",".join(AVAILABLE_KEY_SIGN_HASHES))
                 )
 
-            parameters["timestamp"] = datetime.now(timezone.utc).strftime(
-                "%Y-%m-%dT%H:%M:%SZ"
-            )
+            parameters["timestamp"] = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
             parameters["signature"] = hmac(
                 self.key.encode("utf8"),
                 "".join([self.username, parameters["timestamp"], path]).encode("utf8"),
@@ -163,9 +154,7 @@ class API(object):
 
     def account_information(self, **kwargs):
         """Provides a snapshot of your accounts current API usage"""
-        return self._results(
-            "account-information", "/v1/account", items_path=("products",), **kwargs
-        )
+        return self._results("account-information", "/v1/account", items_path=("products",), **kwargs)
 
     def available_api_calls(self):
         """Provides a list of api calls that you can use based on your account information."""
@@ -180,25 +169,10 @@ class API(object):
                 string[1:],
             )
 
-        api_calls = tuple(
-            (
-                api_call
-                for api_call in dir(API)
-                if not api_call.startswith("_")
-                and callable(getattr(API, api_call, None))
-            )
-        )
-        return sorted(
-            [
-                snakecase(p["id"])
-                for p in self.account_information()["products"]
-                if snakecase(p["id"]) in api_calls
-            ]
-        )
+        api_calls = tuple((api_call for api_call in dir(API) if not api_call.startswith("_") and callable(getattr(API, api_call, None))))
+        return sorted([snakecase(p["id"]) for p in self.account_information()["products"] if snakecase(p["id"]) in api_calls])
 
-    def brand_monitor(
-        self, query, exclude=None, domain_status=None, days_back=None, **kwargs
-    ):
+    def brand_monitor(self, query, exclude=None, domain_status=None, days_back=None, **kwargs):
         """Pass in one or more terms as a list or separated by the pipe character ( | )"""
         if exclude is None:
             exclude = []
@@ -324,9 +298,16 @@ class API(object):
             **kwargs,
         )
 
-    def registrant_monitor(
-        self, query, exclude=None, days_back=0, limit=None, **kwargs
-    ):
+    def parsed_domain_rdap(self, query, **kwargs):
+        """Pass in a domain name to see the most recent Domain-RDAP registration record"""
+        return self._results(
+            "parsed-domain-rdap",
+            "/v1/{0}/rdap/parsed/".format(query),
+            cls=ParsedDomainRdap,
+            **kwargs,
+        )
+
+    def registrant_monitor(self, query, exclude=None, days_back=0, limit=None, **kwargs):
         """One or more terms as a Python list or separated by the pipe character ( | )."""
         if exclude is None:
             exclude = []
@@ -354,15 +335,11 @@ class API(object):
 
     def reverse_ip(self, domain=None, limit=None, **kwargs):
         """Pass in a domain name."""
-        return self._results(
-            "reverse-ip", "/v1/{0}/reverse-ip".format(domain), limit=limit, **kwargs
-        )
+        return self._results("reverse-ip", "/v1/{0}/reverse-ip".format(domain), limit=limit, **kwargs)
 
     def host_domains(self, ip=None, limit=None, **kwargs):
         """Pass in an IP address."""
-        return self._results(
-            "reverse-ip", "/v1/{0}/host-domains".format(ip), limit=limit, **kwargs
-        )
+        return self._results("reverse-ip", "/v1/{0}/host-domains".format(ip), limit=limit, **kwargs)
 
     def reverse_ip_whois(
         self,
@@ -401,9 +378,7 @@ class API(object):
             **kwargs,
         )
 
-    def reverse_whois(
-        self, query, exclude=None, scope="current", mode="purchase", **kwargs
-    ):
+    def reverse_whois(self, query, exclude=None, scope="current", mode="purchase", **kwargs):
         """List of one or more terms to search for in the Whois record,
         as a Python list or separated with the pipe character ( | ).
         """
@@ -423,9 +398,7 @@ class API(object):
         """Pass in a domain name or an IP address to perform a whois lookup."""
         return self._results("whois", "/v1/{0}/whois".format(query), **kwargs)
 
-    def whois_history(
-        self, query, mode=None, sort=None, offset=None, limit=None, **kwargs
-    ):
+    def whois_history(self, query, mode=None, sort=None, offset=None, limit=None, **kwargs):
         """Pass in a domain name."""
         return self._results(
             "whois-history",
@@ -484,16 +457,7 @@ class API(object):
         """Performs a search for the provided search terms ANDed together,
         returning the pivot engine row data for the resulting domains.
         """
-        if (
-            not domain
-            and not ip
-            and not email
-            and not nameserver
-            and not registrar
-            and not registrant
-            and not registrant_org
-            and not kwargs
-        ):
+        if not domain and not ip and not email and not nameserver and not registrar and not registrant and not registrant_org and not kwargs:
             raise ValueError("At least one search term must be specified")
 
         return self._results(
@@ -568,12 +532,8 @@ class API(object):
         younger_than_date = kwargs.pop("younger_than_date", {}) or None
         older_than_date = kwargs.pop("older_than_date", {}) or None
         updated_after = kwargs.pop("updated_after", {}) or None
-        include_domains_with_missing_field = (
-            kwargs.pop("include_domains_with_missing_field", {}) or None
-        )
-        exclude_domains_with_missing_field = (
-            kwargs.pop("exclude_domains_with_missing_field", {}) or None
-        )
+        include_domains_with_missing_field = kwargs.pop("include_domains_with_missing_field", {}) or None
+        exclude_domains_with_missing_field = kwargs.pop("exclude_domains_with_missing_field", {}) or None
 
         filtered_results = DTResultFilter(result_set=results).by(
             [
@@ -581,12 +541,8 @@ class API(object):
                 filter_by_expire_date(date=younger_than_date, lookup_type="before"),
                 filter_by_expire_date(date=older_than_date, lookup_type="after"),
                 filter_by_date_updated_after(date=updated_after),
-                filter_by_field(
-                    field=include_domains_with_missing_field, filter_type="include"
-                ),
-                filter_by_field(
-                    field=exclude_domains_with_missing_field, filter_type="exclude"
-                ),
+                filter_by_field(field=include_domains_with_missing_field, filter_type="include"),
+                filter_by_field(field=exclude_domains_with_missing_field, filter_type="exclude"),
             ]
         )
 
@@ -691,9 +647,7 @@ class API(object):
             kwargs["search_hash"] = search_hash
 
         if not (kwargs or domains):
-            raise ValueError(
-                "Need to define investigation using kwarg filters or domains"
-            )
+            raise ValueError("Need to define investigation using kwarg filters or domains")
 
         if isinstance(domains, (list, tuple)):
             domains = ",".join(domains)
@@ -723,12 +677,8 @@ class API(object):
                 filter_by_expire_date(date=younger_than_date, lookup_type="before"),
                 filter_by_expire_date(date=older_than_date, lookup_type="after"),
                 filter_by_date_updated_after(date=updated_after),
-                filter_by_field(
-                    field=include_domains_with_missing_field, filter_type="include"
-                ),
-                filter_by_field(
-                    field=exclude_domains_with_missing_field, filter_type="exclude"
-                ),
+                filter_by_field(field=include_domains_with_missing_field, filter_type="include"),
+                filter_by_field(field=exclude_domains_with_missing_field, filter_type="exclude"),
             ]
         )
 
@@ -768,9 +718,7 @@ class API(object):
 
         if include_counts:
             if not datetime_counts_since:
-                raise ValueError(
-                    "Need to define datetime_counts_since when include_counts is True"
-                )
+                raise ValueError("Need to define datetime_counts_since when include_counts is True")
             if isinstance(datetime_counts_since, datetime):
                 datetime_counts_since = str(datetime_counts_since.astimezone())
             elif isinstance(datetime_counts_since, str):
@@ -978,9 +926,7 @@ class API(object):
             **kwargs,
         )
 
-    def iris_detect_manage_watchlist_domains(
-        self, watchlist_domain_ids, state, **kwargs
-    ):
+    def iris_detect_manage_watchlist_domains(self, watchlist_domain_ids, state, **kwargs):
         """Changes the watch state of a list of domains by their Iris Detect domain ID.
 
         watchlist_domain_ids: List[str]: required. List of Iris Detect domain IDs to manage.
@@ -999,9 +945,7 @@ class API(object):
             **kwargs,
         )
 
-    def iris_detect_escalate_domains(
-        self, watchlist_domain_ids, escalation_type, **kwargs
-    ):
+    def iris_detect_escalate_domains(self, watchlist_domain_ids, escalation_type, **kwargs):
         """Changes the escalation type of a list of domains by their Iris Detect domain ID.
 
         watchlist_domain_ids: List[str]: required. List of Iris Detect domain IDs to escalate.
@@ -1120,30 +1064,67 @@ class API(object):
             **kwargs,
         )
 
-    def nod(self, **kwargs):
+    def nod(self, **kwargs) -> FeedsResults:
         """Returns back list of the newly observed domains feed"""
-        sessionID = kwargs.get("sessionID")
-        after = kwargs.get("after")
-        if not (sessionID or after):
-            raise ValueError("sessionID or after (can be both) must be defined")
+        validate_feeds_parameters(kwargs)
+        endpoint = kwargs.pop("endpoint", Endpoint.FEED.value)
+        source = ENDPOINT_TO_SOURCE_MAP.get(endpoint)
+        if endpoint == Endpoint.DOWNLOAD.value or kwargs.get("output_format", OutputFormat.JSONL.value) != OutputFormat.CSV.value:
+            # headers param is allowed only in Feed API and CSV format
+            kwargs.pop("headers", None)
 
         return self._results(
-            "newly-observed-domains-feed-(api)",
-            "v1/feed/nod/",
+            f"newly-observed-domains-feed-({source.value})",
+            f"v1/{endpoint}/nod/",
             response_path=(),
+            cls=FeedsResults,
             **kwargs,
         )
 
-    def nad(self, **kwargs):
+    def nad(self, **kwargs) -> FeedsResults:
         """Returns back list of the newly active domains feed"""
-        sessionID = kwargs.get("sessionID")
-        after = kwargs.get("after")
-        if not (sessionID or after):
-            raise ValueError("sessionID or after (can be both) must be defined")
+        validate_feeds_parameters(kwargs)
+        endpoint = kwargs.pop("endpoint", Endpoint.FEED.value)
+        source = ENDPOINT_TO_SOURCE_MAP.get(endpoint).value
+        if endpoint == Endpoint.DOWNLOAD.value or kwargs.get("output_format", OutputFormat.JSONL.value) != OutputFormat.CSV.value:
+            # headers param is allowed only in Feed API and CSV format
+            kwargs.pop("headers", None)
+
+        return self._results(
+            f"newly-active-domains-feed-({source})",
+            f"v1/{endpoint}/nad/",
+            response_path=(),
+            cls=FeedsResults,
+            **kwargs,
+        )
+
+    def domainrdap(self, **kwargs) -> FeedsResults:
+        """Returns changes to global domain registration information, populated by the Registration Data Access Protocol (RDAP)"""
+        validate_feeds_parameters(kwargs)
+        endpoint = kwargs.pop("endpoint", Endpoint.FEED.value)
+        source = ENDPOINT_TO_SOURCE_MAP.get(endpoint).value
+
+        return self._results(
+            f"domain-registration-data-access-protocol-feed-({source})",
+            f"v1/{endpoint}/domainrdap/",
+            response_path=(),
+            cls=FeedsResults,
+            **kwargs,
+        )
+
+    def domaindiscovery(self, **kwargs) -> FeedsResults:
+        """Returns new domains as they are either discovered in domain registration information, observed by our global sensor network, or reported by trusted third parties"""
+        validate_feeds_parameters(kwargs)
+        endpoint = kwargs.pop("endpoint", Endpoint.FEED.value)
+        source = ENDPOINT_TO_SOURCE_MAP.get(endpoint).value
+        if endpoint == Endpoint.DOWNLOAD.value or kwargs.get("output_format", OutputFormat.JSONL.value) != OutputFormat.CSV.value:
+            # headers param is allowed only in Feed API and CSV format
+            kwargs.pop("headers", None)
 
         return self._results(
-            "newly-active-domains-feed-(api)",
-            "v1/feed/nad/",
+            f"real-time-domain-discovery-feed-({source})",
+            f"v1/{endpoint}/domaindiscovery/",
             response_path=(),
+            cls=FeedsResults,
             **kwargs,
         )