> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DomScan

> Reference for the Tracecat DomScan integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Check DNS security

Action ID: `tools.domscan.check_dns_security`

Check DNS security. Calls GET /v1/dns/security directly.

Reference: [https://domscan.net/docs/dns-security](https://domscan.net/docs/dns-security)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to analyze.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

## Check domain availability

Action ID: `tools.domscan.check_domain_availability`

Check domain availability. Calls GET /v1/status directly.

Reference: [https://domscan.net/docs/check-availability](https://domscan.net/docs/check-availability)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="domain" type="string | null">
  Single-domain shortcut for one TLD, for example "mycompany.com".

  Default: `null`.
</ParamField>

<ParamField path="name" type="string | null">
  Domain name without TLD. Use together with tlds (e.g., "example" for example.com).

  Default: `null`.
</ParamField>

<ParamField path="prefer_cache" type="boolean | null">
  Return cached results if available (faster).

  Default: `null`.
</ParamField>

<ParamField path="tlds" type="string | null">
  Comma-separated list of TLDs to check (max 50). Use together with name.

  Default: `null`.
</ParamField>

## Check domain health

Action ID: `tools.domscan.check_domain_health`

Check domain health. Calls GET /v1/health directly.

Reference: [https://domscan.net/docs/health](https://domscan.net/docs/health)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain or subdomain to analyze (e.g. example.com or blog.example.com).
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="details" type="boolean | null">
  Include detailed breakdown. DomScan defaults to true.

  Default: `null`.
</ParamField>

## Check social handles

Action ID: `tools.domscan.check_social_handles`

Check social handles. Calls GET /v1/social directly.

Reference: [https://domscan.net/docs/social](https://domscan.net/docs/social)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="handle" type="string" required>
  Social handle to check, without a leading @.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="platforms" type="string | null">
  Comma-separated platforms to check. Defaults to all known social platforms. Aliases listed by GET /v1/social/info are accepted.

  Default: `null`.
</ParamField>

<ParamField path="resources" type="string | null">
  Optional comma-separated resource types. If platforms is omitted, the request checks only these resources. Aliases listed by GET /v1/social/info are accepted.

  Default: `null`.
</ParamField>

## Detect typosquatting

Action ID: `tools.domscan.detect_typosquatting`

Detect typosquatting. Calls GET /v1/typos directly.

Reference: [https://domscan.net/docs/typosquatting](https://domscan.net/docs/typosquatting)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to analyze for typosquatting risks.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="check_registered" type="boolean | null">
  Check if generated typos are actually registered. Disabled by default and capped for faster responses.

  Default: `null`.
</ParamField>

<ParamField path="include_tld_swap" type="boolean | null">
  Include TLD variation permutations (e.g., .co instead of .com). DomScan defaults to true.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum permutations to generate and check. DomScan defaults to 100.

  Default: `null`.
</ParamField>

## Find subdomains

Action ID: `tools.domscan.find_subdomains`

Find subdomains. Calls GET /v1/subdomains directly.

Reference: [https://domscan.net/docs/subdomains](https://domscan.net/docs/subdomains)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Root domain to search.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="include_wildcards" type="boolean | null">
  Return wildcard certificate SAN patterns in the separate wildcards array. Wildcards are never mixed into the concrete hostname list. DomScan defaults to false.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum number of concrete hostname entries to return, from 1 through 2000. DomScan defaults to 500.

  Default: `null`.
</ParamField>

<ParamField path="prefer_cache" type="boolean | null">
  Serve cached results only. If no fresh or stale cache is available, the API returns 202, queues a background refresh, and refunds the request credits. DomScan defaults to false.

  Default: `null`.
</ParamField>

<ParamField path="sources" type="string | null">
  Compatibility selector. Only ct is accepted. It starts the passive discovery pipeline, but response entries identify the provider that supplied their evidence.

  Default: `null`.
</ParamField>

<ParamField path="verify" type="boolean | null">
  Check DNS only for the returned names. Verification does not discover additional names. DomScan defaults to false.

  Default: `null`.
</ParamField>

## Get certificates

Action ID: `tools.domscan.get_certificates`

Get certificates. Calls GET /v1/certificates directly.

Reference: [https://domscan.net/docs/ssl-certificates](https://domscan.net/docs/ssl-certificates)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to search certificate transparency logs for.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="cursor" type="string | null">
  Offset cursor from pagination.next\_cursor in the previous page.

  Default: `null`.
</ParamField>

<ParamField path="include_expired" type="boolean | null">
  Include certificates that have already expired.

  Default: `null`.
</ParamField>

<ParamField path="include_subdomains" type="boolean | null">
  Include certificates issued for subdomains of the requested domain. DomScan defaults to true.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Maximum certificates to return on this page. DomScan defaults to 100.

  Default: `null`.
</ParamField>

## Get coverage

Action ID: `tools.domscan.get_coverage`

Get coverage. Calls GET /v1/coverage directly.

Reference: [https://domscan.net/docs/coverage](https://domscan.net/docs/coverage)

### Input fields

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="live" type="string | null">
  Set to 1 to include live RDAP endpoint health checks.

  Default: `null`.
</ParamField>

## Get DNS records

Action ID: `tools.domscan.get_dns_records`

Get DNS records. Calls GET /v1/dns directly.

Reference: [https://domscan.net/docs/dns-lookup](https://domscan.net/docs/dns-lookup)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to query DNS records for.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="type" type="string | null">
  DNS record type to query, one of A, AAAA, MX, NS, TXT, SOA, CNAME, CAA, PTR, or SRV. DomScan defaults to A.

  Default: `null`.
</ParamField>

## Get domain overview

Action ID: `tools.domscan.get_domain_overview`

Get a domain overview. Calls GET /v1/overview directly.

Reference: [https://domscan.net/docs](https://domscan.net/docs)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to analyze.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

## Get domain reputation

Action ID: `tools.domscan.get_domain_reputation`

Get domain reputation. Calls GET /v1/reputation directly.

Reference: [https://domscan.net/docs/reputation](https://domscan.net/docs/reputation)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to score for reputation.
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

## Suggest domains

Action ID: `tools.domscan.suggest_domains`

Suggest domains. Calls GET /v1/suggest directly.

Reference: [https://domscan.net/docs/suggestions](https://domscan.net/docs/suggestions)

### Secrets

Required secrets:

* `domscan`: required values `DOMSCAN_API_KEY`.

### Input fields

<ParamField path="keywords" type="string" required>
  Comma-separated keywords (max 10).
</ParamField>

<ParamField path="base_url" type="string | null">
  Base URL of the DomScan API.

  Default: `null`.
</ParamField>

<ParamField path="check" type="boolean | null">
  Check availability of suggestions. DomScan defaults to true.

  Default: `null`.
</ParamField>

<ParamField path="industry" type="string | null">
  Industry for targeted suggestions, one of tech, finance, health, ecommerce, education, media, saas, crypto, ai, or gaming.

  Default: `null`.
</ParamField>

<ParamField path="language" type="string | null">
  Language for prefixes/suffixes (romanized for non-Latin scripts). 30 languages supported. DomScan defaults to en.

  Default: `null`.
</ParamField>

<ParamField path="limit" type="integer | null">
  Max suggestions (1-100). DomScan defaults to 20.

  Default: `null`.
</ParamField>

<ParamField path="style" type="string | null">
  Suggestion style preference, one of brandable, keyword-rich, short, pronounceable, techy, playful, professional, or minimal. DomScan defaults to brandable.

  Default: `null`.
</ParamField>

<ParamField path="tlds" type="string | null">
  Target TLDs. DomScan defaults to com,io,ai,co,app.

  Default: `null`.
</ParamField>