# Passive OSINT & Recon API — passive subdomain discovery and a unified domain/IP recon report from certificate transparency logs, passive DNS, web archives, ASN/rDNS and threat blocklists (no active scanning)

> Passive subdomain discovery across crt.sh + certspotter + OTX + hackertarget + Wayback, deduped, with a per-source matrix and an honest coverage note
> ReefAPI engine `passive-osint` · 4 endpoints · clean JSON, no scraping or browsers to manage.

## How to call
- **Endpoint:** `POST https://api.reefapi.com/passive-osint/v1/<action>` with a JSON body.
- **Auth:** header `x-api-key: <YOUR_REEFAPI_KEY>` — create one free (1,000 credits, no card): https://reefapi.com/signup
- **Response (every call):** `{ ok: boolean, data: ..., meta: { record_count, credits, ... }, error: { code, message } }` — branch on `ok`. Failed or blocked calls are free.
- **One key + one shared credit pool** across every ReefAPI API. Per-call credits are listed on each endpoint below.
- **Use it from an AI agent (MCP):** connect `https://api.reefapi.com/mcp` (remote streamable-http, `Authorization: Bearer <key>`) and your assistant can call these actions directly.

## Endpoints

### POST /passive-osint/v1/subdomains — 2 credits
Passive subdomain discovery across crt.sh + certspotter + OTX + hackertarget + Wayback, deduped, with a per-source matrix and an honest coverage note

**Parameters:**
- `domain` (string, required) — The registrable domain to enrich (a bare host like example.com; a full URL or leading www. is accepted and normalized). NOT a person.
- `sources` (array, optional) — Which passive sources to query (comma-separated string or array). Defaults to all five. Unknown names are ignored. [one of: crtsh, certspotter, otx, hackertarget, wayback]

**Returns:** domain, count, subdomains[] (sorted unique), source_matrix{host:[sources]}, sources{per-source ok/count/note}, coverage_note

**Example request body:**
```json
{
  "domain": "hackerone.com"
}
```

### POST /passive-osint/v1/domain — 3 credits
One-call unified passive report: subdomains + DNS summary + SSL summary + archive first/last-seen + threat blocklist flags, each section degrading independently

**Parameters:**
- `domain` (string, required) — The registrable domain to enrich (a bare host like example.com; a full URL or leading www. is accepted and normalized). NOT a person.
- `sources` (array, optional) — Which passive sources to query (comma-separated string or array). Defaults to all five. Unknown names are ignored. [one of: crtsh, certspotter, otx, hackertarget, wayback]
- `include_pii` (boolean, optional, default false) — If true, reveal the RDAP abuse mailbox / contact email. Default false → contact emails are masked (R17 privacy hygiene).

**Returns:** domain + subdomains_passive{} + dns{} + ssl{} + archive{} + threat_flags{} + dns_history{records:[hostname,record_type,address,first_seen,last_seen]} + associated_domains{domains[] sharing a TLS cert} (each with source/confidence) + provenance{cross_links}; meta.sections = per-section status

**Example request body:**
```json
{
  "domain": "github.com"
}
```

### POST /passive-osint/v1/ip — 1 credit
Passive IP enrichment: rDNS (PTR) + ASN/org/country (Team-Cymru + RDAP) + threat blocklist flags + shared-host neighbours (reverse-IP + OTX IPv4 passive-DNS)

**Parameters:**
- `ip` (string, required) — A single IPv4 address to enrich (rDNS + ASN/org/country + threat + shared-host neighbours).
- `include_pii` (boolean, optional, default false) — If true, reveal the RDAP abuse mailbox / contact email. Default false → contact emails are masked (R17 privacy hygiene).

**Returns:** ip + rdns{ptr} + network{asn,as_name,bgp_prefix,country,org} + threat_flags{} + shared_host{neighbours[],approx_total} + provenance{cross_links}

**Example request body:**
```json
{
  "ip": "8.8.8.8"
}
```

### POST /passive-osint/v1/batch — 3 credits
Compact passive report (subdomain count+list, DNS, threat, archive-first-seen) across up to 10 domains in one call

**Parameters:**
- `domains` (array, required) — Up to 10 domains. A JSON array or a comma/space/newline-separated string. Each gets a compact passive report.

**Returns:** count, results[] (domain, subdomain_count, subdomains[], resolves, mx, threat_verdict, archive_first_seen), coverage_note

## More
- Try it live, no code: https://reefapi.com/playground?engine=passive-osint
- Human docs page: https://reefapi.com/docs/passive-osint
- Every ReefAPI API in one file (for your AI): https://reefapi.com/llms-full.txt