Analyze Domain

Start a full OSINT analysis on a domain, spending a Monitoring slot or a One-shot credit.

https://api.cyborux.com

POST/api/analyze-domain

Bearer

domain*string

email_domain*string

organization_name*string

employees*string

sector*string

consumestring

Authorizationheader

Bearer <token>

API key authentication — use your Cyborux API key as a Bearer token.

Request Body

Field	Type	Description
`domain`	string	The domain to analyze (e.g. `example.com`). Auto-normalized: protocols, `www.`, ports, and path components are stripped. Lowercased. Subdomains are rejected.
`email_domain`	string	Override email domain for discovery if different from the main domain.
`organization_name`	string (max 100)	Human-readable organization name to associate with this domain. Control characters are stripped.
`employees`	enum	Estimated employee count range.
`sector`	enum	Industry sector of the organization.
`consume`	enum (optional)	Which resource to spend when you hold both a free Monitoring slot and One-shot credits: `slot` (monitor the domain) or `one_shot` (one frozen analysis). Omit it to let the server pick when only one is held, or to be prompted (`needs_choice`) when both are.

How a new analysis is charged

Analyzing a new domain spends one of your held resources, chosen by what you hold:

A free Monitoring slot only → the domain is monitored (slot occupied, initial Full analysis run).
One-shot credits only → one credit is spent for a single frozen Full analysis.
Both → if you sent consume, it decides; otherwise the response is needs_choice and you re-submit with consume set (slot is the default).
Neither → 402, prompting a subscription or a One-shot purchase.

Re-running a domain (rescan: true) is charged by how you watch it: a monitored domain's recurring Full re-scan is included, so a rescan of it is free; rescanning a one-shot (non-monitored) domain advances your data cutoff and spends one One-shot credit, or returns 402 (detail.reason upsell) when your balance is empty. A rescan is rejected (429) if you analyzed the domain in the last 24 hours, before any credit is spent.

`employees` Values

1-10, 11-50, 51-100, 101-500, 501-1000, 1000+

`sector` Values

Technology, Finance, Healthcare, Education, Government, Retail, Manufacturing, Energy, Consulting, Other

{
  "domain": "example.com",
  "email_domain": "example.com",
  "organization_name": "Example Corp",
  "employees": "51-100",
  "sector": "Technology"
}

Domain Normalization

The domain field is automatically normalized before analysis:

Input	Normalized
`https://www.example.com/path`	`example.com`
`HTTP://EXAMPLE.COM:8080`	`example.com`
`www.example.com`	`example.com`
`sub.example.com`	Rejected — subdomains are not allowed

Response

The analysis runs asynchronously. Poll the domain summary endpoint to track progress. consume reports which resource was spent — slot (the domain is now monitored) or one_shot.

{
  "status": "success",
  "message": "Domain analysis started",
  "consume": "slot"
}

You hold both a free Monitoring slot and One-shot credits, so the server asks which to spend. Re-submit the same request with consume set to one of options (slot is the default).

{
  "status": "needs_choice",
  "default": "slot",
  "options": ["slot", "one_shot"]
}

Status	Detail
`400`	Invalid domain — could not parse, is a subdomain, or is not a registered (resolvable) domain.
`401`	Not authenticated.
`402`	Nothing to spend — no free slot and no One-shot credits. Subscribe or buy a One-shot. `detail.reason` is `upsell`; on an exhausted fresh-scan allowance it is `block_allowance` (with `one_shot_available`).
`409`	No new work to do, or at capacity. `detail.reason` is one of: `block_cap` — at your Monitoring slot cap, free or add a slot (carries `used` / `cap`); `already_monitored` — you already monitor this domain, so its data stays current on its own; `already_analyzed` — you already ran a Full analysis, re-scan it (`rescan: true`) to refresh. The `already_*` reasons carry a human `message`.

{
  "detail": { "reason": "block_cap", "used": 10, "cap": 10 }
}

{
  "detail": {
    "reason": "already_analyzed",
    "message": "This domain has already been analyzed. Re-scan it to refresh the data (set rescan=true)."
  }
}

curl -X POST https://api.cyborux.com/api/analyze-domain \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "domain": "example.com",
    "organization_name": "Example Corp",
    "employees": "51-100",
    "sector": "Technology"
  }'

const res = await fetch("https://api.cyborux.com/api/analyze-domain", {
  method: "POST",
  headers: { "Content-Type": "application/json", "Authorization": "Bearer YOUR_API_KEY" },
  body: JSON.stringify({
    domain: "example.com",
    organization_name: "Example Corp",
    employees: "51-100",
    sector: "Technology",
  }),
});
const data = await res.json();

import requests

response = requests.post(
    "https://api.cyborux.com/api/analyze-domain",
    json={
        "domain": "example.com",
        "organization_name": "Example Corp",
        "employees": "51-100",
        "sector": "Technology",
    },
    headers={"Authorization": "Bearer YOUR_API_KEY"},
)
data = response.json()