Skip to content

Get a brand's domain

GET
/core/api/brands/{id}/domains/{domain_id}/
curl --request GET \
--url https://app.nebty.de/core/api/brands/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/domains/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/ \
--header 'Authorization: <Authorization>'

Returns one domain associated with the brand, in the full form with scan history and evidence. It is the same record as a row of the non-compact domain list, with the same brand-specific risk score and verdict. Answers 404 if the id is not a UUID or the domain is not associated with this brand.

domain_id
required
string format: uuid

UUID of a domain associated with this brand (as returned in the id field of the brand’s domain list).

id
required
string format: uuid

UUID of the brand, as returned in the id field of the brand list.

Media typeapplication/json

Serializer for Domain model.

object
id
required
string format: uuid
name
required
string
<= 255 characters
source

How this domain was discovered/added to the system

  • VARIATION - Generated from Variation
  • CERTSTREAM - CertStream API
  • SUBDOMAIN_SCAN - Subdomain Scan
  • MANUAL - Manual Entry
  • AD_LIBRARY - Meta Ad Library
string
Allowed values: VARIATION CERTSTREAM SUBDOMAIN_SCAN MANUAL AD_LIBRARY
parent
string format: uuid
nullable
associated_brands
required
Array<string>
latest_scan
required
object
id
required
string format: uuid
domain
required
string format: uuid
mx_records
string
nullable
a_records
string
nullable
cname_records
string
nullable
visual_match
required
boolean
nullable
verdict
required

The single customer-facing verdict, resolved for the requesting brand.

Unlike risk_score/visual_match there is no shared DomainScan column to fall back to: the merged verdict has only ever lived on the pair (BrandDomainAssociation.refresh_merged_verdict), so a caller with no brand in context — or a historical scan row, which carries no pair-specific verdict of its own — gets “unknown” rather than another brand’s answer.

string
verdict_reasoning
required
string
nullable
requires_human_review
required
boolean
visual_scan_at
required

When this brand last had the domain visually scanned.

The shared timestamp is whichever brand scanned the domain most recently, so on a shared hostname it is somebody else’s. NULL on the pair means this brand has not scanned it yet, which is exactly what the cooldown treats it as.

string format: date-time
nullable
screenshot_url

URL to the screenshot of the domain stored in Hetzner S3-compatible Object Storage

string format: uri
nullable <= 2000 characters
https_head_request_response_code
integer
nullable
certificate
string
nullable
scans_executed
integer
is_alerting_event
required

Whether this brand still has an unsent alert for the domain.

The shared flag means “somebody has one”, so after this brand’s alert was sent it would keep reporting true while another brand’s is pending.

boolean
nullable
completeness
required

A completeness of 0 means that the domain has no records set. The higher this number, the more likely the domain is actually used.

integer
risk_score
required
integer
scan_history
required

The domain’s scan timeline, most recent first.

On a domain that has only ever had single-brand history, the whole history is this brand’s own and renders untouched. Once branded rows exist, the domain has had a multi-brand period: the requesting brand then sees only its own rows, and NULL-brand rows are redacted because current association count can no longer prove which brand they belonged to.

Array<object>
object
key
additional properties
user_feedback_type
required
One of:
  • false_positive - False Positive
  • comment - Comment
string
Allowed values: false_positive comment
user_feedback_comment
required

Free text comment from the user.

string
user_feedback_by
required

User who submitted the feedback.

string format: uuid
nullable
user_feedback_at
required

When the feedback was submitted.

string format: date-time
nullable
created_at
required
string format: date-time
updated_at
required
string format: date-time
scans
required
Array<object>

Serializer for DomainScan model.

risk_score and visual_match are answers about a brand↔domain pair, not about the domain (#954). When the caller puts a brand in the serializer context — every brand-scoped endpoint does — both are rendered from that brand’s association, so a domain two customers monitor shows each of them the verdict computed against their own brand.

Without a brand in context the shared columns are rendered unchanged, which is what the domain-global endpoints and the admin want. That column now means “the worst score across every brand monitoring this domain” rather than “the longest-monitored brand’s score” — see DomainScan.get_risk_score.

verdict/verdict_reasoning/requires_human_review are the single customer-facing verdict merged from the visual and content detectors (BrandDomainAssociation.refresh_merged_verdict) and are what the frontend should read going forward. visual_match is kept in the payload as deprecated — do not remove it — because it still governs code paths mid-migration; new consumers should read verdict instead.

object
id
required
string format: uuid
domain
required
string format: uuid
mx_records
string
nullable
a_records
string
nullable
cname_records
string
nullable
visual_match
required
boolean
nullable
verdict
required

The single customer-facing verdict, resolved for the requesting brand.

Unlike risk_score/visual_match there is no shared DomainScan column to fall back to: the merged verdict has only ever lived on the pair (BrandDomainAssociation.refresh_merged_verdict), so a caller with no brand in context — or a historical scan row, which carries no pair-specific verdict of its own — gets “unknown” rather than another brand’s answer.

string
verdict_reasoning
required
string
nullable
requires_human_review
required
boolean
visual_scan_at
required

When this brand last had the domain visually scanned.

The shared timestamp is whichever brand scanned the domain most recently, so on a shared hostname it is somebody else’s. NULL on the pair means this brand has not scanned it yet, which is exactly what the cooldown treats it as.

string format: date-time
nullable
screenshot_url

URL to the screenshot of the domain stored in Hetzner S3-compatible Object Storage

string format: uri
nullable <= 2000 characters
https_head_request_response_code
integer
nullable
certificate
string
nullable
scans_executed
integer
is_alerting_event
required

Whether this brand still has an unsent alert for the domain.

The shared flag means “somebody has one”, so after this brand’s alert was sent it would keep reporting true while another brand’s is pending.

boolean
nullable
completeness
required

A completeness of 0 means that the domain has no records set. The higher this number, the more likely the domain is actually used.

integer
risk_score
required
integer
scan_history
required

The domain’s scan timeline, most recent first.

On a domain that has only ever had single-brand history, the whole history is this brand’s own and renders untouched. Once branded rows exist, the domain has had a multi-brand period: the requesting brand then sees only its own rows, and NULL-brand rows are redacted because current association count can no longer prove which brand they belonged to.

Array<object>
object
key
additional properties
user_feedback_type
required
One of:
  • false_positive - False Positive
  • comment - Comment
string
Allowed values: false_positive comment
user_feedback_comment
required

Free text comment from the user.

string
user_feedback_by
required

User who submitted the feedback.

string format: uuid
nullable
user_feedback_at
required

When the feedback was submitted.

string format: date-time
nullable
created_at
required
string format: date-time
updated_at
required
string format: date-time
open_takedown
required
object
id
required

Takedown id; fetch the case at GET /core/api/takedowns/{id}/.

string format: uuid
status
required

Current status of the running case.

  • REQUESTED - Requested (Pending Approval)
  • OPEN - Open
  • IN_PROGRESS - In Progress
  • PENDING_RESPONSE - Pending Response
  • CLOSED - Closed
  • FAILED - Failed
  • REJECTED - Rejected
string
Allowed values: REQUESTED OPEN IN_PROGRESS PENDING_RESPONSE CLOSED FAILED REJECTED
last_closed_takedown
required
object
id
required

Takedown id; fetch the case at GET /core/api/takedowns/{id}/.

string format: uuid
status
required

How the case ended: CLOSED (worked to a conclusion, see resolution) or FAILED (abandoned, no resolution).

  • CLOSED - Closed
  • FAILED - Failed
string
Allowed values: CLOSED FAILED
resolution
required
One of:
  • DOMAIN_SUSPENDED - Domain Suspended
  • CONTENT_REMOVED - Content Removed
  • SERVER_HOLD - Server Hold
  • VOLUNTARY_TAKEDOWN - Voluntary Takedown
  • UNRESOLVED - Unresolved
  • FALSE_POSITIVE - False Positive
string
Allowed values: DOMAIN_SUSPENDED CONTENT_REMOVED SERVER_HOLD VOLUNTARY_TAKEDOWN UNRESOLVED FALSE_POSITIVE
closed_at
required

When the case finished. For CLOSED this is the case’s closed_at; FAILED and undated legacy cases use a stable result timestamp.

string format: date-time
created_at
required
string format: date-time
updated_at
required
string format: date-time
Example
{
"source": "VARIATION",
"latest_scan": {
"user_feedback_type": "false_positive"
},
"scans": [
{
"user_feedback_type": "false_positive"
}
],
"open_takedown": {
"status": "REQUESTED"
},
"last_closed_takedown": {
"status": "CLOSED",
"resolution": "DOMAIN_SUSPENDED"
}
}

The API key is missing, invalid, revoked or belongs to an inactive user.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
"detail": "example"
}

The requested page or record does not exist or cannot be accessed.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
"detail": "example"
}

Too many requests or failed authentication attempts. Try again later.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
"detail": "example"
}