{"uid":"cap_4kuuoRv0OEtkBjthoIHWn","slug":"netintel-domain-watch-cc9cfa4a","name":"NetIntel Domain Watch","description":"Monitor a domain for changes — DNS records, nameservers, MX, SPF and DMARC, TLS certificate and expiry, newly issued certificates in CT logs, registrar and expiration via RDAP, and the live site's redirect and title, compared with your previous check: changed true/false, field-level before/after and plain alerts (nameservers changed, cert expiring, new cert issued, DMARC removed). Repeat with the same watch_id.","url":"https://netintel.dev/domain/watch?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Bare domain to monitor. Aliases: host, name, target"},"watch_id":{"type":"string","description":"Your job id (1-64 chars A-Za-z0-9_.:-); keeps watches apart when one wallet serves many agents"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"alerts":{"type":"array","items":{"type":"object"}},"changed":{"type":["boolean","null"],"description":"null on the baseline call"},"summary":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"alerts":[{"code":"ns_changed","detail":"nameservers changed","severity":"critical"}],"changed":true,"summary":"1 change, 1 critical alert: ns_changed"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_y9qmYrIuIB1XPYaSu1nVe","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Monitors a domain for changes across DNS, nameservers, MX, SPF/DMARC, TLS certificate, CT logs, RDAP registration, and live site metadata, returning field-level before/after diffs and plain-language alerts.","exampleAgentPrompt":"Keep an eye on example.com for me and let me know if anything changes — nameservers, DNS records, MX, SPF, DMARC, TLS cert, or registration details. Use watch_id 'example-main' so we can track it consistently.","exampleUseCases":[{"title":"Domain hijacking early warning","prompt":"I want you to monitor acmecorp.com using watch_id 'acmecorp-watch' and immediately flag it if the nameservers or registrar change — I need to know the moment anything looks like a domain takeover."},{"title":"TLS certificate expiry alerting","prompt":"Check mybusiness.io for certificate issues — use watch_id 'mybusiness-tls' — and tell me if the TLS cert is expiring soon or if any new certs have been issued in the CT logs that I didn't authorize."},{"title":"Email security config monitoring","prompt":"Watch startup.io using watch_id 'startup-email-sec' and alert me if the SPF or DMARC records get removed or change — I need to know right away if our email security config breaks."}],"resultDescription":"Returns a JSON object with: a `changed` boolean (null on the first baseline call, true/false on repeats), a `summary` string describing the number and severity of changes, and an `alerts` array where each alert has a `code` (e.g. ns_changed, cert_expiring, new_cert_issued, dmarc_removed), `detail` plain-language description, and `severity` level. Field-level before/after diffs are included for each monitored attribute that changed.","failureModes":["Domain not resolvable or invalid — returns error or empty DNS fields","RDAP registry not responding — registrar/expiration fields may be null","CT log query timeout — newly issued certificates may be missing","First call always returns changed=null (baseline establishment, not an error)","watch_id not provided — each call treated as independent, no diff computed","Rate limiting or payment failure — 402 response with no data"],"whenToPreferThis":"Choose this endpoint when you need continuous, automated surveillance of a domain's full infrastructure stack — DNS, certificates, email security records, and registration — with structured before/after diffs and machine-readable alerts. Prefer it over one-shot domain intelligence endpoints when the goal is change detection over time rather than a snapshot. It is especially valuable for security monitoring (detecting hijacking, unauthorized cert issuance, DMARC removal) and operational alerting (cert expiry, MX outages) in agentic or scheduled workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T12:31:46.898Z","isFirstParty":false,"canonicalSlug":"netintel-domain-watch-cc9cfa4a"}