# Grey Ridge Signals — Domain Enrichment API

> Grey Ridge Signals — Domain Enrichment API is a paid API for AI agents from x402-data-api.sigrunner.workers.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Returns DNS records, SSL certificate details, organization info, detected tech stack, subdomains, and a threat verdict for a given domain name

## Facts

- Endpoint: GET https://x402-data-api.sigrunner.workers.dev/enrich/domain
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/grey-ridge-signals-domain-enrichment-api-f35bafb6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_d7Xkd-47-Dx2PspjNC6Gh

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability grey-ridge-signals-domain-enrichment-api-f35bafb6
```

Example prompt: Can you look up everything you can find about the domain suspicious-site.xyz — DNS records, subdomains, SSL certs, what tech it runs, and whether it looks safe?

## When to prefer this

Choose this endpoint when you need a quick, pay-per-call domain intelligence snapshot without API key onboarding. It is ideal for ad-hoc agent workflows that need DNS, certificate, tech stack, and threat verdict data in a single call. Prefer it over heavier OSINT platforms when you want frictionless access, on-chain micropayment billing via x402 on Base, and no subscription commitment. Best for cybersecurity triage, vendor due diligence, and competitive reconnaissance tasks within agentic pipelines.

## Known failure modes

- Domain not found or unresolvable — empty or null DNS fields returned
- Invalid domain format supplied — likely a 400-level error or empty response
- Domain has no discoverable subdomains — subdomains array returned empty
- SSL certificate lookup fails for domains without HTTPS — certificates array empty
- Payment not fulfilled via x402 — 402 response requiring USDC payment on Base before data is returned

## How this service works

Agent-native pay-per-call data on Base (USDC via x402). No API keys, no signup. Discovery: /.well-known/x402

## Output

A JSON object containing: DNS records (A, NS, and possibly others), a list of discovered subdomains, SSL/TLS certificate details (issuer, common name, validity window), detected web tech stack, the registrant or hosting organization, and a plain-English threat verdict (e.g. 'clear') summarizing the domain's risk posture.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "properties": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "dns": {
   "A": [
    "93.184.216.34"
   ],
   "NS": [
    "a.iana-servers.net."
   ]
  },
  "domain": "example.com",
  "verdict": "clear",
  "subdomains": [
   "example.com",
   "www.example.com",
   "mail.example.com"
  ],
  "tech_stack": [
   "nginx"
  ],
  "certificates": [
   {
    "issuer": "C=US, O=Let's Encrypt, CN=R3",
    "valid_to": "2025-04-01T00:00:00Z",
    "valid_from": "2025-01-01T00:00:00Z",
    "common_name": "example.com"
   }
  ],
  "organization": "Internet Assigned Numbers Authority"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/grey-ridge-signals-domain-enrichment-api-f35bafb6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-data-api.sigrunner.workers.dev](https://www.zero.xyz/host/x402-data-api.sigrunner.workers.dev/llms.txt)