# NetIntel Domain Watch

> NetIntel Domain Watch is a paid API for AI agents from netintel.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-30).

Monitors a domain for changes across DNS, nameservers, MX, SPF/DMARC, TLS certificate, CT logs, RDAP registration, and live site metadata, returning field-level before/after diffs and plain-language alerts.

## Facts

- Endpoint: GET https://netintel.dev/domain/watch?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netintel-domain-watch-cc9cfa4a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_4kuuoRv0OEtkBjthoIHWn

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netintel-domain-watch-cc9cfa4a
```

Example prompt: Keep an eye on example.com for me and let me know if anything changes — nameservers, DNS records, MX, SPF, DMARC, TLS cert, or registration details. Use watch_id 'example-main' so we can track it consistently.

## When to prefer this

Choose this endpoint when you need continuous, automated surveillance of a domain's full infrastructure stack — DNS, certificates, email security records, and registration — with structured before/after diffs and machine-readable alerts. Prefer it over one-shot domain intelligence endpoints when the goal is change detection over time rather than a snapshot. It is especially valuable for security monitoring (detecting hijacking, unauthorized cert issuance, DMARC removal) and operational alerting (cert expiry, MX outages) in agentic or scheduled workflows.

## Known failure modes

- Domain not resolvable or invalid — returns error or empty DNS fields
- RDAP registry not responding — registrar/expiration fields may be null
- CT log query timeout — newly issued certificates may be missing
- First call always returns changed=null (baseline establishment, not an error)
- watch_id not provided — each call treated as independent, no diff computed
- Rate limiting or payment failure — 402 response with no data

## How this service works

Monitor a domain for changes — DNS records, nameservers, MX, SPF and DMARC, TLS certificate and expiry, newly issued certificates in CT logs, registrar and expiration via RDAP, and the live site's redirect and title, compared with your previous check: changed true/false, field-level before/after and plain alerts (nameservers changed, cert expiring, new cert issued, DMARC removed). Repeat with the same watch_id.

## Output

Returns a JSON object with: a `changed` boolean (null on the first baseline call, true/false on repeats), a `summary` string describing the number and severity of changes, and an `alerts` array where each alert has a `code` (e.g. ns_changed, cert_expiring, new_cert_issued, dmarc_removed), `detail` plain-language description, and `severity` level. Field-level before/after diffs are included for each monitored attribute that changed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "description": "Bare domain to monitor. Aliases: host, name, target"
      },
      "watch_id": {
       "type": "string",
       "description": "Your job id (1-64 chars A-Za-z0-9_.:-); keeps watches apart when one wallet serves many agents"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "alerts": {
       "type": "array",
       "items": {
        "type": "object"
       }
      },
      "changed": {
       "type": [
        "boolean",
        "null"
       ],
       "description": "null on the baseline call"
      },
      "summary": {
       "type": "string"
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "alerts": [
   {
    "code": "ns_changed",
    "detail": "nameservers changed",
    "severity": "critical"
   }
  ],
  "changed": true,
  "summary": "1 change, 1 critical alert: ns_changed"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netintel-domain-watch-cc9cfa4a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netintel.dev](https://www.zero.xyz/host/netintel.dev/llms.txt)