# domain: a domain's facts, each with its source

> A domain's facts for any caller, each with its source: its category (adult, gambling, security and the rest of Cloudflare Gateway's ids), its DNS records and mail policy, its registration, its TLS certificate and handshake, the names Certificate Transparency logs hold under it, and all of them in one card.

## Quick card

First call:

```bash
curl -qsS https://domain.web.pkgforge.dev/categories
```

Then `GET /category/{name}`, a name's categories:

```bash
curl -qsS https://domain.web.pkgforge.dev/category/pornhub.com
```

Then `POST /category`, three names at once:

```bash
curl -qsS -X POST -H 'content-type: application/json' --data '{"names":["github.com","bet365.com","example.com"]}' https://domain.web.pkgforge.dev/category
```

Failures, by status and `reason`:

- 400 `bad-request`: no retry: fix the request
- 413 `too-large`: no retry unchanged
- 500 `internal`: retry with backoff

Any request route can also answer 503 `disabled` or 429 `rate-limited`: retry after `Retry-After`.

Headers:

- `x-web-provider`: on an answer read from a source
- `x-web-cache`: on an answer read from a source: `hit`, no source was asked

Paging `GET /subdomains/{name}`: pass `next_cursor` as `cursor` until it is null:

```bash
c=; while r=$(curl -qfsS "https://domain.web.pkgforge.dev/subdomains/pkgforge.dev${c:+?cursor=$c}"); do
  jq -c . <<<"$r" >> pages.jsonl; c=$(jq -r '.next_cursor // empty' <<<"$r"); [ -n "$c" ] || break
done
```

Paging `GET /certs/{name}`: pass `next_cursor` as `cursor` until it is null:

```bash
c=; while r=$(curl -qfsS "https://domain.web.pkgforge.dev/certs/pkgforge.dev${c:+?cursor=$c}"); do
  jq -c . <<<"$r" >> pages.jsonl; c=$(jq -r '.next_cursor // empty' <<<"$r"); [ -n "$c" ] || break
done
```

Host: `domain.web.pkgforge.dev`. State: built.

Version: `28783c314bdb`, openapi.json's `info.version`, the first 12 hex digits of the SHA-256 of the four root documents (llms.txt, llms-full.txt, openapi.json, SKILL.md, in that order, joined by a newline), each rendered with an empty version; it changes whenever anything a caller reads in them changes.

Cost: free to every caller: no key, no account, no quota (never gated). The operator's one exception: a service can be switched off (503 `disabled`), and for up to 12 hours a spend breaker can cap each IP at 100 requests per 60 s (429 `rate-limited`) and at 10 per 60 s of those that spend Workers AI or Browser Run ($0.50 in 15 min for all IPs; past it, mostly a 200 skipping that step).

CORS: every answer carries `access-control-allow-origin: *` and exposes the provenance headers; OPTIONS on a listed path is the preflight (204), and it allows every request header the browser names; no credentials.

Every service and its live status: https://web.pkgforge.dev/

When to use:

- what a domain is: its categories as Cloudflare Gateway's ids, each with the sources that say so: `GET /category/<name>`, or up to 1,000 names with `POST /category`
- a domain's DNS records, DNSSEC and mail policy in one answer: `GET /dns/<name>`
- who registered a domain, and when it expires, from RDAP or WHOIS: `GET /rdap/<name>`
- a host's certificate chain and TLS handshake: `GET /tls/<host>`; the names and certificates Certificate Transparency logs hold: `GET /subdomains/<name>`, `GET /certs/<name>`
- every fact of a domain at once, each with its source: `GET /<name>`
- not for a page: use fetch.web.pkgforge.dev for any URL, and read.web.pkgforge.dev for a page's text

## Routes

- [GET /healthz](https://domain.web.pkgforge.dev/openapi.json#/paths/~1healthz/get): service state and the running Worker version
- [GET /](https://domain.web.pkgforge.dev/openapi.json#/paths/~1/get): the index of this service
- [GET /categories](https://domain.web.pkgforge.dev/openapi.json#/paths/~1categories/get): the category taxonomy and each source's map onto it
- [GET /category/{name}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1category~1%7Bname%7D/get): a name's categories and flags
- [POST /category](https://domain.web.pkgforge.dev/openapi.json#/paths/~1category/post): the categories of up to 1,000 names
- [GET /index/current.json](https://domain.web.pkgforge.dev/openapi.json#/paths/~1index~1current.json/get): the category index's live version
- [GET /index/{version}/manifest.json](https://domain.web.pkgforge.dev/openapi.json#/paths/~1index~1%7Bversion%7D~1manifest.json/get): one version's manifest
- [GET /index/{version}/{shard}.bin](https://domain.web.pkgforge.dev/openapi.json#/paths/~1index~1%7Bversion%7D~1%7Bshard%7D.bin/get): one shard of a version
- [GET /index/reader.mjs](https://domain.web.pkgforge.dev/openapi.json#/paths/~1index~1reader.mjs/get): the index's reader, one JavaScript file with no dependency
- [GET /dns/{name}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1dns~1%7Bname%7D/get): a name's DNS records, DNSSEC and mail policy
- [GET /dns/{name}/{type}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1dns~1%7Bname%7D~1%7Btype%7D/get): one record type of a name, in addr.tools's shape
- [GET /rdap/{name}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1rdap~1%7Bname%7D/get): a domain's registration
- [GET /whois/{name}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1whois~1%7Bname%7D/get): a domain's registration, by its other name
- [GET /tls/{host}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1tls~1%7Bhost%7D/get): a host's certificate chain and TLS handshake
- [GET /subdomains/{name}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1subdomains~1%7Bname%7D/get): the names under a domain that certificates carry
- [GET /certs/{name}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1certs~1%7Bname%7D/get): a domain's certificates
- [GET /{name}](https://domain.web.pkgforge.dev/openapi.json#/paths/~1%7Bname%7D/get): every fact of a domain in one answer
- [GET /llms.txt](https://domain.web.pkgforge.dev/llms.txt): llmstxt.org index of this service
- [GET /llms-full.txt](https://domain.web.pkgforge.dev/llms-full.txt): the guide: each route with its common parameters and a call, the headers that matter and the failures
- [GET /openapi.json](https://domain.web.pkgforge.dev/openapi.json): OpenAPI 3.1 for every route
- [GET /SKILL.md](https://domain.web.pkgforge.dev/SKILL.md): one file an agent reads to use this service

## Docs

- [llms-full.txt](https://domain.web.pkgforge.dev/llms-full.txt): the guide: each route with its common parameters and examples, the headers that matter, the failures and the pipeline contract
- [openapi.json](https://domain.web.pkgforge.dev/openapi.json): OpenAPI 3.1, the whole reference: every parameter, header, enum, schema and response
- [SKILL.md](https://domain.web.pkgforge.dev/SKILL.md): one file an agent reads to use this service