MarketXY API

Fresh domain, company, and network intelligence — through one API, JSON responses.

MarketXY's API gives you programmatic access to the same domain registration, WHOIS, DNS, SSL, hosting, technology, company-directory, and network data that powers marketxy.com. Every response is JSON. Every request is authenticated with a single API key. Start with the Universal Query API below, or jump straight to the live API Explorer to try a real request right now.

Authentication

Every request requires an API key, passed as either an X-API-Key header or a Bearer token in Authorization — pick whichever your HTTP client supports.

curl "https://api.marketxy.com/v4/query?type=domain&value=yahoo.com" \
  -H "X-API-Key: mxy_live_your_key_here"

curl "https://api.marketxy.com/v4/query?type=domain&value=yahoo.com" \
  -H "Authorization: Bearer mxy_live_your_key_here"

Base URL & environments

Rate limits & plans

Every request spends MarketXY Data Tokens from your plan. Data Tokens measure the amount and type of data a request returns — they are not AI/LLM tokens, cryptocurrency or credits — so a request that returns more data costs more. Each plan also has a daily and an hourly token budget and a per-second burst limit.

These are the plans and numbers on the pricing page. Check your tokens, your daily and hourly budget and your burst limit anytime with GET /v4/api-plan/status — see Self-discovery endpoints.

Errors

The Universal Query API uses one consistent error shape:

{
  "success": false,
  "request_id": "req_0d42353593c8f850",
  "error": {
    "code": "UNKNOWN_INCLUDE_SECTION",
    "message": "Unknown section(s) in \"include\": company. Valid: whois, dns, ssl, hosting, technologies, social, scores, counts, misc, or \"all\"."
  }
}

Authentication errors (401) carry the same fields plus the older statusCode and message, kept for existing integrations:

{
  "statusCode": 401,
  "message": "Missing API key. Pass it as an 'X-API-Key' header (or 'Authorization: Bearer <key>').",
  "success": false,
  "request_id": "req_...",
  "error": {
    "code": "MISSING_API_KEY",
    "message": "Missing API key. Pass it as an 'X-API-Key' header (or 'Authorization: Bearer <key>')."
  }
}

Pagination

• Cursor-based (registrar, nameserver, tld, country, ip, cms, web_server, technology, mx, create_date, update_date, expiry_date): pass limit (default 100, max 1000) and the previous response's next_cursor as cursor.
• company uses the same limit + cursor parameters (limit default 20, max 100): pass the previous response's next_cursor as cursor to get the next page of matches. page / pageSize are not read by /v4/query.
• Page-based (most Additional Data APIs): pass page and pageSize/limit.

Universal Query API

One endpoint, one shape, sixteen data points.

GET /v4/query is the fastest way to look up domain, company, email, ASN, or reverse/date-range data — pick a type, give a value, get JSON back.

curl "https://api.marketxy.com/v4/query?type=domain&value=yahoo.com&include=whois,ssl" \
  -H "Authorization: Bearer mxy_live_your_key_here"

API Explorer

Build a real request below and send it — this calls the live production API directly from your browser.

All 16 data points

Include sections (domain only)

Count mode

Add count=true to any reverse or search data point for a real match count with no rows fetched.

{
  "success": true,
  "request_id": "req_b02c25ca454bac37",
  "data": { "query": { "type": "tld", "value": "com" }, "matched_count": 136703797 },
  "meta": { "data_point": "tld", "match_type": "reverse", "count_only": true }
}

Response envelope

{ "success": true, "request_id": "req_...", "data": { ... }, "meta": { ... } }

{ "success": false, "request_id": "req_...", "error": { "code": "...", "message": "..." } }

Additional Data APIs

Beyond the Universal Query API, MarketXY exposes ~45 specialized routers under /v4/* — each authenticated and rate-limited the same way as /v4/query.

Company data

Domain intelligence

Network & infrastructure

WHOIS & registry

Security & threat data

Full request/response detail for the two Stable security endpoints — the other rows above are Beta and not yet documented per-parameter. A browsable landing page for domain classification is also at /email-domain-type/.

Email Domain Type — GET /v4/email-domain-type/check

Classifies one domain as disposable, free (a consumer provider like Gmail/Yahoo/Outlook), or company (a real business domain) — plus a separate hostingProvider signal (Google Workspace / Microsoft 365 / Zoho Mail) that never reclassifies a real company as "free" just because a consumer platform hosts its mail. type is null, never a guess, when we have no classification for a domain.

curl "https://api.marketxy.com/v4/email-domain-type/check?domain=example.com" \
  -H "X-API-Key: mxy_live_your_key_here"

import requests

resp = requests.get(
    "https://api.marketxy.com/v4/email-domain-type/check",
    params={"domain": "example.com"},
    headers={"X-API-Key": "mxy_live_your_key_here"},
)
print(resp.json())

$ch = curl_init("https://api.marketxy.com/v4/email-domain-type/check?domain=example.com");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["X-API-Key: mxy_live_your_key_here"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

const res = await fetch("https://api.marketxy.com/v4/email-domain-type/check?domain=example.com", {
  headers: { "X-API-Key": "mxy_live_your_key_here" },
});
console.log(await res.json());

{
  "statusCode": 200,
  "data": {
    "domain": "yoocco.com",
    "type": "company",
    "source": "actes-z7",
    "hostingProvider": "google-workspace",
    "found": true
  }
}

source is actes-z7 for a real crawled classification, or curated-list (major free providers — Gmail, Yahoo, Outlook/Hotmail, iCloud, AOL, ProtonMail, Zoho, GMX, Yandex, Mail.ru) / disposable-email-domains-package (a 121,570-domain open-source list) when the crawl has nothing and a maintained fallback list answers instead — the fallback never overrides a real crawled classification.

Blacklisted Domain Explorer — GET /v4/blacklisted/explorer

Searches MarketXY's real flagged-domain/subdomain/IP database.

curl "https://api.marketxy.com/v4/blacklisted/explorer?pageSize=10" \
  -H "X-API-Key: mxy_live_your_key_here"

import requests

resp = requests.get(
    "https://api.marketxy.com/v4/blacklisted/explorer",
    params={"pageSize": 10},
    headers={"X-API-Key": "mxy_live_your_key_here"},
)
print(resp.json())

$ch = curl_init("https://api.marketxy.com/v4/blacklisted/explorer?pageSize=10");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["X-API-Key: mxy_live_your_key_here"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

const res = await fetch("https://api.marketxy.com/v4/blacklisted/explorer?pageSize=10", {
  headers: { "X-API-Key": "mxy_live_your_key_here" },
});
console.log(await res.json());

{
  "statusCode": 200,
  "data": {
    "hits": [
      {
        "_source": {
          "domain": "000717-coinbase.com",
          "parent_domain": null,
          "d_or_subd": 1,
          "i7": "Malicious",
          "h2": "2025-05-29",
          "h1": "2026-10-11",
          "h0": "2025-05-29",
          "z8": ["raw.githubusercontent.com", "phishing-database-active", "dangerous-domains", "src262"]
        }
      }
    ]
  }
}

People & contacts

Misc & account

Self-discovery endpoints

Roadmap & known limitations

• Full parameter reference for the Additional Data APIs — currently indexed by name and purpose; a complete per-endpoint reference (parameters, types, examples in multiple languages) is on the roadmap. Until then, the Universal Query API is the most fully-documented and recommended way to access this data.
• Legacy ASN/hosting-provider endpoints (/v4/asn, /v4/hosting-providers) — deprecated legacy routes; they still answer today but may be removed. Use type=asn on the Universal Query API instead.
• Legacy email-database endpoint (/v4/email) — deprecated legacy route; it still answers today but may be removed. Use type=email on the Universal Query API instead.
• Some lookups may occasionally take longer under heavy load — these return a clear 503 with a retry_after hint rather than hanging; simply retry.
• Company results are not yet linked directly to a domain's profile — use the separate type=company search for now; a direct link is planned.

Changelog

Documentation generated from the MarketXY API codebase and validated against currently supported endpoints. Last updated 2026-10-20.