SQL API Examples

In this document, we provide some common queries that may assist you in understanding how to use the SQL API endpoint.

Additionally, we provide some articles within our blog that cover the use and shaping of SQL Explorer and its queries:

Get all DNS data for a list of domains

This query returns an output of all hostnames and their DNS records that have either google.com or go.gl as their apex domain name:

curl --request POST \
  --url 'https://api.securitytrails.com/v1/query/scroll' \
  --header 'apikey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"query":"SELECT domain.hostname, dns FROM hosts WHERE domain.apex in (\"google.com\", \"go.gl\") and domain.subdomain == null"}'

Get all Cloudflare customers

This query will list all hostnames, nameserver values, and rank of domains that have Cloudflare's Nameservers configured as authoritative.

curl --request POST \
  --url 'https://api.securitytrails.com/v1/query/scroll' \
  --header 'apikey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"query":"SELECT domain.hostname, dns.ns.value.host, rank.open_page_rank FROM hosts WHERE dns.ns.value.host like \"%.cloudflare.com\"}'

IPs with SSL certs that have the name “Nike.com” in them

This query will provide multiple details about IPs, reverse DNS records, and open ports of targets that expose SSL certificates for hostnames like %.nike.com

curl --request POST \
  --url 'https://api.securitytrails.com/v1/query/scroll' \
  --header 'apikey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '{"query":"SELECT address, dns.reverse, ports.port, ssl.subject.common_name, ssl.subject.organization FROM ips WHERE ssl.domains like \"%.nike.com\" OR ssl.domains = \"nike.com\"}'