Using ndxer with AI assistants

llms.txt and llms-full.txt

llms.txt is a short index in the llms.txt format: a summary of ndxer and links to everything else. Assistants and tools that look for it find it at the site root.

llms-full.txt is the whole API guide on one page, written for a language model: authentication, units, plan limits, errors and retries, pagination, every endpoint with its parameters and fields, and recipes. The limits in it are the ones each plan enforces. This is the one to give an assistant that is writing a program.

Example prompts

Start the prompt with the guide's address, then describe the program. Each prompt below also tells the assistant where the key comes from.

A Python script that maps related domains and their subdomains:

Read https://ndxer.com/llms-full.txt. Write a Python script that takes a domain such as douban.com, calls /v1/related/, keeps the matches whose band is high, then lists each one's hostnames with /v1/hostnames/, and writes a CSV with the columns domain, band, hostname. Read the API key from the NDXER_API_KEY environment variable, follow next_cursor, stop after 5 pages per call, and print the total of meta.units_charged at the end.

A TypeScript tool that reads mail settings for a list of domains:

Read https://ndxer.com/llms-full.txt. Write a TypeScript (Node 20, built-in fetch, no dependencies) command-line tool that reads domains from a file, one per line, calls /v1/dns/ for each, and prints the SPF, DMARC policy and MX hosts from meta.mail_posture as a table. Handle 202 (wait Retry-After seconds and repeat, at most 5 times), 429 (honour Retry-After) and 5xx (exponential backoff). Read the key from process.env.NDXER_API_KEY.

Mapping an organisation from a contact mailbox:

Read https://ndxer.com/llms-full.txt. I want to map an organisation from a contact mailbox. Write a Python script that calls /v1/related/ with q=hostmaster@douban.com, prints each match with its class, band and the evidence it shares, then for every seed signal whose status is used calls /v1/related/expand/ with that kind and key and lists the domains that publish it. Skip signals whose status is common or shared. Read the key from NDXER_API_KEY and stop once the script has spent 50 units.

Pulling the domains you marked Subject in a saved investigation, by the id in its web address:

Read https://ndxer.com/llms-full.txt. I triaged an investigation in the ndxer web app. Write a Python script that takes the investigation id (the UUID in its web address) and pulls every item I marked subject from /v1/investigations/<id>/ with class=subject and type=domain,subdomain, follows next_cursor to the end, and prints one domain per line. Read the key from NDXER_API_KEY; this endpoint costs no units.

Ask the assistant to cap pages and units in any program that loops: every page costs units, and the guide tells it how to read the cost of each response.

The OpenAPI document

The OpenAPI document at https://api.ndxer.com/v1/openapi.json is the machine-readable contract of the API: every endpoint, parameter, response field and type, in OpenAPI 3 JSON. It needs no key. The API reference is the same document, browsable.

Give an assistant the OpenAPI document when you need the exact contract, for example to generate a typed client or to check a field's type. Give it llms-full.txt when you need guidance: limits, units, retries, which endpoint answers which question, and recipes. For a larger program, give it both; where they disagree, the OpenAPI document wins.

A prompt that hands the document to an assistant to write a typed client:

Here is the OpenAPI document of the ndxer API: https://api.ndxer.com/v1/openapi.json. Generate a typed Python client for /v1/hostnames/ and /v1/related/ using only the schemas it defines (HostnameSearchResult, RelatedResult). Every request sends Authorization: Bearer with the key read from the NDXER_API_KEY environment variable.

You can also generate a client yourself. These are third-party, open-source tools that you install and run; ndxer does not ship them. For Python, openapi-python-client:

openapi-python-client generate --url https://api.ndxer.com/v1/openapi.json

For TypeScript types, openapi-typescript:

npx openapi-typescript https://api.ndxer.com/v1/openapi.json -o ndxer-api.d.ts

Keep your API key out of the chat

Never paste an API key into a chat with an assistant. Tell it to read the key from the NDXER_API_KEY environment variable, and set that variable yourself where the program runs. A key in a chat, a prompt or source code can end up in logs and history you do not control.

Create and revoke keys on the API keys page. If a key was ever pasted somewhere it should not be, revoke it and create a new one.