What this endpoint does

This endpoint returns metadata headers for a domain risk list without downloading the list content, primarily used to check whether a risk list has changed since it was last retrieved. By comparing the ETag value from this response against a previously stored ETag, you can determine if the list content has been updated and avoid unnecessary downloads. This is especially useful for automated polling workflows that periodically sync risk lists into SIEMs or firewalls. The same list and format parameters as the GET Domain Risk List endpoint control which risk list is checked.

Response data

The response contains no body — only HTTP headers. The key header is the ETag, which is an MD5 hash of the risk list content for standard lists or a SHA-256 hash if the list has been overridden by the user. Each combination of list filter and format produces a different ETag. Use this ETag with the If-None-Match header on subsequent GET Domain Risk List requests to implement conditional downloads that return data only when the list has changed.