WHOIS Is Dead, Use RDAP: A Domain, IP, and ASN Lookup API That Returns Real JSON
Every WHOIS parser is a pile of regexes against text that changes per registry. RDAP fixed that years ago and almost nobody noticed. Here's what changed, why registrant contacts are empty, and how to query all three object types with one parameter.
TL;DR
- •RDAP is the IETF's replacement for port-43 WHOIS: structured JSON over HTTPS with a standard schema and real HTTP status codes, instead of free text that differs per registry.
- •One parameter covers three object types — pass github.com, 8.8.8.8, or AS13335 and the query type is detected from the input.
- •Registrant contacts are usually absent by design. Post-GDPR, most gTLD registries publish only the sponsoring registrar and an abuse contact. That redaction is the registry's answer, not a gap in the API.
- •An unregistered domain returns HTTP 200 with found:false — that is the availability check, so it is a real answer and it is charged. Only upstream failures return non-2xx, and those are free.
- •Expiry dates come straight from the registry at request time with no caching layer, which is what makes daily portfolio polling viable.
The protocol changed and the tooling did not
If you have ever written code that consumes WHOIS, you have written a parser for free-form text. Verisign formats a record one way, Nominet another, and a ccTLD registry in a third; fields appear and disappear; dates arrive in half a dozen formats. The parser works until a registry adjusts a label, and then it silently returns nothing.
The IETF fixed this. RDAP — the Registration Data Access Protocol — returns structured JSON over HTTPS with a standard schema, real HTTP status codes, and correct handling of internationalized data. Every gTLD registry has been contractually required to run it for years. The protocol won years ago; what lagged is the tooling, which is why so much code still shells out to whois and greps the output.
One parameter, three object types
WHOIS / RDAP Lookup takes a single query and detects what you gave it.
curl "https://www.apipick.com/api/whois?query=github.com" \
-H "x-api-key: $APIPICK_KEY"
{
"query": "github.com",
"type": "domain",
"found": true,
"registrar": "MarkMonitor Inc.",
"registered_at": "2007-10-09T18:20:50Z",
"expires_at": "2026-10-09T18:20:50Z",
"updated_at": "2024-09-07T09:16:32Z",
"dnssec": false,
"nameservers": ["dns1.p08.nsone.net", "ns-421.awsdns-52.com"],
"status": ["client delete prohibited", "client transfer prohibited"],
"contacts": [{ "roles": ["registrar"], "name": "MarkMonitor Inc.", ... }]
}Pass 8.8.8.8 instead and you get the allocated network, its CIDR blocks, the holder, and the RIR handle. Pass AS13335 and you get the AS name with its registrant, abuse, and technical contacts. Same endpoint, same shape, no branching in your client.
Why that matters for agents
An LLM tool definition with one required string parameter is dramatically easier for a model to use correctly than three near-identical tools it has to choose between. "Look up this thing" is a single capability in the model's head, and it is a single capability in the schema, served at GET /api/whois/tool-schema.
The GDPR answer nobody likes
The first question everyone asks is where the registrant went. Since 2018 most gTLD registries redact registrant name, email, and postal address from public RDAP, publishing only the sponsoring registrar and an abuse contact.
What survives is still useful, and for most real jobs it is the part that mattered anyway: registration age, sponsoring registrar, EPP status codes, nameserver delegation, DNSSEC signing, expiry date, and a working abuse contact.
Three jobs this actually does
Renewal monitoring
Poll a domain portfolio daily and alert on expires_at. Because the value is read from the registry at request time rather than a cache, you are not discovering a lapse days after it happened.
Counterparty due diligence
A domain registered eleven days ago through a bulk registrar, with no DNSSEC and a privacy-proxy registrant, is a different risk profile from one registered in 2007 with transfer locks set. registered_at plus status answers that in one call, before you trust an invoice or approve a supplier.
Abuse reporting that reaches a human
Resolve an IP or ASN to its holder and abuse contact so automated reports land in a mailbox someone reads. Pair with IP Geolocation when you also need to know where the address sits.
Availability checks are 200, not 404
Query a domain nobody has registered and you get HTTP 200 with found: false. This is deliberate. "There is no registration record for this name" is a successful lookup that returned a real fact — it is how availability checking works — so it is charged like any other answer. Non-2xx is reserved for genuine upstream trouble: a registry timeout or a rate limit, and those are never billed.
Rolling your own
| Direct RDAP | Legacy WHOIS | API Pick | |
|---|---|---|---|
| Response format | Structured JSON | Free text per registry | Flat JSON |
| Finding the server | Ship + refresh IANA bootstrap | Registry-specific hosts | Handled |
| Contacts | Nested jCard arrays | Regex the text block | Flattened objects |
| Domain + IP + ASN | Three different paths | Three different servers | One parameter |
| Not-found | 404 you must special-case | "No match" string | 200 with found:false |
| Rate limits | Per-registry, undocumented | Aggressive | Per-account credits |
Direct RDAP is genuinely a reasonable option and the data is identical — it is the same registries either way. What you take on is the IANA bootstrap table and keeping it current, jCard flattening, per-registry rate limits, and the referral chain when a registry hands you off to a registrar's own server.
Source and licensing
Records come from the authoritative registry for each object: Verisign, Nominet and the other registry operators for domains; ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC for IP ranges and AS numbers, resolved through the IANA RDAP bootstrap. Nothing is cached or re-published — you see what the registry serves at the moment of the request. Two credits a call, charged only on success. A free key comes with 100 credits and no card.
Frequently Asked Questions
What is RDAP and why should I stop using WHOIS?
RDAP is the Registration Data Access Protocol, the IETF's designated successor to WHOIS on port 43. WHOIS returns free-form text whose layout differs per registry, so consuming it means maintaining parsers that break whenever a registry adjusts its output. RDAP returns structured JSON with a standard schema over HTTPS, uses real HTTP status codes including a proper 404, and supports internationalized data correctly. Every gTLD registry has been required to run RDAP for years — the protocol won, the tooling just lagged behind.
Why are registrant name and email almost always missing?
GDPR. Since 2018 most gTLD registries redact registrant name, email, and postal address from public RDAP and publish only the sponsoring registrar plus an abuse contact. That redaction is the registry's answer to the query, not a limitation of any particular API — no provider can show you data the registry does not publish. Services that claim full registrant data are typically serving cached pre-GDPR records or scraped data of uncertain provenance.
Does one endpoint really handle domains, IPs, and AS numbers?
Yes. The query type is detected from the input, so github.com resolves as a domain, 8.8.8.8 or an IPv6 address as an IP network, and AS13335 or the bare number 13335 as an autonomous system. Domains return nameservers, DNSSEC status, and expiry; IPs return the allocated network, CIDR blocks, and the RIR handle; ASNs return the AS name and its registrant, abuse, and technical contacts. For an LLM that means one clean tool definition instead of three.
How do I check whether a domain is available?
Query it. An unregistered domain returns HTTP 200 with found set to false, because 'no registration record exists' is a real answer rather than an error. That is exactly how availability checking works over RDAP. Since it is a genuine result it consumes the normal credit; only an upstream failure such as a registry timeout returns a non-2xx, and those are never charged.
Is the expiry date fresh enough for renewal monitoring?
It comes directly from the registry's own RDAP record at request time with no caching layer in between, so it is as current as the registry itself. That is what makes it suitable for monitoring: poll a portfolio daily and alert on expires_at. A cached WHOIS aggregator can be days stale, which is precisely the window in which a forgotten renewal becomes an outage.
APIs used in this article
Sarah Choy is the CEO of API Pick. She writes about building production-ready APIs for AI agents and LLM workflows.