WHOIS & RDAP Lookup API
Registration data for any domain, IP address, or AS number, straight from the authoritative registry via RDAP. Registrar, nameservers, DNSSEC, expiry dates, and abuse contacts as flat JSON.
Don't have an API key?
Sign in to your account to create and manage your API keys.
Integration guide
Copy a snippet, replace your API key, run. Works in any HTTP client — examples below in cURL, JavaScript, and Python.
/api/whoishttps://www.apipick.comRegistration data for a domain, IP address, or AS number
querystringrequiredA domain name, IPv4/IPv6 address, or AS number. The type is detected automatically. github.com
curl -X GET "https://www.apipick.com/api/whois" \
-H "x-api-key: YOUR_API_KEY"{
"query": "github.com",
"type": "domain",
"found": true,
"domain": "github.com",
"unicode_domain": null,
"nameservers": [
"dns1.p08.nsone.net",
"ns-421.awsdns-52.com"
],
"dnssec": false,
"handle": "1264983250_DOMAIN_COM-VRSN",
"status": [
"client delete prohibited",
"client transfer prohibited"
],
"country": null,
"registrar": "MarkMonitor Inc.",
"registered_at": "2007-10-09T18:20:50Z",
"updated_at": "2024-09-07T09:16:32Z",
"expires_at": "2026-10-09T18:20:50Z",
"contacts": [
{
"roles": [
"registrar"
],
"handle": "292",
"name": "MarkMonitor Inc.",
"organization": null,
"email": null,
"phone": null,
"address": null,
"country": null
}
],
"source": "RDAP (IANA bootstrap via rdap.org)",
"credits_used": 2,
"remaining_credits": 98
}Built for Real-World Use Cases
Expiry Monitoring
Poll a domain portfolio and alert before renewal dates. Live registry data, so nothing is stale by a cache cycle.
Domain Due Diligence
Check registration age, registrar, and status codes before trusting a counterparty domain or approving a supplier.
Abuse Reporting
Resolve an IP or ASN to its holder and abuse contact so automated reports reach a mailbox someone reads.
Agent Enrichment
One parameter covers domains, IPs, and ASNs, which makes it a single clean tool definition for an LLM.
Response Fields
| Field | Type | Description |
|---|---|---|
| type | string | Detected query type: domain, ip, or autnum |
| found | boolean | False when the object is unregistered or unallocated |
| registrar | string | null | Sponsoring registrar (domains) |
| registered_at | string | null | ISO 8601 registration date |
| expires_at | string | null | ISO 8601 expiry date (domains) |
| updated_at | string | null | ISO 8601 date the record last changed |
| status | string[] | EPP status codes, e.g. client transfer prohibited |
| nameservers | string[] | Delegated nameservers (domains) |
| dnssec | boolean | null | Whether the delegation is DNSSEC-signed |
| cidr | string[] | CIDR blocks of the allocation (IP queries) |
| asn | integer | null | Autonomous System Number (ASN queries) |
| contacts[] | object[] | Flattened jCard entities with roles, org, email, and phone |
| credits_used | integer | Credits deducted for this request |
| remaining_credits | integer | Credits remaining in your account |
Rate limits
Throttling is per API key, sliding 60-second window. Hit the limit and you get a clean 429 with a Retry-After header.
30req/min
Per API key, per endpoint. Sliding 60-second window.
3concurrent
Max simultaneous in-flight requests per API key.
X-RateLimit-LimitMaximum requests allowed per minuteX-RateLimit-RemainingRequests remaining in the current windowX-RateLimit-ResetSeconds until the current window resetsRetry-AfterSeconds to wait before retrying (only on 429)HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 30
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 12
{
"error": "rate_limit_exceeded",
"message": "Rate limit exceeded: 30 requests/minute per API key. Retry after 12s.",
"retry_after": 12
}Data Source & Licensing
Records come from the authoritative registry for each object — Verisign, Nominet and the other registry operators for domains; ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC for IP ranges and AS numbers — resolved through the IANA RDAP bootstrap. Nothing is cached or re-published: you see what the registry serves at request time.
Frequently Asked Questions
Q: How is this different from classic WHOIS?
A: RDAP is the IETF's replacement for port-43 WHOIS. Where WHOIS returns free text that differs per registry and has to be scraped, RDAP returns structured JSON with a standard schema, over HTTPS, with proper 404s. We query the authoritative registry through the IANA bootstrap and flatten the jCard contact blocks into plain objects.
Q: Why are registrant contacts usually missing?
A: Since GDPR, most gTLD registries redact registrant name, email, and address from public RDAP and publish only the sponsoring registrar plus an abuse contact. That redaction is the registry's answer, not a gap in this API — no WHOIS provider can show you data the registry does not publish.
Q: Does it work for IP addresses and AS numbers?
A: Yes. Pass an IPv4 or IPv6 address to get the allocated network, its CIDR blocks, the holder, and the RIR handle; pass AS13335 or 13335 to get the AS name and its registrant, abuse, and technical contacts. The query type is detected from the input, so one parameter covers all three.
Q: What does an unregistered domain return?
A: HTTP 200 with found: false. That is a real answer — it is how you check availability — so it costs the normal credit. Only an upstream failure (registry timeout, rate limit) returns a non-2xx, and those are never charged.
Q: How current is the expiry date?
A: It comes straight from the registry's own RDAP record at request time, with no caching layer in between, so it is as current as the registry itself. That makes it suitable for expiry monitoring — poll a portfolio daily and alert on expires_at.