[ security · registry ]● 2 cr · 30 req/min

WHOIS & RDAP Lookup API

Registration data for any domain, IP address, or AS number, straight from the authoritative registry via RDAP. Registrar, nameservers, DNSSEC, expiry dates, and abuse contacts as flat JSON.

RDAP (not scraped WHOIS)Domain · IP · ASNLive registry data
auth · x-api-key

Don't have an API key?

Sign in to your account to create and manage your API keys.

[ 02 · integrate ]

Integration guide

Copy a snippet, replace your API key, run. Works in any HTTP client — examples below in cURL, JavaScript, and Python.

spec
GET/api/whois
base
https://www.apipick.com

Registration data for a domain, IP address, or AS number

parameters
querystringrequired

A domain name, IPv4/IPv6 address, or AS number. The type is detected automatically. github.com

curl -X GET "https://www.apipick.com/api/whois" \
  -H "x-api-key: YOUR_API_KEY"
● 200 · response
{
  "query": "github.com",
  "type": "domain",
  "found": true,
  "domain": "github.com",
  "unicode_domain": null,
  "nameservers": [
    "dns1.p08.nsone.net",
    "ns-421.awsdns-52.com"
  ],
  "dnssec": false,
  "handle": "1264983250_DOMAIN_COM-VRSN",
  "status": [
    "client delete prohibited",
    "client transfer prohibited"
  ],
  "country": null,
  "registrar": "MarkMonitor Inc.",
  "registered_at": "2007-10-09T18:20:50Z",
  "updated_at": "2024-09-07T09:16:32Z",
  "expires_at": "2026-10-09T18:20:50Z",
  "contacts": [
    {
      "roles": [
        "registrar"
      ],
      "handle": "292",
      "name": "MarkMonitor Inc.",
      "organization": null,
      "email": null,
      "phone": null,
      "address": null,
      "country": null
    }
  ],
  "source": "RDAP (IANA bootstrap via rdap.org)",
  "credits_used": 2,
  "remaining_credits": 98
}

Built for Real-World Use Cases

Expiry Monitoring

Poll a domain portfolio and alert before renewal dates. Live registry data, so nothing is stale by a cache cycle.

🕵️

Domain Due Diligence

Check registration age, registrar, and status codes before trusting a counterparty domain or approving a supplier.

🚨

Abuse Reporting

Resolve an IP or ASN to its holder and abuse contact so automated reports reach a mailbox someone reads.

🤖

Agent Enrichment

One parameter covers domains, IPs, and ASNs, which makes it a single clean tool definition for an LLM.

Response Fields

FieldTypeDescription
typestringDetected query type: domain, ip, or autnum
foundbooleanFalse when the object is unregistered or unallocated
registrarstring | nullSponsoring registrar (domains)
registered_atstring | nullISO 8601 registration date
expires_atstring | nullISO 8601 expiry date (domains)
updated_atstring | nullISO 8601 date the record last changed
statusstring[]EPP status codes, e.g. client transfer prohibited
nameserversstring[]Delegated nameservers (domains)
dnssecboolean | nullWhether the delegation is DNSSEC-signed
cidrstring[]CIDR blocks of the allocation (IP queries)
asninteger | nullAutonomous System Number (ASN queries)
contacts[]object[]Flattened jCard entities with roles, org, email, and phone
credits_usedintegerCredits deducted for this request
remaining_creditsintegerCredits remaining in your account
[ 03 · limits ]

Rate limits

Throttling is per API key, sliding 60-second window. Hit the limit and you get a clean 429 with a Retry-After header.

request rate

30req/min

Per API key, per endpoint. Sliding 60-second window.

concurrency

3concurrent

Max simultaneous in-flight requests per API key.

response headers
X-RateLimit-LimitMaximum requests allowed per minute
X-RateLimit-RemainingRequests remaining in the current window
X-RateLimit-ResetSeconds until the current window resets
Retry-AfterSeconds to wait before retrying (only on 429)
● 429 · too many requests
HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 30
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 12

{
  "error": "rate_limit_exceeded",
  "message": "Rate limit exceeded: 30 requests/minute per API key. Retry after 12s.",
  "retry_after": 12
}

Data Source & Licensing

Records come from the authoritative registry for each object — Verisign, Nominet and the other registry operators for domains; ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC for IP ranges and AS numbers — resolved through the IANA RDAP bootstrap. Nothing is cached or re-published: you see what the registry serves at request time.

Frequently Asked Questions

Q: How is this different from classic WHOIS?

A: RDAP is the IETF's replacement for port-43 WHOIS. Where WHOIS returns free text that differs per registry and has to be scraped, RDAP returns structured JSON with a standard schema, over HTTPS, with proper 404s. We query the authoritative registry through the IANA bootstrap and flatten the jCard contact blocks into plain objects.

Q: Why are registrant contacts usually missing?

A: Since GDPR, most gTLD registries redact registrant name, email, and address from public RDAP and publish only the sponsoring registrar plus an abuse contact. That redaction is the registry's answer, not a gap in this API — no WHOIS provider can show you data the registry does not publish.

Q: Does it work for IP addresses and AS numbers?

A: Yes. Pass an IPv4 or IPv6 address to get the allocated network, its CIDR blocks, the holder, and the RIR handle; pass AS13335 or 13335 to get the AS name and its registrant, abuse, and technical contacts. The query type is detected from the input, so one parameter covers all three.

Q: What does an unregistered domain return?

A: HTTP 200 with found: false. That is a real answer — it is how you check availability — so it costs the normal credit. Only an upstream failure (registry timeout, rate limit) returns a non-2xx, and those are never charged.

Q: How current is the expiry date?

A: It comes straight from the registry's own RDAP record at request time, with no caching layer in between, so it is as current as the registry itself. That makes it suitable for expiry monitoring — poll a portfolio daily and alert on expires_at.