# WHOIS and RDAP API

> Registrar, dates, status and nameservers for a domain.

Looks the domain up over RDAP, the structured successor to WHOIS, using the IANA bootstrap to find the right registry, and falls back to the classic port-43 WHOIS service for registries without RDAP. Returns the registrar, creation, update and expiry dates, EPP status codes, nameservers and DNSSEC flag.

- **Endpoint:** `GET https://api.zactonz.com/domain/whois/`
- **Category:** Domain
- **Version:** 1
- **Status:** stable
- **Authentication:** `Authorization: Bearer YOUR_API_KEY`
- **Reference page:** https://developers.zactonz.com/apis/domain-whois/

## Parameters

Send parameters in the query string.

| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| `domain` | string | yes |  | Domain name. A host name or URL is reduced to its registrable domain. |
| `raw` | boolean | no | `false` | `1` includes the raw WHOIS text when the fallback service was used. |

## Example request

```bash
curl "https://api.zactonz.com/domain/whois/?domain=zactonz.com&raw=" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Response

OK

| Field | Type | Description |
|---|---|---|
| `status` | integer | `200` on success. |
| `data` | object | The result. |
| `data.domain` | string | Registrable domain. |
| `data.source` | string | `rdap` or `whois`. |
| `data.registry` | string | RDAP base URL or WHOIS server used. |
| `data.registrar` | string | Registrar name. |
| `data.abuse_contact` | string | Registrar abuse email when published. |
| `data.status` | array of string | EPP status codes. |
| `data.created` | string | Registration date. |
| `data.updated` | string | Last change. |
| `data.expires` | string | Expiry date. |
| `data.nameservers` | array of string | Delegated nameservers. |
| `data.dnssec` | boolean | Whether the delegation is signed. |
| `data.raw` | string | Raw WHOIS text, only with `raw=1` on the fallback path. |

```json
{
    "status": 200,
    "data": {
        "domain": "zactonz.com",
        "source": "rdap",
        "registry": "https://rdap.verisign.com/com/v1/",
        "registrar": "GoDaddy.com, LLC",
        "abuse_contact": "abuse@godaddy.com",
        "status": [
            "client delete prohibited",
            "client renew prohibited",
            "client transfer prohibited",
            "client update prohibited"
        ],
        "created": "2016-07-24T02:01:45Z",
        "updated": "2025-07-25T06:15:02Z",
        "expires": "2028-07-24T02:01:45Z",
        "nameservers": [
            "ns1.zctz.me",
            "ns2.zctz.me"
        ],
        "dnssec": false
    }
}
```

## Status codes

The outcome is reported in the JSON `status` field. General rules: https://developers.zactonz.com/apis/errors.md

| status | Meaning | Description |
|---|---|---|
| `400` | Bad request | `domain` is missing or not a domain name. |
| `404` | Not found | The registry has no record for this domain. |
| `422` | No service | No RDAP or WHOIS service is known for that top-level domain, or it did not answer. |
| `503` | Registry busy | The registry is rate limiting; retry shortly. |
| `401` | Unauthorized | The Authorization header is missing or the key is not recognised. |
| `403` | Forbidden | The key is not licensed for this product. |
| `429` | Too many requests | The per-minute rate or the plan quota is exhausted. Retry after the seconds given in `Retry-After`. |

## Notes

Subdomains are reduced to the registrable domain. Answers are cached for an hour. Registries rate-limit lookups; a `503` means the registry asked us to slow down.