# RDAP API

> Normalized RDAP domain, IP, ASN, nameserver, and entity lookups over a REST
> JSON API. RDAP is the official replacement for WHOIS; RDAP API returns one
> consistent JSON shape across 1,200+ TLDs and all five RIRs, so callers never
> parse WHOIS text or handle per-registry response quirks.

Base URL: `https://rdapapi.io/api/v1`

Authentication: every endpoint except `/ping` requires an API key sent as a
bearer token. Keys are created on the dashboard after subscribing.

```bash
curl https://rdapapi.io/api/v1/domain/google.com \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Endpoints

- [GET /api/v1/domain/{domain}](https://rdapapi.io/docs#tag/domain/GET/domain/{domain}): Domain registration data — registrar, registration/expiry dates, nameservers, EPP status codes, DNSSEC, contacts. Accepts Unicode (IDNA2008) and multi-label suffixes such as `co.uk`. Optional `?follow=true` merges the contacts held by the registrar, which thin registries (`.com`, `.net`) do not publish themselves.
- [POST /api/v1/domains/bulk](https://rdapapi.io/docs#tag/domain/POST/domains/bulk): Up to 10 domains in one request, fetched concurrently. Body: `{"domains": [...], "follow": false}`.
- [GET /api/v1/ip/{ip}](https://rdapapi.io/docs#tag/ip/GET/ip/{ip}): IPv4/IPv6 network allocation — network range, organization, country, abuse contacts, geofeed URL. Accepts a plain address (`8.8.8.8`) or a CIDR block (`8.8.8.0/24`).
- [GET /api/v1/asn/{asn}](https://rdapapi.io/docs#tag/asn/GET/asn/{asn}): Autonomous System registration data. Accepts `15169` or `AS15169`.
- [GET /api/v1/nameserver/{host}](https://rdapapi.io/docs#tag/nameserver/GET/nameserver/{host}): Nameserver host record, for the registries that publish one.
- [GET /api/v1/entity/{handle}](https://rdapapi.io/docs#tag/entity/GET/entity/{handle}): Contact or organization by RDAP handle (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC).
- [GET /api/v1/tlds](https://rdapapi.io/docs#tag/tlds/GET/tlds): Every supported TLD, which protocol answers for it, when support was added, and which fields that registry actually populates. Supports `?since=` and `?server=`, returns an `ETag`.
- [GET /api/v1/tlds/{tld}](https://rdapapi.io/docs#tag/tlds/GET/tlds/{tld}): The same object for a single TLD.
- GET /api/v1/ping: liveness probe, no API key.

Provenance: TLDs with no RDAP server are read from the registry's WHOIS
server, in the same shape. `meta.source` is `rdap` or `whois`, and
`meta.server` is the host that answered (the string `/tlds` reports, usable as
`?server=`). WHOIS registries publish fewer fields; anything absent is null,
never inferred. `whois=false` refuses the fallback. `meta.rdap_server` is
deprecated.

## Errors and limits

Errors carry an `error` code and a `message`; branch on `error`, since several
codes share a status.

- `404 not_found` is the only answer that means a domain may be free.
  `domain_reserved` (with `reason`), `not_registrable` (`www.example.com`;
  look up `registrable_domain` instead) and `not_supported` (we can't query
  that TLD or zone, or `whois=false`) are 404s too. A mistyped path is
  `404 unknown_endpoint`.
- `429 rate_limit_exceeded` (per minute) and `429 quota_exceeded` (monthly,
  resets on the 1st, UTC): wait for `Retry-After`. `X-RateLimit-*` covers the
  per-minute limit only; a bulk request spends one unit per domain.
- Answers can be up to 48 hours old, or 7 days if the registry is down; see
  `meta.cache_expires`.

Quota: successful lookups and lookup `404`s count, bar a `not_supported` that
asked no registry; nothing else does, `/tlds` and `/ping` included. A bulk
request bills per domain on those terms, and `?follow=true` counts once.

## Plans and pricing

API access requires an active paid subscription. Each plan starts with a 7-day
free trial for first-time subscribers (card required). There is
no free API tier; the only no-account way to try the service is the public web
lookup at https://rdapapi.io/lookup. Yearly billing is 10x the monthly price.

- Starter — $9/month, 30,000 requests/month, 30 requests/minute.
- Pro — $49/month, 200,000 requests/month, 60 requests/minute. Includes bulk lookups.
- Business — $199/month, 1,000,000 requests/month, 300 requests/minute. Includes bulk lookups.

- [Pricing](https://rdapapi.io/pricing): Plan comparison and billing details.

## MCP server

An MCP server exposes the same lookups to AI agents at
`https://rdapapi.io/mcp/rdap` ([docs](https://rdapapi.io/mcp)), with the same
key, quota and billing as the REST API. Clients that cannot send a header
(claude.ai, ChatGPT connectors) use OAuth: they need only the URL, discover the
authorization server from `/.well-known/oauth-protected-resource`, and the user
approves them on rdapapi.io, which creates a revocable API key named after the
client. `initialize`, `ping` and `tools/list` answer without a key and are
free; keyless traffic is capped at 30 requests per minute per IP
(`429 too_many_requests`). Every `tools/call` needs a key. Tools:

- `domain-lookup` — `domain` (required), `follow` and `whois` (optional).
- `bulk-domain-lookup` — `domains` (up to 10), `follow` and `whois`.
- `ip-lookup` — `ip`, optional `prefix`.
- `asn-lookup` — `asn`, with or without `AS`.
- `nameserver-lookup` — `host`.
- `entity-lookup` — `handle`, e.g. `GOGL` (ARIN) or `ORG-RIEN1-RIPE` (RIPE).
- `tlds` — optional `tld`, `server` and `since`; free.

## Documentation

- [API reference](https://rdapapi.io/docs): Every endpoint, with curl, Node and Python requests and example responses.
- [OpenAPI 3.1 spec](https://rdapapi.io/openapi.yaml): Machine-readable source of truth for endpoints, schemas, and error codes.
- [Supported TLDs](https://rdapapi.io/tlds): Browsable directory of every TLD served, with per-TLD field availability.
- [RDAP coverage](https://rdapapi.io/stats): How much of the DNS answers over RDAP — TLD coverage including registries absent from IANA's bootstrap file, backend concentration, certificate health and IPv6 support.
- [WHOIS sunset tracker](https://rdapapi.io/whois-sunset): Status of the ICANN WHOIS-to-RDAP transition.
- [Changelog](https://rdapapi.io/changelog): API and product changes.

## SDKs

Official clients, all supporting domain, IP, ASN, nameserver, entity, and bulk lookups.

- [Node.js](https://rdapapi.io/sdks/node): `npm install rdapapi`. Node 20+, TypeScript types included. Source: https://github.com/rdapapi/node-sdk
- [Python](https://rdapapi.io/sdks/python): `pip install rdapapi`. Python 3.9+, typed Pydantic models, async support. Source: https://github.com/rdapapi/python-sdk
- [PHP](https://rdapapi.io/sdks/php): `composer require rdapapi/rdapapi-php`. PHP 8.2+. Source: https://github.com/rdapapi/rdapapi-php
- [Go](https://rdapapi.io/sdks/go): `go get github.com/rdapapi/rdapapi-go`. Go 1.22+, zero dependencies. Source: https://github.com/rdapapi/rdapapi-go
- [Java](https://rdapapi.io/sdks/java): `io.rdapapi:rdapapi-java` on Maven Central. Java 11+. Source: https://github.com/rdapapi/java-sdk

## Guides

- [rdap.org Isn't an API — It's a Redirect](https://rdapapi.io/blog/rdap-org): What rdap.org actually does and how to use it correctly.
- [Stealth RDAP: Finding the RDAP Server for .io, .de, and 40 More](https://rdapapi.io/blog/stealth-rdap): TLDs with working RDAP servers that IANA's bootstrap registry does not list.
- [Verisign RDAP: .com Lookups and the 404 Response](https://rdapapi.io/blog/verisign-rdap-endpoint): Querying rdap.verisign.com and reading its domain-not-found behavior.
- [Every EPP Status Code, Explained](https://rdapapi.io/blog/epp-status-codes-explained): clientTransferProhibited, serverHold, redemptionPeriod, and the rest.
- [Why we normalize RDAP responses](https://rdapapi.io/blog/why-we-normalize-rdap): The same domain shown raw and normalized, field by field.
- [ASN Lookups Explained](https://rdapapi.io/blog/asn-lookups-explained): What RDAP returns across the five RIRs.
- [WHOIS Port 43 Is Dead. What Replaces It?](https://rdapapi.io/blog/whois-port-43-is-dead): The January 2025 ICANN sunset and its consequences.
- [WhoisXML API Alternatives Compared](https://rdapapi.io/blog/whoisxml-api-alternatives): Seven providers by pricing, protocol, and use case.
- [How to Check if a Domain Is Available](https://rdapapi.io/blog/domain-availability-checking): DNS vs WHOIS vs RDAP, and where each one is wrong.
- [Why Your Domain Checker Breaks on .org and .dev](https://rdapapi.io/blog/domain-checker-breaks): Per-registry WHOIS differences that break naive clients.
- [WHOIS Rate Limits Are Killing Your App](https://rdapapi.io/blog/whois-rate-limits): Why WHOIS servers block you and how RDAP changes it.
- [The RDAP JSON Response Decoded](https://rdapapi.io/blog/rdap-json-response-decoded): Field-by-field walkthrough, including vcardArray.
- [Check Domain Availability with One API Call](https://rdapapi.io/blog/check-domain-availability-with-rdap): Availability across 1,200+ TLDs.
- [How to Look Up IP Ownership via RDAP](https://rdapapi.io/blog/ip-ownership-lookup): Network block, organization, and abuse contacts.
- [Domain Expiration Monitoring with GitHub Actions](https://rdapapi.io/blog/domain-expiration-monitoring): Copy-paste workflow with Slack or email alerts.
- [Bulk Domain Lookup API](https://rdapapi.io/blog/bulk-domain-lookup-api): Ten domains in one request.
- [Domain Expiration API: Get the Expiry Date in 5 Languages](https://rdapapi.io/blog/check-domain-expiration-with-code): Python, JavaScript, PHP, Go, Java, and curl.
- [7 WHOIS API Alternatives Compared](https://rdapapi.io/blog/whois-api-alternatives): Pricing, rate limits, and GDPR gaps.
- [WHOIS to RDAP Migration Guide](https://rdapapi.io/blog/whois-to-rdap-migration): Before/after code for the sunset.
- [RDAP API Python SDK — Getting Started](https://rdapapi.io/blog/rdap-api-python): Install, authenticate, and query.
- [RDAP vs WHOIS: The Complete Comparison](https://rdapapi.io/blog/rdap-vs-whois): Protocol differences that matter to developers.

## Optional

- [Terms of Service](https://rdapapi.io/terms)
- [Privacy Policy](https://rdapapi.io/privacy)
- [Legal, DPA, and TOMs](https://rdapapi.io/legal)
- [Contact](https://rdapapi.io/contact)