API quickstart

Authenticate, look up your first domain, and see what else the API can do. The full reference, with every endpoint, parameter and field, is in your dashboard once you have an account.

Authentication

Every request goes to https://api.whoistoolkit.com and carries your API key as a bearer token:

Authorization: Bearer YOUR_API_KEY

You create and revoke keys in your dashboard. Keep them out of client-side code and public repositories; anyone with a key can use your plan. Don't have an account yet? Get in touch and we'll set you up.

If a header isn't practical, an ?apiKey=YOUR_API_KEY query parameter works too. We'd still recommend the header where you can use it: a key in the URL can end up in server logs and browser history in a way a header doesn't.

Your first lookup

Ask for a domain by name. With your key in the WHOISTOOLKIT_KEY environment variable:

Request

curl https://api.whoistoolkit.com/v1/domains/example.com \
  -H "Authorization: Bearer $WHOISTOOLKIT_KEY"

The response is a single JSON record:

200 OK response

{
  "domainName": "example.com",
  "domainNameExt": ".com",
  "estimatedDomainAge": 11363,
  "createdDate": "1995-08-14T04:00:00",
  "updatedDate": "2026-01-16T18:26:50",
  "expiresDate": "2026-08-13T04:00:00",
  "fetchedAt": "2026-02-09T16:18:05",
  "registrarName": "RESERVED-Internet Assigned Numbers Authority",
  "status": "client delete prohibited client transfer prohibited client update prohibited",
  "dnssecSigned": true,
  "privacyProtected": false,
  "dataError": null,
  "nameServers": {
    "hostNames": ["elliott.ns.cloudflare.com", "hera.ns.cloudflare.com"]
  },
  "registrant": {
    "name": null,
    "organization": null,
    "street": null,
    "city": null,
    "state": null,
    "postalCode": null,
    "country": null,
    "email": null,
    "telephone": null
  },
  "technicalContact": { … },
  "administrativeContact": { … },
  "billingContact": { … }
}

Dates are UTC. fetchedAt is when we last checked the domain's registration details.
Contact fields are null when the registrar doesn't publish them, which is the case for most domains since GDPR. privacyProtected tells you when a privacy service is involved.
The three contact blocks collapsed above have the same fields as registrant.

What else you can do

The same key works across the API. Parameters and response fields for each are in the reference in your dashboard.

Current records: Registration, registrar, dates, status, DNSSEC, nameservers and published contacts for a domain.
Records as of a date: The same record as it stood on a past date, from our own history.
Reverse search: Every domain sharing a registrant email, an organisation, or a nameserver.
Bulk lookups: Up to 100 domains in a single request.
Availability: Whether a domain appears in its registry's zone file.
DNS records: Live DNS lookups for a domain, by record type.

Credits

Any key can check its account's balance, free of charge:

Request

curl https://api.whoistoolkit.com/v1/account/balance \
  -H "Authorization: Bearer $WHOISTOOLKIT_KEY"

200 OK response

{
  "balance": 4998,
  "unlimited": false,
  "meteringEnabled": true
}

unlimited accounts don't have a balance to run out of. meteringEnabled tells you whether calls are being charged against it at all — most accounts aren't metered yet.

Errors

Failed requests use a real HTTP status code and the same JSON shape every time:

404 Not Found response

{
  "error": {
    "code": "not_found",
    "message": "Domain 'example.invalid' not found."
  }
}

Status	Code	Meaning
400	`bad_request`	A parameter is missing or malformed, such as an invalid domain name.
401	`unauthorized`	The Authorization header is missing, or the key isn't valid or active.
404	`not_found`	We have no record of that domain.
502	`upstream_error`	Our lookup backend didn't respond. Retry after a short wait.

Getting help

If a record looks wrong, or the API isn't behaving the way this page says, tell us. Include the domain and the request you made. Current service health is on the status page.