<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — WHOIS Analysis

## whois CLI

### Domain Lookup
```bash
whois example.com
whois example.com | grep -iE "registrant|registrar|creation|expiration|nameserver"
```

### IP Lookup
```bash
whois 1.2.3.4
whois -h whois.arin.net 1.2.3.4
```

### ASN Lookup
```bash
whois -h whois.radb.net AS15169
```

## RDAP (Registration Data Access Protocol)

### Domain Query
```bash
curl -s "https://rdap.verisign.com/com/v1/domain/example.com" | jq .
```

### IP Query
```bash
curl -s "https://rdap.arin.net/registry/ip/1.2.3.4" | jq .
```

### ASN Query
```bash
curl -s "https://rdap.arin.net/registry/autnum/15169" | jq .
```

## python-whois

### Basic Lookup
```python
import whois
w = whois.whois("example.com")
print(w.registrar, w.creation_date, w.name_servers)
```

## SecurityTrails API

### WHOIS History
```bash
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/history/example.com/whois"
```

### Associated Domains
```bash
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domain/example.com/associated"
```

## DomainTools API

### Reverse WHOIS
```bash
curl -s "https://api.domaintools.com/v1/reverse-whois/" \
  -d "terms=registrant@example.com" \
  -d "api_username=$DT_USER" \
  -d "api_key=$DT_KEY"
```

### Domain Profile
```bash
curl -s "https://api.domaintools.com/v1/example.com/profile/" \
  -d "api_username=$DT_USER&api_key=$DT_KEY"
```

## Environment Variables

| Variable | Description |
|----------|-------------|
| `SECURITYTRAILS_KEY` | SecurityTrails API key |
| `DT_USER` | DomainTools API username |
| `DT_KEY` | DomainTools API key |
