API

Authentication

Send your key as a bearer token or in X-Api-Key. Keys are created on the API keys page and shown once.

curl -H "Authorization: Bearer wm_live_…" https://whois.me.uk/api/v1/whois/bbc.co.uk

Endpoints

Method	Path	What it does
GET	/me	Key, plan and remaining allowance
GET	/lookup	Lookup bar: quick verbs and auto-detection
GET	/whois/{domain}	Registry record (RDAP first, port-43 in raw)
GET	/dns/{domain}	DNS records with nameserver consistency checks
GET	/mail/{domain}	MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and a live SMTP test
GET	/web/{host}	HTTP/HTTPS, redirects, TLS certificate and protocols, security headers, ping and traceroute
GET	/ip/{target}	IP or AS ownership, reverse DNS and blocklist scan (a domain scans the addresses behind it)
GET	/checkup/{domain}	Domain Check-up: every facet merged into one report
GET	/watches	List your watches
POST	/watches	Create a watch (same rules and plan limits as the dashboard)
GET	/watches/{id}	One watch with recent checks and incidents
DELETE	/watches/{id}	Delete a watch and its history
POST	/watches/{id}/pause	Pause a watch
POST	/watches/{id}/resume	Resume a paused watch (runs within a minute)
POST	/watches/{id}/check	Queue a check now (at most once a minute)
GET	/dmarc/{domain}	DMARC aggregate report summary for a domain you have verified: sources, alignment, dispositions, daily series, findings

Creating a watch:

curl -X POST -H "Authorization: Bearer wm_live_…" -H "Content-Type: application/json" \
  -d '{"kind":"tls_expiry","target":"www.example.co.uk","label":"Shop certificate"}' https://whois.me.uk/api/v1/watches

Add ?fresh=1 to bypass the cache (costs three calls) and ?raw=1 to include source data such as the registry text and RDAP document.

The envelope

{
  "engine": "mail", "target": "example.co.uk", "checked_at": "2026-09-19T08:00:00+00:00", "cached": false,
  "duration_ms": 3120, "error": null, "score": 85,
  "counts": {"pass": 9, "caution": 1, "fail": 1, "note": 2, "skipped": 0},
  "data": { … normalised records … },
  "findings": [{"level": "fail", "code": "DMARC-MISSING", "title": "No DMARC record", "detail": "…", "fix": "…", "facet": "mail"}]
}

Finding codes are stable. Each one has a fix guide at /learn/fix/{code}, so you can link straight from your own dashboard.

Limits and errors

• Daily allowance by plan: Free 100 (trial), Pro 2,000, Business 20,000. Per-second rate 1 / 5 / 20. Every response carries the daily allowance as X-Quota-Limit, X-Quota-Remaining and X-Quota-Reset (seconds to midnight UTC), and the per-second rate as X-RateLimit-Limit / X-RateLimit-Remaining.
• 401 bad key · 403 email not confirmed · 422 invalid target · 429 allowance or rate exceeded (Retry-After set) · 502 an upstream registry, resolver or probe failed (the envelope's error says which).

Fair use

Keys are personal and non-transferable. Use the API for your own domains, your customers' domains and research at reasonable volumes. Bulk WHOIS harvesting, reselling raw registry data and intrusive checks against hosts you do not control are not allowed; see the acceptable use policy.