RDAP and WHOIS
What the public registry publishes for one allocation, and how to read the same record over either protocol.
On this page (7)
RDAP and WHOIS Documentation
Every allocation is registered, and the registration is public. Whisper runs the registry for the individual /128 inside 2a04:2a01::/32; the RIR that holds the covering block answers for the block. Both doors are keyless.
The RDAP object
GET https://rdap.whisper.online/ip/<address>, served as application/rdap+json per RFC 9083.
curl -s -H 'accept: application/rdap+json' \
https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 | jq .
| Field | What it holds |
|---|---|
handle | the allocation, written as the address with its prefix length |
parentHandle | the covering block the allocation was cut from |
name | the object name for this identity |
type | Whisper agent identity |
status | the registry state of the allocation |
startAddress, endAddress | identical, because the allocation is a single address |
rdapConformance | ["rdap_level_0"] |
links | includes a referral up to the RIR that holds parentHandle |
remarks | carries the nested-identity note when the identity egresses behind another |
An address with no identity answers 404 with an RFC 9083 error object:
{"errorCode": 404, "title": "Not Found", "description": ["no Whisper agent identity for this address"]}
The domain object
GET https://rdap.whisper.online/domain/<name> answers for a name rather than an address, which is the door to use when what you hold is the identity's fully qualified name.
Ownership history
The registry keeps the allocation's history, so you can ask who held an address at a moment in the past rather than only who holds it now.
curl -s "https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478?history" | jq .history
curl -s "https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478?at=2026-06-01T00:00:00Z" | jq .
?at= and ?time= both take an RFC 3339 timestamp, epoch milliseconds, or a relative offset. This is how an abuse report about last month's traffic gets attributed to the identity that was actually holding the address at the time.
The per-identity transparency arm
GET /ip/<address>/transparency returns the log events for this one allocation, each with its proof, under an ES256-signed root.
curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478/transparency | jq .
The response carries object, address, count, events, root_hash, root_signature and root_signature_alg. The Transparency Log explains how this arm relates to the global log.
The inbound lookups feed
GET /ip/<address>/lookups returns who has been looking this identity up, k-anonymised. It answers the question an operator asks after publishing an identity: which parties are checking it before they accept traffic from it.
The WHOIS record
whois.whisper.online on TCP port 43, RFC 3912, accepting either the address or the identity's forward name. Same allocation, key-and-value lines.
whois -h whois.whisper.online 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
netname: <the identity's label>
descr: Whisper agent identity
status: active
country: NL
origin: AS219419
org: viaGraph B.V.
aggregate: 2a04:2a01::/32
posture: tier1.5
source: WHISPER
posture names the connectivity tier the identity is running on; see Connectivity Tiers. A nested identity carries an extra nested-behind line naming the parent allocation, as described in Nested Identities.
WHOIS has no delegation mechanism of its own, so a client that wants the covering block queries the RIR's WHOIS server directly, or follows the RDAP referral above.
Which door to use
Use RDAP when you are writing code. It is JSON, it is typed, it carries structured error objects, and it is the only one of the two that gives you the referral and the history.
Use WHOIS when a tool or a human on the other end speaks WHOIS and will not be changed. The record is the same allocation, flattened.
For the full endpoint reference, including request parameters and status codes, see Keyless Endpoints.