# RDAP and WHOIS

> The public registry behind a Whisper identity: the RDAP object for one /128, the port-43 WHOIS record, ownership history and the inbound lookups feed.

*Source: https://www.whisper.security/docs/identity/registry*

---
Every allocation is registered, and the registration is public. Whisper runs the registry for the individual `/128` inside `2a04:2a01::/32`; the RIR that holds the covering block answers for the block. Both doors are keyless.

## The RDAP object {#rdap}

`GET https://rdap.whisper.online/ip/<address>`, served as `application/rdap+json` per RFC 9083.

```bash
curl -s -H 'accept: application/rdap+json' \
  https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 | jq .
```

| Field | What it holds |
|---|---|
| `handle` | the allocation, written as the address with its prefix length |
| `parentHandle` | the covering block the allocation was cut from |
| `name` | the object name for this identity |
| `type` | `Whisper agent identity` |
| `status` | the registry state of the allocation |
| `startAddress`, `endAddress` | identical, because the allocation is a single address |
| `rdapConformance` | `["rdap_level_0"]` |
| `links` | includes a referral up to the RIR that holds `parentHandle` |
| `remarks` | carries the nested-identity note when the identity egresses behind another |

An address with no identity answers `404` with an RFC 9083 error object:

```json
{"errorCode": 404, "title": "Not Found", "description": ["no Whisper agent identity for this address"]}
```

## The domain object {#domain}

`GET https://rdap.whisper.online/domain/<name>` answers for a name rather than an address, which is the door to use when what you hold is the identity's fully qualified name.

## Ownership history {#history}

The registry keeps the allocation's history, so you can ask who held an address at a moment in the past rather than only who holds it now.

```bash
curl -s "https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478?history" | jq .history
curl -s "https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478?at=2026-06-01T00:00:00Z" | jq .
```

`?at=` and `?time=` both take an RFC 3339 timestamp, epoch milliseconds, or a relative offset. This is how an abuse report about last month's traffic gets attributed to the identity that was actually holding the address at the time.

## The per-identity transparency arm {#transparency}

`GET /ip/<address>/transparency` returns the log events for this one allocation, each with its proof, under an ES256-signed root.

```bash
curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478/transparency | jq .
```

The response carries `object`, `address`, `count`, `events`, `root_hash`, `root_signature` and `root_signature_alg`. [The Transparency Log](/docs/identity/transparency) explains how this arm relates to the global log.

## The inbound lookups feed {#lookups}

`GET /ip/<address>/lookups` returns who has been looking this identity up, k-anonymised. It answers the question an operator asks after publishing an identity: which parties are checking it before they accept traffic from it.

## The WHOIS record {#whois}

`whois.whisper.online` on TCP port 43, RFC 3912, accepting either the address or the identity's forward name. Same allocation, key-and-value lines.

```bash
whois -h whois.whisper.online 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
```

```text
netname:       <the identity's label>
descr:         Whisper agent identity
status:        active
country:       NL
origin:        AS219419
org:           viaGraph B.V.
aggregate:     2a04:2a01::/32
posture:       tier1.5
source:        WHISPER
```

`posture` names the connectivity tier the identity is running on; see [Connectivity Tiers](/docs/network/egress/tiers). A nested identity carries an extra `nested-behind` line naming the parent allocation, as described in [Nested Identities](/docs/identity/nested).

WHOIS has no delegation mechanism of its own, so a client that wants the covering block queries the RIR's WHOIS server directly, or follows the RDAP referral above.

## Which door to use {#choosing}

Use RDAP when you are writing code. It is JSON, it is typed, it carries structured error objects, and it is the only one of the two that gives you the referral and the history.

Use WHOIS when a tool or a human on the other end speaks WHOIS and will not be changed. The record is the same allocation, flattened.

For the full endpoint reference, including request parameters and status codes, see [Keyless Endpoints](/docs/control-plane/keyless).