# What Is RDAP (Registration Data Access Protocol)?

> RDAP (Registration Data Access Protocol) is the structured successor to WHOIS for looking up who holds a domain name, an IP address block or an autonomous system number. It returns registration data as JSON over HTTPS, with standard fields for the holder, their contacts and roles, and the dates a record was created and last changed.

*Source: https://www.whisper.security/glossary/rdap*
*Published: 2026-06-18*
*Last updated: 2026-09-25*

---

## How RDAP differs from WHOIS

[WHOIS](/glossary/whois) returns free text whose layout differs by registry and registrar, so every parser is a pile of special cases. RDAP defines one schema and one query pattern for domains, IP networks and ASNs. Records link to each other, so a network record points to the entity that holds it and that entity to its abuse contact. RDAP also supports access control, which registries use to redact personal data for the public and show more to authenticated users.

Registries and registrars for the generic top-level domains are required to run RDAP, and the regional internet registries serve their IP and ASN allocations through it.

## Why it matters for infrastructure analysis

Ownership is the layer that turns a list of addresses into a list of organizations. RDAP gives a registry-sourced answer to who holds a network, where its abuse contact is, and when the allocation was made or last changed. Two networks registered to the same entity handle belong to the same holder, whatever names appear in their route announcements, which makes the handle a sturdier pivot than an organization name typed into a free-text field.

Registration dates matter as well. A network allocated last month that already announces space listed in threat feeds deserves a closer look than one with a long, quiet history.

## How it appears in the graph

WhisperGraph stores network registrations as RDAP_ENTITY nodes, with the handle, display name, kind, roles, abuse email and registration dates. REGISTERED_TO_ENTITY links each [autonomous system](/glossary/autonomous-system) and each registered prefix to its entity, so one hop answers who holds a network, and a reverse hop from the entity lists the other networks it holds.

Domain registration data sits on separate edges from the domain's HOSTNAME node: HAS_REGISTRAR, HAS_EMAIL, HAS_PHONE and REGISTERED_BY. Following a registrant email from one domain to every other domain that lists it is the same kind of pivot, one layer up.

## Where this shows up

See it in a live investigation: [Who actually owns this infrastructure and how far does it reach?](/products/intelligence/use-cases/infrastructure-supply-chain/infrastructure-mapping)

Go hands-on with [the pivoting examples](/docs/whisper-graph/schema/pivoting).

## Related Terms

- [Whois](https://www.whisper.security/glossary/whois.md)
- [Autonomous System](https://www.whisper.security/glossary/autonomous-system.md)
- [Infrastructure Pivoting](https://www.whisper.security/glossary/infrastructure-pivoting.md)