# WHOIS History API URL: https://www.deepinfo.com/data-api/apis/whois-history/ ## Trace What Changed Between a Domain’s WHOIS Records. The WHOIS History API takes a domain and returns each distinct registration record Deepinfo has observed for it, each with the dates it was seen, so registrar transfers, registrant changes and name server moves read as a sequence. The record as it stands today comes from [Domain WHOIS](https://www.deepinfo.com/data-api/apis/whois-lookup/). [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [WHOIS History reference](https://docs.deepinfo.com/reference/lookup/whois-history/) ### List Each Distinct Record a Domain Has Had. The response is an array. A record appears once, with all the dates it was observed under `check_dates`, so identical snapshots never repeat. GET `https://api.deepinfo.com/v1/analyze/whois-history` [Reference](https://docs.deepinfo.com/reference/lookup/whois-history/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `domain` | string | Required | A registered domain, for example `deepinfo.com`. | Request curl: ```bash curl "https://api.deepinfo.com/v1/analyze/whois-history?domain=deepinfo.com" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/analyze/whois-history", params={"domain": "deepinfo.com"}, headers={"apikey": "YOUR_API_KEY"}, ) for item in r.json(): w = item["whois"] print(w["registrar"], w["name_servers"], len(item["check_dates"])) ``` JavaScript: ```javascript const r = await fetch( 'https://api.deepinfo.com/v1/analyze/whois-history?domain=deepinfo.com', { headers: { apikey: 'YOUR_API_KEY' } } ) for (const { whois, check_dates } of await r.json()) console.log(whois.registrar, whois.expiry_date, check_dates.length) ``` Response 200 OK · application/json ```json [ { "whois": { "create_date": "2001-06-05T02:57:08Z", "update_date": "2025-08-19T07:33:45Z", "expiry_date": "2028-10-20T11:59:59Z", "registrar": "godaddy online services cayman islands ltd.", "registrant": { "…": "name, organization, address, phone, email" }, "name_servers": [ "may.ns.cloudflare.com", "simon.ns.cloudflare.com" ], "domain_status": [ "clientdeleteprohibited", "clienttransferprohibited" ], "whois_server": "whois.uniregistrar.com", "check_date": "2026-09-01T08:00:00Z" }, "check_dates": [ "2026-09-01T08:00:00Z", "2026-08-01T08:00:00Z" ] } ] ``` ### What Changes Between Two Records. Order the records by their `check_dates` and compare them field by field. These fields carry most ownership stories. Registrar #### A Transfer A different `registrar` between two records is a transfer. The `check_dates` on either side bracket when it happened. Creation date #### A New Registration A later `create_date` means the domain was deleted and registered again, possibly by someone else. Name servers #### A New Operator Moved `name_servers` show when a domain changed DNS provider, which can mean a change in who runs it. ### Where Ownership Over Time Decides It. #### [Incident Investigation](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) Establish who held a domain when the incident happened, from the records observed around that date. #### [M&A Due Diligence](https://www.deepinfo.com/solutions/use-cases/mergers-acquisitions-due-diligence/) Check the ownership claims in a data room against the registration record over time. #### [Fraud Prevention](https://www.deepinfo.com/solutions/use-cases/fraud-prevention/) Spot a domain that lapsed and was registered again before it is used against your customers. #### [Threat Hunting](https://www.deepinfo.com/solutions/use-cases/threat-hunting/) Find registrars, registrant details and name servers that suspicious domains had in common at some point. ### Redaction, Routes and the Current Record. - **Current vs history**: This call returns what Deepinfo has observed over time. The record as the registry serves it right now comes from the [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/). - **Redacted records**: Registrant fields hold what the registry published at the time, and many registries redact them. Registrar, dates and name servers often carry the story on their own. - **Path**: The route is `/v1/analyze/whois-history`. Older examples that use `/analyze/history/whois` return `404`. - **Rate limits and errors**: Plan-dependent, one request per second by default. `400` when `domain` is not a valid domain. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/) and [errors](https://docs.deepinfo.com/getting-started/errors/). ### Other Records for One Domain. - [Domain WHOIS](https://www.deepinfo.com/data-api/apis/whois-lookup/) (Lookup): The registration record as the registry serves it now, raw and parsed. - [DNS History](https://www.deepinfo.com/data-api/apis/dns-history/): The DNS values Deepinfo has observed for a name, with each sighting. - [Reverse WHOIS Email](https://www.deepinfo.com/data-api/apis/reverse-whois-email/) (Discovery): Domains registered with a given email address, or at its email domain. ### See This Data at Work in the Deepinfo Platform This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs. - [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) (EASM) - [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) (TPRM) - [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) (DSI) ### Questions About WHOIS History API **How far back does the history go?** It depends on the domain. The response holds each distinct record Deepinfo has observed, so the oldest date across the `check_dates` lists is the earliest observation the index holds. **Can we find the domains a registrant email was ever used on?** Use [Domain Search](https://www.deepinfo.com/data-api/apis/domain-search/) on `domain.whois_registrant_email_historical`, which holds every registrant email seen in a domain’s WHOIS records over time. **Can we pull WHOIS history for many domains at once?** Not through a public endpoint: this call answers for one domain. For many domains, see [Historical WHOIS Records](https://www.deepinfo.com/data-api/feeds/historical-whois-records/) and tell our data team what you need. **How is the WHOIS History API priced?** Your plan sets which endpoints your key can call, and API services are priced by volume and frequency, separately from the platform. See [Data & API pricing](https://www.deepinfo.com/pricing/#data-pricing). **Can analysts read WHOIS history without writing code?** Yes. [Instant Lookups](https://www.deepinfo.com/platform/dsi/instant-lookups/) shows WHOIS History in the Deepinfo Platform. For domains you monitor, External Attack Surface Management also keeps each asset’s WHOIS snapshots. ### Trace Your Domains First. Pull the history of a domain you know well and check it against the transfers and renewals you remember. We set up access and answer schema questions on a short call. [Talk to us about access](https://www.deepinfo.com/contact/?topic=data-api) [All API services](https://www.deepinfo.com/data-api/apis/)