WHOIS History API
Trace What Changed Between a Domain’s WHOIS Records.
The WHOIS History API takes a domain and returns each distinct registration record Deepinfo has observed for it, each with the dates it was seen, so registrar transfers, registrant changes and name server moves read as a sequence. The record as it stands today comes from Domain WHOIS.
WHOIS history
acme.example
/analyze/whois-history
records
- check_datesJul 1, Aug 1 2026
- check_datesSep 22 2026
What changed between two records
name_serversnew operator- ns1/ns2.hosting.example (before), now ns1/ns2.acme.example
expiry_daterenewed- 2026-09-14 (before), now 2027-09-14
List Each Distinct Record a Domain Has Had.
The response is an array. A record appears once, with all the dates it was observed under check_, so identical snapshots never repeat.
| Parameter | Type | Description | |
|---|---|---|---|
domain | string | Required | A registered domain, for example deepinfo.com. |
Request
curl "https://api.deepinfo.com/v1/analyze/whois-history?domain=deepinfo.com" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/analyze/whois-history",
params={"domain": "deepinfo.com"},
headers={"apikey": "YOUR_API_KEY"},
)
for item in r.json():
w = item["whois"]
print(w["registrar"], w["name_servers"], len(item["check_dates"]))const r = await fetch(
'https://api.deepinfo.com/v1/analyze/whois-history?domain=deepinfo.com',
{ headers: { apikey: 'YOUR_API_KEY' } }
)
for (const { whois, check_dates } of await r.json())
console.log(whois.registrar, whois.expiry_date, check_dates.length)Response
[
{
"whois": {
"create_date": "2001-06-05T02:57:08Z",
"update_date": "2025-08-19T07:33:45Z",
"expiry_date": "2028-10-20T11:59:59Z",
"registrar": "godaddy online services cayman islands ltd.",
"registrant": { "…": "name, organization, address, phone, email" },
"name_servers": [
"may.ns.cloudflare.com",
"simon.ns.cloudflare.com"
],
"domain_status": [
"clientdeleteprohibited",
"clienttransferprohibited"
],
"whois_server": "whois.uniregistrar.com",
"check_date": "2026-09-01T08:00:00Z"
},
"check_dates": [
"2026-09-01T08:00:00Z",
"2026-08-01T08:00:00Z"
]
}
]What Changes Between Two Records.
Order the records by their check_ and compare them field by field. These fields carry most ownership stories.
Registrar
A Transfer
A different registrar between two records is a transfer. The check_ on either side bracket when it happened.
Creation date
A New Registration
A later create_ means the domain was deleted and registered again, possibly by someone else.
Name servers
A New Operator
Moved name_ show when a domain changed DNS provider, which can mean a change in who runs it.
WHOIS history
acme.example
Record · check_dates
Jul 1, Aug 1 2026
name_servers ns1/ns2.hosting.example
name_servers moved · a new operator
after the check on Aug 1, by the check on Sep 22
Record · check_dates
Sep 22 2026
name_servers ns1/ns2.acme.example
Where Ownership Over Time Decides It.
Incident Investigation
Establish who held a domain when the incident happened, from the records observed around that date.
M&A Due Diligence
Check the ownership claims in a data room against the registration record over time.
Fraud Prevention
Spot a domain that lapsed and was registered again before it is used against your customers.
Threat Hunting
Find registrars, registrant details and name servers that suspicious domains had in common at some point.
Redaction, Routes and the Current Record.
| Current vs history | This call returns what Deepinfo has observed over time. The record as the registry serves it right now comes from the Domain WHOIS API. |
|---|---|
| Redacted records | Registrant fields hold what the registry published at the time, and many registries redact them. Registrar, dates and name servers often carry the story on their own. |
| Path | The route is /. Older examples that use / return 404. |
| Rate limits and errors | Plan-dependent, one request per second by default. 400 when domain is not a valid domain. See rate limits and errors. |
See This Data at Work in the Deepinfo Platform
This registration and ownership data finds the domains that belong to you and to your vendors in the platform: External Attack Surface Management for your own, Third-Party Risk Management for theirs.
Questions About WHOIS History API
How far back does the history go?
It depends on the domain. The response holds each distinct record Deepinfo has observed, so the oldest date across the check_ lists is the earliest observation the index holds.
Can we find the domains a registrant email was ever used on?
Use Domain Search on domain.whois_, which holds every registrant email seen in a domain’s WHOIS records over time.
Can we pull WHOIS history for many domains at once?
Not through a public endpoint: this call answers for one domain. For many domains, see Historical WHOIS Records and tell our data team what you need.
How is the WHOIS History API priced?
Your plan sets which endpoints your key can call, and API services are priced by volume and frequency, separately from the platform. See Data & API pricing.
Can analysts read WHOIS history without writing code?
Yes. Instant Lookups shows WHOIS History in the Deepinfo Platform. For domains you monitor, External Attack Surface Management also keeps each asset’s WHOIS snapshots.
Trace Your Domains First.
Pull the history of a domain you know well and check it against the transfers and renewals you remember. We set up access and answer schema questions on a short call.