domains
GET /v1/domains/{domainId}/registry
What the public registry says about a domain (the WHOIS card).
Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X GET https://api.zinndigital.com/v1/domains/{domainId}/registry \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Registration dates, the registrar, the EPP status set and the DNSSEC flag, read from the registry's own **RDAP** service — the structured replacement for port-43 WHOIS. ⭐ **This answers for a domain registered somewhere else.** RDAP needs no credential, so a domain a customer registered at a registrar we have never integrated still returns its real expiry date and transfer lock. `GET /v1/domains/{domainId}` cannot: those columns are our own mirror of a registrar API, and for a connected (non-`registered`) domain we hold no account to mirror from, so they are empty and stay empty. Two sources, two endpoints, neither pretending to be the other. ⛔⛔ **Every field is nullable, and `null` means the registry did not publish it — never that the domain lacks it.** `transfer_locked: null` is "we did not read a status set", not "unlocked"; rendering it as unlocked tells a customer to go and protect a domain that is already protected. `dnssec: null` is the same shape. ⛔ No registrant, admin or technical contact is returned, by decision: most registries redact them post-GDPR, and republishing the ones that do not would export personal data through our UI for no product reason. A registry that does not answer is a `503`, never an empty body and never a `404` — "the registry is quiet" and "this domain is not registered" are different facts and RDAP cannot reliably tell them apart (a stale bootstrap map 404s from the wrong registry). Requires `sites.view`, RLS-scoped; a domain the caller cannot see is a `404`.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
domainId (path) | Uuid | Yes | The domain's id. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
fqdn | string | Yes | The name this record is about, normalised to lower case. |
checked_at | string | Yes | When we read the registry. Answers are cached for a few hours, so this is the age of the reading and not the time of the request. |
registrar | string | Yes | The registrar of record, as the registry publishes it. |
registrar_iana_id | string | Yes | The registrar's IANA id — stable where the display name is not. |
registered_at | string | Yes | When the domain was first registered. |
expires_at | string | Yes | When the registration lapses. ⭐ This is the **registry's** date, not our billing date, and on a domain the customer renews elsewhere it is the only true one we have. |
last_changed_at | string | Yes | When the registry record last changed. A renewal, a nameserver edit or a lock change all move it, so it is a useful "something happened" marker and not a statement of what. |
statuses | string[] | Yes | The EPP status set, lower-cased as RDAP publishes it. An empty array means the registry published none — not that the domain has none. |
nameservers | string[] | Yes | The nameservers the **registry** holds. May legitimately differ from the public delegation mid-propagation — compare with `Delegation.nameservers`, which is what the internet ac… |
dnssec | boolean | Yes | Whether the delegation is signed. `null` when the registry published no `secureDNS` block at all, which many do not. |
transfer_locked | boolean | Yes | Whether a client transfer prohibition is set. `null` when no status set was published — ⛔ not `false`, for the reason in this schema's description. |
lapsed | boolean | Yes | Whether the registration is in a redemption or pending-delete window right now. Worth surfacing loudly: those windows are short, cost a fee to reverse, and end with the name bei… |
Errors this endpoint can return
401 · 403 · 404 · 429 · 503