WHOIS History API: see how a domain changed over time.
Get a JSON timeline of changes to a domain's registrar, key dates, nameservers, status codes and DNSSEC. Each event shows what changed, with before and after values, so you can investigate domains without parsing old WHOIS records yourself.
3000+ satisfied developers love us.
Domain timeline
example.com
-
swap_horiz
Mar 14, 2026
Registrar transferred
Example Registrar, Inc. arrow_forward Another Registrar LLC -
dns
Mar 14, 2026
Nameservers changed
ns1.old-dns.example arrow_forward a.new-dns.example -
event_repeat
Nov 2, 2025
Expiration extended
2025-12-01 arrow_forward 2026-12-01
What is a WHOIS history lookup?
A regular WHOIS lookup shows a domain as it is today. A WHOIS history lookup shows how its public registration data changed: when it moved registrars, when nameservers were switched, and when it was renewed.
Change events, not raw dumps
Each event compares one observation with the one before it and lists only the fields that changed, with before and after values.
Archive backfill
The timeline is built from WHOIS/RDAP observations we have saved. If we have none for a domain, we make a one-time request to a historical WHOIS archive.
Date filters and cursors
Narrow results with from and to timestamps, page through long histories with a cursor, and read coverage to see how far the record goes back.
Public registration data only
Responses cover registrar, dates, nameservers, status and DNSSEC. Contact details and raw WHOIS text are not included.
One request, one timeline
Simple REST endpoint
Send a GET request with your API token. Subdomains resolve to their registrable domain, so www.example.com returns the history for example.com.
Fields compared in every event
- check_circleEvents are returned newest first.
- check_circleUp to 100 events per page with cursor pagination.
- check_circleOptional
fromandtoISO 8601 filters.
curl 'https://whoisjsonapi.com/v1/example.com/history' \
--header 'Authorization: Bearer {your-api-token}'{
"domain": "example.com",
"history_status": "records_available",
"page_status": "changes",
"events": [
{
"source": "native",
"observed_at": "2026-03-14T09:21:07.512Z",
"previous_observed_at": "2025-11-02T14:05:31.000Z",
"changes": [
{
"path": "registrar.name",
"before": { "state": "present", "value": "Example Registrar, Inc." },
"after": { "state": "present", "value": "Another Registrar LLC" }
}
]
}
],
"coverage": {
"observation_count": 14,
"first_observed_at": "2014-06-09T08:12:44.000Z",
"last_observed_at": "2026-03-14T09:21:07.512Z"
},
"pagination": { "limit": 20, "has_more": false, "next_cursor": null }
}Where to use WHOIS history
Registration changes are often the earliest sign that a domain changed owners, infrastructure or purpose.
1. Threat investigation
Spot recent registrar transfers or nameserver swaps that often come before phishing, hijacking or infrastructure changes.
2. Domain acquisition due diligence
Check how long a domain has been registered, how often it changed hands between registrars, and whether it was renewed on time.
3. Fraud and risk scoring
Add signals such as a recent registrar change or newly added hold status to onboarding, payments or trust-and-safety checks.
4. Brand protection
Review the registration history of look-alike domains to understand when they were set up and how they have been managed.
5. Incident response
Confirm when nameservers or DNSSEC changed for your own domains while reconstructing an outage or a security event.
6. Compliance and audit
Keep a structured record of registration changes for portfolios you manage, without parsing WHOIS text yourself.
Frequently Asked Questions
Everything you need to know about WHOIS history lookups.
Which plans include the WHOIS History API?
WHOIS history is available on Premium and Enterprise plans. Requests from other plans are rejected.
How many credits does a request use?
Every successful response uses 50 requests from your plan allowance, including each additional page fetched with a cursor. Error responses use nothing. A request is accepted only when at least 50 requests remain.
How far back does the history go?
It depends on the observations available for the domain. The coverage object in every response shows the first and last observation times and how many observations were found, so you always know the span you are looking at.
Is observed_at the exact time of the change?
No. observed_at is when a record was seen. The change happened between previous_observed_at and observed_at.
Does the response include registrant contact details?
No. WHOIS history covers public registration fields only: registrar, creation, update and expiration dates, nameservers, status codes and DNSSEC.
Are missing values reported as changes?
No. A change is reported only when both the before and after values are present, so a field that one source did not supply never shows up as a false change.
Start tracking domain history today
WHOIS History API is included in Premium and Enterprise plans.