GET /whois/{domain} — the registry record
No API key, no account, no signup. Responses are JSON, CORS is open, and every endpoint is read-only — nothing here can register, buy or change anything.
Request
curl https://dotsweep.com/whois/example.comResponse
The same shape as GET /check/{domain}, plus a
record object: registrar, creation and expiry dates, nameservers,
and registry status codes.
Why this is a separate endpoint
A check answers availability, and delegation in DNS already proves registration — so for a taken domain no registry record is ever fetched. That is correct for availability and it means the registrar, the nameservers and the for-sale signal are all absent from a plain check.
This endpoint bypasses the DNS prefilter and the cache. It is the only call
that populates offer, the field that says a domain appears to be
listed, parked or expiring.
Because it always queries, it is the expensive call. Use /check when you want availability, and this when you want the record.
Where the answer comes from
RDAP first, and legacy WHOIS on port 43 when a registry publishes no usable
RDAP. Several do: .co, .eu and .ru are all
confirmed over WHOIS. .co is the one worth naming, because it
does publish an RDAP endpoint that returns a well-formed not-found for
every name, google.co included. Routing to it would report every
registered .co as free, so it is excluded by name.
Google's TLDs go the other way: .app, .dev and about
45 others have RDAP and no WHOIS at all, which is why a plain
whois .dev has no server to call.
Errors
{ "error": { "code": "invalid_domain", "message": "...", "hint": "..." } }Codes: invalid_domain, bad_body,
batch_too_large, rate_limited,
unknown_endpoint, method_not_allowed,
internal_error. The hint says what to do differently.
For anything other than rate_limited and internal_error,
repeating the same call fails the same way.
Rate limit
120 requests a minute per client, counted as requests rather than domains. Edge cache hits never reach the Worker and are not counted at all.
That rate is the whole quota. There is no daily or monthly ceiling, no credit balance and no trial that expires, so a job that stays under the rate can run as long as it needs to. Said plainly because an unstated limit gets read as a hidden one, and a caller who plans around a monthly cap is planning around nothing.
The other endpoints
GET /check/{domain}— one domain, edge-cached, unmetered on a hitPOST /check— up to 10 domains per request, for volumeGET /tlds— the full list, with price, term and eligibilityPOST /mcp— the same engine over Model Context Protocol