The job

An agent needs to check a domain before it trusts a link, starts outreach, or renews a vendor. It needs the registration date, expiry, registrar, nameservers, and DNSSEC state. Those are facts to retrieve, not a verdict about whether a company is safe.

Account key or one paid request

Many domain-data services put WHOIS and RDAP behind an account, a stored API key, and a plan. That fits a monitoring system making a steady stream of lookups.

For a one-off diligence step, whois returns a 402 first. The response states the USDC price before the agent pays. Resend the request with payment and the endpoint returns the RDAP record for $0.005 per call. No vendor key needs to live in the agent's working memory. 

curl -X POST https://x402.agentutility.ai/whois \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com"}'

The paid response includes the domain, registration and expiration dates, age in days, registrar details, nameservers, DNSSEC status, registry status codes, and flags. Set include_certificates to true only when the workflow also needs a certificate-transparency summary.

A repeatable diligence record

Save the response fields that can change: expiration_date, registrar, nameservers, dnssec_signed, statuses, and flags. On the next lookup, compare those fields with the previous paid response. Keep the registration date and age as context, but don't mistake a changed nameserver or renewal date for a risk score. 

{
  "domain": "example.com",
  "include_certificates": false
}

For a long form search slug, use whois-lookup. It has the same RDAP backend and price. The short whois route is useful when a tool plan already calls the job by its common name.

Where each route fits

An account-based provider can make more sense for bulk monitoring, alerting, historical archives, or a contracted support requirement. whois is for an agent that needs a current domain record inside a single paid workflow and doesn't want to retain another credential.

The response is evidence for a review. A recently registered domain, an expiring registration, or a missing DNSSEC flag can justify another check. It doesn't prove fraud, ownership, or the safety of a transaction.