WHOIS

The WHOIS dataset holds registry records from the regional internet registries, rebuilt every day and published as one snapshot per UTC day. A snapshot is a single tar.gz archive that contains seven Parquet tables, one per kind of registry record.

What a snapshot contains

The archive unpacks into one directory named after the snapshot's date, whois-YYYY-MM-DD/, with one Parquet file per table.

File	Contents
`asns.parquet`	Autonomous systems.
`networks.parquet`	IPv4 and IPv6 allocations and assignments.
`organisations.parquet`	Organisations that hold networks and ASNs.
`contacts.parquet`	Contact records, such as admin, tech, and abuse.
`maintainers.parquet`	Maintainer records.
`transfers.parquet`	Transfers of address ranges and ASN ranges.
`delegations.parquet`	Delegated ASN ranges.

WHOIS is export-only. There is no real-time stream, there are no hourly snapshots, there is one format, and there is no lite variant. The dataset is served over HTTP; the gRPC export RPCs cover the stream feeds only.

Publishing schedule

A day is published once that day's registry build is complete, usually between 00:15 and 02:30 UTC. Until then a request for that date answers 404, and latest keeps resolving to the previous day.

A day can be published again when it is rebuilt. The archive's size and checksum then change. Compare the checksum from the metadata endpoint, or send the ETag back as If-None-Match, to find out whether the copy you hold is still current.

Authentication

All endpoints require your API key in the x-api-key header and are served from https://api.synthient.com under /api/v4. The dataset is gated by the WHOIS_FEED scope. Requests count against the same rate limits as the other export endpoints, and a download counts as one export.

curl -G https://api.synthient.com/api/v4/feeds/whois/export \
  -H "x-api-key: $SYNTHIENT_API_KEY"

Tables and columns

Each table has its own columns, and the metadata endpoint lists them all with their types under entities[].schema. Read the schema from there instead of hard-coding it. The columns below are the ones that identify a record and link the tables to each other.

Table	Columns	Use
`asns`	`asn`	The AS number.
`asns`	`org_handle`	Handle of the holding record in `organisations`.
`networks`	`start_address`, `end_address`	First and last address of the range, as text.
`networks`	`handle`, `registry`, `source`	The network's own handle, and where the record comes from. `handle` can be null.
`networks`	`org_handle`	Handle of the holding record in `organisations`.
`networks`	`admin_handle`, `tech_handle`, `abuse_handle`	Handles of records in `contacts`.
`networks`	`maintainer`	Handle of a record in `maintainers`.
`asns`, `networks`	`abuse_email`	Abuse contact address.
`organisations`, `contacts`, `maintainers`	`handle`, `registry`	A record is identified by its handle together with its registry.
`contacts`	`emails`	A list of email addresses.
`delegations`	`start_asn`, `end_asn`	First and last AS number of the delegated range.
`transfers`	`start_address`, `end_address`, `start_asn`, `end_asn`, `transferred_at`	The transferred address range or ASN range, and when it was transferred.

A reference column can name more than one handle in a single value, separated by commas, semicolons, or spaces (for example A-MNT, B-MNT). Split the value before you join on it.

Query the unpacked tables

-- Networks that contain 203.0.113.7, with the handle of their holder
SELECT n.start_address, n.end_address, n.handle, n.org_handle
FROM 'whois-2026-11-14/networks.parquet' AS n
WHERE TRY_CAST(n.start_address AS INET) <= INET '203.0.113.7'
  AND TRY_CAST(n.end_address AS INET) >= INET '203.0.113.7';

GET/api/v4/feeds/whois/export

Open in playground

List snapshots

Returns one page of available daily snapshots, newest-first. Pages are capped at 500 rows; pass next_cursor from the response back as cursor to fetch the next page.

Query parameters

Name
limit
Type
integer
Description
Page size. Defaults to 100. Values above 500 are clamped.
Name
cursor
Type
string
Description
Opaque pagination token returned in next_cursor of the previous response. Omit on the first page.
Name
day
Type
string
Description
Only list the snapshot for this UTC date, as YYYY-MM-DD.

Response

Name
stream
Type
string
Description
Always whois.
Name
feeds
Type
array<object>
Description
Page of snapshots, newest-first.
Name
feeds[].kind
Type
string
Description
Always daily.
Name
feeds[].date
Type
string
Description
UTC YYYY-MM-DD the snapshot is for.
Name
feeds[].size_bytes
Type
integer
Description
Size of the tar.gz archive in bytes.
Name
feeds[].row_count
Type
integer
Description
Total rows across all seven tables.
Name
feeds[].checksum
Type
string
Description
Hex-encoded SHA-256 of the archive bytes.
Name
feeds[].id
Type
string
Description
Identifier to pass back to /export/{id}: the snapshot's YYYY-MM-DD date.
Name
feeds[].created_at
Type
integer
Description
Unix timestamp in seconds when the snapshot was indexed server-side.
Name
feeds[].download_path
Type
string
Description
Relative API path to follow for the 307 download redirect.
Name
feeds[].formats
Type
array<object>
Description
The files of the snapshot. Always one entry with format set to tar.gz, and the archive's size_bytes and checksum.
Name
feeds[].entities
Type
array<object>
Description
The Parquet tables inside the archive, ordered by name.
Name
feeds[].entities[].entity
Type
string
Description
Table name: asns, contacts, delegations, maintainers, networks, organisations, or transfers.
Name
feeds[].entities[].row_count
Type
integer
Description
Number of rows in that table.
Name
feeds[].entities[].size_bytes
Type
integer
Description
Size of that table's Parquet file in bytes.
Name
feeds[].entities[].checksum
Type
string
Description
Hex-encoded SHA-256 of that table's Parquet file.
Name
next_cursor
Type
string
Description
Pagination token. Absent on the final page.

Request

GET/api/v4/feeds/whois/export

curl -G https://api.synthient.com/api/v4/feeds/whois/export \
  -H "x-api-key: $SYNTHIENT_API_KEY" \
  --url-query "day=2026-11-14"

Response

{
  "stream": "whois",
  "feeds": [
    {
      "kind": "daily",
      "date": "2026-11-14",
      "size_bytes": 964118204,
      "row_count": 20913962,
      "checksum": "6f2a1b0c9d8e7f605142332415a6b7c8d9e0f1a2b3c4d5e6f708192a3b4c5d6e",
      "id": "2026-11-14",
      "created_at": 1794712867,
      "download_path": "/api/v4/feeds/whois/export/2026-11-14",
      "formats": [
        {
          "format": "tar.gz",
          "size_bytes": 964118204,
          "checksum": "6f2a1b0c9d8e7f605142332415a6b7c8d9e0f1a2b3c4d5e6f708192a3b4c5d6e"
        }
      ],
      "entities": [
        {
          "entity": "asns",
          "row_count": 123418,
          "size_bytes": 9412880,
          "checksum": "0a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9"
        },
        {
          "entity": "contacts",
          "row_count": 5902771,
          "size_bytes": 148220412,
          "checksum": "1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a"
        },
        {
          "entity": "delegations",
          "row_count": 41206,
          "size_bytes": 1204331,
          "checksum": "2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b"
        },
        {
          "entity": "maintainers",
          "row_count": 98344,
          "size_bytes": 6120554,
          "checksum": "3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c"
        },
        {
          "entity": "networks",
          "row_count": 12048331,
          "size_bytes": 702114963,
          "checksum": "4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d"
        },
        {
          "entity": "organisations",
          "row_count": 2611480,
          "size_bytes": 96338127,
          "checksum": "5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e"
        },
        {
          "entity": "transfers",
          "row_count": 88412,
          "size_bytes": 2481090,
          "checksum": "60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f"
        }
      ]
    }
  ]
}

GET/api/v4/feeds/whois/export/{date}

Open in playground

Download a snapshot

Returns a 307 redirect to a presigned R2 URL that is valid for 24 hours. The URL is minted per request and expires, so intermediaries must not cache it. Follow the redirect to download the tar.gz archive.

Path parameters

Name
date
Type
string
Description
A YYYY-MM-DD UTC date, or the literal string latest for the newest published day.

Conditional requests

The response carries an ETag (the archive's SHA-256 in quotes) and a Last-Modified header. Send the ETag back as If-None-Match to get an empty 304 while the archive is unchanged. A 304 is not counted as an export.

Responses

Code	Meaning
`307`	Redirect to a 24-hour presigned download URL.
`304`	The archive matches your `If-None-Match` or `If-Modified-Since` header. No redirect is issued.
`400`	Bad date format.
`401`	Missing or invalid API key.
`403`	API key lacks the `WHOIS_FEED` scope.
`404`	No snapshot is published for that date yet.

Request

GET/api/v4/feeds/whois/export/{date}

# Follow the 307 with -L and write to a file
curl -L -o whois.tar.gz \
  https://api.synthient.com/api/v4/feeds/whois/export/latest \
  -H "x-api-key: $SYNTHIENT_API_KEY"

Response

{
  "type": "https://docs.synthient.com/errors/not-found",
  "title": "Resource not found",
  "status": 404,
  "detail": "No snapshot found for the requested date",
  "instance": "4f1c2a9e7b3d4e5f8a6b9c0d1e2f3a4b"
}

GET/api/v4/feeds/whois/export/{date}/meta

Open in playground

Snapshot metadata

Returns JSON metadata for one day: the SHA-256 checksum and byte size of the archive, the total row count, and for each table inside it the row count, size, checksum, and column schema. It returns no file body.

Path parameters

Name
date
Type
string
Description
A YYYY-MM-DD UTC date, or latest for the newest published day.

Response

Name
stream
Type
string
Description
Always whois.
Name
kind
Type
string
Description
Always "daily".
Name
id
Type
string
Description
The snapshot's YYYY-MM-DD date, or latest when you asked for latest.
Name
format
Type
string
Description
Always "tar.gz".
Name
date
Type
integer
Description
Unix timestamp in seconds for midnight UTC of the snapshot's day.
Name
created_at
Type
integer
Description
Unix timestamp in seconds when the snapshot was indexed server-side.
Name
size
Type
integer
Description
Size of the archive in bytes.
Name
rows
Type
integer
Description
Total rows across all seven tables.
Name
checksum
Type
string
Description
Hex-encoded SHA-256 of the archive bytes.
Name
schema.fields
Type
array<object>
Description
Empty for WHOIS (null). The columns are listed per table under entities.
Name
formats
Type
array<object>
Description
One entry with format set to tar.gz, and the archive's size_bytes and checksum.
Name
entities
Type
array<object>
Description
The Parquet tables inside the archive, ordered by name.
Name
entities[].entity
Type
string
Description
Table name. The file in the archive is whois-YYYY-MM-DD/{entity}.parquet.
Name
entities[].row_count
Type
integer
Description
Number of rows in that table.
Name
entities[].size_bytes
Type
integer
Description
Size of that table's Parquet file in bytes.
Name
entities[].checksum
Type
string
Description
Hex-encoded SHA-256 of that table's Parquet file. Use it to verify a file after you unpack the archive.
Name
entities[].schema.fields
Type
array<object>
Description
One entry per column of that table, as name and type. Types are string, int32, int64, float, double, bool, date, timestamp, bytes, or list<...> of one of these.

Request

GET/api/v4/feeds/whois/export/{date}/meta

curl -G https://api.synthient.com/api/v4/feeds/whois/export/2026-11-14/meta \
  -H "x-api-key: $SYNTHIENT_API_KEY"

Response

{
  "checksum": "6f2a1b0c9d8e7f605142332415a6b7c8d9e0f1a2b3c4d5e6f708192a3b4c5d6e",
  "date": 1794614400,
  "format": "tar.gz",
  "size": 964118204,
  "rows": 20913962,
  "schema": { "fields": null },
  "stream": "whois",
  "kind": "daily",
  "id": "2026-11-14",
  "created_at": 1794712867,
  "formats": [
    {
      "format": "tar.gz",
      "size_bytes": 964118204,
      "checksum": "6f2a1b0c9d8e7f605142332415a6b7c8d9e0f1a2b3c4d5e6f708192a3b4c5d6e"
    }
  ],
  "entities": [
    {
      "entity": "networks",
      "row_count": 12048331,
      "size_bytes": 702114963,
      "checksum": "4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d",
      "schema": {
        "fields": [
          { "name": "start_address", "type": "string" },
          { "name": "end_address",   "type": "string" },
          { "name": "handle",        "type": "string" },
          { "name": "org_handle",    "type": "string" }
        ]
      }
    },
    {
      "entity": "organisations",
      "row_count": 2611480,
      "size_bytes": 96338127,
      "checksum": "5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e",
      "schema": {
        "fields": [
          { "name": "handle",   "type": "string" },
          { "name": "registry", "type": "string" }
        ]
      }
    }
  ]
}

Verifying a download

Check the archive against the checksum from the metadata endpoint before you unpack it. Use a fixed date for both requests so the metadata and the download describe the same snapshot.

Download and verify

BASE=https://api.synthient.com/api/v4/feeds/whois/export
DAY=2026-11-14

SUM=$(curl -sG "$BASE/$DAY/meta" -H "x-api-key: $SYNTHIENT_API_KEY" | jq -r '.checksum')

curl -sL -o "whois-$DAY.tar.gz" "$BASE/$DAY" -H "x-api-key: $SYNTHIENT_API_KEY"
echo "$SUM  whois-$DAY.tar.gz" | sha256sum --check

tar -xzf "whois-$DAY.tar.gz"

Response codes

Downloads answer with a 307 redirect: follow the Location header to a 24-hour presigned URL. Every other status follows the shared contract. See Errors for the full reference and retry guidance.