# IP WHOIS via RDAP

> IP WHOIS via RDAP is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Looks up the registered netblock for an IP address via RDAP, returning ownership details, allocation type, country, address range, and organization from the authoritative regional registry.

## Facts

- Endpoint: GET https://intel.rallylive.ca/ip/rdap
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ip-whois-via-rdap-9060860d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_2XcrUfq2D1wF2Ckqs0ePY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ip-whois-via-rdap-9060860d
```

Example prompt: Who owns the IP address 203.0.113.42? I need the registered netblock name, owning organization, country, allocation type, and abuse contact from the authoritative registry.

## When to prefer this

Choose this endpoint when you need authoritative, registry-sourced IP ownership data including the exact netblock, organization, allocation type, and abuse contacts. Prefer it over reverse DNS or geo-IP lookups when the goal is ownership research, abuse reporting, or compliance verification rather than geographic location or hostname resolution. It is particularly useful for cybersecurity incident response, network attribution, and identifying the responsible organization for abuse complaints.

## Known failure modes

- IP address not found or not yet allocated — registry returns no matching record
- Malformed or invalid IP address input — request fails with a validation error
- RDAP registry temporarily unavailable — upstream timeout or error returned
- Private or reserved IP ranges (RFC 1918, loopback) may return no useful registry data
- Rate limiting if many requests are made in rapid succession

## How this service works

IP WHOIS via RDAP: the registered netblock for an address with its name, handle, allocation type, country, start and end addresses and the owning organization, from the authoritative regional registry. Ownership research and abuse contacts. $0.01 per IP.

## Output

Returns the registered netblock details for the queried IP address: netblock name, handle, allocation type (e.g. DIRECT ALLOCATION, ASSIGNED), country of registration, start and end addresses of the block, and the owning organization — all sourced from the authoritative regional internet registry via RDAP.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ip-whois-via-rdap-9060860d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)