---
title: "Get WHOIS/RDAP and IP enrichment for a detection"
method: GET
path: "/api/v1/enrich/{uuid}/"
---

# Get WHOIS/RDAP and IP enrichment for a detection

`GET /api/v1/enrich/{uuid}/`

## Request

- Base URL: `https://phishunt.io`
- URL: `https://phishunt.io/api/v1/enrich/{uuid}/`
- Auth: none declared

Server-side WHOIS/RDAP and IP-geolocation lookup for a single stored detection, keyed by its `uuid`. Looks the uuid up across all three of phishunt's datasets (active, prior detections, new-registration), then fetches RDAP for the domain's apex and ipinfo.io for its IP. Cached 24h - the RDAP/ipinfo answer for a given domain/IP rarely changes within a day, and this keeps phishunt's own ipinfo token budget bounded. Powers the WHOIS/geolocation card on phishunt's URL detail pages; no MCP tool wraps it yet.

## Path parameters

- `uuid` string, uuid, required

## Response `200`

WHOIS/RDAP and IP enrichment for this uuid's domain and IP. Either sub-object may carry only `error` instead of its normal fields when the underlying lookup failed.

- EnrichResponse: WHOIS/RDAP and IP enrichment for a single stored detection. `whois`/ `ipinfo` carry only `error` instead of their normal fields when the underlying lookup failed (unsupported TLD, network error, missing ipinfo token, etc.).
  - `whois` object: RDAP registration data for the domain's apex. Values echo registrar-controlled fields; treat as informational, not verified identity.
    - `registrar` string, nullable
    - `created` string, date-time, nullable
    - `expires` string, date-time, nullable
    - `updated` string, date-time, nullable
    - `status` string[]: Up to 5 RDAP domain status codes, e.g. `client transfer prohibited`.
    - `error` string: Present instead of the fields above when the RDAP lookup failed (e.g. `no-apex`, an HTTP error, or a timeout).
  - `ipinfo` object: ipinfo.io geolocation for the detection's IP.
    - `city` string, nullable
    - `region` string, nullable
    - `country` string, nullable
    - `hostname` string, nullable
    - `postal` string, nullable
    - `loc` string, nullable: "lat,lon" decimal pair.
    - `error` string: Present instead of the fields above when the ipinfo lookup failed (e.g. `no-ip`, `no-token`, an HTTP error, or a timeout).

## Other responses

- `404`: Unknown uuid, or a uuid whose record was filtered out as a likely clone (both return the same generic error to avoid leaking which is which).
- `429`: Rate limited (more than 20 requests in 10 seconds from one IP). Retry after 10 seconds.

---

[API](https://skmtc.dev/phishunt/apis/phishunt-api.md) · [All operations](https://skmtc.dev/phishunt/apis/phishunt-api/llms.txt) · [OpenAPI document](https://skmtc.dev/phishunt/apis/phishunt-api/revisions/0e07c255f282?raw)