id: rdap
name: RDAP (WHOIS)
version: 1.0.0
description: "RDAP, the IETF successor to WHOIS — who registered a domain, an IP block or an AS number, and when. Answers the first phishing question (how old is this domain?) with `age_days`, plus registrar, status, name servers and the abuse contact. Queries the authoritative registry found through the IANA bootstrap files; free, no API key; stdlib-only. Personal data is usually redacted by registries (GDPR) — expect the registrant to be empty for most domains. As a context enrichment rule (Riposte 0.299+, no score field): domain_lookup with summary `Registered ${age_days} days ago · ${registrar}`; ip_lookup with `${network_name} · ${holder} · ${country}`."
changelog: "1.0.0 — Initial release: domain, IP and ASN lookups through the IANA bootstrap, test connection."
category: enrichment

config_schema:
  properties:
    bootstrap_url:
      type: string
      description: "Where the IANA bootstrap files live (default https://data.iana.org/rdap)"
      default: https://data.iana.org/rdap
    fallback_url:
      type: string
      description: "RDAP server asked when the bootstrap has no entry for a TLD (default https://rdap.org, a public redirector). Leave empty to fail instead."
      default: https://rdap.org
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required: []

commands:
  - id: domain_lookup
    name: rdap-domain-lookup
    description: "Registration data for a domain. A host name (www.mail.example.com) is walked up to the registered domain. Returns a summary — registrar, created, updated, expires, age_days, status, nameservers, abuse_email, registrant (when not redacted), dnssec — and the registry's `rdap` record. An unregistered domain returns HTTP 404."
    risk: read
    inputs_schema:
      properties:
        domain: { type: string, description: "Domain or host name" }
        include_raw: { type: boolean, description: "Include the registry's full RDAP record under `rdap` (default true)" }
      required: [domain]
    outputs_schema: { properties: {} }

  - id: ip_lookup
    name: rdap-ip-lookup
    description: "The network an IPv4 / IPv6 address belongs to, from its regional registry (RIPE, ARIN, APNIC, LACNIC, AFRINIC): network name, CIDR, country, holder organisation, abuse contact, allocation date."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IPv4 or IPv6 address" }
        include_raw: { type: boolean, description: "Include the registry's full RDAP record under `rdap` (default true)" }
      required: [ip]
    outputs_schema: { properties: {} }

  - id: asn_lookup
    name: rdap-asn-lookup
    description: "The holder of an autonomous system number: name, organisation, country, abuse contact, registration date."
    risk: read
    inputs_schema:
      properties:
        asn: { type: string, description: "AS number (13335 or AS13335)" }
        include_raw: { type: boolean, description: "Include the registry's full RDAP record under `rdap` (default true)" }
      required: [asn]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: rdap-test-connection
    description: "Fetch the IANA domain bootstrap file (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }