IP Intelligence API

Use IP endpoints when you need network-level context without running a full fraud assessment.

All endpoints require an active workspace API key and consume one shared monthly lookup unit per request. Geolocation (GET /ip/{ip}/geo) is included in Free. IP risk, reputation and RDAP require any Suite or Lookups plan. See Authorization.

Endpoints

GET /ip/{ip}
GET /ip/{ip}/geo
GET /ip/{ip}/reputation
GET /ip/{ip}/rdap

Risk Summary

GET /ip/8.8.8.8

Returns the normalized IP signal used by RequestGuard assessments, including country, ASN, hosting, proxy, VPN, Tor, datacenter, and source metadata when available.

Geolocation

GET /ip/8.8.8.8/geo

Returns country, country name, continent, timezone, ASN, organization, and source confidence fields when known.

Reputation

GET /ip/8.8.8.8/reputation

Returns the IP signal plus a risk score, risk level, decision, reasons, and source hits. Use this when you need a direct allow/challenge/review/block recommendation for one IP.

RDAP

GET /ip/8.8.8.8/rdap

Returns an ownership summary for the IP address, including registry, organization, ASN, and abuse-contact fields when available.

Response Shape

Exact fields vary by signal availability. Common fields include:

Field	Meaning
ip	Queried IP address.
country_code	ISO country code when known.
asn	Autonomous System Number.
as_organization	Network organization name.
is_datacenter	Datacenter or cloud hosting signal.
is_vpn	VPN signal.
is_tor	Tor exit signal.
risk_score	Normalized 0-100 risk score on reputation responses.
sources	Source metadata used to build the response.