REST API

The main endpoint of the REST API is /ip, authenticated via an API key. GET /ip/{ip} takes an IP address and answers with the risk categories it is flagged in. Alternatively, GET /ip/{ip}/full adds the network and location intelligence associated to it - the same reading the dashboard renders as a passport, in addition to the risks.

The query endpoint

GET /ip/{ip} answers with the risk categories the address is flagged in, and nothing else. 1 API credit.

curl 'https://api.ipraccoon.com/ip/172.58.147.73' \
  -H "Authorization: $IP_RACCOON_TOKEN" \
  -H 'Accept: application/json'

GET /ip/{ip}/full answers with the same risks plus the network and location objects behind them - the full reading the dashboard renders as a passport. 1.5 API credits.

curl 'https://api.ipraccoon.com/ip/172.58.147.73/full' \
  -H "Authorization: $IP_RACCOON_TOKEN" \
  -H 'Accept: application/json'

Parameter	In	Description
`ip`	path	The address to score - only IPv4 addresses are supported

Both calls consume API credits from your account balance. If needed, you can query the GET /me endpoint to check your current balance, see the REST API Reference section for more details.

The response

Example response

Note that the network and location fields are only included if the /ip/{ip}/full is used, otherwise they will not be defined.

{
  "ip": "172.58.147.73",
  "risks": {
    "reputation": "abuse"
  },
  "network": {
    "asn": 21928,
    "as": "T-Mobile USA, Inc.",
    "isp": "T-Mobile USA",
    "org": "T-Mobile USA",
    "networkType": "Mobile",
    "mcc": "310",
    "mnc": "053"
  },
  "location": {
    "country": "US",
    "city": "Nashville",
    "latitude": 36.0711,
    "longitude": -86.7196,
    "timezone": "America/Chicago",
    "continent": "NA",
    "eu": false
  }
}

`risks` - the flags

An object keyed by the categories the address is currently flagged in, each value the detection (subcategory) that raised it. Each category has a different set of possible detections. An empty object means no risks were associated to that address. Each category is backed by a dataset you can also subscribe to directly - see the Dataset Downloads.

Category	Meaning
`reputation`	Threat reputation feeds, spam and form-abuse signals, and IP abuse history
`anonymizers`	VPN, proxies, datacenter IP ranges and Tor exit nodes
`detected_bots`	Malicious, behavioural and heuristic bot detection patterns from live traffic
`known_bots`	Verified bot signatures and known crawler registries, including LLMs such as Claude and ChatGPT

`network` - the operator

null when the address is outside coverage. Every field inside is itself nullable: the record is a form, and a field the sources cannot fill stays empty rather than guessed.

Field	Type	Description
`asn`	integer	Autonomous system number
`as`	string	Autonomous system name
`isp`	string	The operating ISP
`org`	string	The organization the range is allocated to
`networkType`	string	`Unknown`, `Mobile` or `WiFi`
`mcc` / `mnc`	string	Mobile country / network code, for mobile ranges

`location` - the geography

null when the address is outside coverage - the dashboard reads a response with network and location both null as No data. Same rule as the network: every field nullable, nothing guessed.

Field	Type	Description
`country`	string	ISO 3166-1 alpha-2 country code
`city`	string	The nearest city
`latitude` / `longitude`	number	Coordinates of that city context
`timezone`	string	IANA timezone name
`continent`	string	Two-letter continent code
`eu`	boolean	Whether the country is in the EU

Geolocation is city-accurate at best - treat the coordinates as continent and city context, never as a street address.

Limits and errors

400 Bad Request - Invalid or unsupported IP address.
401 Unauthorized - API key not provided, or invalid/revoked.
402 Payment Required - Account has not enough API credits. Consider activating auto-recharge to avoid any interruption of the service.
Error bodies are plain text, not JSON.