The IP and domain lookup API
One GET answers what our databases say about an IP address, an AS or a domain. Unlimited, the free plan, needs no key and has no cap. A paid plan answers every field, and one POST takes up to 1,000 lookups.
Try it in your browser
Open one of these. You don't need a key or an SDK, and any page's path on this site works on the API's host.
{"ip": "146.70.116.130","is_bogon": false,"is_tor": false,"is_relay": false,"is_anycast": false,"is_carrier": false,"is_satellite": false,"is_ssh": false,"is_smtp": false,"is_web": false,"is_dns_resolver": false,"is_bittorrent": false,"tor": {},"relay": {},"location": {"continent": "EU","continent_name": "Europe","country": "AT","country_name": "Austria","timezone": "Europe/Vienna","currency_code": "EUR","currency_name": "Euro","currency_symbol": "€","flag_emoji": "🇦🇹","flag_unicode": "U+1F1E6 U+1F1F9"},"asn": {"asn": 9009,"name": "M247 Europe SRL","domain": "m247global.com","type": "hosting","prefix": "146.70.116.0/24"},"company": {"name": "M247 LTD Vienna Infrastructure","domain": "m247.ro"},"hostname": "","abuse": {"email": "abuse@m247.ro"}}
Errors and limits
A limit hit, a revoked key and a target we can't read answer the same way every time, with a status your code can branch on.
HTTP/1.1 429 Too Many RequestsRetry-After: 23{"error": "per-minute limit for Unlimited lookups exceeded; retry shortly, or use a paid plan"}
The header tells the two 429s apart. Present means a rate limit, and retrying after it works; absent means a paid plan's overage cap is reached and retrying won't help.
Retry with backoff and jitter. Every official client does this for you.
The SDKs never send them. Private, loopback, documentation and the other reserved ranges answer with every flag false. Sent to the API, they count against Unlimited's per-minute limit and cost nothing on a paid plan.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the lookups and the database downloads. They answer bogons without a request, cache what they look up and split a batch for you. Install commands are in the docs.
Which fields come back?
On Unlimited, with a key or without one: country-level location, asn, the company's name and domain, the abuse email, the hostname, Tor and relay with their detail, and the anycast, carrier, satellite and service flags. Every paid plan answers every field, the same on each. A flag your plan includes is always in the answer, true or false; a field it doesn't include is left out, never sent as false.
What counts as a lookup?
One IP address, one AS or one domain, on its own or in a batch. On a paid plan a bogon costs nothing.
How do I send my API key?
In an Authorization: Bearer header, an X-Api-Key header or an apikey query parameter, whichever your client makes easiest. A key can be limited to the addresses your servers call from, and a call from anywhere else answers 403.
Is there a rate limit?
On Unlimited, up to 600 lookups a minute from each address, or each account with a key, and no daily or monthly cap: past that, a 429 carries Retry-After, the seconds until the next minute. On a paid plan its monthly quota is what matters, and lookups past it are billed at the plan's overage rate, up to any spend cap you set.
Can I call it from a browser?
Yes, from any origin. A key in a page is readable by anyone who loads it, so make the calls you act on from your server. Without a key, GET /myip from the visitor's browser answers their own address.
Can I use Unlimited commercially?
Yes, for any purpose, commercial included, as long as its answers aren't redistributed, resold or used in a competing service, as section 4 of the terms says.
Do you support IPv6?
Yes, on the same endpoint as IPv4. An IPv4-mapped address (::ffff:a.b.c.d) is answered as the IPv4 address it carries.
Test the real build first.
An evaluation license puts a full current build in your hands, with no sampling, so you can measure it against your own traffic before anyone talks about terms.